Compliance doesn't have to be a nightmare, whether you are a marketing professional or a **[Data protection officer](https://goadopt.io/en/blog/responsibilities-of-a-data-protection-officer/)**, making simple mistakes can easily ruin your brand's reputation.

Facing million-dollar **[fines](https://goadopt.io/en/blog/company-fined-the-end/)** and losing user trust are the biggest risks today. Everything starts with how you manage **[cookies](https://goadopt.io/en/blog/lgpd-cookies-all-you-need-to-know/)** at the front door of your website.

We are here to simplify this for you. Let's dive into the five biggest market mistakes and how a solid **[Cookie notice/banner](https://goadopt.io/en/blog/operation-of-cookie-banner/)** solves this on autopilot.

## How to Avoid GDPR and CCPA Legal Issues

The global privacy landscape is changing extremely fast. Because of that, knowing if your **[website needs cookie consent](https://goadopt.io/en/blog/website-needs-cookie-consent-gdpr-lgpd-ccpa/)** is no longer a choice, it's a mandatory rule.

Tech giants have paid millions in **[fines](https://goadopt.io/en/blog/gdpr-lgpd-and-ccpa-what-are-these-laws-similarities-and-differences/)** just for ignoring basic transparency and data tracking guidelines.

The good news is that you don't need to pause your operations. Our technology protects everything, from your blog to your **[e-commerce](https://goadopt.io/en/blog/impact-ecommerce-lgpd/)**, without any headaches.

Common Issue: Unclear Cookie Banner Text
Many businesses rely on cookie consent notices filled with confusing or vague language. Here are some common pitfalls:

![common-privacy-dark-patterns.png](/uploads/common_privacy_dark_patterns_1a54e06b8c.png)

### 1. Confusing Consent Text

Using technical jargon or generic text only pushes visitors away. Global laws like the **[LGPD](https://goadopt.io/en/blog/lgpd-general-data-protection-law/)** demand total clarity and transparency in your communication.

Pre-made phrases like "we use technologies to improve your experience" mean absolutely nothing. You need to clearly explain the true role of **[cookies](https://goadopt.io/en/blog/lgpd-cookies-all-you-need-to-know/)** on your page.

The solution is a colloquial and direct language. A great **[Cookie banner](https://goadopt.io/en/blog/why-are-cookie-banners-everywhere/)** must detail the collection purposes without sounding like a boring contract.

### 2. Hiding the Reject Option

Hiding the reject button in difficult menus is a dark pattern that generates heavy **[fines](https://goadopt.io/en/blog/company-fined-the-end/)** in Europe and the Americas.

Your visitor must have the exact same ease to accept or reject tracking. This balance is the core of why a **[website needs cookie consent](https://goadopt.io/en/blog/website-needs-cookie-consent-gdpr-lgpd-ccpa/)**.

Avoid buttons with muted colors or tiny fonts. Let your **[Data protection officer](https://goadopt.io/en/blog/responsibilities-of-a-data-protection-officer/)** validate the interface to ensure no deceptive patterns exist.

![table-2.png](/uploads/table_2_2f71ca54e2.png)

### 3. Firing Cookies Before Permission

This is the fatal error that destroys many traffic managers' strategies. Loading tracking scripts before the "accept" click is a clear violation of the **[LGPD](https://goadopt.io/en/blog/lgpd-general-data-protection-law/)** and GDPR.

The golden rule is: block everything that isn't strictly essential. You do not want marketing tools and **[cookies](https://goadopt.io/en/blog/lgpd-cookies-all-you-need-to-know/)** running without the user's green light.

To be sure your site is running clean, instruct your tech team to **[delete cookies](https://goadopt.io/en/blog/delete-cookies-cache-chrome/)** and simulate accesses as a first-time visitor.

### 4. Poor Consent Record Management

A beautiful banner is useless if you don't store the logs correctly. Remember that a proper **[website needs cookie consent](https://goadopt.io/en/blog/website-needs-cookie-consent-gdpr-lgpd-ccpa/)** involves keeping safe proof of actions.

During an audit, your company and the **[Data protection officer](https://goadopt.io/en/blog/responsibilities-of-a-data-protection-officer/)** will need to present data such as date, time, and exact user preferences.

Losing this information leaves your operation completely vulnerable. A lack of documentation is a direct shortcut to **[fines](https://goadopt.io/en/blog/fines-in-LGPD/)** that can shut down your business.

### 5. Pre-checked Boxes and Assumed Consent

The era of assuming a user agreed just by scrolling the page is over. Modern frameworks like the **[LGPD](https://goadopt.io/en/blog/lgpd-general-data-protection-law/)** strictly prohibit implied consent.

Pre-checked boxes or forced cookie walls are not allowed. The power of choice regarding **[cookies](https://goadopt.io/en/blog/lgpd-cookies-all-you-need-to-know/)** must be actively in the hands of the visitor.

Respecting this autonomy builds a much stronger brand perception. At the end of the day, it increases trust in your **[e-commerce](https://goadopt.io/en/blog/impact-ecommerce-lgpd/)** and brings qualified leads.

## How AdOpt Solves This For You

Adapting your marketing processes doesn't have to be ugly or exhausting. Our CMP technology resolves your **[Cookie notice/banner](https://goadopt.io/en/blog/why-are-cookie-banners-everywhere/)** installation in a few clicks.

With our platform, script blocking happens automatically, protecting your campaigns and mitigating 100% of the risk of **[fines](https://goadopt.io/en/blog/fines-in-LGPD/)** from improper tracking.

We keep the entire consent history encrypted and organized. It's the security your **[Data protection officer](https://goadopt.io/en/blog/responsibilities-of-a-data-protection-officer/)** needs, with the design your brand deserves.

## Frequently Asked Questions (FAQ) About Cookie Consent

### 1. Why should I care about cookie consent?
Ignoring permission tracking is a critical **compliance** error that directly hurts your business. If you receive international traffic, knowing exactly why your **[website needs cookie consent](https://goadopt.io/en/blog/website-needs-cookie-consent-gdpr-lgpd-ccpa/)** is the first step to avoiding penalties and protecting your brand.

### 2. Can I leave the accept box pre-checked?
Absolutely not, as modern privacy rules require affirmative action. Strict frameworks, like the **[LGPD](https://goadopt.io/en/blog/lgpd-general-data-protection-law/)** and GDPR, prohibit implied consent, ensuring the visitor has total control over their data.

### 3. What happens if I hide the reject button?
Making it hard to refuse trackers is a deceptive practice highly penalized by regulatory authorities. Besides destroying user trust, this flaw attracts heavy financial **[fines](https://goadopt.io/en/blog/fines-in-LGPD/)** that can cripple your company's budget.

### 4. Should cookies be blocked before the user accepts?
Exactly, because no advertising or marketing script should be fired in the browser without prior authorization. Our AdOpt platform blocks these tags before the visitor interacts with the **[Cookie banner](https://goadopt.io/en/blog/why-are-cookie-banners-everywhere/)**, doing all the heavy lifting for you.

### 5. Who is responsible for managing these consents?
While the tech team handles the installation, the responsibility for keeping records secure falls on managers and the **[Data protection officer](https://goadopt.io/en/blog/responsibilities-of-a-data-protection-officer/)**. These professionals use our automated reports to prove legality during an audit.

## Take the Next Step Towards Compliance

Don't let bureaucratic mistakes harm your **[LGPD e-commerce](https://goadopt.io/en/blog/impact-ecommerce-lgpd/)** performance or your agency's metrics.

Compliance technology doesn't have to be an expensive and complex hurdle, and we are ready to show you how fast and smooth it can be.

Book a free demo with our team of experts right now through **[our HubSpot](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria?uuid=e1bc9e87-710e-4f13-894e-4ade5ce7af10)** and discover how to automate your consent management.


5 Common Cookie Consent Mistakes Hurting Your Compliance

João Bruno Soares

The Connecticut Data Privacy Act (CTDPA, Public Act No. 22-15) has two specific requirements for sites that process personal data for targeted advertising or sell personal data.

This page covers one piece of the picture. For the full scope of the CTDPA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the CTDPA and cookies](https://goadopt.io/en/blog/connecticut-CTDPA-and-cookies-all-you-need-to-know/).

The first is immediate: a clear and conspicuous link on the site to an opt-out page.

The second took effect on **January 1, 2025**: the obligation to honor opt-out signals sent by platforms, technologies, or mechanisms with consumer consent, such as the **Global Privacy Control (GPC)**.

This article focuses exclusively on what the CTDPA requires from a Cookies Policy: what must be in the document, how consent and opt-out must work, and what the law's specific requirements mean for each tracker on your site.

## Cookies Policy vs. cookie banner: the necessary distinction

The [cookie banner](https://goadopt.io/en/blog/how-to-choose-a-cookie-banner-for-your-website/) is the visual consent interface. It is what the visitor sees when they first access the site.

The Cookies Policy is the detailed document. It is where the user finds complete information about each technology: what it collects, what it is for, who receives the data, and how to exercise rights.

Both need to exist. Both need to be aligned. And the Cookies Policy must be accessible from a clear link within the [consent notice](https://goadopt.io/en/blog/operation-of-cookie-banner/) itself.

## What the CTDPA specifically requires for cookies

### Specific purpose for each category

Section 6(a)(1) requires the controller to limit collection to what is adequate, relevant, and reasonably necessary for the disclosed purposes. And Section 6(c)(2) requires the purpose to be in the privacy notice.

For cookies, each tracker category needs a specific purpose description, not a generic one.

What does not work: "cookies to improve your experience."

What works: "Analytics cookies: collect browsing behavior data including pages visited, traffic source, and session duration. Used to identify content improvement opportunities. Data is not sold or used for targeted advertising."

"Advertising cookies: collect behavioral identifiers shared with advertising platforms for targeted advertising on non-affiliated websites. Include pixels from Meta Ads and Google Ads. Consumers may exercise opt-out via the opt-out link on this page."

### Cookie categories present on the site

The Policy must list tracker categories:

**Necessary cookies:** essential for basic functionality. Do not constitute targeted advertising or data sale. Must be documented but do not require opt-out.

**Analytics cookies:** depends on configuration. If data stays internal, generally does not constitute targeted advertising. If sent to third parties for targeting on other sites, may qualify.

**Advertising cookies:** almost always constitute "targeted advertising" under the CTDPA, which defines it as ads based on data "obtained or inferred from the consumer's activities over time and across nonaffiliated Internet web sites or online applications" (Section 1(28)).

**Functional cookies:** remember preferences. Generally do not constitute targeted advertising or sale.

**Third-party cookies:** fired by external services. [Correct tag categorization](https://goadopt.io/en/blog/difference-cookies-local-storage-session-storage/) is what makes accurate documentation possible.

### Targeted advertising: non-affiliated websites

The CTDPA defines targeted advertising (Section 1(28)) as displaying ads based on personal data obtained or inferred from the consumer's activities over time and across **nonaffiliated** Internet web sites or online applications.

What does not constitute targeted advertising:

Advertisements based on activities within the controller's own websites or online applications.

Advertisements based on the context of a current search query or visit.

Advertisements directed to a consumer in response to an information request.

Processing personal data solely to measure or report advertising frequency, performance, or reach.

Retargeting campaigns using behavioral data from other sites therefore almost always constitute targeted advertising under the CTDPA.

### Sale of personal data

The CTDPA defines sale (Section 1(26)) as the exchange of personal data for monetary or other valuable consideration by the controller to a third party.

Not a sale: disclosure to processors, disclosure for products/services requested by the consumer, disclosure to affiliates, consumer-directed disclosure, publicly made available data, and M&A transfers.

If the site shares data with partners in exchange for services or other economic benefits, it may constitute a sale even without direct cash payment.

### Categories of third parties receiving data via cookies

The Policy must identify the categories of third parties receiving data via cookies (Section 6(c)(5)).

This includes digital advertising platforms, analytics tools, programmatic advertising networks, email marketing platforms receiving behavioral data, and any other partner receiving identifiers or user behaviors collected via cookie.

### Retention period

The obligation to limit collection to what is necessary (Section 6(a)(1)) implies data should also be retained only for as long as necessary. The Cookies Policy must document how long each cookie category stays active and how long data is retained in systems.

## The mandatory opt-out link

Section 6(e)(1)(A)(i) requires a clear and conspicuous link on the controller's website to a page enabling the consumer or their agent to opt out of targeted advertising or sale of personal data.

This link must be visible on the page, not in obscure locations. The Cookies Policy must identify this link and describe how the opt-out works.

## The opt-out preference signal from January 2025

Section 6(e)(1)(A)(ii) requires that from **January 1, 2025**, controllers processing for targeted advertising or selling data allow opt-out via signal sent with consumer consent.

In practical terms for cookies: when a user visits the site with the GPC activated in their browser, the site must interpret this signal as an opt-out of targeted advertising and data sale, and automatically block the corresponding trackers.

The mechanism must meet CTDPA-specific requirements (Section 6(e)(1)(A)(ii)):

Cannot unfairly disadvantage another controller.

Cannot be a default setting: must represent an affirmative, freely given, and unambiguous consumer choice.

Must be consumer-friendly and easy for the average consumer.

Must be as consistent as possible with similar mechanisms required by other laws.

Must enable the controller to accurately determine whether the consumer is a Connecticut resident.

When the opt-out signal conflicts with an existing controller-specific setting or loyalty program participation, the controller must comply with the signal but may notify the consumer of the conflict and give them the option to confirm their prior preference.

The Cookies Policy must describe how the site processes these signals.

## What constitutes valid consent for cookies under the CTDPA

Section 1(6) defines consent as a clear affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreement.

What is not valid consent:

Accepting general terms with data processing descriptions alongside unrelated information.

Hovering over, muting, pausing, or closing a piece of content.

Any agreement obtained through dark patterns.

Dark patterns are defined in Section 1(11) as interfaces designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision-making, or choice, including any practice the FTC refers to as a dark pattern.

The correct standard for cookies: non-essential cookies off by default. The user chooses what to enable, not what to disable.

## Consent revocation in 15 days

If the user granted consent for non-essential cookies and then decides to revoke, Section 6(a)(6) requires the controller to:

Provide a revocation mechanism at least as easy as the consent mechanism.

Cease processing not later than **15 days** after receiving the revocation.

This 15-day deadline is exclusive to the CTDPA and means the [consent management platform](https://goadopt.io/en/blog/how-to-choose-cmp-consent-management-platform/) must be configured to process revocations promptly, not just log them.

## Protection for teens aged 13 to 15 via cookies

Section 6(a)(7) prohibits processing data of consumers aged 13 to 15 for targeted advertising or sale without their consent when the controller has actual knowledge of that age range.

If the site may have users in this range, the Cookies Policy must describe how advertising cookies are blocked for this audience and how consent is obtained when required.

## When to update the Cookies Policy

The CTDPA does not specify a minimum privacy notice update frequency like the CCPA/CPRA does. But Section 6(a)(2) prohibits processing for purposes not disclosed without consent, and Section 6(a)(1) requires limiting collection to what is necessary for the disclosed purposes.

In practice, situations requiring a Cookies Policy update:

Adding a new advertising pixel or tracker.

New analytics tool sending data to third parties.

New partner receiving behavioral data.

Change in the use of cookie data for new purposes.

Any modification to opt-out mechanisms.

Continuous [data mapping](https://goadopt.io/en/blog/what-is-privacy-by-design/) is what keeps the cookie inventory synchronized with the document.

## Enforcement and penalties

Violations are treated as unfair trade practices by the **Connecticut Attorney General**. There is no private right of action.

From January 2025, the cure period is discretionary. The AG may act without a guaranteed prior correction period.

## How AdOpt helps with the Cookies Policy under the CTDPA

AdOpt's automatic scan identifies all active technologies on the site, feeding the list of categories that must appear in the Cookies Policy.

The [cookie notice](https://goadopt.io/en/blog/operation-of-cookie-banner/) configured through AdOpt blocks non-essential trackers before acceptance, presents categories with clear descriptions, offers real opt-out options, detects and honors the GPC from January 2025, processes revocations within 15 days, and logs every interaction.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Cookies Policy for your site that complies with the CTDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what your Cookies Policy needs for the CTDPA

**Visible link** in the footer and within the cookie banner.

**Listing of cookie categories** with a description of what each does.

**Specific purpose for each category**, without vague descriptions (Section 6(c)(2)).

**Identification of cookies constituting targeted advertising or sale** (Section 6(d)).

**Categories of third parties** receiving data via cookies (Section 6(c)(5)).

**Clear and conspicuous link** for opt-out of targeted advertising/sale on the site (Section 6(e)(1)(A)(i)).

**Opt-out preference signal**: description of how GPC is honored from January 2025 (Section 6(e)(1)(A)(ii)).

**15-day consent revocation**: mechanism and deadline described (Section 6(a)(6)).

**Non-essential cookies disabled by default**, without dark patterns (Section 1(11)).

**Protection for teens aged 13 to 15** described where applicable (Section 6(a)(7)).

**Retention period** for each cookie category.

**Active email address or online mechanism** for contacting the controller (Section 6(c)(6)).

**Accessible language**, without legal jargon.

**No cookie walls**.

## FAQ: CTDPA and Cookies Policy

**1. Is the CTDPA opt-out link different from the CCPA's "Do Not Sell" link?**
They are similar in function but different in requirement. The CCPA requires specific link texts: "Do Not Sell or Share My Personal Information" and "Limit the Use of My Sensitive Personal Information." The CTDPA simply requires a clear and conspicuous link to an opt-out page for targeted advertising or data sale, without mandating specific text. Businesses that already have the CCPA links likely satisfy the CTDPA requirement, depending on the link's scope.

**2. Is the CTDPA's opt-out preference signal the same as the GPC?**
The GPC is the best-known mechanism meeting the CTDPA's technical specifications. The law does not name the GPC specifically, but the GPC was developed precisely for this type of legal requirement. As long as the mechanism is an affirmative consumer choice (not a default), does not create unfair disadvantage for the controller, and allows verification that the consumer is a Connecticut resident, it meets Section 6(e)(1)(A)(ii).

**3. Does the 15-day consent revocation deadline apply to all cookies?**
It applies when consent is the basis for processing. For advertising cookies where the consumer gave consent and then revokes it, Section 6(a)(6) requires cessation within 15 days. For opt-outs of targeted advertising or sale (which do not require prior consent but rather an opt-out mechanism), the law does not specify the 15-day deadline, but requires cessation as soon as practicable.

**4. Do analytics cookies constitute targeted advertising under the CTDPA?**
It depends on the tool and configuration. If analytics data stays internal or is sent to the provider only to generate reports without use for targeting on other sites, it generally does not qualify. If the tool sends data used for targeting on other sites, it may. The CTDPA's criterion is data "obtained or inferred from activities across nonaffiliated websites" (Section 1(28)).

**5. Does the CTDPA require teens aged 13 to 15 to consent before any cookie?**
Section 6(a)(7) is specific: it prohibits processing data of 13-to-15-year-olds for targeted advertising or sale without their consent. It does not require consent for other types of processing such as internal analytics. The restriction applies when the controller has actual knowledge of the user's age.

[Ready to build a Cookies Policy for your site that complies with the CTDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


Connecticut CTDPA: Cookies Policy

Creating [GDPR](https://goadopt.io/en/blog/gdpr-cookies-explained/)\-compliant cookie banners is essential in 2025 to avoid fines and build trust. Here’s what you need to know:

-   **Consent Rules**: Users must explicitly agree to non-essential cookies. No pre-checked boxes or assumed consent.
-   **Cookie Categories**: Clearly define cookies (e.g., Necessary, Analytics, Marketing) and specify which need consent.
-   **Clear Design**: Make banners easy to read, with equal emphasis on "Accept" and "Reject" buttons.
-   **Cookie Blocking**: Block non-essential cookies until consent is given.
-   **Consent Management**: Allow users to easily update or withdraw consent anytime.
-   **Compliance Tools**: Use tools like [AdOpt](https://goadopt.io/en) to automate cookie management and consent tracking.
-   **Regular Checks**: Audit cookies, update policies, and maintain detailed consent logs.

**Quick Overview**: A GDPR-compliant banner must prioritize transparency, user control, and clear communication to meet legal standards while respecting privacy.

## [GDPR](https://goadopt.io/en/blog/gdpr-cookies-explained/) and Cookie Consent Banners

::: @iframe https://www.youtube.com/embed/gsQQgfRay88
:::

## 1\. GDPR Cookie Banner Requirements

By 2025, GDPR cookie banners must prioritize transparency and give users greater control. These updates are crucial for staying compliant and maintaining user trust. Here's a breakdown of the key consent rules, cookie categories, and communication guidelines needed for GDPR compliance.

### Consent Rules

Under GDPR, consent must be explicit and freely given. Practices like pre-checked boxes or assuming consent are not allowed. Website owners are required to:

-   Obtain consent **before** setting any non-essential cookies.
-   Make declining cookies just as easy as accepting them.
-   Allow users to withdraw their consent at any time.
-   Keep detailed records of all consent provided.

Failing to comply can lead to hefty [fines](https://goadopt.io/en/blog/fines-in-LGPD/).

### Cookie Categories

Cookies must be clearly categorized based on their purpose and whether they require consent. Here's how they should be organized in your banner:

| Category | Description | Consent Required |
| --- | --- | --- | --- |
| Necessary | Required for basic website functions | No  |
| Analytics | Tracks user behavior and site performance | Yes |
| Personalization | Saves user preferences and login details | Yes |
| Marketing | Supports targeted advertising | Yes |
| Functional | Supports website experience | Yes |

### Clear Communication Standards

Your cookie banner needs to present information in a straightforward and accessible way. Here’s what’s required:

1.  **Transparent Purpose Description**

Explain why cookies are used in plain, easy-to-understand language. [Be upfront about any data shared with third parties](https://goadopt.io/en/blog/what-is-privacy-by-design/).

2.  **Accessible Design**

The banner should be prominently displayed and include:

-   Clear links to adjust cookie settings.
-   Direct access to the full cookie policy.
-   Simple, clear explanations of how data is used.
-   Visible buttons for both accepting and rejecting [cookies](https://goadopt.io/en/blog/how-to-choose-a-cookie-banner-for-your-website/).

3.  **Comprehensive Information**

> "Cookie consent refers to obtaining clear and informed consent from website visitors for the use of cookies that collect their personal data" [*](https://goadopt.io/en/blog/why-are-cookie-banners-everywhere/).

This means your banner must provide detailed information about:

-   The types of cookies used.
-   How long the cookies will be stored.
-   Any third parties receiving the data.
-   The purpose of collecting the data.

## 2\. Cookie [Audit](https://goadopt.io/en/features/audit-logs/) Steps

Conducting a cookie audit is essential for ensuring your banner complies with GDPR standards.

### Website Cookie Categorization

Start by scanning your website to identify all active cookies. Use modern scanning tools to automate this process accurately. For each cookie, record the following details:

| Cookie Attribute | Required Information | Example |
| --- | --- | --- |
| Name | Technical identifier | \_ga |
| Provider | First or third-party source | Google Analytics |
| Duration | Cookie lifespan | 2 years |
| Purpose | Specific function | User behavior tracking |
| Data Collected | Type of information stored | Anonymous user ID |

To maintain up-to-date documentation:

-   Schedule automated scans regularly, such as once a month, to detect new cookies.
-   Record any updates promptly.
-   Verify that third-party cookie providers comply with GDPR regulations.

Keeping this documentation organized will make it easier to categorize cookies accurately.

### Cookie Classification

Once you've identified the cookies, sort them into categories to determine whether user consent is required. Use the following classification system:

| Category | Consent Required | Common Examples |
| --- | --- | --- |
| Necessary | No  | Login sessions, shopping cart data |
| Analytics | Yes | Page views, user journey tracking |
| Functional | Yes | Language preferences, theme settings |
| Marketing | Yes | Ad targeting, behavioral profiling |

To ensure compliance, follow these steps:

-   **Purpose Assessment**: Clearly define why each cookie is needed and its role.
-   **Duration Review**: Ensure cookie lifespans match their intended use.
-   **Data Mapping**: Track the data each cookie collects and where it is stored.

These practices will help you manage your cookies effectively and stay GDPR-compliant.

## 3\. Cookie Banner Design Guidelines

### Design Requirements

To ensure your cookie banner meets GDPR standards, focus on both its appearance and functionality. It should stand out without being intrusive, allowing users to make informed choices about their cookie preferences.

Here are some key design elements to consider:

| Element | Requirement | Implementation |
| --- | --- | --- |
| **Banner Placement** | Visible on first visit | Top or bottom of the screen, or as a modal overlay |
| **Consent Options** | Clear buttons | Include "Accept", "Reject", and "Preferences" options |
| **Text Clarity** | Easy-to-understand language | Keep explanations brief and straightforward |
| **Visual Hierarchy** | Distinct buttons | Ensure equal emphasis on "Accept" and "Reject" |
| **Interaction** | No misleading designs | Avoid pre-checked boxes or confusing layouts |

### Mobile and Language Support

Your cookie banner should work seamlessly across all devices and languages, especially since mobile browsing accounts for a large share of web traffic. Here's how to address these needs:

-   **Mobile Optimization**: Make sure the banner is easily readable and functional on smaller screens. Use responsive design so it adapts to various device sizes without blocking essential content.
-   **Language Accessibility**: Use automatic language detection to display the banner in the user's preferred language. This is particularly important for websites with an international audience.

Combine these features with clear links to your cookie policy for a more complete design.

### Cookie Policy Links

Your cookie banner should include links to provide users with detailed information about your cookie practices. These links should be easy to find and understand. Here's how to organize them:

| Link Type | Purpose | Placement |
| --- | --- | --- |
| **Cookie Policy** | Full details on cookie usage | Main banner view |
| **Privacy Settings** | Options for granular controls | Prominent button |
| **Category Details** | Explanations for specific cookies | Within the settings panel |

> "Privacy laws, such as the GDPR and the California Privacy Rights Act (CPRA), require the visitor's consent and proof of consent each time you process their personal data." - Osano Staff [\[2\]](https://www.osano.com/articles/cookie-banner)

#### sbb-itb-4d50478

## 4\. Cookie Blocking Setup

Setting up cookie blocking is essential to comply with GDPR regulations. This ensures that non-essential cookies are disabled until the user explicitly consents.

### Using [AdOpt](https://goadopt.io/) for Cookie Management

![home en.png](https://strapi.goadopt.io/uploads/home_en_be8dacaf46.png)

Once your banner is ready, it's time to implement cookie blocking to respect user consent. AdOpt simplifies this process with key features:

| Feature | Purpose | Advantage |
| --- | --- | --- |
| **Automatic Geolocation** | Identifies visitor location | Applies consent rules based on regional requirements |
| **Tag Categorization** | Groups cookies by type | Allows for detailed consent options |
| **Script Control** | Oversees third-party scripts | Blocks unauthorized data collection |
| **Consent Tracking** | Logs user preferences | Provides a complete audit trail for compliance needs |

By adding a single JavaScript snippet to your website’s header, you can manage:

-   Blocking cookies before consent is given
-   Handling user preferences
-   Storing consent records
-   Ensuring compliance with over 30 international data protection laws

### Verification Steps

Before launching, thoroughly test your setup. Use these steps to confirm everything works as intended:

1.  **Initial Cookie Audit**

    Scan your website to identify all cookies and their purposes.

2.  **Cookie Blocking**

    Test your site as a new visitor to confirm:

    -   Non-essential cookies stay inactive until consent is provided
    -   Essential cookies operate correctly
    -   Third-party scripts are managed properly
    -   User cookie preferences are stored accurately
3.  **Standards Check**

    Make sure your implementation aligns with GDPR standards:

    | Test Area | What to Verify | Expected Result |
    | --- | --- | --- |
    | **Consent Flow** | User choices are recorded | Clear documentation of decisions |
    | **Cookie Loading** | Script behavior is correct | No tracking without consent |
    | **User Control** | Settings are accessible | Users can easily manage preferences |
    | **Documentation** | Consent records are maintained | Complete audit trail available |

Regularly testing and monitoring your setup ensures your cookie blocking system stays effective and compliant as your website grows or changes.

## 5\. Consent Management Options

After setting up cookie blocking, the next step is implementing a strong consent management system. This ensures users can control their cookie preferences while meeting GDPR requirements.

### Cookie Settings Panel

An effective cookie settings panel should provide detailed options for managing cookie categories:

| Feature | Implementation | User Benefit |
| --- | --- | --- |
| **Category Toggle** | Separate switches for each cookie type | Enables precise control over data collection |
| **Purpose Description** | Clear explanations for each cookie category | Helps users make informed choices |
| **Essential Cookies Info** | Displays required cookies that can't be turned off | Ensures transparency about site functionality |
| **Save Preferences** | Prominent button to save changes | Simplifies preference updates |

The panel should remain easily accessible through a floating button or a footer link, allowing users to adjust their preferences anytime. This setup lays the groundwork for seamless consent updates, discussed next.

### Consent Update Options

GDPR also requires that users can withdraw consent as easily as they provide it. To meet this standard, your system should:

-   Offer multiple access points, such as:
    -   A persistent floating button
    -   A footer navigation link
    -   The privacy policy page
    -   The cookie policy section
-   Keep detailed consent logs, including:
    -   The timestamp of initial consent
    -   Records of preference changes
    -   Selected cookie categories

Users should be able to review, modify, withdraw, or export their consent preferences without hassle.

> "Opting out must be as easy as it was to opt in." - Osano.com [\[1\]](https://www.osano.com/articles/gdpr-cookie-consent)

When preferences are updated, your system should immediately:

-   Apply the new settings
-   Remove cookies not authorized by the updated preferences
-   Update consent records
-   Provide users with confirmation feedback

These features ensure your consent management system aligns with GDPR requirements, complementing your cookie banner setup.

## 6\. Compliance Tool Implementation

After setting up cookie preferences and consent management, the next step in your GDPR strategy is integrating a compliance tool. AdOpt's platform streamlines this process by automating compliance tasks, reducing the need for manual intervention. This tool works seamlessly with your cookie banner and consent management system to ensure your website meets GDPR requirements.

### Tool Functions

AdOpt offers several features to help maintain GDPR compliance:

| Function | Capability | Compliance Benefit |
| --- | --- | --- |
| Automated Scanning | Identifies and categorizes cookies | Keeps your cookie inventory current |
| Multi-language Support | Supports over 30 languages | Ensures clear communication with users |
| Consent Logging | Records user preferences | Provides a reliable compliance trail |
| Tag Management | Blocks scripts until consent is given | Manages data collection effectively |

To get started, log in, configure your settings, and insert the provided code on your website to activate compliance.

### Automated Compliance

Once set up, AdOpt ensures your compliance practices remain up to date through automated features:

1.  **Real-time Cookie Management**  
    The system blocks advertising and tracking scripts until users explicitly give consent.

2.  **Dynamic Consent Verification**  
    AdOpt checks consent in real time with advertising partners, ensuring third-party tools only activate when properly authorized.

3.  **Automated Updates**  
    The platform stays current with regulatory changes, including updates to GDPR and U.S. privacy laws.

### Scalable Solutions for All Website Sizes

AdOpt offers plans tailored to your website's traffic needs:

| Traffic Volume | Recommended Plan | Monthly Views |
| --- | --- | --- |
| Small Sites | Free Plan | Up to 5,000 |
| Medium Sites | Starter Plan | Up to 100,000 |
| Large Sites | Essential Plan | Up to 1 million |
| Enterprise | Professional Plan | Up to 10 million |

AdOpt has been shown to improve user acceptance rates and decrease bounce rates [\[3\]](https://www.consentmanager.net/en/). By choosing the right plan, you can ensure your site remains compliant while enhancing the user experience.

## 7\. Regular Compliance Checks

Beyond the initial setup and system updates, keeping up with compliance checks is a must.

### Regular Cookie Reviews

Make it a habit to review and monitor cookies to ensure they are categorized and functioning correctly.

| Review Type | Key Actions |
| --- | --- |
| Automated Scan | Detect and classify cookies regularly. |
| Technical Audit | Check script performance and ensure consent mechanisms work. |
| Full Assessment | Review cookie policies and consent processes. |
| Documentation Review | Audit GDPR-related documentation and consent records. |

### Policy Updates

After reviewing your cookies, update your policy to match your current practices. Here's what to focus on:

-   **Cookie Inventory Updates**  
    Stay on top of changes in third-party services and adjust your cookie inventory as needed.

-   **Policy Language Review**  
    Use clear, straightforward language to explain why cookies are used and how data is processed.

-   **Consent Mechanism Verification**  
    Test consent systems regularly across various devices and browsers to ensure they work properly.

### Consent Records

Maintaining detailed logs of user consent is critical. Include the following:

| Record Type | Details Tracked |
| --- | --- |
| Timestamp | The exact date and time consent was given. |
| Preferences | The cookie categories chosen by the user. |
| Policy Version | The version of the policy shown during consent. |
| Method | How the consent was obtained. |

These records not only show your dedication to compliance but also prepare you for potential audits.

> "Organizations must maintain records of visitor consents and be able to demonstrate compliance with the regulation in case of an audit or investigation. This includes keeping track of when and how consent was obtained, as well as providing mechanisms for visitors to easily manage their cookie preferences." - Osano.com [\[1\]](https://www.osano.com/articles/gdpr-cookie-consent)

Using a consent management system can simplify this process. Look for a system that creates compliance reports with details like consent rates, policy version history, timestamps, preference updates, and withdrawal records. Store these securely to stay audit-ready.

## Wrapping It Up

This guide has broken down the process of achieving GDPR compliance step by step - from categorizing cookies to conducting regular audits. In 2025, cookie banners that comply with GDPR must strike a careful balance between meeting legal requirements and offering a smooth user experience. By following the seven steps outlined here, businesses can create consent systems that respect user privacy while keeping their websites functional.

Properly designed cookie banners play a key role in safeguarding user privacy. With hefty penalties still a risk for non-compliance, getting this right is crucial for any organization.

A well-executed cookie banner system should focus on three main goals:

| Goal | Advantage | Effect on Business |
| --- | --- | --- |
| Legal Compliance | Avoids fines and legal issues | Supports uninterrupted operations |
| Building Trust | Offers transparency and control | Encourages better user interaction |
| Data Security | Manages visitor information responsibly | Minimizes privacy risks |

Keeping cookie banners effective requires regular updates and reviews, as discussed earlier. Since data privacy rules are always changing, staying informed and making adjustments ensures ongoing compliance with GDPR while fostering trust among your website users.


7 Steps to GDPR-Compliant Cookie Banners in 2025

How does your website handle privacy regulations like [LGPD](https://goadopt.io/en/blog/lgpd-general-data-protection-law/), CCPA, GDPR...?

What strategies does it use to comply with the any of them?
Have you thought about using a [cookie banner](https://goadopt.io/en/blog/why-are-cookie-banners-everywhere/) but don't know if your site has [cookies](https://goadopt.io/en/blog/lgpd-cookies-all-you-need-to-know/) or if it's enough? If you can't answer these questions, be cautious! Your page may be exposed to fines and other sanctions.

Below, check out 5 signs that indicate your strategies either don't exist or aren't working as they should. So keep reading to ensure the necessary compliance of your site with the principles of the law that regulates data consent.

## 5 Signs You Need a Cookie Consent Strategy Right Now

Check out the top 5 signs that your website isn't in compliance with privacy regulations and then see how to start your adjustment!

## 1 - You Have No Control Over the Data You Collect and Use
This is an undeniable sign that you need to reconsider how you view LGPD, GDPR, CCPA, etc. After all, it regulates the use of third-party data.

It requires respect for user privacy and their consent. Therefore, data usage should always be informed. Not only that, but also the purposes to which it is directed, the way it is stored, and the period of use.

So, consider that if you don't know what data you collect, how will you inform the visitor? Furthermore, how will you ensure that the use of this information complies with the limits imposed by the data subject?

These are important questions that indicate that something is not right on your website regarding privacy and its requirements.

LPs created without control, rich content available for download without accepting terms and policies, mailing lists being shared and passed from campaign to campaign... Be cautious!

I've separated this article for you, in case this is your situation:

[Understand the meaning of LGPD for your company.](https://goadopt.io/en/blog/lgpd-meaning/)

## 2 - There's No Information About the Use of Cookies

Cookies are another type of data that, in principle, should be informed by websites to their visitors. After all, they also capture information about these data subjects and, therefore, fall within the concept of data usage that any privacy regulation addresses.

The use of cookies is almost natural for most websites, especially if they come from e-commerce platforms, for example.

_### To check if your site triggers cookies, access it from a computer and - in Google Chrome, click on the padlock just to the left of the address. It should show exactly which ones and how many there are._

However, many pages fail to see cookies for what they really are: data files and personal information. Therefore, the absence of this communication to your site's visitors is dangerous as it can be a violation of the law.

In fact, not just that, but the collection of them without prior consent is also a violation. You know that "We use Cookies" pop-up? Well, it's not there for no reason.

It's a way to comply with GDPR, CCPA,LGPD... as it informs the use of this type of file while capturing authorization to use them.

- In this article, I help you understand more about [consent as a Legal Basis.](https://goadopt.io/en/blog/legal-bases-of-lgpd/)
- In this one, [how to choose an appropriate CMP - Consent Management Platform for your website.](https://goadopt.io/en/blog/how-to-choose-cmp-consent-management-platform/)

## 3 - Generic Privacy Policy and Terms of Use

Your site probably has documents such as Privacy Policy and Terms of Use. They inform, respectively, the use of visitor data (and capture authorization for it) and the prevailing rules, rights, and duties.

Therefore, they are very important, especially in the times of privacy regulations!
They stand out for their informative content to promote transparency with the data subject.

It is up to the data subject, then, to accept or not the conditions therein. In this sense, it is worth noting that the site may suspend access to some services, for example, due to a lack of acceptance of the rules and conditions. And that is natural since some of them are only possible with the authorization to use certain data.

Either way, these are important documents. But they shouldn't just be there. They should be specific to what the site offers and how it operates. So if you made your terms and policies based on Ctrl C + Ctrl V, pay attention!

It's time to review these documents and rewrite them to make them compatible with the reality of the site. Also, to fill gaps and clarify data usage. Below, I've separated a few more articles for you:

- [What is a Privacy Policy?](https://goadopt.io/en/blog/what-is-a-privacy-policy/)
- [What's the Ideal Privacy Policy for Your Company?](https://goadopt.io/en/blog/ideal-privacy-policy/)
- [What are Terms of Use in LGPD?](https://goadopt.io/en/blog/terms-of-use-lgpd/)

## 4 - Data Loss or Data Breach

When it comes to data loss, it's time to sound the alarm. Data breaches are a clear sign that your privacy compliance strategy needs urgent correction or revision.

After all, it should be developed to maintain the confidentiality of data and their use in accordance with the data subject's consent or the [legal basis](https://goadopt.io/en/blog/legal-bases-of-lgpd/) chosen. Also, to ensure the protection of this information.

Data breaches are compromising! They can tarnish the company's reputation and often that of its customers and suppliers as well. Furthermore, the company can be held responsible for them and, as a result, face significant sanctions, including hefty fines.

[**Understand the difference between Data Controller and Data Processor here.**](https://goadopt.io/en/blog/differences-data-controller-data-processor/)

And it's not just data loss itself. The lack of a clear plan of action in the event of information leaks is also an indication that you urgently need to work on your LGPD strategies. Below are some more articles to help you with this review:

- [Data Mapping or Inventory in LGPD, the DPO's life jacket.](https://goadopt.io/en/blog/data-mapping-or-data-inventory/)
- [How to Adapt Your Marketing to LGPD](https://goadopt.io/en/blog/lgpd-for-marketing-a-practical-guideline/)
- [10 Risky Processes in Your Marketing](https://goadopt.io/en/blog/10-risky-processes-in-your-marketing/)

## 5 - Absence of Designation of a Data Protection Officer

Finally, the last sign that your website needs an LGPD, GDPR, CCPA strategy is the absence of the designation of a Data Protection Officer or DPO (Data Protection Officer) for the processing of data on your site.

This figure is a requirement of LGPD, GDPR, CCPA and, according to the laws, is responsible for controlling and managing data processing. They carry out tasks determined by the Data Controller.

They are also the ones who handle complaints from personal data subjects, provide explanations, and communicate with them. Similarly, they control the entry and exit of consents, so they take the necessary actions to ensure compliance with authorizations. In this article, I explain more about [the responsibilities of a Data Protection Officer or DPO in LGPD.](https://goadopt.io/en/blog/responsibilities-of-a-data-protection-officer/)

## So, how about adapting your site to LGPD, GDPR, CCPA?

If you have recognized that your site falls into any of the signs above, it's a sign that you should take action to align it with the law. Otherwise, you may face [fines](https://goadopt.io/en/blog/fines-in-LGPD/) and other penalties that could even lead to the suspension of your page's activities.

Not to mention the impact on your brand's image in the eyes of the public, as someone who could care more about data privacy.

So, it's more than time to review your privacy strategies in the face of LGPD, GDPR, CCPA... For this, count on [AdOpt](https://goadopt.io/), which helps you not only organize them but also control the entry and use of data, as well as consents about them.


5 Signs Your Website Needs an Cookie Consent Strategy

---
meta_description: "How to handle DSARs under the California CCPA/CPRA: 7 consumer rights, 45-day deadline, toll-free number required, 12-month lookback, private right of action for breaches, and CPPA enforcement."
---

This page covers one piece of the picture. For the full scope of the CCPA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the CCPA and cookies](https://goadopt.io/en/blog/california-ccpa-and-cookies-all-you-need-to-know/).

## California CCPA: DSAR and the Privacy Portal

California has the most developed consumer rights system among all US state privacy laws.

It is not just the number of rights guaranteed by the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). It is the specificity of the processes, the precise deadlines, the private right of action for security breaches, and the existence of an independent regulatory agency with enforcement power.

This article covers all of it: what a DSAR is under the CCPA/CPRA, what rights are guaranteed, how to structure the Privacy Portal, the exact deadlines, and what happens when the business does not comply.

## What is a DSAR under the CCPA/CPRA?

DSAR stands for Data Subject Access Request, or Verifiable Consumer Request in the language of the CCPA. It is any formal request from a California resident to exercise the rights the law grants over their own data.

Under the CCPA/CPRA, the consumer can make verifiable requests to exercise six main rights, plus the private right of action for security breaches, which has its own flow.

If you are already familiar with the [GDPR](https://goadopt.io/en/blog/gdpr-cookies-explained/) data subject rights framework, the structure is familiar. The CCPA/CPRA uses the term "verifiable consumer request" to describe authenticated requests.

## What are consumer rights under the CCPA/CPRA?

### 1. Right to know and access (§ 1798.110, 1798.115)

The consumer may request that the business confirm whether it processes their data and disclose:

The categories of personal information collected.

The categories of sources.

The business or commercial purpose for collecting, selling, or sharing.

The categories of third parties with whom data was shared.

The **specific pieces** of personal information collected about the consumer.

The response must cover the **preceding 12 months** from the date of receipt.

If the business sells or shares data, the request also covers:

Categories of data sold or shared, by category of third party.

Categories of data disclosed for business purposes, separately.

### 2. Right to deletion (§ 1798.105)

The consumer may request deletion of any personal information the business collected about them.

The business must delete the data from its own records and **notify service providers, contractors, and third parties** to also delete, unless impossible or involving disproportionate effort.

The business may maintain a confidential record of deletion requests solely to prevent the data of a consumer who requested deletion from being resold.

Exceptions allowing retention even after a deletion request include: completing ongoing transactions, ensuring security, debugging errors, exercising free speech, complying with law, conducting approved public research, and fulfilling a legal obligation.

### 3. Right to correction (§ 1798.106)

Added by the CPRA. The consumer may request the business to correct inaccurate personal information, taking into account the nature of the data and the purposes of processing.

The business must use commercially reasonable efforts to correct the data as directed by the consumer.

### 4. Right to opt-out of sale and sharing (§ 1798.120)

The consumer may, at any time, direct the business not to sell or share their personal information with third parties.

After receiving the consumer's direction, the business may not sell or share the data unless the consumer subsequently provides consent.

The business must wait at least **12 months** before requesting the consumer to again authorize sale or sharing (§ 1798.135(c)(4)).

For consumers under 16 who did not consent to sale or sharing, the business must wait at least **12 months** before requesting consent again, or until the consumer turns 16 (§ 1798.135(c)(5)).

### 5. Right to limit use of sensitive personal information (§ 1798.121)

Added by the CPRA. The consumer may direct the business to limit the use of sensitive personal information to what is necessary to provide the products or services reasonably expected.

After receiving the consumer's direction, the business may not use the sensitive information for other purposes unless the consumer provides new consent.

### 6. Right of non-discrimination (§ 1798.125)

The consumer may not be discriminated against for exercising any right guaranteed by the CCPA/CPRA. The business cannot deny products or services, charge different prices, provide different quality, or suggest differential treatment.

The exception is voluntary financial incentive programs where the price or quality difference is reasonably related to the value the data represents to the business.

### The private right of action for security breaches (§ 1798.150)

This right has a different flow from the others. A consumer whose unencrypted and unredacted data is accessed or exposed in a security breach may file a civil lawsuit to recover **US$ 100 to US$ 750** per consumer per incident, or actual damages when greater, plus injunctive relief.

Before initiating any action for statutory damages, the consumer must provide written notice to the business **30 days in advance**, identifying the specific violations. If the business cures within the period and provides a written statement that no further violations will occur, no action may be initiated.

## What are the response deadlines?

The CCPA/CPRA is specific on deadlines.

**45 days** from receipt of a verifiable consumer request (§ 1798.130(a)(2)(A)).

The deadline can be extended by another **45 days** when reasonably necessary, considering the complexity and number of requests, as long as the consumer is notified within the initial period with the justification and reason for the delay (§ 1798.145(h)(1)).

Service is free. The business is not obligated to provide the same information to the same consumer more than **twice in a 12-month period** (§ 1798.130(b)).

## What is a "verifiable consumer request"?

The CCPA/CPRA uses the term "verifiable consumer request" (§ 1798.140(ak)) to describe requests that the business can verify were made by the consumer themselves, by a minor child's parent, by an authorized representative, or by a person with power of attorney.

The business may authenticate the request using commercially reasonable methods. It may require authentication proportionate to the nature of the information requested, but cannot require the consumer to create a new account. If the consumer already has an account, the business may require use of that account.

Data collected for identity verification may only be used for that purpose, not for other uses (§ 1798.130(a)(7)).

## What should the request submission channel look like?

§ 1798.130(a)(1) requires two or more designated methods for submitting requests, including at minimum a **toll-free telephone number**.

Businesses that operate exclusively online with a direct consumer relationship may limit themselves to an email address.

If the business maintains a website, it must make it available as a submission channel.

The business cannot require the consumer to create a new account, but may require use of an existing account.

A structured Privacy Portal offers:

A submission form with clear categories (know/access, delete, correct, opt-out of sale/sharing, limit sensitive PI use).

A proportionate and non-discriminatory identity verification process.

Automatic receipt confirmation.

A log of each request, action taken, and response sent.

## Requests from authorized representatives

The consumer may authorize another person to exercise their rights on their behalf, including through the GPC opt-out preference signal (§ 1798.135(e)).

An authorized agent may submit requests. The business may require proof that the agent was properly authorized by the consumer.

Parents or guardians may exercise rights on behalf of minor children.

## Free service: what the law says

Service is free (§ 1798.130(a)(2)(A)). But the business is not obligated to provide the same information to the same consumer more than **twice in a 12-month period** (§ 1798.130(b)).

For manifestly unfounded, excessive, or repetitive requests, the business may charge a reasonable fee for administrative costs or decline. The burden of demonstrating the excessive nature lies with the business (§ 1798.145(h)(3)).

## How to process each type of DSAR in practice

### Access and information request

Receive and authenticate the consumer's identity.

Locate all personal data collected about this consumer in the preceding 12 months across all systems.

Prepare a response covering: categories of data, categories of sources, purposes, categories of third parties, and the specific pieces of information.

If the business sold or shared data: list by category of data and category of third party (in separate lists for "sold/shared" and "disclosed for business purposes").

Deliver in a readily usable format that allows transmission from one entity to another without hindrance.

Send within the 45-day deadline.

### Deletion request

Receive and authenticate.

Check whether a legal exception allows retaining the data.

If no exception: delete from own records and notify service providers, contractors, and third parties to also delete.

Retain only the confidential record of the deletion request to prevent future resale.

Confirm to the consumer.

### Correction request

Receive and authenticate.

Identify which data is inaccurate and in which systems it is stored.

Use commercially reasonable efforts to correct as directed by the consumer.

Confirm the correction.

If the request is for correction of health information and the business rejects it as accurate, the consumer has the right to include an addendum of up to 250 words to the record.

### Opt-out of sale and sharing request

Receive the request (may be via "Do Not Sell or Share" link, via GPC, or via authorized representative).

Immediately cease sale and sharing of this consumer's data.

Do not request consent again for at least 12 months.

Notify any third parties that recently received the data about the opt-out.

### Request to limit use of sensitive personal information

Receive via "Limit the Use of My Sensitive Personal Information" link or other mechanism.

Cease use of the consumer's sensitive personal information for purposes beyond what is necessary to provide the products or services reasonably expected.

Notify service providers about the limitation so they also cease unauthorized uses.

## Protection against discrimination

§ 1798.125 expressly prohibits businesses from discriminating against consumers who exercise their rights. The business cannot:

Deny products or services.

Charge different prices or rates.

Provide different quality of goods or services.

Suggest the consumer will receive differential treatment.

Retaliate against employees, job applicants, or independent contractors who exercise their rights.

The exception is voluntary financial incentive programs. The business may offer financial compensation, discounts, or benefits in exchange for data use, as long as the consumer expressly consents and the incentives are not unjust, unreasonable, coercive, or abusive.

## Documentation and records

Every processed request must be documented. This includes:

Date and time of receipt.

Type of request.

Authentication process performed.

Action taken.

Date and form of response to the consumer.

In case of denial: recorded justification.

This documentation is what protects the business in a CPPA or Attorney General investigation.

## Shared enforcement: CPPA and Attorney General

The **California Privacy Protection Agency (CPPA)** has administrative power to:

Investigate businesses on its own initiative or based on complaints.

Impose fines of up to **US$ 2,500 per violation** and up to **US$ 7,500 for intentional violations** or violations involving minors.

The **California Attorney General** may seek civil penalties in the same amounts in a civil action.

There is no guaranteed cure period before CPPA actions. The agency decides by discretion whether and when to initiate an investigation.

## How AdOpt helps with the Privacy Portal

AdOpt logs every consent, opt-out, and sensitive information limitation interaction with a timestamp and unique identifier. When the consumer opts out of sale and sharing, the system automatically updates the corresponding trackers.

The GPC is honored automatically. AdOpt's auditable log serves as evidence of compliance. And when legislation changes, the platform updates automatically.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Privacy Portal for your site that complies with the CCPA/CPRA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what the Privacy Portal needs for the CCPA/CPRA

**Two or more submission methods**, including a toll-free telephone number (§ 1798.130(a)(1)).

**Website available** as a submission channel if the business maintains a website.

**Coverage of 6 rights**: access/know, deletion, correction, opt-out of sale/sharing, limit sensitive PI, and non-discrimination.

**12-month lookback** for access requests (§ 1798.130(a)(2)(B)).

**45-day response deadline**, with +45-day extension with notification (§ 1798.130(a)(2)(A)).

**Free service** limited to twice per consumer in 12 months (§ 1798.130(b)).

**Authentication process** proportionate to the nature of data, without requiring new account creation.

**Acceptance of requests from authorized representatives**, including parents of minors.

**"Do Not Sell or Share My Personal Information" link** on the site when there is sale or sharing.

**"Limit the Use of My Sensitive Personal Information" link** when applicable.

**GPC honored** when sent by the user.

**12-month waiting period** before requesting consent again after opt-out.

**Notification of third parties** for data deletion when a deletion request is fulfilled.

**Confidential record** of deletion requests to prevent resale.

**Documentation** of each request, action, and response.

## Comparison: Privacy Portal deadlines under the CCPA/CPRA

| Request type | Response deadline | Extension possible |
|---|---|---|
| Access/know, deletion, correction | 45 days | +45 days with notification |
| Opt-out of sale/sharing | Immediate after receipt | Does not apply |
| Limit use of sensitive PI | Immediate after receipt | Does not apply |
| Re-contact after opt-out | 12 months minimum | No extension |
| Pre-lawsuit notice (security breach) | 30 days for business to cure | No extension |

## FAQ: CCPA/CPRA and Privacy Portal

**1. Does the CCPA require a toll-free telephone number for the Privacy Portal?**
Yes. § 1798.130(a)(1) requires the business to provide two or more designated methods for submitting requests, including at minimum a toll-free telephone number. The exception applies to businesses that operate exclusively online with a direct consumer relationship, which may limit themselves to an email address. For most businesses with a website, the toll-free number is mandatory.

**2. What is the "12-month lookback" and how does it affect access requests?**
§ 1798.130(a)(2)(B) requires that the response to an access request cover the 12 months preceding receipt of the request. This means the Privacy Portal must be capable of retrieving data collected in the preceding 12 months from each request date, which requires appropriate tracking and retention systems.

**3. How many times per year must the business process DSARs free of charge?**
Twice in a 12-month period per consumer, under § 1798.130(b). For requests beyond this limit, or that are manifestly unfounded or repetitive, the business may charge a reasonable fee for administrative costs or decline, demonstrating the excessive nature.

**4. How does the private right of action under the CCPA work and what does it have to do with the Privacy Portal?**
§ 1798.150 grants the consumer the right to file a civil lawsuit for security data breaches. Before initiating action for statutory damages, the consumer must provide written notice 30 days in advance. The Privacy Portal should be the channel through which these notifications are received and processed. If the business cures within the period and provides an adequate written statement, no action may be initiated.

**5. Must the business notify third parties when it fulfills a deletion request?**
Yes. § 1798.105(c)(1) requires the business to notify any service provider or contractor to delete the data, and also notify all third parties to whom the data was sold or shared, unless impossible or involving disproportionate effort. The business may also maintain a confidential record of the deletion request solely to ensure that the data of the consumer who requested deletion is not resold.

[Ready to build a Privacy Portal for your site that complies with the CCPA/CPRA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


California CCPA: DSAR Privacy Portal

Have you ever thought that your marketing agency could find a great business opportunity in LGPD, GDPR, CCPA...?

Well, unlike what many think, it brings changes that can accelerate the demand for the services of these companies.

After all, the new privacy regulations like the GDPR, CCPA, and the LGPD ([General Data Protection Law (LGPD)](https://goadopt.io/en/blog/lgpd-general-data-protection-law/)) - as it shouldn't be news to anyone - has brought significant changes to how companies handle third-party data. This applies to data processed on the internet or not.

And marketing is one of the areas directly affected by the new rules because its digital operations depend on third-party data, which is precisely the focus of the LGPD, for example.

So, how about learning more about how to leverage this new law to create opportunities in the field of marketing?

To do that, keep reading and see everything about the subject below!
(I'll keep using the LGPDas an example, but, the same logic applies to any privacy regulation.)

## LGPD Doesn't Mean the End of Digital Marketing, Quite the Opposite

Like other novelties, the [emergence of LGPD](https://goadopt.io/en/blog/lgpd-general-data-protection-law/) has also brought many rumors, created legends, and generated a lot of apprehension! After all, it changes how data was previously treated and introduces new obligations.

[LGPD](https://goadopt.io/en/blog/lgpd-meaning/) aims especially at transparency regarding data usage, as well as using data in accordance with the consent of the data subject and within the limits of this authorization.

For this reason, many believed that it would bring an end to the golden age of digital marketing. After all, it requires user information, which, in turn, requires their consent.

Considering the various accesses and actions that occur on web pages, as well as the numerous impressions and reach that marketing aims for, this seemed impossible.

However, it's not.

It's possible to organize digital marketing in accordance with the General Data Protection Law in a way that it continues to generate leads and attract customers and interested parties. Below, I've included an article to help you on this journey:

[### TIP: 10 marketing processes you should reconsider due to LGPD.](https://goadopt.io/en/blog/10-risky-processes-in-your-marketing/)

## Significant Changes for Marketing Have Emerged with LGPD

Marketing hasn't died, but that doesn't mean it doesn't require updates in its tools and how it operates.

For example, consent will always be present in the collection of any data that the user provides, either directly or indirectly. It is only with consent that a company can use the information for any purpose, including marketing.

Certainly, other [legal bases of LGPD](https://goadopt.io/en/blog/legal-bases-of-lgpd/) serve as the foundation for data permission and usage. But, in any case, consent ends up being a part of all of them since at some point in the data flow, the individual consented to providing that product/service.

Similarly, the use of this data must always be clear, whether the user voluntarily provides their information (such as in form submissions) or if it's collected automatically through cookies and other tools.

In this sense, it's important to keep in mind that marketing only succeeds when it has data to guide its actions, including now the confirmation that proves the data was collected regularly.
Therefore, this data can only be collected and used after the user is notified of it and grants their consent, or through another legal basis.

To obtain consent, numerous tools are available, as we'll see next.

[### Learn more about adapting digital marketing to the General Data Protection Law.](https://goadopt.io/en/blog/lgpd-for-marketing-a-practical-guideline/)

## Outsourcing Marketing Becomes an Interesting Option, Provided Agencies Know How to Handle It

So, you might be wondering: Ok, LGPD brought changes regarding marketing. But where do agencies fit into this?

Many companies choose to conduct marketing activities themselves or even outsource a large portion of them. In any case, the service needs to be done and now fully compliant with LGPD. That is, whether they are internal actions or third-party actions conducted by specialists, all must adjust.

This leads to a series of new demands, routines, and daily processes that someone will have to be responsible for.

### Can some of the new demands created by LGPD become part of the agency's service portfolio?

We already know that simply ignoring them can lead to [fines and sanctions under LGPD](https://goadopt.io/en/blog/fines-in-LGPD/) which can require significant amounts of money and even lead to the suspension of the website or database.

Furthermore, there's another very important aspect for marketing agencies regarding LGPD. After all, as of LGPD, captured data will only be what's consented, which provides a rich ground for campaigns.

In other words, the law requires data to be collected with the user's authorization, which they provide voluntarily.

This means that marketing now has data that genuinely directs it toward those who are already interested in the company's services or products and are engaged!

Therefore, LGPD is an opportunity for marketing agencies in that they can present themselves as experts in adapting product promotion and customer acquisition strategies to comply with the law!

## Develop a Marketing Policy Based on LGPD
Agencies have various ways to adapt marketing strategies. For example, here are some of the tools that need to be reviewed:

- Marketing emails;
- Sponsored ads;
- Forms;
- Landing pages, and more.

Note that all these tools collect user data, whether through the use of cookies or by requesting contact information (among others) to access information, promotions, and products.

Therefore, all of them should follow the development of a policy that makes it clear to the user that this data will be used, as well as the limits of data usage.

A good [LGPD tool](http://goadopt.io/) is the [cookie banner](https://goadopt.io/en/blog/how-to-choose-a-cookie-banner-for-your-website/) that asks for a "check" before data is sent and consent is granted, among other things.

[Learn more about how a cookie banner works!](https://goadopt.io/en/blog/operation-of-cookie-banner/)

## Other LGPD Adaptations Beyond Digital Marketing

Furthermore, it's important to consider the website itself, where advertising pages can drive user traffic.

In this case, it's interesting for the website to be equipped with a tool that presents all the company's policies regarding data usage in one place.

That is, the Terms of Use, Privacy Policy, and also the Cookie Policy. In this case, all of them provide information about data usage and related information.

[Learn everything about the Privacy Policy, how it works, and its requirements!](https://goadopt.io/en/blog/what-is-a-privacy-policy/)

For this, count on AdOpt! Our tool works by granting a tab as a pop-up that opens on your website every time someone accesses it.

There, it's possible to access the website rules, data usage policies (in their various forms), and consent collection.

[Learn more about the Cookie banner, its advantages, and how to use it.](https://goadopt.io/en/blog/operation-of-cookie-banner/)


LGPD: An Opportunity for Digital Marketing Agencies!

Having a cookie banner on your brand's website has become essential for many. For e-commerce, it has practically become an obligation. This type of website has a technological composition in which cookies are a structural part. Login flow, items in the cart, recommendation showcase, remarketing... Most of them rely on cookies.

As a result, the use of cookies is essential for the survival of online commerce. Therefore, cookie banners are also necessary to avoid fines and other penalties that may be imposed after the enactment of the [General Data Protection Law (LGPD)](https://goadopt.io/en/blog/lgpd-general-data-protection-law/).

However, beyond the simple legal obligation, cookie banners maintain a transparent and open relationship with the public.

Our experience allows us to anticipate some "consequences" of the cookie banner on your online store. It is important for you to understand each of them so that you are not caught off guard and can adjust to this new reality.

## Cookie Banner: What Is It?

As the name suggests, a cookie banner is simply an alert about the use of this type of data by your website. Through it, visitors become aware that the page uses these files, which are essential for its operation and to enhance the user experience.

However, it's not just that. With the enactment of LGPD in 2020, data subjects gained the power to authorize or refuse the use of these tools during their browsing. In other words, they can accept or reject cookies at any time.

Therefore, the cookie banner informs visitors about their website's use of cookies and, at the same time, requests the user's authorization to use them. The user has the power to choose which types of cookies to allow.

Thus, all the management of these variables is contained in a platform called CMP - Consent Management Platform.

[To learn more about what a CMP is, we've prepared this article for you.](https://goadopt.io/en/blog/how-to-choose-cmp-consent-management-platform/)

### ## Some Tips for Configuring the Cookie Banner

According to the [LGPD text, consent is defined as a free, informed, and unequivocal expression by which the data subject agrees to the processing of their personal data for a specific purpose.](https://presrepublica.jusbrasil.com.br/legislacao/612902269/lei-13709-18#art-5) Here are some points to consider when setting up consent collection for your e-commerce:

- **FREE**: Collecting consent in exchange for some benefit is prohibited. This can constitute what's called "consent bias." Visitors cannot be forced or coerced into accepting.

- **INFORMED**: Citizens must be informed about the details of consent. Only with free access to this information can consent be "celebrated" between the parties.

- **UNEQUIVOCAL**: Consent must be provided in writing or by another means that demonstrates the data subject's will, which can be evidenced by a record, date, and time.

- **SPECIFIC PURPOSE**: Consent must be given for a specific and not a generic or general use.

Only with the four points listed above can various interpretations be drawn for the consent collection flow. In [this article](https://goadopt.io/en/blog/how-to-choose-cmp-consent-management-platform/), we've provided a specific analysis of each of the flow, design, and legal arguments to help you choose your cookie banner.

## The Most Overlooked and Feared Configuration in the Market

The most complex and overlooked configuration in the market is the blocking of third-party cookies, releasing them only after consent. In other words, tags like Google Analytics, Conversion Pixel, Remarketing, etc., can only be fired after visitor consent, with the exception of essential tags, of course.

This is one of the most important points that ensure the rights and privacy of data subjects, which many companies struggle to understand, adopt, and implement. After all, this would completely impact the site's performance, conversion KPIs, and numerous tracking metrics.

However, it's worth noting that this configuration is also one of the first things auditors and authorities look at when assessing whether a website is compliant or not. Firing cookies before consent leaves a poor impression and is certainly a red flag for audits and authorities.

Unfortunately, many SEO, performance, and analytics tools do not prioritize privacy. Google itself favors sites that use its services and share data with it. So, the entire market will have to adapt. An interesting alternative for those looking for privacy-respecting analytics services is [Fathom](https://usefathom.com/).

## How Does a Cookie Banner Impact Your E-commerce?

Delving a bit deeper into the direct and indirect impacts of the cookie banner on e-commerce, we've listed some of the main influences below.

### 1. Bounce Rate: Be Cautious About Size and Design Harmony
Any popup, banner, or notice that appears on the screen tends to prompt an immediate reaction, often rejection (especially on mobile). To prevent this, it's important for the Cookie Banner to have a minimalist design that harmonizes with your site's style. Otherwise, the chances of rejection or a bounce increase significantly. Look for opportunities to customize colors, formats, fonts, text, and images to make the banner's communication as unobtrusive as possible.

**2. Cookie Blocking and Metric Impact: Balloon Banners Are More Accepted Than Bottom Bars**
As explained in the previous item, once third-party cookie blocking is implemented, the metrics associated with this firing are directly impacted. From our experience, we've observed that about 25% of site visitors give consent. Sites that use balloon-style cookie banner have an 80% higher acceptance rate than the bottom bar format.

### 3. Data Subject Requests Create a New Workflow/Process in Your Company
One of the obligations brought by privacy laws ([LGPD, GDPR, CCPA, PIPEDA](https://goadopt.io), etc.) is the free access of citizens to their data and direct queries to companies. In other words, a citizen can at any time inquire if your company holds any data related to them and request more information, portability, or even deletion of it.

That's why, at AdOpt, we place such importance on data subject request workflows. Each AdOpt banner also generates an Opt-out page where people can make their requests at any time. This generates an email sent to the [Data Protection Officer](https://goadopt.io/en/blog/responsibilities-of-a-data-protection-officer/) (DPO) of the company, which, by law, must be responded to within 15 days.

So, your company needs a structured process to ensure that requests and their responses are fully met within the deadline. Someone must be trained and responsible for this workflow.

Would you like more tips on how to organize your operations to better handle these requests? I've selected two articles for you:

- Learn more about the [ROPA document of LGPD](https://goadopt.io/en/blog/ropa-for-lgpd/).
- [Data Mapping or Data Inventory, the DPO's Lifesaver](https://goadopt.io/en/blog/data-mapping-or-data-inventory/).

### 4. Tag Changes, Tool Testing Will Have a Larger Workflow
Some companies tend to test many tools and technologies on their websites, which is not a problem in itself. However, since many of these tools fire cookies, it's essential that the entire communication flow, now established by LGPD, be reviewed and, if necessary, updated with the introduction of a new technology that fires cookies or collects data.

Especially if your official documents, such as the Privacy Policy and, possibly, the Terms of Use, have already listed the cookies you use, their purposes, deadlines, etc.

Therefore, if there is any change in the listing of official documents, it is important that communication is also completely revised and updated. It's worth noting that whenever a new privacy policy or cookie policy is updated, all consents collected up to that point should be updated/replaced.

This is because consent is an agreement between the company and the citizen, the terms of which are precisely in the policy. Therefore, if the policy changes, the agreement of the parties must also be collected.

- [Learn more about how to notify users about term updates.](https://goadopt.io/en/blog/notification-to-users-terms-of-use/)
- [Important Tips on the Ideal Privacy Policy for Companies.](https://goadopt.io/en/blog/ideal-privacy-policy/)

## Is a Cookie Banner the Same as a CMP?

No, a CMP (Consent Management Platform) is a tool where a cookie notice or banner is just one integrated feature among many.

This differentiation is important because some people think that a cookie banner is just a pop-up with a button for the website. However, the technology involved goes far beyond that.

The banner can identify whether the visitor is accessing for the first time or not. By collecting the visitor's consent, it triggers this record to the database and to other tools that also await consent to react to access. All of this happens in milliseconds.

This is just one of several functionalities. Others include:

- Blocking third-party cookies.
- Hiding after acceptance.
- Recognizing the browser's language so that the banner is translated into the visitor's preferred language.
- Recognizing the visitor's IP country to ensure compliance with the visitor's country's legislation.
- Redirecting to the Opt-out/rights of data subjects page.
- Alerting the DPO when a request is made, consolidating visitor information.
- Integration with systems via API, callbacks to feed other databases.
- And more...

- Want to know more about a [CMP and how to choose one for your company? This link can help.](https://goadopt.io/en/blog/how-to-choose-cmp-consent-management-platform/)

## Why Have a Cookie Banner?

In summary, based on what we've seen so far, this is important for two main reasons. First, because LGPD requires it. According to the law, all use of data from data subjects must have their knowledge and consent. If you can manage this information offline or in some specific way, great! If you need to scale and automate workflows, the cookie banner (CMP) is essential for you.

But it's not just that. The cookie banner is also important to demonstrate to your audience how you care about both their experience on your site and the transparency in the relationship between the page and them.

Therefore, it improves the reliability of the relationship and shows the site's responsibility to its audience, as well as its pursuit of the best possible experience without compromising privacy.

So, it's extremely important to have a good cookie banner. It should be intuitive, grab the audience's attention, and integrate naturally with your website. Below, you can see how to get a good information banner and consent management.

## How to Get a Good Cookie Banner that Helps with Data and Consent Management?

For this, you can rely on AdOpt! Our cookie platform not only includes the banner but also a management tool, i.e., a CMP.

The platform is adaptable to your website's design, seamlessly integrating with it. Thus, when the site opens, it's available and provides information about the cookies used, as well as offering personalized configuration options for which ones the data subject will authorize.

Similarly, AdOpt includes essential documents for LGPD compliance on the page: Terms of Use and Privacy Policy. Therefore, all this data is organized in one place.

To top it off, AdOpt combines all of this with a real-time update and tracking tool for all entries, exits, and changes in consent. By doing so, it ensures that data will only be used in accordance with the data subject's wishes.

So, don't hesitate to rely on AdOpt and check out our plans. You'll see how complying with LGPD is much easier and more beneficial than it seems!



The Impact of Cookie Banners on Your E-commerce - LGPD

California was the first US state to have a comprehensive data privacy law. And when it decided it could do better, it did.

The California Privacy Rights Act (CPRA), also known as Proposition 24, was approved by California voters in November 2020 and took effect on **January 1, 2023**. It did not replace the CCPA. It expanded it, strengthened it, and created an independent regulatory agency to enforce it.

If you already dealt with [the CCPA and its cookie obligations](https://goadopt.io/en/blog/california-ccpa-and-cookies-all-you-need-to-know/), you will recognize the structure. But you will need to update everything.

## The timeline: where the CPRA came from

To understand the CPRA, you need to understand California's data privacy trajectory.

**2018:** The California Consumer Privacy Act (CCPA) is signed by Governor Jerry Brown after more than 629,000 Californians sign petitions to put it on the ballot. The legislature approves a negotiated version before the deadline to avoid the more restrictive version that would have gone to voters.

**January 1, 2020:** The CCPA takes effect. For the first time, California consumers gain rights to access, deletion, and opt-out of data sales.

**July 2020:** CCPA enforcement begins by the California Attorney General's office.

**November 2020:** Voters approve Proposition 24, the CPRA, with 56.2% in favor. Because it was passed by ballot initiative, the state legislature cannot repeal it. Any amendment must be "consistent with and further the purpose and intent" of the law.

**January 1, 2022:** The CPRA begins applying to data collected from this date forward.

**January 1, 2023:** The CPRA becomes fully operational. The California Privacy Protection Agency (CPPA) takes over enforcement, replacing the Attorney General in that role.

**July 1, 2023:** Formal enforcement by the CPPA begins for data collected on or after January 1, 2022.

## What is the CPRA?

The CPRA is California's current consumer privacy law. It amends and expands the CCPA, adding new rights, a new category of sensitive personal information with specific controls, a prohibition on retaining data beyond what is necessary, and a dedicated regulatory agency.

Enforcement is the responsibility of the **California Privacy Protection Agency (CPPA)**, an independent agency created by the CPRA itself. The Attorney General retains concurrent authority for certain violations.

## Who must comply with the CPRA?

The CPRA applies to businesses that conduct business in California or collect personal information from California residents and that meet any one of the following criteria:

Have **annual gross revenue exceeding US$ 25 million** in the preceding calendar year.

Buy, sell, or share personal information of **100,000 or more consumers or households** per year.

Derive **50% or more** of annual revenue from selling personal information of consumers.

### The threshold change from the CCPA

The original CCPA used a threshold of 50,000 consumers or households. The CPRA doubled that number to 100,000, potentially excluding some smaller businesses. But at the same time, it expanded the concept of "selling" to include "sharing" data, which brought many businesses back into scope.

The focus remains on where consumers are, not where the company is based. A website with California traffic at scale may be in scope regardless of where it operates.

### CPRA exemptions

Outside the scope:

HIPAA-covered information, when treated in accordance with that federal law.

Gramm-Leach-Bliley Act regulated data, when treated accordingly.

Credit data regulated by the Fair Credit Reporting Act.

Health information under California's Confidentiality of Medical Information Act.

Research data, under specific conditions.

Employee and job applicant information, when used exclusively in that capacity.

Government entity data.

## CCPA vs. CPRA: the key differences

This is the section that matters for anyone already CCPA-compliant who needs to understand what changed.

### 1. New regulatory agency

The CCPA was enforced by the California Attorney General. The CPRA created the California Privacy Protection Agency (CPPA), an independent agency with an exclusive mission to protect consumer privacy. The CPPA has authority to investigate, fine, and issue regulations. The AG retains concurrent authority for certain violations.

### 2. New consumer rights

The CCPA had four main rights: access, deletion, opt-out of sale, and non-discrimination. The CPRA added:

Right to correct inaccurate personal information (new).

Right to limit use and disclosure of sensitive personal information (new).

The opt-out right was expanded to include sharing of data for cross-context behavioral advertising, in addition to selling.

### 3. Sensitive personal information category

The CCPA had no formal category of sensitive data with differentiated treatment. The CPRA created the "sensitive personal information" (SPI) category with its own rules: precise geolocation, financial account data, private communications, genetic data, biometric data, health data, sexual orientation, racial or ethnic origin, religious beliefs, and immigration status. Consumers have the right to limit use of this information to essential purposes.

### 4. Consumer threshold doubled

CCPA: 50,000 consumers or households. CPRA: 100,000 consumers or households. This may have taken some smaller businesses out of scope, but the new concept of "sharing" partially offset that effect.

### 5. "Sharing" as a separate category

The CCPA focused on "sale" of data. The CPRA added "sharing," which includes disclosing data for cross-context behavioral advertising even without direct payment. This closed a significant gap: businesses that argued they did not "sell" data but shared it with advertising networks.

### 6. Prohibition on retaining data beyond what is necessary

The CCPA had no data retention rule. The CPRA explicitly prohibits businesses from retaining personal information beyond what is necessary for the disclosed purpose. Businesses must specify retention periods and comply with them.

### 7. Tripled penalties for violations involving minors

The CCPA provided penalties of up to US$ 7,500 per intentional violation. The CPRA kept that amount for general violations but tripled the automatic penalties for violations involving personal information of consumers under 16: up to US$ 7,500 per violation, now applied automatically without needing to prove intent.

### 8. Enhanced protection for teens aged 13 to 15

The CCPA required opt-in for data of consumers under 16. The CPRA kept that and added: if a consumer under 16 declines consent, the business must wait **12 months** before requesting consent again.

### 9. Elimination of the cure period

The original CCPA had a 30-day cure period: the AG had to notify the business and give 30 days to correct before initiating formal action. The CPRA eliminated that cure period for CPPA enforcement. The CPPA can act directly.

### 10. Data Protection Assessments and Audit

The CPRA requires businesses to conduct periodic privacy risk assessments for high-risk activities, and to submit to regular privacy audits when required by the CPPA.

## What is personal information under the CPRA?

Any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.

This includes identifiers (name, address, email, IP), legally protected characteristics, commercial information, biometric data, geolocation data, internet activity data, audio and visual data, professional information, education information, and inferences used to create profiles.

Publicly available information from government sources is excluded.

## What is sensitive personal information (SPI) under the CPRA?

This is the CPRA's major innovation. The law created a subcategory called "sensitive personal information" with specific controls. SPI includes:

Social Security number, driver's license, passport or government ID number.

Financial account, debit or credit card information combined with access credentials.

Precise geolocation.

Contents of private communications (emails, texts), unless the business is the intended recipient.

Genetic data.

Biometric data for unique identification.

Health data.

Information about sex life or sexual orientation.

Racial or ethnic origin, religious or philosophical beliefs, or union membership.

Consumers have the right to limit use and disclosure of SPI to essential purposes.

## What are consumer rights under the CPRA?

The CPRA guarantees California residents:

**Right to know:** categories of personal information collected, sources, purposes, and third parties.

**Right to access:** a copy of specific personal information collected in the past 12 months.

**Right to deletion:** request deletion, with some exceptions.

**Right to correct:** request correction of inaccurate personal information (new under CPRA).

**Right to portability:** data in a portable, usable format.

**Right to opt-out of sale and sharing:** refuse sale and sharing for cross-context behavioral advertising.

**Right to limit SPI use:** limit use and disclosure of sensitive personal information to essential purposes (new under CPRA).

**Right to non-discrimination:** no penalties for exercising rights.

The response deadline is **45 days**, extendable by another 45 days when necessary, with consumer notification within the initial period.

Response is **free up to twice per year** per consumer.

## Protection for minors

The CPRA has specific protections for consumers under 16 that deserve attention.

For consumers under 16: the business cannot sell or share personal information without active opt-in. The default is opt-in, not opt-out.

For consumers under 13: consent must be given by parents or legal guardians.

If a consumer under 16 declines consent, the business must wait **12 months** before making a new consent request.

Penalties for violations involving data of consumers under 16 are tripled automatically, reaching **US$ 7,500 per violation**.

## Mandatory links on the site

The CPRA requires two links that must be visible on the homepage and on any page where personal information is collected:

**"Do Not Sell or Share My Personal Information"**: for opt-out of selling and sharing data for cross-context behavioral advertising.

**"Limit the Use of My Sensitive Personal Information"**: for limiting use of sensitive personal information to essential purposes.

These links may be combined into a single link if both opt-out options are available on the same destination page.

## Cookies and the CPRA

Cookies that collect personal information, especially for behavioral advertising, fall directly within the CPRA's scope.

The site must display a clear [cookie notice](https://goadopt.io/en/blog/operation-of-cookie-banner/), provide the opt-out links for sale/sharing and SPI limitation, and block non-necessary trackers before the consumer decides.

[Correct tag categorization](https://goadopt.io/en/blog/best-practices-tag-categorization/) is what makes it possible to identify which cookies constitute selling or sharing of personal information.

The Global Privacy Control (GPC) is recognized in California: the CPPA confirmed that the GPC is a valid form of opt-out under the CPRA. If a visitor accesses the site with the GPC enabled, that is equivalent to clicking "Do Not Sell or Share My Personal Information."

## Enforcement and penalties

The CPPA has primary enforcement authority for the CPRA for data collected from January 2022 forward. The AG retains concurrent authority for data breach violations.

There is no guaranteed cure period from the CPPA. The agency can initiate action directly.

Penalties are:

Up to **US$ 2,500 per unintentional violation**.

Up to **US$ 7,500 per intentional violation**.

Up to **US$ 7,500 per violation involving information of consumers under 16** (automatic, no need to prove intent).

The CPRA also preserves the **private right of action** for data security violations: consumers can sue the business directly for damages caused by unauthorized data breaches involving specified categories of personal information.

## How AdOpt helps with the CPRA

AdOpt records every consent and opt-out interaction, blocks trackers before acceptance, honors the GPC automatically, and generates the auditable log needed in a CPPA investigation.

The automatic scan identifies all active [trackers](https://goadopt.io/en/blog/gdpr-cookies-explained/) on the site, feeding the data inventory required for the privacy policy and risk assessments. And when the law changes, the platform updates automatically.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Ready to bring your website into compliance with the California CPRA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## CCPA vs. CPRA: comparison table

| Point | CCPA (2020) | CPRA (2023) |
|---|---|---|
| Effective date | Jan 2020 | Jan 2023 |
| Consumer threshold | 50,000 | 100,000 |
| Data sale | Opt-out | Opt-out |
| Sharing for advertising | Not explicitly covered | Opt-out (new) |
| Sensitive data | No separate category | SPI with specific limitation right |
| Right to correct | Not provided | Provided (new) |
| Limit SPI use | Not provided | Provided (new) |
| Regulatory agency | Attorney General | CPPA (new) |
| Cure period | 30 days guaranteed | Eliminated by CPPA |
| Penalties for minors | Up to US$ 7.5K with intent | Up to US$ 7.5K automatic |
| Data retention | No specific rule | Prohibited beyond necessity |
| Private right of action | Data breaches only | Maintained and expanded |

## Comparing CPRA with other privacy laws

| Law | State | Threshold | Agency | Cure Period | Effective Date |
|---|---|---|---|---|---|
| CPRA | California | US$ 25M or 100K or 50% revenue | CPPA | Eliminated | Jan 2023 |
| OCPA | Oregon | 100K (excl. payments) or 25K + 25% | AG Oregon | Eliminated (Jan 2026) | Jul 2024 |
| CTDPA | Connecticut | 100K (excl. payments) or 25K + 25% | AG Connecticut | Discretionary | Jul 2023 |
| VCDPA | Virginia | 100K or 25K + 50% | AG Virginia | 30 days guaranteed | Jan 2023 |
| NHDPA | New Hampshire | 35K or 10K + 25% | AG NH | Discretionary | Jan 2025 |

## Continue learning about privacy in California

Compliance in California is built from three documents that need to agree with each other: the [cookie policy](https://goadopt.io/en/blog/california-cpra-cookies-policy/), which declares every tracker and its purpose; the [privacy policy](https://goadopt.io/en/blog/california-cpra-privacy-policy/), reviewed at least every 12 months; and the [privacy portal](https://goadopt.io/en/blog/california-cpra-dsar-privacy-portal/), where the consumer exercises their rights and you keep the record of it.

## The CPRA in practice: the three documents

Compliance with the CPRA rests on three documents that have to agree with each other: the [cookies policy](https://goadopt.io/en/blog/california-cpra-cookies-policy/), which declares every tracker and its purpose; the [privacy policy](https://goadopt.io/en/blog/california-cpra-privacy-policy/), which explains what you do with the data; and the [privacy portal](https://goadopt.io/en/blog/california-cpra-dsar-privacy-portal/), where the consumer exercises their rights and you keep the record of it.

## FAQ: California CPRA

**1. What is the difference between the CCPA and the CPRA? Does the CCPA still exist?**
The CCPA still exists as the base law, but the CPRA substantially amended and expanded it. In practice, the current framework is CCPA/CPRA combined, with the CPRA adding new rights (correction, SPI limitation), a new data category (sensitive personal information), a new regulatory body (CPPA), a data retention prohibition, and enforcement changes. The CPRA took effect on January 1, 2023 and applies to data collected on or after January 1, 2022.

**2. What is the California Privacy Protection Agency (CPPA) and how does it differ from the Attorney General?**
The CPPA is an independent agency created by the CPRA itself, with an exclusive mission to protect consumer privacy in California. It took over CPRA enforcement for data collected from January 2022 forward, replacing the AG in that role. The AG retains concurrent authority for certain data breach violations. The CPPA also has rulemaking authority, which makes California's privacy law more dynamic than other state laws: rules can be updated without going through the legislature.

**3. What is sensitive personal information (SPI) and what new rights does it generate?**
The CPRA created the sensitive personal information (SPI) category, which includes: precise geolocation, financial account data combined with credentials, private communications, genetic data, biometric data, health data, sex life or sexual orientation, racial or ethnic origin, religious beliefs, and union membership. Consumers have the right to limit use of this information to essential purposes (providing the requested service, security, legal compliance). Businesses must provide a separate "Limit the Use of My Sensitive Personal Information" link on the homepage.

**4. What changes for cookies and digital advertising under the CPRA?**
The CPRA expanded the concept of "sale" to include "sharing," which covers disclosure of personal information for cross-context behavioral advertising even without direct payment. This means advertising pixels like the Meta Pixel and Google Ads that send behavioral data to external advertising networks may constitute "sharing" under the CPRA, even if the business receives no money directly for that specific sharing. The GPC is recognized as a valid form of opt-out from selling and sharing.

**5. What is the penalty for CPRA non-compliance and is there a private right of action?**
The CPPA can seek penalties of up to US$ 2,500 per unintentional violation and up to US$ 7,500 per intentional violation. Violations involving data of consumers under 16 generate automatic penalties of up to US$ 7,500 per violation without needing to prove intent. The CPRA preserves the private right of action for data security breaches resulting in unauthorized access to specified categories of personal information. Consumers can sue directly for damages of US$ 100 to US$ 750 per consumer per incident, or actual damages, whichever is greater. Class actions are permitted.

[Ready to bring your website into compliance with the California CPRA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


California CPRA and Cookies: All you need to know

The Iowa Consumer Data Protection Act (ICDPA, Iowa Code § 715D) has the longest DSAR deadlines of all US state privacy laws.

This page covers one piece of the picture. For the full scope of the ICDPA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the ICDPA and cookies](https://goadopt.io/en/blog/iowa-icdpa-and-cookies-all-you-need-to-know/).

**90 days** to respond to a request. **+45 days** possible extension. **60 days** to respond to an appeal. **90 days** guaranteed cure period before any AG action.

For businesses that have already structured portals for the VCDPA, OCPA, or CTDPA with 45-day deadlines, the ICDPA requires a process with lower throughput capacity, which may seem operationally easier. But the covered rights are also more limited: no right to correct data, no opt-out of profiling, and deletion limited to data provided by the consumer.

This article covers everything you need to know.

## What is a DSAR under the ICDPA?

DSAR stands for Data Subject Access Request. It is any formal request from an Iowa resident to exercise the rights the ICDPA guarantees over their own data.

Under § 715D.3(1), consumers exercise their rights by submitting a request to the controller, using the means specified by the controller in the privacy notice.

## What are consumer rights under the ICDPA?

Under § 715D.3(1), Iowa residents have four rights:

### 1. Confirm and access

The consumer may confirm whether the controller is processing their personal data and access that data (§ 715D.3(1)(a)).

### 2. Deletion

The consumer may request deletion of personal data they provided to the controller (§ 715D.3(1)(b)).

**Limited scope:** like the UCPA, the ICDPA limits the deletion right to data the consumer provided. Data obtained from third parties, data brokers, external lists, and derived data do not need to be deleted under the ICDPA.

This differs from laws like the OCPA and CTDPA, which require deletion of data from any source.

### 3. Portability

The consumer may obtain a copy of the data in a portable and, where technically practicable, readily usable format, for transmission to another controller without impediment, where processing is carried out by automated means (§ 715D.3(1)(c)).

Scope is also limited to data the consumer provided to the controller.

### 4. Opt-out from data sales

The consumer may refuse the sale of personal data (§ 715D.3(1)(d)).

**Important:** although opt-out from targeted advertising is not listed as a formal right in § 715D.3, § 715D.4(6) requires the controller to offer an opt-out from targeted advertising as part of its transparency obligations. In practice, the Privacy Portal must accept opt-out requests for targeted advertising as well.

### What the ICDPA does not have

No right to correct inaccurate data (same as UCPA).

No formal opt-out of profiling.

Deletion limited to data provided by the consumer.

## Deadlines: the longest of all state privacy laws

Under § 715D.3(2):

**90 days** to respond from receipt of the request (§ 715D.3(2)(a)).

Extension of **+45 days** when reasonably necessary due to complexity or volume, with notification within the initial period.

If the controller suspects fraud, it may simply state that it was unable to authenticate, without detailing the reason (§ 715D.3(2)(b)).

**Free service: 2 times per year** per consumer (§ 715D.3(2)(c)). From the third request in the same 12-month period, the controller may charge a reasonable fee or refuse if the request is manifestly unfounded, excessive, repetitive, technically infeasible, or if the primary purpose is not to exercise a right. The burden of demonstrating the excessive nature is on the controller.

## The appeal process: 60 days

Under § 715D.3(3), the controller must establish an appeal process. It must be conspicuously available and similar to the original submission process.

Within **60 days** of receiving an appeal, the controller must inform the consumer in writing of any action taken or not taken, with a written explanation of the reasons.

If the appeal is denied, the controller must provide the consumer with an online mechanism to contact the Attorney General and submit a complaint (§ 715D.3(3)).

## Authentication

Under § 715D.3(2)(d), if the controller cannot authenticate the request using commercially reasonable efforts, it is not required to comply. It may request additional information reasonably necessary to authenticate.

In case of suspected fraud, the controller may simply inform that it was unable to authenticate, without needing to detail why it believes the request is fraudulent (§ 715D.3(2)(b)).

The ICDPA has no special authentication rule for opt-out requests, unlike the OCPA which prohibits requiring authentication for opt-out from targeted advertising.

## How the request submission channel must work

Under § 715D.4(7), the controller must establish secure and reliable means for request submissions, and describe them in the privacy notice.

These means must:

Consider how consumers normally interact with the controller.

Ensure secure and reliable communication.

Allow authentication of the consumer's identity.

The controller may not require the consumer to create a new account to exercise rights. It may require use of an existing account.

A well-structured Privacy Portal for the ICDPA includes:

A form with the four rights (confirm/access, deletion, portability, opt-out from sales), plus opt-out from targeted advertising per § 715D.4(6).

A proportionate identity verification process.

Receipt confirmation.

Record of the request and the response.

An appeal channel for denied requests.

The [site consent mechanism](https://goadopt.io/en/blog/operation-of-cookie-banner/) and the Privacy Portal must be integrated so that opt-out preferences are reflected in the business's operational systems.

## How to process each type of DSAR in practice

### Access and confirmation request

Receive and authenticate with commercially reasonable efforts.

Confirm whether the consumer's data is being processed.

Locate relevant personal data in systems.

Respond within 90 days.

### Deletion request

Receive and authenticate.

Identify which data the consumer directly provided.

Check for a legal exception.

Delete the identified data from systems.

**Note:** data the controller obtained from external sources does not need to be deleted under the ICDPA.

### Portability request

Receive and authenticate.

Identify data the consumer directly provided.

Prepare in portable, usable format.

Deliver to consumer within 90 days.

### Opt-out from data sales

Receive via the designated channel.

Authenticate.

Cease selling the consumer's data.

Inform consumer within 90 days.

### Opt-out from targeted advertising

Receive via the designated channel (obligation per § 715D.4(6)).

Authenticate.

Update tracking systems to cease targeted advertising.

Inform the consumer.

## What happens when the controller denies a request?

Under § 715D.3(2)(b), the controller that decides not to act must inform the consumer without undue delay with:

Justification for not taking action (except in case of suspected fraud, where it may simply state it was unable to authenticate).

Instructions on how to appeal the decision.

The appeal process must result in a written response within **60 days**. If the appeal is denied, the consumer must be informed of how to contact the Attorney General online.

## Protection of children

Under § 715D.3(1), the parents or legal guardians of known children (under 13) may exercise rights on the child's behalf.

For children's data, the business must comply with COPPA (§ 715D.2(2)(r) and 715D.4(2)), including verifiable parental consent.

## Protection against discrimination

Under § 715D.4(3), the business may not discriminate against consumers who exercise their rights. This includes denying goods or services, charging different prices, or offering different quality.

The exception is voluntary loyalty programs and situations where opt-out from targeted advertising justifies price adjustment.

## The 90-day cure period and DSARs

Before initiating any action, the AG must notify the controller and grant **90 days to cure** (§ 715D.8(2)).

Businesses without a structured DSAR process have more time to correct under the ICDPA than under other laws (VCDPA: 30 days, UCPA: 30 days, OCPA: eliminated). But the cure period is a guarantee, not a compliance strategy.

## How AdOpt helps with the Privacy Portal

AdOpt records every consent and opt-out interaction with a timestamp and unique identifier. When the consumer exercises opt-out from sales or targeted advertising, the system automatically updates the corresponding trackers.

AdOpt's auditable log serves as evidence of compliance for the Iowa Attorney General.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Privacy Portal for your site that complies with the ICDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what the Privacy Portal needs for the ICDPA

**Request submission channel** described in the privacy notice (§ 715D.4(7)).

**Coverage of the 4 rights**: confirm/access, deletion (data provided by consumer), portability, opt-out from data sales.

**Opt-out from targeted advertising** (transparency obligation, § 715D.4(6)).

**No requirement to create a new account** to exercise rights.

**90-day deadline** to respond (+45 ext. with notification) (§ 715D.3(2)(a)).

**Authentication with commercially reasonable efforts** (§ 715D.3(2)(d)).

**Free service for 2 requests** per year per consumer (§ 715D.3(2)(c)).

**Appeal process** conspicuously available (§ 715D.3(3)).

**60-day deadline** for appeal responses (§ 715D.3(3)).

**Online mechanism to contact AG** if appeal is denied (§ 715D.3(3)).

**Documented record** of each request, action taken, and response sent.

**Parents/guardians** may exercise rights for known children (§ 715D.3(1)).

**Protection against discrimination** (§ 715D.4(3)).

## Comparative: Privacy Portal deadlines under the ICDPA

| Request type | Response deadline | Extension possible |
|---|---|---|
| Access, deletion, portability | 90 days | +45 days with notification |
| Opt-out from data sales | 90 days | +45 days with notification |
| Appeal | 60 days | Not specified |
| Cure period for violations | 90 days guaranteed | No extension |

## FAQ: ICDPA and Privacy Portal

**1. Why is the ICDPA's 90-day deadline the longest of all US state privacy laws?**
The ICDPA was passed by Iowa's legislature with a focus on reducing operational burden for businesses. § 715D.3(2)(a) explicitly establishes 90 days as the standard deadline. Businesses operating across multiple jurisdictions will still need to process requests within the shorter deadlines of other laws, which makes the ICDPA's 90-day period more of a legal ceiling than an operational target.

**2. Can consumers formally invoke opt-out from targeted advertising as a right under the ICDPA?**
Not as a formally listed right in § 715D.3. Formal opt-out rights cover only data sales in § 715D.3(1)(d). However, § 715D.4(6) requires that if the controller engages in targeted advertising, it must disclose this and describe the opt-out method. In practice, the Privacy Portal must accept and process these requests as part of transparency obligations, even though the legal basis differs from the opt-out from data sales.

**3. Why is the ICDPA deletion right more limited than the OCPA's?**
§ 715D.3(1)(b) limits deletion to data "personal data provided by the consumer to the controller." This excludes third-party data, inferred data, and derived data. The OCPA requires deletion of data provided by the consumer, obtained from other sources, and derived data. Under the ICDPA, a business that purchased data from a data broker does not need to delete that data upon the consumer's deletion request.

**4. How does the ICDPA appeal timeline compare to other state laws?**
The ICDPA's 60-day appeal deadline (§ 715D.3(3)) matches Virginia's VCDPA and Connecticut's CTDPA, both with 60 days. Oregon's OCPA sets 45 days for appeals. Utah's UCPA has no formal structured appeal process. In terms of timeline, the ICDPA is aligned with the more traditional eastern US state laws.

**5. What happens if the controller has no structured DSAR process when the Attorney General investigates?**
The AG notifies the controller and grants 90 days to cure (§ 715D.8(2)). If the controller cures the violation and provides an express written statement, no action is initiated. If not cured or if the statement is breached, the AG may seek penalties of up to US$ 7,500 per violation (§ 715D.8(3)). There is no private right of action (§ 715D.8(4)).

[Ready to build a Privacy Portal for your site that complies with the ICDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


IOWA ICDPA: DSAR and Privacy Portal

The Utah Consumer Privacy Act (UCPA, Utah Code § 13-61-101) has the simplest DSAR process among current US state privacy laws.

This page covers one piece of the picture. For the full scope of the UCPA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the UCPA and cookies](https://goadopt.io/en/blog/utah-ucpa-and-cookies-all-you-need-to-know/).

Four rights. No formal appeal process. No special authentication distinction for opt-out requests. And the response deadline is the same for all: 45 days.

But there are particularities worth attention: the deletion right is more restricted than in other laws, and the UCPA has specific rules about fee charging and fraud protection in requests.

This article covers everything.

## What is a DSAR under the UCPA?

DSAR stands for Data Subject Access Request. It is any formal request from a Utah resident to exercise the rights the UCPA guarantees over their own data.

Under Utah Code § 13-61-202(1), consumers exercise their rights by submitting a request to the controller, using the means prescribed by the controller, specifying which right they intend to exercise.

If you already know the [LGPD data subject portal](https://goadopt.io/en/blog/lgpd-cookies-all-you-need-to-know/), the structure is familiar, but simplified. The UCPA has no formal appeal process and the scope of some rights is more limited.

## What are consumer rights under the UCPA?

Under Utah Code § 13-61-201, Utah residents have four rights:

### 1. Right to confirm and access

The consumer may confirm whether the controller is processing their personal data and access that data (§ 13-61-201(1)).

The response must be provided in an accessible format within 45 days.

### 2. Right to deletion

The consumer may request deletion of personal data they provided to the controller (§ 13-61-201(2)).

**Note on the limited scope:** the UCPA limits the deletion right to data the consumer **provided** to the controller. Data the controller obtained from other sources, such as data brokers, third-party lists, or inferences created from other data, do not need to be deleted under the UCPA.

This is substantially different from laws like the OCPA and CTDPA, which require deletion of data obtained from any source, including derived data.

### 3. Right to portability

The consumer may obtain a copy of the personal data they provided to the controller, in a portable format where technically feasible and practicable, for transmission to another controller without impediment, when processing is carried out by automated means (§ 13-61-201(3)).

The scope is also limited to data the consumer provided, not all data the controller holds about the consumer.

### 4. Right to opt-out

The consumer may refuse processing of their personal data for targeted advertising or sale of personal data (§ 13-61-201(4)).

**What the UCPA does not include in opt-out:** profiling. The UCPA does not guarantee opt-out of profiling for decisions with legal or significant effects, unlike the OCPA, VCDPA, and CTDPA. The opt-out covers only targeted advertising and data sales.

## What the UCPA does not have: absent rights compared to other laws

For businesses already processing DSARs for other jurisdictions, it is worth noting what the UCPA does not provide:

**No right to correct.** The UCPA does not guarantee the right to correct inaccurate data. Laws like the CPRA, OCPA, VCDPA, and CTDPA all include this right.

**No formal structured appeal process.** When the controller denies a request, the UCPA does not require a structured appeal process. The consumer may file a complaint with the Division of Consumer Protection.

**No opt-out of profiling.** The UCPA covers only targeted advertising and data sales in the opt-out, excluding profiling for decisions with legal effects.

**Deletion limited to data provided by the consumer.** Third-party data and derived data do not need to be deleted.

## What are the response deadlines?

Under Utah Code § 13-61-203:

**45 days** to respond from receipt of the request (§ 13-61-203(2)(a)).

Extension of **+45 days** when reasonably necessary due to complexity or volume, with notification before the initial period expires (§ 13-61-203(2)(b)(c)).

If the controller reasonably suspects the request is fraudulent and cannot authenticate before the deadline expires, the 45-day period does not apply until authentication is completed (§ 13-61-203(2)(d)).

**Free for the first request** from each consumer per 12-month period (§ 13-61-203(4)(a)).

## When the business may charge a fee or refuse

Utah Code § 13-61-203(4)(b) allows the controller to charge a reasonable fee or refuse to act if the request:

Is excessive, repetitive, technically infeasible, or manifestly unfounded.

The controller reasonably believes the primary purpose in submitting the request is something other than exercising a right.

The request, individually or as part of an organized effort, harasses, disrupts, or imposes undue burden on the business's resources.

The controller that charges a fee or refuses to act based on these criteria bears the burden of demonstrating that the request satisfies one or more of the listed criteria.

## Authentication: no special rule for opt-out

One important difference from the OCPA: the UCPA has no special authentication rule for opt-out requests. Under § 13-61-203(5), if the controller cannot authenticate the request using commercially reasonable efforts, it is not required to comply, but may request additional information reasonably necessary to authenticate.

This rule applies equally to all types of requests, including opt-out. This differs from the OCPA, which prohibits requiring authentication for opt-out from targeted advertising.

## How the request submission channel must work

Under Utah Code § 13-61-203(1) and 302(1)(a)(iii), the controller must establish means by which consumers can submit requests, and describe those means in the privacy notice.

The controller cannot require the consumer to create a new account solely to exercise a right. The law allows use of an existing account (§ 13-61-202(1) refers to using "means prescribed by the controller").

A well-structured Privacy Portal for the UCPA includes:

A form with the four rights categories.

A proportionate identity verification process.

Receipt confirmation.

Record of the request, action taken, and response sent.

The [site consent mechanism](https://goadopt.io/en/blog/operation-of-cookie-banner/) and the Privacy Portal must be integrated so that opt-out preferences are reflected in the business's operational systems.

## Protection of children

Under Utah Code § 13-61-202(2), in the case of processing personal data of a known child, the parent or legal guardian must exercise rights on the child's behalf.

Under § 13-61-202(3), in the case of processing data of a consumer subject to guardianship, conservatorship, or other protective arrangement, the guardian or conservator exercises rights on the consumer's behalf.

For data of known children, the business must comply with COPPA (§ 13-61-102(3)), including verifiable parental consent before any data collection.

## What happens when the controller denies a request?

Under Utah Code § 13-61-203(3), a controller that decides not to act on a consumer's request must inform the consumer within 45 days, with the reasons for not taking action.

The UCPA does not describe a formal appeal process. There is no specific appeal deadline, nor an obligation to inform about how to contact the regulator in case of denial.

The consumer may file a complaint with the Division of Consumer Protection, which may investigate and, if it finds substantial evidence of violation, refer to the Attorney General.

## How to process each type of DSAR in practice

### Access and confirmation request

Receive and authenticate with commercially reasonable efforts.

Confirm whether the consumer's data is being processed.

Locate the consumer's personal data in relevant systems.

Prepare response in an accessible format within 45 days.

### Deletion request

Receive and authenticate.

Identify which data the consumer directly provided.

Check for a legal exception justifying retention.

Delete the identified data from relevant systems.

**Important note:** data the controller obtained from sources other than the consumer themselves (data brokers, third-party lists, derived data) does not need to be deleted under the UCPA.

### Portability request

Receive and authenticate.

Identify which data the consumer directly provided.

Prepare response in a portable, usable format.

Deliver to consumer within 45 days.

### Opt-out from targeted advertising and data sales

Receive request via the designated channel.

Authenticate with commercially reasonable efforts.

Cease processing for the indicated purposes.

Update corresponding tracking systems.

Inform the consumer within 45 days.

## Protection against discrimination

Utah Code § 13-61-302(4) prohibits discriminating against consumers who exercise their rights, including denying goods or services, charging different prices, or offering different quality.

The exception is voluntary loyalty programs and situations where the consumer opted out of targeted advertising and the business adjusted pricing accordingly, provided the price difference is reasonably related to the value the data provides the business.

## Documentation and records

Each processed request must be documented. This includes:

Date and time of receipt.

Type of right exercised.

Authentication process conducted.

Action taken.

Date and form of response to the consumer.

If denied: justification recorded.

This documentation is what protects the business when the Division of Consumer Protection investigates complaints or when the case is referred to the Attorney General.

## The cure period and DSARs

Before initiating any action, the Attorney General must notify the controller and grant **30 days to cure** (§ 13-61-402(3)). This deadline is guaranteed permanently.

Businesses without a structured DSAR process find it difficult to implement in 30 days what should have been in place from the start. The cure period is a guarantee, not a compliance strategy.

## How AdOpt helps with the Privacy Portal

AdOpt records every consent and opt-out interaction with a timestamp and unique identifier. When the consumer exercises opt-out from targeted advertising, the system automatically updates the corresponding trackers.

AdOpt's auditable log serves as evidence of compliance for the Division of Consumer Protection and the Attorney General. And when the law changes, the platform updates automatically.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Privacy Portal for your site that complies with the UCPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what the Privacy Portal needs for the UCPA

**Request submission channel** described in the privacy notice (§ 13-61-302(1)(a)(iii)).

**Coverage of the 4 rights**: confirm/access, deletion (data provided by consumer), portability, opt-out from targeted advertising and data sales.

**No requirement to create a new account** to exercise rights.

**45-day deadline** to respond (+45 ext. with notification) (§ 13-61-203(2)).

**Authentication with commercially reasonable efforts** for all request types (§ 13-61-203(5)).

**Free service** for the first request per 12-month period (§ 13-61-203(4)(a)).

**Documented record** of each request, action taken, and response sent.

**Child protection**: parents/guardians exercise rights for known children (§ 13-61-202(2)).

**COPPA compliance** for data of children under 13 (§ 13-61-102(3)).

**Protection against discrimination** for consumers exercising rights (§ 13-61-302(4)).

## Comparative: Privacy Portal deadlines under the UCPA

| Request type | Response deadline | Extension possible |
|---|---|---|
| Access, deletion, portability | 45 days | +45 days with notification |
| Opt-out (targeted advertising and data sales) | 45 days | +45 days with notification |
| Appeal of denial | Not structured by the UCPA | N/A |
| Cure period for violations | 30 days guaranteed | No extension |

## FAQ: UCPA and Privacy Portal

**1. Why is the UCPA deletion right more restricted than in other state laws?**
Utah Code § 13-61-201(2) limits the deletion right to "personal data the consumer provided to the controller." This excludes data the controller obtained from third parties, data inferred or derived from other data, and data obtained from sources other than the consumer themselves. In contrast, laws like the OCPA and CTDPA require deletion of data from any source. The UCPA reflects the Utah legislature's philosophy of protecting consumers without creating excessively burdensome obligations for businesses.

**2. Does the UCPA have a formal appeal process when the controller denies a request?**
No. Unlike the OCPA (45 days for appeal), CTDPA (60 days), and VCDPA (60 days), the UCPA does not define a structured appeal process. When the controller denies a request, it must inform the consumer of the reasons within 45 days (§ 13-61-203(3)). The consumer may then file a complaint with the Division of Consumer Protection, which may investigate and refer to the Attorney General if it finds substantial evidence of violation.

**3. Does the UCPA require opt-out of profiling?**
No. The UCPA's opt-out right covers only targeted advertising and data sales (§ 13-61-201(4)). Laws like the VCDPA, OCPA, and CTDPA include opt-out of profiling for decisions with legal or significant effects. The UCPA is the only one among the major US state laws that does not include this right.

**4. Does the Privacy Portal need a separate opt-out process from other rights?**
Not in any special way. Unlike the OCPA, which prohibits requiring authentication for opt-out, the UCPA uses the same "commercially reasonable efforts" authentication standard for all request types (§ 13-61-203(5)). The opt-out does not need a separate or simpler authentication flow than access or deletion.

**5. What happens if the controller suspects a request is fraudulent?**
Utah Code § 13-61-203(2)(d) establishes that the 45-day deadline does not apply if the controller reasonably suspects the request is fraudulent and cannot authenticate before the deadline expires. The controller may request additional information for authentication (§ 13-61-203(5)(b)). If the fraud suspicion is reasonable and documented, the controller may charge a fee or refuse to act, bearing the burden of demonstrating the fraudulent nature.

[Ready to build a Privacy Portal for your site that complies with the UCPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


Utah UCPA: DSAR and Privacy Portal

Montana MTCDPA: Privacy Policy

## New Hampshire NHDPA: DSAR and the Privacy Portal

You collect data from New Hampshire consumers. But when one of those people asks to know what you have on them, what happens?

This page covers one piece of the picture. For the full scope of the NHDPA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the NHDPA and cookies](https://goadopt.io/en/blog/new-hampshire-nhdpa-and-cookies-all-you-need-to-know/).

That question leaves a lot of businesses without an answer. And the New Hampshire Data Privacy Act (NHDPA, RSA 507-H), in effect since January 1, 2025, does not accept silence as a response.

The law guarantees clear and concrete rights to state consumers. And for each of those rights, there is a corresponding obligation on your side. This article covers all of it: what a DSAR is, what rights the NHDPA guarantees, how to process each type of request, which deadlines to apply, and what happens when something goes wrong.

## What is a DSAR?

DSAR stands for Data Subject Access Request. In practice, it is any formal request made by a consumer to exercise the rights the law grants them over their own data.

This includes asking to see what you collected, correcting incorrect information, requesting deletion of their data, asking for a portable copy, refusing the use of their data for advertising purposes, or contesting a decision your business made about a previous request.

If you are already familiar with the [GDPR](https://goadopt.io/en/blog/gdpr-cookies-explained/), the DSAR framework will feel quite familiar. The NHDPA follows the same logic: the data subject needs a functional channel to exercise the rights the law guarantees.

The Privacy Portal is the digital interface that centralizes this process.

## What are consumer rights under the NHDPA?

Under RSA 507-H:4, residents of New Hampshire have six main rights:

### Right to access and confirmation

The consumer can request confirmation that the business processes their data and obtain a copy of the personal data the business holds about them, under RSA 507-H:4, I, a.

The copy must be in a readable format. If processing is carried out by electronic means, the format must also be portable.

### Right to correction

The consumer can request correction of inaccurate personal data, taking into account the nature and purpose of the processing, under RSA 507-H:4, I, b.

This includes any outdated, incomplete, or incorrect data. The business cannot ignore this request by claiming the data is old or was already used for a specific purpose.

### Right to deletion

The consumer can request the deletion of personal data they provided or that was collected about them, under RSA 507-H:4, I, c.

There are exceptions. The business may refuse if processing is necessary to comply with a legal obligation, for defense in legal proceedings, or for purposes expressly protected by law. But the refusal must be justified.

### Right to portability

The consumer can obtain a copy of their data in a portable and machine-readable format when processing is carried out by automated means, under RSA 507-H:4, I, d. This makes it easier to transfer the data to another service.

### Right to opt-out

The consumer can refuse the processing of their data for three specific purposes (RSA 507-H:4, I, e):

Targeted advertising.

Sale of personal data to third parties.

Profiling with legal or similarly significant effects on the consumer.

The opt-out for targeted advertising and data sale must be accessible via a clear and conspicuous link on the site, as required by RSA 507-H:6, V, a, 1. The business cannot create obstacles to the consumer exercising this right.

### Right to appeal

If the business denies a request, the consumer has the right to appeal the decision, under RSA 507-H:4, II. The business must provide an appeals process that is convenient and comparable to the original submission mechanism.

The deadline to respond to appeals is **60 days**, under RSA 507-H:4, II, b.

If the appeal is also denied, the business must inform the consumer how they can file a complaint with the New Hampshire Attorney General.

## What are the response deadlines?

The NHDPA is clear on deadlines and there is little room for interpretation.

**45 days** from the receipt of an authenticated request to respond (RSA 507-H:4, III, a).

The deadline can be extended by another **45 days** in cases of high volume or complexity, as long as the consumer is notified within the initial period with the reason for the extension (RSA 507-H:4, III, a).

**60 days** to respond to appeals (RSA 507-H:4, II, b).

These deadlines begin when the request is received and authenticated. If the business requests additional information to verify the identity of the requester, the deadline is paused until that verification is completed, provided the request for information is reasonable and proportionate.

### What counts as "receipt" of a request?

For deadline purposes, receipt of the request occurs when the business has the information necessary to identify the consumer and process the request.

If the identity verification process is still pending, the deadline starts only after confirmation. This is why the [verification process](https://goadopt.io/en/blog/consent-website-lgpd/) must be agile and proportionate to the type of data involved.

## What should the request submission channel look like?

Under RSA 507-H:6, V, the controller must make available at least one secure and reliable mechanism for consumers to submit requests to exercise their rights.

This mechanism must meet two fundamental requirements:

It cannot require the consumer to create a new account to exercise the rights guaranteed by law (RSA 507-H:6, V, b).

It must include a clear and conspicuous link to a page where the consumer can specifically exercise the opt-out of targeted advertising and data sale (RSA 507-H:6, V, a, 1).

A well-structured Privacy Portal offers:

A request submission form with clear categories (access, correction, deletion, portability, opt-out).

A proportionate and non-discriminatory identity verification process.

Automatic receipt confirmation with a tracking reference number.

A log of each request and response for audit purposes.

An appeal channel for denied cases.

The [cookie consent on the site](https://goadopt.io/en/blog/operation-of-cookie-banner/) and the Privacy Portal must be integrated so that consumer preferences are reflected in real time in the company's systems.

## Identity verification: how to do it without creating barriers

The business needs to verify that whoever is submitting the request is actually the data subject. But this process cannot be a barrier.

The NHDPA does not specify a single verification method, but the general standard is that verification must be proportionate to the sensitivity of the data involved and the risk of harm to the consumer.

In practice, this means:

For low-risk data: an email confirmation may be sufficient.

For sensitive data or high-risk harm scenarios: a second verification factor may be necessary.

What is never acceptable: requiring documents that go beyond what is reasonable to verify identity, such as physical ID documents for access to simple browsing data.

The business also cannot require the creation of a new account, the use of third-party platforms unrelated to the original service, or the provision of more personal data than necessary for identification.

## Fees: what the law says

Under RSA 507-H:4, III, c, request processing is free of charge once per year per consumer.

From the second request within the same 12-month period, the business may charge a reasonable fee or decline processing if the request is manifestly unfounded, excessive, or repetitive.

But the burden of proof is on the business. In other words, if you want to charge or refuse, you must be able to demonstrate that the request is in fact excessive. A subjective assessment is not enough.

## How to process each type of DSAR in practice

Each type of request has a specific workflow. Here is how to process each one.

### Access request

Receive the request and authenticate the data subject.

Locate all personal data the business holds about this consumer across its systems.

Prepare a copy in a readable format.

Include in the response: categories of data, purposes of processing, third parties with whom the data was shared, and retention period.

Send the response within the 45-day deadline.

An up-to-date [data mapping](https://goadopt.io/en/blog/data-mapping-or-data-inventory/) exercise is what makes this process viable. Without a clear inventory of where data lives, the search becomes manual and error-prone.

### Correction request

Receive and authenticate.

Identify which data is inaccurate and where it is stored.

Correct the data in primary systems and, where applicable, notify third parties that received the data so they can also make the correction on their side.

Confirm to the data subject that the correction was made.

### Deletion request

Receive and authenticate.

Check whether a legal exception exists that allows retaining the data (legal obligation, judicial defense, purpose protected by law).

If no exception exists: delete the data from all systems where it is stored, including backups where technically feasible.

Notify third parties that received the data to also delete it where applicable.

Confirm to the data subject with details of what was deleted and, if anything was retained, the legal justification.

### Portability request

Receive and authenticate.

Generate a file with the data subject's data in a portable, machine-readable format (such as JSON or CSV).

Deliver it to the data subject securely within the deadline.

### Opt-out request

This is the most urgent of all. When the consumer exercises the opt-out of targeted advertising, data sale, or profiling with significant effects, the systems must be updated immediately.

And there is a specific deadline for this: under RSA 507-H:6, I, f, after consent is revoked, the business has a maximum of **15 days** to cease processing.

This means that CRM systems, email marketing platforms, advertising pixels, and analytics tools must be configured to accept and process this command within 15 days. It is not optional.

A [consent management platform](https://goadopt.io/en/blog/how-to-choose-cmp-consent-management-platform/) integrated with the company's systems automates a large part of this workflow.

## What happens when the business denies a request?

The business may deny a request when:

It cannot verify the identity of the data subject.

The request is manifestly unfounded or excessive.

Processing is necessary for a legal or contractual reason that prevails over the right to deletion.

In all cases, the denial must be communicated to the data subject within the 45-day deadline. The communication must:

State the reason for the denial clearly.

Explain how the data subject can appeal the decision.

Indicate the available appeal process.

The appeal process must be accessible and practical. The business has 60 days to respond to the appeal (RSA 507-H:4, II, b). If the appeal is also denied, the data subject must be informed that they can file a complaint with the Attorney General.

## Protection against discrimination

The NHDPA expressly prohibits businesses from discriminating against consumers who exercise the rights guaranteed by law (RSA 507-H:6, II).

This means the business cannot:

Deny products or services to a consumer who exercised the opt-out.

Charge different prices because a right was exercised.

Offer lower quality service as retaliation for a request.

There is a specific exception: loyalty programs or benefits that offer value in exchange for the use of data are permitted, as long as the benefits are reasonably related to the value the data represents to the business.

## Special protection for teenagers between 13 and 15 years old

RSA 507-H:6, I, g brings an additional protection that directly impacts the Privacy Portal: when the business has actual knowledge that a consumer is between 13 and 15 years old, it cannot process that person's data for targeted advertising or sell it without explicit consent.

If your portal receives requests from users in this age range, the process must have a differentiated flow to ensure that this consent exists or does not exist, as the case may be.

## Documentation and records

Every processed request must be documented. This includes:

Date and time of receipt.

Type of request.

Identity verification process performed.

Action taken.

Date and form of response to the data subject.

In case of denial: recorded justification.

In case of appeal: the full appeal history and decision.

This documentation is what protects the business in the event of an Attorney General investigation. Without records, there is no way to prove that the process was completed within the required deadlines.

A [Records of Processing Activities (ROPA)](https://goadopt.io/en/blog/ropa-for-lgpd/) document that is kept up to date is the central element of this audit trail.

## The shift in enforcement from 2026

In 2025, before initiating a lawsuit, the Attorney General was required to notify the business and give 60 days to correct any violation (RSA 507-H:11, II). From 2026 onward, this cure period became discretionary (RSA 507-H:11, III).

This directly impacts the Privacy Portal: a business without a structured process to handle DSARs may face direct enforcement action, with no guaranteed time to correct.

Violations are treated under RSA 358-A:2 (Consumer Protection Act), with reference penalties of up to US$ 10,000 per violation.

## How AdOpt helps with the Privacy Portal

AdOpt logs every consent and revocation interaction with a timestamp and unique identifier. When the consumer revokes consent through the Privacy Portal, the system automatically updates cookie and tracker triggers within the 15-day deadline required by the NHDPA.

AdOpt's auditable log serves as evidence that the process was completed as required by law. And when legislation changes, the platform updates automatically.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Privacy Portal for your site that complies with the NHDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what the Privacy Portal needs for the NHDPA

**Request submission channel** without requiring creation of a new account (RSA 507-H:6, V, b).

**Coverage of all 6 rights** guaranteed by the NHDPA: access, correction, deletion, portability, opt-out, and appeal.

**Conspicuous opt-out link** for targeted advertising and data sale (RSA 507-H:6, V, a, 1).

**45-day response deadline**, with the option to extend by another 45 days with notification (RSA 507-H:4, III, a).

**60-day deadline** to respond to appeals (RSA 507-H:4, II, b).

**Proportionate and non-discriminatory identity verification** process.

**Free response once per year** per consumer (RSA 507-H:4, III, c).

**Cessation of processing within 15 days** after consent revocation (RSA 507-H:6, I, f).

**Documented record** of each request, action taken, and response sent.

**Accessible appeals process** with information on how to file a complaint with the Attorney General in case of a second denial.

**Non-discrimination protection** for consumers exercising their rights (RSA 507-H:6, II).

**Differentiated treatment** for consumers aged 13 to 15 (RSA 507-H:6, I, g).

**Notification to third parties** where applicable for deletion or correction of shared data.

## Comparison: Privacy Portal deadlines under the NHDPA

| Request type | Response deadline | Extension possible |
|---|---|---|
| Access, correction, deletion, portability | 45 days | +45 days with notification |
| Opt-out (advertising, sale, profiling) | 45 days | +45 days with notification |
| Cessation after consent revocation | 15 days | No extension |
| Appeal of a decision | 60 days | Not specified |

Other US states with similar laws, such as the [Texas TDPSA](https://goadopt.io/en/blog/texas-tdpsa-and-cookies-all-you-need-to-know/) and the [Tennessee TIPA](https://goadopt.io/en/blog/tennessee-tipa-and-cookies-all-you-need-to-know/), follow similar structures with variations in deadlines and application criteria.

## FAQ: NHDPA and Privacy Portal

**1. Does the NHDPA require a dedicated Privacy Portal?**
Not by name. RSA 507-H:6, V requires the controller to make available at least one secure and reliable mechanism for submitting requests. A dedicated Privacy Portal is the most organized way to meet this requirement, but a well-structured contact form or an active, monitored email address can also fulfill the obligation, as long as all legal criteria are met.

**2. What is the deadline to process a targeted advertising opt-out?**
There are two separate deadlines that must be observed. The general response deadline is 45 days from authenticated receipt, under RSA 507-H:4, III, a. But the deadline for actual cessation of processing after consent revocation is 15 days, under RSA 507-H:6, I, f. Both deadlines run simultaneously and must be met independently.

**3. Can the business charge a fee for processing a DSAR?**
Processing is free once per year per consumer, under RSA 507-H:4, III, c. From the second request within the same 12-month period, the business may charge a reasonable fee or decline if the request is manifestly unfounded, excessive, or repetitive. The burden of proving the excessive nature lies with the business.

**4. What happens if the business denies a request without adequate justification?**
The consumer can appeal the decision within 60 days, under RSA 507-H:4, II. If the appeal is denied, they can file a complaint with the New Hampshire Attorney General. From 2026 onward, the Attorney General can initiate direct action without guaranteeing a cure period for the business (RSA 507-H:11, III), with reference penalties of up to US$ 10,000 per violation under RSA 358-A:2.

**5. How should requests from teenagers aged 13 to 15 be handled?**
RSA 507-H:6, I, g requires special treatment for consumers in this age range. When the business has actual knowledge that the requester is between 13 and 15 years old, processing their data for targeted advertising and selling it without explicit consent are prohibited. The Privacy Portal must have a specific workflow to identify and handle these requests differently, ensuring that the additional restrictions are automatically applied.

With AdOpt, you're covered.

[Ready to build a Privacy Portal for your site that complies with the NHDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)



New Hampshire NHDPA: DSAR Privacy Portal

Tenesse TIPA: Cookies Policy

Connecticut CTDPA and Cookies: All You Need to Know

Colorado has a requirement that changes the equation for any site with users in the state.

This page covers one piece of the picture. For the full scope of the CPA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the CPA and cookies](https://goadopt.io/en/blog/colorado-cpa-and-cookies-all-you-need-to-know/).

From **July 1, 2024**, if your site processes personal data for targeted advertising or sells personal data, it must automatically detect and honor the **Universal Opt-Out Mechanism** (UOM). This includes the Global Privacy Control (GPC) and other mechanisms recognized by the Colorado Department of Law.

This is not optional. It is not a recommended best practice. It is a legal obligation under the Colorado Privacy Act (CPA, C.R.S. § 6-1-1301 et seq.), complemented by the Colorado Privacy Act Rules (4 CCR 904-3).

This article focuses exclusively on what the CPA and its regulations require from a Cookies Policy: what the document must contain, how consent and opt-out must work, and what the Universal Opt-Out Mechanism means for each tracker on your site.

## Cookies Policy vs. cookie banner: the necessary distinction

The [cookie banner](https://goadopt.io/en/blog/how-to-choose-a-cookie-banner-for-your-website/) is the visual interface. It is what the visitor sees when they access the site and where they make choices.

The Cookies Policy is the detailed document. It is where the user finds complete information about every technology operating on the site.

Both need to exist. Both need to be aligned. And the Cookies Policy must be accessible from a link within the [consent notice](https://goadopt.io/en/blog/operation-of-cookie-banner/) itself.

## What the CPA specifically requires for cookies

### Specific purpose for each category

C.R.S. § 6-1-1308(1)(a)(II) requires the privacy notice to describe the purposes for which each category of data is processed. The regulations (4 CCR 904-3, Rule 6.06) require specificity.

For cookies, each category needs a purpose description the consumer can actually understand.

What does not work: "cookies to improve your experience." That is not a purpose.

What works: "Analytics cookies: collect browsing behavior data including pages visited, traffic source, and session duration. Used to identify content improvement opportunities. Data is processed by our internal systems and is not sold or used for targeted advertising."

"Advertising cookies: collect behavioral identifiers that are shared with advertising platforms for targeted advertising on other non-affiliated sites and applications. Include pixels from Meta Ads, Google Ads. Consumers may exercise opt-out through the link in our Privacy Policy or via Universal Opt-Out Mechanism."

### Cookie categories present on the site

The Policy must list tracker categories:

**Necessary cookies:** essential for basic functionality. Do not constitute targeted advertising or data sale. Must be documented.

**Analytics cookies:** depends on configuration. If data stays internal, generally does not constitute targeted advertising. If sent to third parties for targeting on other sites, it may.

**Advertising cookies:** almost always constitute targeted advertising under the CPA, which defines it as ads based on data "obtained or inferred over time from the consumer's activities across nonaffiliated websites, applications, or online services" (C.R.S. § 6-1-1303(25)(a)).

**Functional cookies:** remember preferences. Generally do not constitute targeted advertising or data sale.

**Third-party cookies:** fired by external services. [Correct tag categorization](https://goadopt.io/en/blog/difference-cookies-local-storage-session-storage/) is what makes it possible to document each one accurately.

### Targeted advertising: the CPA's definition

The CPA defines targeted advertising (C.R.S. § 6-1-1303(25)(a)) as displaying an advertisement selected based on personal data obtained or inferred over time from the consumer's activities across **nonaffiliated websites, applications, or online services**.

What does not constitute targeted advertising:

Advertising in response to a specific consumer request.

Advertisements based on activities within the controller's own websites or applications.

Advertisements based on the context of the current search query, website visit, or online application.

Processing personal data solely for measuring or reporting advertising performance, reach, or frequency.

### Sale of personal data

The CPA defines sale (C.R.S. § 6-1-1303(23)(a)) as the exchange of personal data for monetary or other valuable consideration from a controller to a third party.

The second threshold criterion of the CPA already signals this breadth: it includes "receiving a discount on the price of goods or services" from the sale of data. Agreements where the controller exchanges data for indirect economic benefits may constitute a sale.

### Who receives data via cookies

The notice must identify the categories of third parties receiving data via cookies (C.R.S. § 6-1-1308(1)(a)(V)), at a level of detail giving the consumer understanding of the type, business model of, or processing by those third parties (4 CCR 904-3, Rule 6.03(A)(1)(e)).

This means it is not enough to say "advertising partners." The notice should describe, for example: "digital advertising platforms that use the data for cross-context behavioral advertising," "data brokers," "analytics platforms that process browsing behavior data."

### The Universal Opt-Out Mechanism and cookies

This is the most important CPA requirement for the cookies context. From **July 1, 2024**, a controller that processes personal data for targeted advertising or sells data **must** accept opt-outs via UOM (C.R.S. § 6-1-1306(1)(a)(IV)(B)).

In practical terms for cookies: when a user visits the site with the GPC activated in their browser, the site must interpret that signal as an opt-out of targeted advertising and data sale, and automatically block the corresponding trackers.

The regulations (4 CCR 904-3, Rule 5.08(A)) detail:

After receiving a valid opt-out via UOM, the controller must continue treating the browser, device, and consumer as having exercised opt-out until the consumer consents again.

The controller cannot require the consumer to log in as a condition for recognizing the UOM.

The controller may display conspicuously when the opt-out signal has been honored (e.g., "Opt-Out Preference Signal Honored").

The Cookies Policy must describe how the UOM is processed and what happens when a consumer sends this signal.

### Retention period for each category

The duty of data minimization (C.R.S. § 6-1-1308(3)) and the regulations (4 CCR 904-3, Rule 6.07) require data to be kept only for as long as necessary for the specified purpose.

For cookies: document how long each cookie category stays active on the device and how long collected data stays in the business's systems. Biometric data and stored photographs must be reviewed at least once a year to verify the storage is still necessary (4 CCR 904-3, Rule 6.07(B)(2)).

## What constitutes valid consent for cookies under the CPA

C.R.S. § 6-1-1303(5) defines consent as a clear, affirmative act that is freely given, specific, informed, and unambiguous.

The correct standard: non-essential cookies off by default. The user chooses what to enable.

What is not valid consent: accepting general terms with data processing descriptions mixed with unrelated information, hovering over or closing content, and any agreement through dark patterns.

### Dark patterns: Colorado's detailed prohibition

Colorado's regulations have the most detailed description of dark patterns among all US state privacy laws (4 CCR 904-3, Rule 7.09). Prohibited:

Presenting consent choice options with unequal weight or focus ("accept" button larger, in a more prominent color, or more visible than "decline").

Emotionally manipulative language or visuals to steer choices (e.g., "Yes, I want to help endangered species" vs "No, I don't care about animals").

Silence or inaction interpreted as consent (closing a window is not consent).

Pre-selected default options.

A longer or more difficult path to exercise the more privacy-protective option than to accept.

Repeatedly interrupting the consumer experience to request consent after refusal.

Misleading language, double negatives, or confusing syntax in choice options.

## Protection for children's data via cookies

The CPA defines "child" as an individual under 13 years of age (C.R.S. § 6-1-1303(4)). Data from known children is sensitive data and requires parental consent before processing (C.R.S. § 6-1-1308(7)).

The regulations (4 CCR 904-3, Rule 7.06) detail verifiable parental consent methods, including: signed forms returned by mail or fax, financial transaction with account holder notification, toll-free telephone call with trained staff, or videoconference.

If the site may have users under 13, the Cookies Policy must describe how cookies are blocked for this audience.

## When to update the Cookies Policy

The regulations (4 CCR 904-3, Rule 6.04) require notifying consumers of material changes. For cookies, situations requiring an update:

Adding a new advertising pixel or third-party tracker.

New analytics tool.

New partner receiving behavioral data.

Change in the use of cookie data for new purposes.

Addition of a newly recognized UOM to the Colorado Department of Law's public list (which requires the site to begin recognizing it within 6 months).

Continuous [data mapping](https://goadopt.io/en/blog/what-is-privacy-by-design/) is what keeps the cookie inventory synchronized with the document.

## Enforcement: AG and District Attorneys

CPA violations are treated as deceptive trade practices by the **Attorney General** and **District Attorneys** of Colorado. There is no private right of action (C.R.S. § 6-1-1310).

The 60-day cure period was repealed on January 1, 2025. From 2025 onward, the AG and DAs may act without a guaranteed prior correction period.

## How AdOpt helps with the Cookies Policy under the CPA

AdOpt's automatic scan identifies all active technologies, feeding the list of categories that must appear in the Cookies Policy.

The [cookie notice](https://goadopt.io/en/blog/operation-of-cookie-banner/) configured through AdOpt blocks non-essential trackers before acceptance, automatically detects and honors the GPC and other UOMs, offers real choice options without dark patterns, and logs every interaction for 24 months.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Cookies Policy for your site that complies with the Colorado CPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what your Cookies Policy needs for the CPA

**Visible link** in the footer and within the cookie banner.

**Listing of cookie categories** with a specific description of each.

**Specific purpose for each category**, without vague descriptions.

**Indication of whether data is sold or used for targeted advertising** (4 CCR 904-3, Rule 6.03(A)(1)(c)).

**Categories of third parties** receiving data, with detail on type/business model.

**Clear and conspicuous opt-out method** within and outside the notice (4 CCR 904-3, Rule 4.03(B)).

**Universal Opt-Out Mechanism** recognized: description of how GPC and other UOMs are processed (mandatory since July 2024).

**Retention period** for each cookie category.

**Non-essential cookies disabled by default**, without dark patterns (4 CCR 904-3, Rule 7.09).

**Protection for children under 13** with tracker blocking without parental consent.

**Date of last update** of the document.

**Accessible language**, without legal jargon.

**No cookie walls**.

## FAQ: CPA and Cookies Policy

**1. What is the Universal Opt-Out Mechanism and why is it mandatory in Colorado?**
The UOM is a mechanism (like the GPC) that allows the consumer to automatically communicate their opt-out choice for targeted advertising and data sale to multiple controllers simultaneously. From July 2024, C.R.S. § 6-1-1306(1)(a)(IV)(B) made it mandatory for controllers processing data for targeted advertising or data sale to accept and honor these signals. Colorado was the first US state to require this by law.

**2. How should I configure the site to recognize the GPC as a UOM?**
The regulations (4 CCR 904-3, Rule 5.08) require that when a valid UOM signal is received, the controller must immediately cease processing for the indicated opt-out purposes. The controller cannot require login to recognize the signal, cannot collect data beyond what is strictly necessary to authenticate the consumer as a Colorado resident, and may display on screen when the signal has been honored. A consent management platform integrates this recognition automatically.

**3. What happens if the consumer sends the GPC and the site continues tracking for advertising?**
It is a direct violation of C.R.S. § 6-1-1306(1)(a)(IV)(B). The AG or District Attorney may investigate and, from 2025, act without a guaranteed cure period. The regulations (4 CCR 904-3, Rule 5.08(A)(2)) clarify that the controller must continue treating the browser and consumer as having exercised opt-out until the consumer voluntarily consents again.

**4. Do analytics cookies require opt-out under the CPA?**
It depends on how the data is used. If analytics data stays internal and is not sent to third parties for targeting on other sites, it generally does not constitute targeted advertising. But if the analytics tool sends data to the provider for use on other sites, it may. The CPA's criterion is "activities across nonaffiliated websites" (C.R.S. § 6-1-1303(25)(a)).

**5. How does Colorado's dark pattern prohibition apply to cookie banners?**
The regulations (4 CCR 904-3, Rule 7.09) are detailed: "accept" and "decline" buttons must have equal visual weight (size, color, position). The path to decline cannot be longer or more difficult. Pre-selected options are prohibited. Reappearing repeatedly after the consumer declines is prohibited. Cookie walls blocking content until acceptance may be prohibited if consent is not strictly necessary for the service.

[Ready to build a Cookies Policy for your site that complies with the Colorado CPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


Colorado CPA: Cookies Policy

In this article, you will have a great introduction to the topic, as well as various other variations that revolve around the subject: Cookies and [LGPD](https://goadopt.io/en/blog/lgpd-general-data-protection-law/).

We list concepts and examples of cookie types, how to classify them in your documentation, [Privacy Policy](https://goadopt.io/en/blog/what-is-a-privacy-policy/), [Legal Bases ](https://goadopt.io/en/blog/legal-bases-of-lgpd/)of LGPD, etc.

In effect since August 2020, the General Data Protection Law ([LGPD](https://goadopt.io/en/blog/lgpd-general-data-protection-law/)) will require a drastic change in the operations of companies that use data from their customers and users. Starting from August, data can only be used if it complies with the principles of LGPD - the so-called [Legal Bases of LGPD](https://goadopt.io/en/blog/legal-bases-of-lgpd/) - and is transparently and objectively consented to.

This will cause numerous websites to not only change their privacy policies and the information their cookies store but also various processes and ways of handling people's data. In this article, we will see how the use of cookies will be affected and how your company can continue to use them in a way that respects the law.

## What are cookies?

[Cookies](https://goadopt.io/en/blog/how-to-choose-a-cookie-banner-for-your-website/) are small text files that can store what the user is doing for a certain period. Some cookies store your browsing history, as well as logins and passwords. It is because of them that you can access your Facebook account without having to enter your email every time, as the browser (using cookies) does it for you.

In addition to various functional aspects, cookies also provide excellent service in well-known systems such as Google Drive, for example. Thanks to the cookie's ability to store information, we can work on our texts, spreadsheets, presentations, even offline, and when we reconnect, our work is not lost.

## There are two types of cookies:
**First-Party** and **Third-Party Cookies,** terms used to refer to cookies generated by the website owner or by third parties.

First-Party [Cookies](https://goadopt.io/en/blog/how-to-choose-a-cookie-banner-for-your-website/) are those generated by the website's own domain. From the website owner's perspective, they are the information that visitors generate during their browsing session.

- Which tabs you visited;
- If you searched for a product, added it to a list, and "forgot it in the shopping cart";
- If you filled out any forms, etc.

Many website builders or e-commerce services use cookies to provide these functionalities to their customers. So, don't be surprised if you see that your website triggers first-party cookies without notifying you. They have practically become a "market standard."

Regarding the cookie's storage capacity, this information is indeed "generated" by our browsing, and cookies are one way to store it. How does it work?

When the system generates a cookie, it has an identifier that stores the information in the company's database as well as in the visitor's browser. A very simple example is when we access a news portal and encounter the famous paywall message, "you have reached the limit of daily free articles, subscribe to our services."

How does it know that you have already read a specific article?
Simple, through the cookies it stores in your browser for each article read.
(Does this mean that if I clear my cookies or browse anonymously, I can read freely?... Wait, wait... do you think they haven't thought about that too? 😉)

On the other hand, Third-Party Cookies are cookies from third-party sources external to the website's domain. In other words, they are cookies from third-party companies that also set cookies to record information about their visitors.

Most of the time, these third-party cookies should (or at least should) all be authorized to be present. Otherwise, the website owner may be surprised by the number of entities "sucking" data from their site(s).

Here are some common examples of services that use cookies:

- Facebook Ads
- Google Ads
- Google Analytics
- Hotjar
- Cloudflare
- Mixpanel
- Zendesk
...

## How does LGPD affect the use of cookies?

5th Article 5 of the _Lei Geral de Proteção de Dados_ - [LGPD](https://goadopt.io/en/blog/lgpd-general-data-protection-law/) provides legal definitions of terms that you will come across frequently when researching the regulation. Among these definitions is that of personal data:

**"personal data: **information related to an identified or identifiable _natural person._"

We have the last two words in italic because they are the most important for the subject at hand.

Not all data that cookies carry is personal. For example, your visit to our website is not personal data. However, once you register your email on a site like Facebook, you are identifying yourself. Therefore, this is personal data that can be collected by a cookie.

And it is from there that the LGPD starts to affect how your data is used by websites and how your website handles user data.

The problem with the use of cookies arises when it is not known what data is being collected, for what purposes, and by whom. It is a matter of privacy and transparency, values that are the foundation of the LGPD.

The use of cookies that violates the LGPD will be penalized, and among the penalties are expensive fines.

## Who needs a cookie [policy](https://goadopt.io/en/blog/what-is-a-privacy-policy/)?

All websites that process data, specifically those that use First or [Third Party Cookies.](https://goadopt.io/en/blog/how-to-choose-a-cookie-banner-for-your-website/) If your website processes personal data or data that, when combined, can identify an individual person, it needs even more careful review of how this information is processed.

But, should this be listed in the Cookie [policy](https://goadopt.io/en/blog/what-is-a-privacy-policy/) or the Privacy Policy?

That depends on the company's choice to differentiate these aspects, as it may be a different approach based on the business model. Some companies address regulations for their "digital" data in the Cookie [policy](https://goadopt.io/en/blog/what-is-a-privacy-policy/) and the "offline" data in the Privacy Policy. However, it varies greatly, so we recommend consulting an expert who can analyze your business model and all the data flows and mappings of your company to understand the need for such differentiation.

## Cookie requirements: How to keep your website compliant with LGPD.

To ensure that a website is compliant with [LGPD](https://goadopt.io/en/blog/lgpd-general-data-protection-law/) when using [cookies](https://goadopt.io/en/blog/how-to-choose-a-cookie-banner-for-your-website/), there are certain principles to consider, especially if you have a valid "reason" or legal basis that supports the use of data and cookies on your site. For many, this legal basis is "Consent."

What does that mean?
In order for companies to process personal data of data subjects (individuals like you and me), they now need to have a strong legal basis provided by the law (LGPD). This "permission" is known as the Legal Bases of LGPD.

Therefore, while consent is not the only legal basis that allows companies to use data, it plays a crucial role when it comes to cookies. This is why [cookie banners](https://goadopt.io/en/blog/how-to-choose-a-cookie-banner-for-your-website/) serve an essential purpose: notifying and informing visitors, as well as correctly collecting and storing individual consents.

Regardless of the information carried by a cookie, it should have been consented to by the user. But what makes consent valid? And what should be communicated to the user?

The user must be clearly and objectively informed about the purpose for which their data will be collected. Additionally, they must give their explicit consent, or opt-in, by clicking on a banner.

To automate this process, [Cookie Notices or Cookie Banners ](https://goadopt.io/en/blog/how-to-choose-a-cookie-banner-for-your-website/)are used.
They serve to fulfill the sixth principle of the law: transparency.

## Cookie Banner or Cookie Notice
The [Cookie Banner ](https://goadopt.io/en/blog/how-to-choose-a-cookie-banner-for-your-website/)is that little pop-up window you can see on most websites nowadays, including when you entered our blog. This banner communicates that the site uses cookies. Ours says the following:

"Take control of your privacy. Our site uses cookies to enhance navigation." Then, there are two links: Privacy Policy and Terms of Use. Right after, there's a button for you to view your privacy options and an "accept" button, indicating that you agree to the use of your data.

The cookie banner, or cookie notice, which is a feature of the Consent Management Platform, serves to explicitly state the practice (use of cookies), the purpose (enhancing navigation), and offer users the possibility to fully or partially agree to the data processing.

This is what LGPD requires: transparency and objectivity, without complications.
In this way, the use of cookies is permitted and can greatly assist in your business operations.

## What is the expiration period of a cookie?

GDPR, the European data protection regulation, has a limit of twelve months for the use of a cookie. However, LGPD does not establish an "expiration" deadline.

But one of the principles for data processing is necessity. According to the regulation, data can only be retained for the time necessary to fulfill its purpose. If a cookie carries information that no longer needs to be used, it becomes invalid under the law.

Additionally, there are various initiatives by browsers—especially Apple's Safari, which automatically blocks third-party cookies. This "trend," as it is known in the market, has been widely discussed since 2015, even before GDPR. However, it is always being rethought or adapted because the entire advertising and analytics market relies heavily on the widespread use of cookies.

Thus, any changes in this regard will indeed be revolutionary and will bring many changes to the ecosystem as a whole.

## Cookies and [LGPD](https://goadopt.io/en/blog/lgpd-general-data-protection-law/) in the privacy policy.
It is important that your privacy policy includes a detailed and specific explanation of how your website uses cookies.

As described earlier, many companies make distinctions between the cookie policy and the privacy policy. This is not mandatory, but it may be necessary based on the business model. So, don't cling to templates, but strengthen transparency and accessibility for the information listed there.

## Cookie Pixel and Tag, what's the difference?
It is important to avoid confusion at this point, as many people end up mixing up these concepts. I'll provide a simple explanation below, which will help us understand the order of things and facilitate overall comprehension.

Remember: Tags and Pixels trigger Cookies.

- Tag & Pixel: Code that goes into the HTML of your website to call a specific service. These are scripts (programming codes) that call a server and perform specific functions based on these requests.

- Cookies: Text files read and triggered by Tags & Pixels, which store data and serve to identify whether a browser is new (if there is no cookie, the tag triggers) or already known (if It has the cookie, It will overwrite it).

## What is the correct way to use cookies under [LGPD](https://goadopt.io/en/blog/lgpd-general-data-protection-law/)?

To maintain compliance with the law, it is necessary to pay attention to the principles of [LGPD](https://goadopt.io/en/blog/lgpd-general-data-protection-law/) and have knowledge of the regulation as a whole.

Furthermore, once it is decided that the company will indeed use first-party or third-party cookies in its operations, the categorization or organization of these cookies is the basis for communicating with visitors in your cookie policy and banner.

In general, the market uses five main groups to classify their tags and consequently the cookies triggered by them:

- **Necessary**: Without them, your business model doesn't work, or you have to use them due to legal requirements/legislation.
(e.g., first-party cookies, gateway authentication, etc.)

- **Advertising**: With them, you trigger remarketing, populate ad pixels, email sequences, etc.
(e.g., Facebook Pixel and Google Ads)

- **Analytics**: With them, you have an analysis of what visitors do, where they come from, how they behave on your site.
(e.g., Google Analytics, Hotjar, etc.)

- **Performance**: Tags that maintain site functionality and ensure its operation, e.g., preventing DDoS attacks.
(e.g., Cloudflare)

- **Functional**: Tags that handle functional aspects, such as remembering preferences or recognizing that the user is already logged into the system.
(e.g., Chatbots, Helpcenters)

## How to [manage cookies](https://goadopt.io/en/blog/how-to-choose-a-cookie-banner-for-your-website/) and visitor consent under LGPD?
To facilitate data collection and record user consent, there are Consent Management Platforms (CMPs) like [AdOpt](https://goadopt.io/).

In this [link](https://goadopt.io/en/), you can learn more about our service: In summary, a [Cookie Banner ](https://goadopt.io/en/blog/how-to-choose-a-cookie-banner-for-your-website/)that helps your website comply with LGPD, GPDR, CCPA... standards while also being a comprehensive tool for managing consent and communicating with visitors.

Get [started for free now](https://goadopt.io/en/) and avoid [LGPD](https://goadopt.io/en/blog/lgpd-general-data-protection-law/), GPDR, CCPA... [fines](https://goadopt.io/en/blog/fines-in-LGPD/)!



LGPD and Cookies all do you need to know?

Every tracker you install on your site starts collecting data before the user makes any conscious decision about what they accept or reject.

This page covers one piece of the picture. For the full scope of the FDBR — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the FDBR and cookies](https://goadopt.io/en/blog/florida-fdbr-and-cookies-all-you-need-to-know/).

An advertising pixel registers the visit. An analytics cookie begins measuring behavior. A support chat already knows the visitor's origin before the first message.

The Florida Digital Bill of Rights (FDBR, §§ 501.701 to 501.721), in effect since July 1, 2024, has specific requirements for how these trackers operate and what must be documented about them.

This article focuses exclusively on what the FDBR requires from a Cookies Policy: what the document must contain, how tracker consent must work, and what the law's specific rights imply for your cookie strategy.

## Cookies Policy vs. cookie banner: the necessary distinction

The [cookie banner](https://goadopt.io/en/blog/how-to-choose-a-cookie-banner-for-your-website/) is the visual consent element. It is what the visitor sees when they first access the site. It must be clear, offer real options, block non-essential trackers before they fire, and not use dark patterns.

The Cookies Policy is the detailed document. It is where the user finds complete information about every technology operating on the site: what it collects, what it is for, who receives the data, and how long it is stored.

Both need to exist. Both need to be aligned. And the Cookies Policy must be accessible through a clear link within the [consent notice](https://goadopt.io/en/blog/operation-of-cookie-banner/) itself.

## What the FDBR specifically requires for cookies

### Specific purpose for each category

§ 501.71(2)(a) prohibits processing for purposes incompatible with those disclosed. And § 501.711(1)(b) requires the purpose of processing to be included in the privacy notice.

For cookies, each category needs a specific purpose description, not a generic one.

What does not work: "cookies to improve your experience." That is not a purpose. It is a vague description that provides no compliance and no protection.

What works:

"Analytics cookies: collect browsing behavior data including pages visited, session duration, and traffic source. Used to identify opportunities to improve site content and prioritize usability corrections."

"Advertising cookies: collect behavioral data across affiliated and non-affiliated websites over time to build interest profiles and display personalized ads. Include pixels from platforms such as Meta Ads, Google Ads, and programmatic DSPs."

### The categories of cookies present on the site

The Policy must list the categories of trackers operating on the site with a description of what each one does. The main categories:

**Necessary cookies:** essential for basic functionality. Authentication, session security. These do not require consent but must be documented.

**Analytics cookies:** measure browsing behavior. These generally require consent because they collect data that may identify users through cross-referencing.

**Advertising cookies:** feed ad pixels, build behavioral profiles, enable retargeting. These require explicit consent and the specific disclosure mandated by the FDBR.

**Functional cookies:** remember user preferences. May or may not require consent depending on the nature of the data.

**Third-party cookies:** fired by external services integrated into the site. [Correct tag categorization](https://goadopt.io/en/blog/difference-cookies-local-storage-session-storage/) is what makes it possible to document each one accurately.

### Targeted advertising: the FDBR's broader definition

The FDBR defines targeted advertising (§ 501.702(33)) as ads based on consumer activity data over time across **affiliated or non-affiliated** websites and online applications.

This is an important point of difference. The VCDPA, for example, covers only non-affiliated websites. The FDBR includes affiliated ones, meaning that trackers operating within the ecosystem of companies in the same corporate group may constitute targeted advertising under the FDBR.

§ 501.711(4) requires clear and conspicuous disclosure of any data sale or targeted advertising processing, along with the opt-out mechanism. This must be in the Cookies Policy.

### Sale of data: includes non-monetary consideration

§ 501.702(29) defines sale of personal data as sharing, disclosing, or transferring for monetary **or other valuable consideration**.

This is broader than the VCDPA, which mentions only monetary consideration. A company that exchanges user data with partners in return for services, technology, or other benefits may be conducting a "sale" under the FDBR. The Cookies Policy must assess whether site integrations fall under this definition.

### Categories of data shared with third parties via cookies

§ 501.711(1)(d) and (e) require the privacy notice to disclose which categories of data are shared with third parties and which categories of third parties receive them.

For cookies, this means clearly declaring:

If a Meta Pixel transfers behavioral data to Meta, it must be documented.

If Google Analytics sends session data to Google, it must be stated.

If CRM tools receive browsing data from the site, they must be identified.

Every data flow leaving the controller's environment via cookies must be categorized.

### Retention period: the 2-year limit

§ 501.719(3) requires adoption of a retention schedule that prohibits use or retention of personal data after the initial purpose is fulfilled, after the contract ends, or **2 years after the consumer's last interaction**.

For cookies, the Policy must document:

How long each cookie category remains active on the user's device.

How long data collected via cookies is retained in the business's systems.

How and when data is deleted, respecting the 2-year limit.

### The opt-out for sensitive data via cookies

The FDBR has a right that does not exist in other US state privacy laws: consumers may opt out of the **collection of sensitive data** (§ 501.705(2)(f)), including precise geolocation data.

If the site collects precise geolocation data (within 1,750 feet) via cookies or location scripts, this is sensitive data under the FDBR (§ 501.702(31)(d)). The consumer has the right to refuse this collection, and the opt-out mechanism must be accessible in the Cookies Policy.

### The opt-out for voice and facial recognition

The FDBR's seventh right (§ 501.705(2)(g)) guarantees consumers the opt-out of data collection via voice or facial recognition features.

If the site uses any voice recognition technology (voice chat, audio commands) or facial recognition (identity verification, camera filters), the Cookies Policy must mention these technologies, explain their purpose, and describe how the consumer can exercise the opt-out.

## What constitutes valid consent for cookies under the FDBR

§ 501.702(7) defines consent as a clear affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreement.

The correct standard: non-essential cookies off by default. The user chooses what to enable, not what to disable.

What is not valid consent:

Accepting general terms that contain cookie descriptions alongside other conditions.

Hovering over or closing a banner.

Any agreement obtained through dark patterns.

### Dark patterns prohibited by the FDBR

Dark patterns are defined in § 501.702(11) as interfaces designed with the substantial effect of subverting or impairing user autonomy, decision-making, or choice, including any practice the FTC refers to as a dark pattern.

In the context of cookies, common patterns the FDBR invalidates:

An "accept all" button prominently displayed with the reject option hard to find.

Non-essential cookies enabled by default.

Confusing language in the choice options.

Cookie walls blocking content until all cookies are accepted.

Banners that reappear repeatedly until the user accepts.

## Special protection for children's data via cookies

The FDBR defines "known child" as any individual under **18 years of age** of whose age the controller has actual knowledge or willfully disregards (§ 501.702(17)).

This is a much higher threshold than other US laws. For known children:

Between 13 and 18: their affirmative authorization is required to process sensitive data (§ 501.71(2)(d)).

Under 13: COPPA applies.

If the site may have users under 18 whose age the controller knows, the Cookies Policy must describe how their data is treated differently, including the prohibition on using dark patterns to obtain data beyond what is necessary.

Penalties for violations involving known children are **automatically tripled** under the FDBR (§ 501.72(1)(a)).

## Two or more opt-out channels: FDBR-exclusive requirement

§ 501.709 requires the controller to establish **two or more methods** for consumers to submit requests. This includes opt-out requests.

The Cookies Policy must describe at least two channels through which the consumer can exercise opt-outs for targeted advertising, data sale, sensitive data, and voice/facial recognition.

A [consent management platform](https://goadopt.io/en/blog/how-to-choose-cmp-consent-management-platform/) integrated into the site can be one of these channels. A DSAR form on the website can be another.

## When to update the Cookies Policy

§ 501.711(1) requires updates **at least annually**. Beyond the mandatory annual review, situations requiring immediate update include:

Adding a new advertising pixel.

A new analytics, heatmap, or session recording tool.

A new chat, support, or engagement plugin.

A new CRM or email marketing platform integration.

Any new technology that collects voice, video, or location data.

New partners receiving behavioral data from users.

Continuous [data mapping](https://goadopt.io/en/blog/data-mapping-or-data-inventory/) is what maintains synchronization between the tool inventory and the Cookies Policy.

## Enforcement: high and triplicable penalties

Violations of cookie-related requirements under the FDBR are treated as unfair trade practices, with penalties up to **US$ 50,000 per violation** (§ 501.72).

Penalties are triplicable (reaching US$ 150,000 per violation) when:

The violation involves a known Florida child.

The business continues to sell or share data after the consumer opts out.

There is a failure to delete data after an authenticated request.

The 45-day cure period is discretionary and does not apply to violations involving children.

## How AdOpt helps with the Cookies Policy under the FDBR

AdOpt's automatic scan identifies all technologies active on the site, feeding the list of categories that must appear in the Cookies Policy.

The [cookie notice](https://goadopt.io/en/blog/operation-of-cookie-banner/) configured through AdOpt blocks non-essential trackers before acceptance, presents categories with clear descriptions, offers real choice options without dark patterns, and logs every interaction for audit purposes.

The system supports the configuration of FDBR-specific opt-outs, including sensitive data and voice/facial recognition.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Cookies Policy for your site that complies with the FDBR? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what your Cookies Policy needs for the FDBR

**Visible link** in the site footer and within the cookie banner itself.

**Listing of cookie categories** with a description of what each one does on the site.

**Specific purpose for each category**, without vague descriptions (§ 501.711(1)(b)).

**Disclosure of targeted advertising**, including affiliated sites (§ 501.702(33)), with an accessible opt-out (§ 501.711(4)).

**Data sale declaration**, including non-monetary consideration if applicable (§ 501.702(29)).

**Notice of sensitive data sale** when applicable (§ 501.711(2)).

**Notice of biometric data sale** when applicable (§ 501.711(3)).

**Categories of data shared with third parties** via cookies (§ 501.711(1)(d)).

**Categories of third parties** that receive data via cookies (§ 501.711(1)(e)).

**Opt-out of sensitive data and geolocation** clearly described (§ 501.705(2)(f)).

**Opt-out of voice and facial recognition** described (§ 501.705(2)(g)).

**Retention period** for each category, including the 2-year limit (§ 501.719(3)).

**Non-essential cookies disabled by default**, without dark patterns (§ 501.702(11)).

**Special protection for known children** under 18 years of age (§ 501.702(17)).

**Two or more submission channels** described for opt-out requests (§ 501.709).

**Accessible language**, without legal jargon.

**No cookie walls**.

**Annual update** of the document at minimum.

## FAQ: FDBR and Cookies Policy

**1. Does the FDBR require a separate document called a "Cookies Policy"?**
Not by name. The disclosure requirements for trackers are distributed between the privacy notice (§ 501.711) and the controller's specific duties (§ 501.71). A dedicated Cookies Policy is the most organized way to meet all of these requirements in a user-accessible format.

**2. Is the FDBR's definition of targeted advertising different from other laws?**
Yes. The FDBR (§ 501.702(33)) includes ads based on activity data from affiliated or non-affiliated websites, while the VCDPA, for example, covers only non-affiliated websites. This broadens the scope of advertising practices requiring disclosure and opt-out. A retargeting campaign within the same corporate group's ecosystem may constitute targeted advertising under the FDBR.

**3. What changes for cookies when the user is a known child under 18?**
For known children between 13 and 18, their affirmative authorization is required to process sensitive data (§ 501.71(2)(d)). For children under 13, COPPA applies. A controller that willfully disregards a user's age is treated as having actual knowledge of it (§ 501.702(17)). Penalties for violations involving known children are automatically tripled.

**4. Does the FDBR require an opt-out for geolocation via cookies?**
Yes. Precise geolocation data is sensitive data under the FDBR (§ 501.702(31)(d)). The consumer has the right to opt out of the collection of sensitive data (§ 501.705(2)(f)). If the site uses location scripts that identify the user within a radius of 1,750 feet, the opt-out for this tracking must be available and described in the Cookies Policy.

**5. What are the specific penalties related to cookies under the FDBR?**
All violations can result in up to US$ 50,000 per violation (§ 501.72(1)). Penalties are triplicable for violations involving known children, continuation of sharing or selling data after consumer opt-out, and failure to delete data after an authenticated request. A cookie that continues tracking after opt-out can result in a tripled penalty for each affected consumer.

[Ready to build a Cookies Policy for your site that complies with the FDBR? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


Florida FDBR: Cookies Policy

Google Consent Mode: Beginner to Advanced Guide.

Colorado CPA and Cookies: All You Need to Know

If the Florida Digital Bill of Rights (FDBR) applies to your business, you have specific obligations about what must be in the Privacy Policy, how it should be presented, and how often it must be updated.

This page covers one piece of the picture. For the full scope of the FDBR — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the FDBR and cookies](https://goadopt.io/en/blog/florida-fdbr-and-cookies-all-you-need-to-know/).

The FDBR (§§ 501.701 to 501.721), in effect since July 1, 2024, has one requirement that sets it apart from other US state privacy laws: the privacy notice must be updated **at least annually**, not only when there are material changes to processing practices.

This article focuses exclusively on what the FDBR requires from your Privacy Policy, point by point, based on the official text of the law.

## What the FDBR calls a Privacy Notice

The law uses the term "privacy notice." In practice, it is the Privacy Policy that most websites already have, but with specific content requirements and an annual update obligation.

§ 501.711 requires the controller to provide consumers with a privacy notice that is "reasonably accessible and clear, updated at least annually," containing six mandatory categories of information.

## What must be in the Privacy Policy under the FDBR

### 1. Categories of personal data processed

The document must list the categories of personal data the business processes, including, if applicable, any sensitive data processed (§ 501.711(1)(a)).

The FDBR is explicit in requiring specific mention of sensitive data when it is processed. This creates an additional layer of clarity compared to other state laws.

Personal data under the FDBR (§ 501.702(19)) includes any information linkable to an identified or identifiable individual, including pseudonymous data when used in conjunction with information that links the individual. Geolocation data, device identifiers, browsing history, and biometric data fall within this scope.

### 2. The purpose of processing

The document must explain what the data is used for (§ 501.711(1)(b)).

The purposes must be specific and correspond to what actually happens. § 501.71(2)(a) prohibits processing for purposes incompatible with those disclosed, except with consumer consent.

§ 501.711(5) goes further: the controller cannot collect additional categories of data or use collected data for additional purposes without providing prior notice to the consumer. Any expansion of the collection or use scope must be communicated.

### 3. How consumers exercise all seven rights

The document must describe how consumers can exercise all rights guaranteed by the FDBR (§ 501.711(1)(c)), including the appeal process.

Unlike most other state laws that guarantee five rights, the FDBR guarantees **seven**. The Privacy Policy must describe how the consumer can exercise each of them:

The right to access and confirmation.

The right to correction.

The right to deletion.

The right to portability.

The right to opt out of targeted advertising, data sale, and profiling with significant effects.

The right to opt out of collection of sensitive data, including precise geolocation.

The right to opt out of collection via voice or facial recognition features.

And how the appeal process works when a request is denied.

The [data protection officer](https://goadopt.io/en/blog/responsibilities-of-a-data-protection-officer/) must have these workflows mapped and operationally functional before publishing the document.

### 4. Categories of data shared with third parties

If the business shares data with third parties, the document must disclose which categories of data are shared (§ 501.711(1)(d)).

This covers analytics platforms, CRMs, email marketing tools, advertising networks, payment processors, and any other service that receives user data.

In the FDBR, the concept of "sale" is broader than in other laws. § 501.702(29) includes sharing for non-monetary valuable consideration in addition to monetary. A company that exchanges data with partners to receive services or other benefits may be conducting a "sale" under the FDBR definition.

### 5. Categories of third parties that receive data

In addition to the types of data, the Policy must disclose which categories of third parties receive them (§ 501.711(1)(e)).

Categories such as "digital advertising platforms," "analytics tools," "CRM systems," and "payment processors" are valid examples. Categories must be identifiable enough for the consumer to understand who accesses their data.

### 6. Description of the request submission methods

§ 501.711(1)(f) requires the Policy to describe the methods specified in § 501.709 for consumers to submit requests.

Here is a requirement specific to the FDBR: the controller must have **two or more methods** for submitting requests (§ 501.709). These methods must be secure, reliable, and clearly and conspicuously accessible. The Privacy Policy must describe all of them.

The business must also maintain a mechanism on its own website for request submission. Businesses that operate exclusively online and have a direct consumer relationship may additionally accept requests by email.

## Specific mandatory notices for sales of sensitive and biometric data

The FDBR has two specific notices that do not exist in other US state privacy laws.

If the controller engages in the sale of personal data that is sensitive data, it must display: **"NOTICE: This website may sell your sensitive personal data."** (§ 501.711(2))

If the controller engages in the sale of personal data that is biometric data, it must display: **"NOTICE: This website may sell your biometric personal data."** (§ 501.711(3))

These notices must be posted in accordance with the accessibility requirements of § 501.711(1) and are mandatory whenever these practices occur.

## Disclosure of targeted advertising and data sale

If the business sells personal data to third parties or processes it for targeted advertising, § 501.711(4) requires clear and conspicuous disclosure of this practice, along with the manner in which the consumer can opt out.

The FDBR defines targeted advertising (§ 501.702(33)) more broadly than other laws: it includes ads based on consumer activity data across **affiliated or unaffiliated** websites over time. This broadens the scope compared to laws like the VCDPA, which covers only non-affiliated websites.

## The mandatory annual update

§ 501.711(1) is explicit: the privacy notice must be updated **at least annually**. It is not enough to update only when there are material changes, as is common practice under other laws.

In practice, this means every company within the FDBR's scope needs an internal annual review process for the Privacy Policy, even if nothing has substantially changed in processing practices.

Situations that require immediate updates (in addition to the annual review):

Adding a new category of data collected.

Using existing data for new purposes.

New partners receiving consumer data.

Changes in data sale practices.

Introduction of new voice or facial recognition features.

## Protection of sensitive data: additional requirements

Sensitive data receives special treatment under the FDBR. The Privacy Policy must explicitly identify whether sensitive data is collected and which categories.

Under § 501.702(31), sensitive data includes: racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data for identification, known children's personal data, and precise geolocation data.

For each category of sensitive data collected, the Policy must explain how the consumer's consent is obtained and how it can be revoked.

For known children between 13 and 18, the FDBR requires their affirmative authorization (§ 501.71(2)(d)). For children under 13, COPPA applies.

## The device surveillance prohibition

§ 501.705(3) prohibits devices with voice recognition, facial recognition, video recording, audio recording, or other data collection features from being used for surveillance when not in active use by the consumer, without express authorization.

The Privacy Policy must mention this prohibition and describe how the business's devices are configured to comply with it.

## Children's data: "child" means under 18 years of age

The FDBR uses a broader definition. "Known child" (§ 501.702(17)) is any individual under **18 years of age** of whose age the controller has actual knowledge or willfully disregards.

This differs from most US laws that use 13 years as the threshold. If the site may have users under 18 whose age is known to the controller, the FDBR's special protections apply.

The Privacy Policy must describe how data of known users under 18 is treated differently.

## Data Protection Assessments

§ 501.713 requires controllers to conduct and document Data Protection Assessments for:

Processing data for targeted advertising.

Sale of personal data.

Processing for profiling with a reasonably foreseeable risk of harm.

Processing sensitive data.

Any processing presenting a heightened risk of harm.

Assessments are confidential. The Department of Legal Affairs may request access, and disclosure in response to that request does not constitute waiver of attorney-client privilege.

The Privacy Policy does not need to publish the assessments, but should communicate that the business conducts impact assessments for high-risk activities.

## Data retention: the 2-year limit

§ 501.719(3) requires adoption of a retention schedule that prohibits use or retention of personal data after:

The fulfillment of the initial collection purpose.

The expiration or termination of the contract.

**2 years after the consumer's last interaction with the controller.**

The Privacy Policy must mention the retention periods adopted for each data category and the existence of this 2-year limit.

## Enforcement and penalties

Violations of the FDBR are treated as unfair and deceptive trade practices by the Department of Legal Affairs, with penalties up to **US$ 50,000 per violation**.

Penalties are triplicable for violations involving known Florida children, failure to delete or correct data after an authenticated request, and continuation of data sale or sharing after consumer opt-out.

The 45-day cure period is discretionary. There is no guarantee it will be granted, and for violations involving children, it is not available.

## How AdOpt supports compliance with the FDBR

AdOpt ensures that what is written in the Policy has real correspondence with what actually happens on the site.

The automatic scan identifies all active technologies, feeding the list of data categories and third parties that must appear in the document. The [consent management platform](https://goadopt.io/en/blog/how-to-choose-cmp-consent-management-platform/) ensures the consent and opt-out mechanism works as described, including the additional rights specific to the FDBR.

Every consent interaction is logged. If the Department requests evidence, the record is available.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Privacy Policy for your site that complies with the FDBR? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what the Privacy Policy must contain for the FDBR

**Visible and accessible link** on all pages of the site.

**Updated at least annually**, even without material changes (§ 501.711(1)).

**Categories of personal data processed**, including sensitive data if applicable (§ 501.711(1)(a)).

**Purpose of processing** for each category, without vague descriptions (§ 501.711(1)(b)).

**How to exercise all 7 rights** guaranteed by the FDBR, with processes, channels, and deadlines (§ 501.711(1)(c)).

**Appeal process** described with a 60-day deadline.

**Categories of data shared with third parties** (§ 501.711(1)(d)).

**Categories of third parties** that receive data (§ 501.711(1)(e)).

**Description of the two or more submission methods** for consumer requests (§ 501.711(1)(f)).

**Notice of sensitive data sale** when applicable (§ 501.711(2)).

**Notice of biometric data sale** when applicable (§ 501.711(3)).

**Disclosure of targeted advertising or data sale** with accessible opt-out (§ 501.711(4)).

**Differentiated treatment for known children** under 18 years of age (§ 501.702(17)).

**Device surveillance prohibition** and how it is implemented (§ 501.705(3)).

**Retention periods** for each data category, including the 2-year limit (§ 501.719(3)).

**Non-discrimination policy** for consumers exercising their rights.

**Free service at least twice per year** per consumer.

## FAQ: FDBR and Privacy Policy

**1. Does the FDBR require the Privacy Policy to be updated annually even without changes?**
Yes. § 501.711(1) explicitly requires the privacy notice to be "updated at least annually." This differs from other US state privacy laws that require updates only when there are material changes. Companies within the FDBR's scope need a mandatory annual review process.

**2. What specific notices does the FDBR require that do not exist in other laws?**
The FDBR requires two specific notices. If the controller sells sensitive data, it must display: "NOTICE: This website may sell your sensitive personal data." If it sells biometric data: "NOTICE: This website may sell your biometric personal data." These notices are exclusive to the FDBR among US state privacy laws (§ 501.711(2) and (3)).

**3. How does the FDBR define "child" differently from other laws?**
The FDBR defines "known child" as any individual under 18 years of age of whose age the controller has actual knowledge or willfully disregards (§ 501.702(17)). Most other state laws use 13 years. This means businesses within the FDBR's scope need specific protections for users up to 17 years old, not just those under 13.

**4. Does the Privacy Policy need to mention the device surveillance prohibition?**
Yes. § 501.705(3) prohibits devices with voice, video, facial recognition, or other sensor features from being used for surveillance when not in active use by the consumer, without express authorization. For businesses that operate devices with these features, the Privacy Policy must describe how the prohibition is respected in practice.

**5. What happens if the Privacy Policy is not updated annually?**
The absence of an annual update constitutes a violation of § 501.711(1). The Department of Legal Affairs may grant a 45-day cure period for correction, but that period is discretionary. If not corrected, penalties reach up to US$ 50,000 per violation, potentially triplicable in specific circumstances (§ 501.72).

[Ready to build a Privacy Policy for your site that complies with the FDBR? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


Florida FDBR: Privacy Policy

California has one of the most detailed privacy policy requirements among all US state privacy laws.

This page covers one piece of the picture. For the full scope of the CCPA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the CCPA and cookies](https://goadopt.io/en/blog/california-ccpa-and-cookies-all-you-need-to-know/).

The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA) and codified at Cal. Civ. Code § 1798.100 et seq., requires the privacy notice to be updated every 12 months and to contain specific lists of what was collected, sold, shared, and disclosed in the preceding year.

This article focuses exclusively on what the CCPA/CPRA requires from your Privacy Policy, based on the official text of the law.

## Did the CPRA change what the CCPA requires from the Privacy Policy?

Yes, significantly. The CPRA (Proposition 24, operative since January 2023) expanded the transparency obligations of the privacy notice in three main areas:

Added the obligation to disclose the category of **sensitive personal information** when collected.

Added the **two new mandatory links** on the site: "Do Not Sell or Share My Personal Information" and "Limit the Use of My Sensitive Personal Information."

Reinforced **data minimization** and **proportionate retention** requirements, requiring the Policy to include the period the business intends to retain each category of data.

For more on what the CPRA specifically changed, we have a dedicated guide on the [California CPRA](https://goadopt.io/en/blog/california-cpra-and-cookies-all-you-need-to-know/). This article covers the current consolidated law.

## What must be in the Privacy Policy under the CCPA/CPRA

### 1. Categories of personal information collected

The privacy notice must list the categories of personal information collected about consumers in the **preceding 12 months** (§ 1798.130(a)(5)(B)).

The CCPA/CPRA establishes specific categories that must be used for this description, under § 1798.140(v):

Identifiers (name, address, IP address, email, Social Security number, etc.).

Personal information described in Section 1798.80 of California law.

Characteristics of protected classifications under California or federal law.

Commercial information (records of property, purchase history).

Biometric information.

Internet or other electronic network activity (browsing history, search history, ad interactions).

Geolocation data.

Audio, electronic, visual, thermal, olfactory, or similar information.

Professional or employment-related information.

Education information.

Inferences drawn to create profiles about preferences, characteristics, behavior, and aptitudes.

Sensitive personal information.

### 2. Categories of sources of personal information

The privacy notice must identify the categories of sources from which consumers' personal information is collected (§ 1798.130(a)(5)(B)(ii)).

Typical sources include: the consumer directly through forms, analytics systems, advertising networks, data partners, social media, and publicly available sources.

### 3. The business or commercial purpose for collecting, selling, or sharing

The notice must explain what the data is used for (§ 1798.130(a)(5)(B)(iii)).

The CCPA/CPRA defines "business purpose" (§ 1798.140(e)) with specific categories: auditing ad impression counts, ensuring security and integrity, debugging errors, short-term transient use, performing services on behalf of the business, advertising and marketing (except cross-context behavioral advertising), internal research, and quality verification activities.

### 4. Categories of third parties with whom data is shared

The notice must identify the categories of third parties with whom the business shares consumers' personal information (§ 1798.130(a)(5)(B)(iv)).

### 5. List of categories sold or shared in the preceding 12 months

§ 1798.130(a)(5)(C) requires the privacy notice to include:

A list of categories of personal information **sold or shared** about consumers in the preceding 12 months, by category; or a statement that the business has not sold or shared personal information.

A list of categories **disclosed for business purposes** in the preceding 12 months; or a statement that no such disclosure occurred.

These two lists must be kept separate in the privacy notice.

### 6. Consumer rights and how to exercise them

The notice must describe the rights guaranteed by the CCPA/CPRA and the designated methods for submitting requests (§ 1798.130(a)(5)(A)):

Right to know and access (§ 1798.100, 1798.110, 1798.115).

Right to deletion (§ 1798.105).

Right to correction of inaccurate data (§ 1798.106).

Right to opt-out of sale and sharing (§ 1798.120).

Right to limit use of sensitive personal information (§ 1798.121).

Right of non-discrimination (§ 1798.125).

And the two or more designated methods for submitting requests, including at minimum a toll-free telephone number.

### 7. Retention period for each category

§ 1798.100(a)(3) requires that, at or before the point of collection, the business inform consumers of the length of time it intends to retain each category of personal information, including sensitive personal information, or the criteria used to determine that period.

The business shall not retain a consumer's personal information for longer than is reasonably necessary for the disclosed purpose.

## The two mandatory links on the homepage

§ 1798.135 requires the Privacy Policy to mention and the site to provide, clearly and conspicuously:

**"Do Not Sell or Share My Personal Information":** a link to a page where the consumer can opt out of the sale and sharing of their data. Sharing, defined as transfer for cross-context behavioral advertising, is included even without monetary consideration.

**"Limit the Use of My Sensitive Personal Information":** a link that allows the consumer to limit the use of sensitive personal information to what is necessary to provide the products or services reasonably expected.

The business may use a single combined link that clearly allows exercising both options.

Alternatively, the business may honor the opt-out preference signal of the **Global Privacy Control (GPC)** when sent by the consumer, instead of maintaining the links. In that case, the Policy must state that the site respects the GPC.

## Disclosure of sensitive personal information

If the business collects sensitive personal information, the privacy notice must expressly disclose this (§ 1798.100(a)(2)).

Sensitive personal information under the CCPA/CPRA (§ 1798.140(ae)) includes: Social Security number, driver's license, or passport number; login credentials and financial account access codes; precise geolocation; racial or ethnic origin, citizenship status, religious beliefs, union membership; contents of private communications; genetic data; neural data; biometric data for identification; health information; sex life or sexual orientation.

For each category of sensitive information collected, the Policy must explain:

For what specific purpose it is collected.

Whether it is sold or shared, and with whom.

How the consumer can limit its use (via "Limit the Use of My Sensitive Personal Information" link or via GPC).

## The 12-month lookback

A specific feature of the CCPA/CPRA is the 12-month lookback in access requests.

When a consumer makes an access request, the response must cover the period of 12 months preceding receipt of the request (§ 1798.130(a)(2)(B)).

After adoption of specific regulations, the consumer may request information beyond 12 months for data collected from January 1, 2022, if it is not impossible or would not involve disproportionate effort.

The Privacy Policy must mention this 12-month lookback so the consumer understands which time period is covered by their request.

## Request submission methods: the toll-free number is mandatory

§ 1798.130(a)(1) requires two or more designated methods for submitting requests, including at minimum a **toll-free telephone number**.

Businesses that operate exclusively online with a direct consumer relationship may limit themselves to an email address.

The business must make its website available for request submission if it maintains a website.

The business cannot require the consumer to create a new account to exercise their rights. It may require use of an existing account.

Data collected for identity verification may be used only for that purpose, not for other uses (§ 1798.130(a)(7)).

## Protection for consumers under 16 years of age

If the business may have consumers under 16 years of age, the Privacy Policy must describe the special protections applicable:

For consumers between 13 and 15: the business cannot sell or share data without affirmative authorization from the consumer themselves (§ 1798.120(c)).

For consumers under 13: parental or guardian authorization is required.

A business that willfully disregards the consumer's age is deemed to have actual knowledge of it.

The [data protection officer](https://goadopt.io/en/blog/responsibilities-of-a-data-protection-officer/) must ensure that the age verification process, where applicable, is operational and documented.

## The private right of action and the Privacy Policy

§ 1798.150 grants the consumer the private right of action for security breaches, with damages of US$ 100 to US$ 750 per consumer per incident.

Before initiating any action for statutory damages, the consumer must provide written notice to the business 30 days in advance. If the business cures the violation within the period and provides a written statement that no further violations will occur, no action may be initiated.

The Privacy Policy must mention this right and how the consumer can exercise it.

## The mandatory annual update

§ 1798.130(a)(5) requires the privacy notice to be updated **at least once every 12 months**.

This update must reflect what was collected, sold, shared, and disclosed for business purposes in the preceding 12 months. A generic, outdated notice is not sufficient: the business needs an internal mandatory annual review process.

Situations requiring immediate update, in addition to the annual review:

Adding a new category of data collected.

New third parties receiving data.

Changes in sale or sharing practices.

New purposes for data use.

Any change to opt-out links or submission methods.

## Enforcement and penalties

CCPA/CPRA violations are investigated and enforced by the **California Privacy Protection Agency (CPPA)** and the **California Attorney General**.

The CPPA can impose administrative fines of up to **US$ 2,500 per violation** and up to **US$ 7,500 for intentional violations** or violations involving minors. The Attorney General can seek civil penalties in the same amounts.

There is no guaranteed cure period before CPPA actions. The agency has discretion to investigate without any obligation to grant advance notice.

## How AdOpt supports CCPA/CPRA compliance

AdOpt ensures that what is written in the Policy has real correspondence with what actually happens on the site.

The automatic scan identifies all active technologies, feeding the list of data categories and third parties. The [consent management platform](https://goadopt.io/en/blog/how-to-choose-cmp-consent-management-platform/) ensures that the opt-out and sensitive information limitation mechanisms work as described.

The GPC is honored automatically when sent by the user. Every consent interaction is logged. If the CPPA or Attorney General requests evidence, the record is available.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Privacy Policy for your site that complies with the CCPA/CPRA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what the Privacy Policy must contain for the CCPA/CPRA

**Visible and accessible link** on all pages of the site.

**Updated at least once every 12 months** (§ 1798.130(a)(5)).

**Categories of personal information collected** in the preceding 12 months (§ 1798.130(a)(5)(B)(i)).

**Categories of sources** of personal information (§ 1798.130(a)(5)(B)(ii)).

**Business or commercial purpose** for collecting, selling, or sharing (§ 1798.130(a)(5)(B)(iii)).

**Categories of third parties** with whom data is shared (§ 1798.130(a)(5)(B)(iv)).

**List of categories sold or shared** in the preceding 12 months (§ 1798.130(a)(5)(C)(i)).

**List of categories disclosed for business purposes** in the preceding 12 months (§ 1798.130(a)(5)(C)(ii)).

**Consumer rights and how to exercise them**, with process and deadlines (§ 1798.130(a)(5)(A)).

**Two or more submission methods**, including a toll-free telephone number (§ 1798.130(a)(1)).

**"Do Not Sell or Share My Personal Information" link** or statement of honoring GPC (§ 1798.135).

**"Limit the Use of My Sensitive Personal Information" link** when applicable (§ 1798.121, 1798.135).

**Categories of sensitive personal information** collected, when applicable (§ 1798.100(a)(2)).

**Retention period** for each category of data (§ 1798.100(a)(3)).

**12-month lookback** for access requests mentioned (§ 1798.130(a)(2)(B)).

**Private right of action** for security breaches mentioned (§ 1798.150).

**Protection for minors** aged 13 to 15 and under 13 (§ 1798.120(c)).

**Non-discrimination policy** for consumers exercising their rights (§ 1798.125).

## FAQ: CCPA/CPRA and Privacy Policy

**1. How often does the Privacy Policy need to be updated under the CCPA/CPRA?**
At least once every 12 months, under § 1798.130(a)(5). This goes beyond updating only when there are material changes. The business needs a mandatory annual review process, and the lists of categories sold, shared, and disclosed in the preceding 12 months must be regularly updated.

**2. What is the "12-month lookback" and how does it affect the Privacy Policy?**
§ 1798.130(a)(2)(B) requires that the response to a consumer access request cover the 12 months preceding receipt of the request. The Privacy Policy must mention this period so the consumer understands which time window is covered by their request.

**3. Does the Privacy Policy need to mention the CCPA private right of action?**
Yes. § 1798.150 grants consumers the right to file civil lawsuits for security data breaches. The Policy must mention this right and the process: the consumer must provide written notice to the business 30 days in advance before initiating action for statutory damages.

**4. Is the toll-free telephone number really mandatory?**
Yes. § 1798.130(a)(1) requires the business to provide two or more designated methods for submitting requests, including at minimum a toll-free telephone number. The exception applies to businesses that operate exclusively online with a direct consumer relationship, which may limit themselves to an email address.

**5. What did the CPRA add that was not in the original CCPA?**
The CPRA added: the right to correct inaccurate data (§ 1798.106), the right to limit use of sensitive personal information (§ 1798.121), the mandatory "Limit the Use of My Sensitive Personal Information" link, the distinction between "sale" and "sharing" for behavioral advertising, the expanded definition of sensitive personal information (including neural data), and data minimization and proportionate retention requirements. All of this must be reflected in the Privacy Policy.

[Ready to build a Privacy Policy for your site that complies with the CCPA/CPRA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


California CCPA: Privacy Policy

The Connecticut Data Privacy Act (CTDPA, Public Act No. 22-15) has a specific requirement for the privacy notice that does not appear as explicitly in other US state privacy laws: the notice must include an **active email address** or other online mechanism that the consumer may use to contact the controller.

This page covers one piece of the picture. For the full scope of the CTDPA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the CTDPA and cookies](https://goadopt.io/en/blog/connecticut-CTDPA-and-cookies-all-you-need-to-know/).

It sounds simple. But it is an explicit requirement that many businesses overlook when building privacy policies for compliance with other legislation.

This article focuses exclusively on what the CTDPA requires from the Privacy Policy, based on the official text of the law.

## What the CTDPA calls a Privacy Notice

The law uses the term "privacy notice." In practice, it is the Privacy Policy that most sites already have, but with CTDPA-specific content elements.

Section 6(c) requires the controller to provide consumers with a privacy notice that is "reasonably accessible, clear and meaningful."

## What must be in the Privacy Policy under the CTDPA

### 1. Categories of personal data processed

The notice must list the categories of personal data processed by the controller (Section 6(c)(1)).

Categories must be described clearly enough for consumers to understand what types of data are being collected. This includes identifiers, behavioral data, geolocation data, communication data, and specifically whether sensitive data is in the list.

Sensitive data under the CTDPA (Section 1(27)) includes: racial or ethnic origin, religious beliefs, physical or mental health, sex life, sexual orientation, citizenship or immigration status, genetic or biometric data for identification, known children's data, and precise geolocation. If any of these categories are collected, they must be explicitly listed.

### 2. The purpose for processing

The notice must explain what the data is used for (Section 6(c)(2)).

The purpose must be specific enough for the consumer to understand the actual intent. The CTDPA prohibits processing for purposes incompatible with those disclosed, except with consent (Section 6(a)(2)).

If data is used for targeted advertising or sale, Section 6(d) requires clear and conspicuous specific disclosure about that use, along with the opt-out method.

### 3. How consumers exercise their rights and file appeals

The notice must describe how consumers can exercise the five rights guaranteed by the CTDPA, including how to appeal a controller decision (Section 6(c)(3)).

The five rights covered are: access and confirmation, correction, deletion, portability, and opt-out of targeted advertising, data sale, and solely automated profiling.

For exercising rights, Section 6(e)(1) requires the controller to establish one or more secure and reliable means, described in the privacy notice, taking into account:

The ways in which consumers normally interact with the controller.

The need for secure and reliable communication.

The controller's ability to verify the consumer's identity.

The controller cannot require creation of a new account, but may require use of an existing account.

### 4. Categories of personal data shared with third parties

The notice must identify the categories of personal data the controller shares with third parties (Section 6(c)(4)).

This includes analytics platforms, advertising tools, CRMs, payment processors, and any external service receiving user data. "Third party" under the CTDPA (Section 1(29)) excludes the consumer, the controller, the processor, and affiliates of the controller or processor.

### 5. Categories of third parties with whom data is shared

Beyond the categories of data, the notice must identify the categories of third parties receiving them (Section 6(c)(5)).

Categories such as "digital advertising platforms," "analytics tools," "marketing CRMs," and "payment processors" are valid examples. Categories must be identifiable enough for the consumer to understand who accesses their data.

### 6. Active email address or online contact mechanism

The notice must include an active email address or other online mechanism the consumer may use to contact the controller (Section 6(c)(6)).

This requirement is explicit and specific to the CTDPA. The consumer needs a direct contact channel with the controller available within the privacy notice itself, not just abstract rights and processes.

## Disclosure of targeted advertising and data sale

If the controller sells personal data to third parties or processes it for targeted advertising, Section 6(d) requires clear and conspicuous disclosure of this, along with the opt-out method.

Targeted advertising under the CTDPA (Section 1(28)): ads based on data from consumer activities over time across **nonaffiliated** websites or online applications. Contextual ads, own-site-based ads, and ads in response to consumer requests do not constitute targeted advertising.

## The mandatory opt-out link on the site

Beyond the privacy notice, Section 6(e)(1)(A)(i) requires the controller to provide a clear and conspicuous link on its website to a page enabling the consumer to opt out of targeted advertising or sale of personal data.

This link must be visible on the page, not buried in obscure menus or footers.

## The opt-out preference signal from January 2025

Section 6(e)(1)(A)(ii) requires that from **January 1, 2025**, controllers processing for targeted advertising or selling data allow opt-out via signal sent with consumer consent.

The mechanism cannot be a default setting: must represent an affirmative, freely given, and unambiguous consumer choice. The Global Privacy Control (GPC) is the best-known mechanism meeting these criteria.

The Privacy Policy must state whether the site honors these signals and how they work.

## Protection for sensitive data

Sensitive data requires consent before processing. The Policy must identify:

Whether any sensitive data category is collected.

For what specific purpose sensitive data is used.

How consent is obtained and can be revoked.

The revocation mechanism must be at least as easy as the consent mechanism. After revocation, processing must cease within **15 days** (Section 6(a)(6)).

## Special protection for teens aged 13 to 15

If the site may have users aged 13 to 15, the Privacy Policy must describe how the business obtains consent before processing data for targeted advertising or sale (Section 6(a)(7)).

A controller with actual knowledge that willfully disregards that a user is in this age range is subject to the law's sanctions.

## The right to portability and trade secrets

The CTDPA has a specific clause for portability (Section 4(a)(4)): the controller is not required to reveal trade secrets when providing data in portable format. The Policy may mention this limitation to set consumer expectations.

## The appeal process: 60 days, not 45

The appeal response deadline under the CTDPA is **60 days** (Section 4(d)), not 45 like the initial request deadline. The Privacy Policy must describe the appeal process with the correct deadline.

If the appeal is denied, the controller must provide the consumer with an online mechanism or other method to contact the Attorney General to submit a complaint.

## The duty not to discriminate

Section 6(a) expressly prohibits discrimination against consumers who exercise their rights, including denying goods or services, charging different prices, or offering different quality.

The exception is voluntary loyalty programs, rewards, premium features, discounts, or club card programs.

## Enforcement and penalties

CTDPA violations are treated as unfair trade practices by the **Connecticut Attorney General**. There is no private right of action.

From January 2025, the cure period is discretionary. The AG may or may not grant a correction period before acting.

## How AdOpt supports CTDPA compliance

AdOpt ensures that what is written in the Policy has real correspondence with what actually happens on the site.

The automatic scan identifies all active technologies, feeding the list of data categories and third parties. The [consent management platform](https://goadopt.io/en/blog/how-to-choose-cmp-consent-management-platform/) ensures the consent and opt-out mechanism works as described, the GPC is honored from January 2025, and consent revocations are processed within 15 days.

Every interaction is logged. If the AG requests evidence, the record is available.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Privacy Policy for your site that complies with the CTDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what the Privacy Policy must contain for the CTDPA

**Visible and accessible link** on all pages of the site.

**Categories of personal data processed**, including sensitive data if collected (Section 6(c)(1)).

**Purpose for processing** each category (Section 6(c)(2)).

**How to exercise all 5 rights** guaranteed by the CTDPA, with processes and timelines (Section 6(c)(3)).

**Appeal process** with **60-day** deadline (not 45) (Section 4(d)).

**Categories of personal data shared with third parties** (Section 6(c)(4)).

**Categories of third parties** that receive data (Section 6(c)(5)).

**Active email address or online mechanism** for consumer contact with the controller (Section 6(c)(6)).

**Disclosure of targeted advertising or data sale** with accessible opt-out (Section 6(d)).

**Clear and conspicuous link** for opt-out on the site (Section 6(e)(1)(A)(i)).

**Opt-out preference signal**: statement of how GPC is processed from January 2025 (Section 6(e)(1)(A)(ii)).

**Treatment of sensitive data** with how consent is obtained and revoked.

**15-day deadline** for honoring consent revocation mentioned (Section 6(a)(6)).

**Protection for teens aged 13 to 15** described (Section 6(a)(7)).

**Non-discrimination policy** for consumers exercising rights (Section 6(a)).

## FAQ: CTDPA and Privacy Policy

**1. Why does the CTDPA require an active email or online mechanism in the Privacy Policy?**
Section 6(c)(6) specifically requires the privacy notice to include an active email address or other online mechanism the consumer may use to contact the controller. This ensures consumers have a direct communication channel available in the privacy document itself, not just abstract rights and processes.

**2. What is the difference between the response deadline for requests and for appeals in the CTDPA?**
For initial requests: 45 days, extendable by 45 more (Section 4(c)(1)). For appeals: 60 days, with no mentioned extension (Section 4(d)). The Privacy Policy must correctly describe both deadlines.

**3. Does the Privacy Policy need to mention the 15-day consent revocation deadline?**
Yes. Section 6(a)(6) requires the controller to cease processing within 15 days after receiving consent revocation. As this is unique among US state laws, it is important to explicitly mention this deadline in the Policy so consumers know what to expect.

**4. What is the opt-out preference signal and when does the CTDPA require it?**
It is a signal sent by a browser, extension, or device (like the GPC) communicating an opt-out preference. Section 6(e)(1)(A)(ii) makes it mandatory for controllers to honor these signals from January 1, 2025. The Privacy Policy must describe how these signals are processed.

**5. Does the Privacy Policy need to mention the protection for teens aged 13 to 15?**
Yes, if the site may have users in that age range. Section 6(a)(7) prohibits processing data for targeted advertising or sale of 13-to-15-year-old consumers without their consent when the controller has actual knowledge. The Policy must describe how consent is obtained for this specific group.

[Ready to build a Privacy Policy for your site that complies with the CTDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


Connecticut CTDPA: Privacy Policy

The Colorado Privacy Act (CPA, C.R.S. § 6-1-1301 et seq.) has one of the most detailed sets of privacy notice requirements among all US state privacy laws.

This page covers one piece of the picture. For the full scope of the CPA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the CPA and cookies](https://goadopt.io/en/blog/colorado-cpa-and-cookies-all-you-need-to-know/).

This happens because Colorado went beyond the statute: the Attorney General promulgated the Colorado Privacy Act Rules (4 CCR 904-3), a complete set of regulations that precisely specify what each element of the privacy notice must contain, how it must be presented, in what languages, and which changes require immediate update.

This article focuses exclusively on what the CPA and its regulations require from the Privacy Policy, based on the official text of both documents.

## What the CPA calls a Privacy Notice

The law uses the term "privacy notice." In practice, it is the Privacy Policy.

C.R.S. § 6-1-1308(1) requires the controller to provide consumers with a privacy notice that is "reasonably accessible, clear, and meaningful."

The regulations (4 CCR 904-3, Rule 6.02) expand this standard: the notice must give the consumer a meaningful understanding and accurate expectations of how their personal data will be processed. It must be clear, easily accessible, specific, and available in all languages the controller regularly uses to interact with consumers.

## What must be in the Privacy Policy under the CPA

### 1. Categories of personal data processed

The notice must list the categories of personal data collected or processed by the controller or a processor (C.R.S. § 6-1-1308(1)(a)(I)).

The regulations (4 CCR 904-3, Rule 6.03(A)(1)(a)) require categories to be described at a sufficient level of detail for the consumer to understand the type of data. Examples of categories with adequate granularity: "contact information," "government-issued identification numbers," "payment information," "data from cookies," "data revealing religious affiliation," "medical data."

The notice must also specifically indicate whether sensitive data or children's data is processed.

### 2. The purposes for which the data is processed

The notice must explain what the data of each category is used for (C.R.S. § 6-1-1308(1)(a)(II)).

The regulations (4 CCR 904-3, Rule 6.06) require the purpose to be described at a level of detail that gives the consumer a meaningful understanding of how the data is used. Vague purposes are not permitted. If data will be used for targeted advertising, profiling, or sale, this must be stated explicitly for each category.

### 3. How consumers exercise their rights and file appeals

The notice must describe how and where consumers can exercise the rights guaranteed by the CPA, including the controller's contact information and how to appeal a decision (C.R.S. § 6-1-1308(1)(a)(III)).

The regulations (4 CCR 904-3, Rule 6.03(A)(4)) detail what must be in the notice:

Instructions on how to use each available submission method.

Instructions on how an authorized agent may submit opt-outs on behalf of a consumer.

A clear and conspicuous method to exercise opt-out of targeted advertising and data sale.

The description of the commercially reasonable identity authentication process.

Effective July 2024: explanation of how requests via Universal Opt-Out Mechanism will be processed.

### 4. Categories of personal data shared with third parties

If the controller shares data with third parties, the notice must identify the categories of data shared (C.R.S. § 6-1-1308(1)(a)(IV)).

The regulations (4 CCR 904-3, Rule 6.03(A)(1)(d)) also require the notice to indicate whether each category of data will be sold, used for targeted advertising, or for profiling with significant effects on the consumer.

### 5. Categories of third parties with whom data is shared

In addition to the categories of data, the notice must identify the categories of third parties that receive them (C.R.S. § 6-1-1308(1)(a)(V)).

The regulations (4 CCR 904-3, Rule 6.03(A)(1)(e)) require categories of third parties to be described at a level of detail that gives the consumer a meaningful understanding of the type, business model of, or processing conducted by those third parties. Examples: "analytics companies," "data brokers," "third-party advertisers," "payment processors," "lenders," "government agencies."

### 6. The date of last update

The regulations (4 CCR 904-3, Rule 6.03(A)(8)) require the notice to include the date it was last updated.

## The opt-out mechanism must be in the notice

C.R.S. § 6-1-1308(1)(b) requires that if the controller sells personal data or processes for targeted advertising, it must disclose this clearly and conspicuously, along with the method to exercise the opt-out.

The regulations (4 CCR 904-3, Rule 4.03(B)) detail: the opt-out method must appear in the privacy notice AND in a clear, conspicuous, and readily accessible location outside the notice. A direct link to the opt-out method is required.

From July 2024, the notice must also describe how requests via Universal Opt-Out Mechanism (including the GPC) will be processed.

## Sensitive data: additional requirements

If the controller processes sensitive data, the notice must reflect this explicitly.

Sensitive data under the CPA (C.R.S. § 6-1-1303(24)) includes: racial or ethnic origin, religious beliefs, physical or mental health, sex life or sexual orientation, citizenship status, genetic or biometric data for identification, and known children's data.

The regulations (4 CCR 904-3, Rule 6.10) add an important nuance: inferences made by the controller that indicate these sensitive categories ("Sensitive Data Inferences") are also sensitive data and require consent to be processed, except in specific situations where they can be deleted within 24 hours.

If the controller uses this 24-hour inference exception, the notice must describe the inferences subject to this provision and the retention and deletion timeline.

## The duty of purpose specification

The CPA explicitly names the **duty of purpose specification** as an autonomous controller obligation (C.R.S. § 6-1-1308(2)): the controller must specify the express purposes for which personal data are collected and processed.

The regulations (4 CCR 904-3, Rule 6.06) detail what this means:

The purpose must be described at a level of detail that gives the consumer a meaningful understanding of how the data is used.

If data is collected for more than one purpose, each unrelated purpose must be specified separately.

It is not permitted to identify a broad purpose to justify numerous processing activities that are only remotely related.

It is not permitted to specify so many purposes that the purposes become unclear or uninformative.

## The duty to avoid secondary use

The CPA also names the **duty to avoid secondary use** (C.R.S. § 6-1-1308(4)): the controller must not process personal data for purposes not reasonably necessary or compatible with the specified purposes, except with consumer consent.

The regulations (4 CCR 904-3, Rule 6.08) detail: if the controller collected data before July 2023 and the processing purpose changes after that date in a way incompatible with the original, new consent must be obtained.

## The 24-month consent refresh requirement

This is a requirement exclusive to Colorado's regulations that does not exist in other US state privacy laws.

Under 4 CCR 904-3, Rule 7.08: when a consumer has not interacted with the controller in the **past 24 months**, the controller must **refresh consent** to:

Continue processing sensitive data.

Continue processing personal data for secondary purposes involving profiling with significant effects.

The exception is for cases where the consumer has permanent access and ability to update their opt-out preferences through a consumer-controlled interface.

The Privacy Policy must describe when and how this consent will be refreshed.

## Material changes: mandatory notification

The regulations (4 CCR 904-3, Rule 6.04) require the controller to notify consumers of material changes to the privacy notice, communicated in a manner by which the controller regularly interacts with consumers.

Material changes include: categories of personal data processed, processing purposes, the controller's identity, the act of sharing personal data with third parties, categories of third parties, and methods for exercising rights.

If a material change constitutes a secondary use, the controller must obtain consumer consent.

## Enforcement and penalties

CPA violations are treated as **deceptive trade practices** under the Colorado Consumer Protection Act (C.R.S. § 6-1-1311(1)(c)).

Enforcement is shared between the **Attorney General** and **District Attorneys** of Colorado. There is no private right of action (C.R.S. § 6-1-1310).

Before 2025, there was a guaranteed 60-day cure period. From 2025 onward, the cure period is discretionary.

## How AdOpt supports CPA compliance

AdOpt ensures that what is written in the Policy has real correspondence with what actually happens on the site.

The automatic scan identifies all active technologies, feeding the list of data categories and third parties. The [consent management platform](https://goadopt.io/en/blog/how-to-choose-cmp-consent-management-platform/) ensures that the Universal Opt-Out Mechanism is honored automatically and the consent mechanism works as described.

Every interaction is logged for 24 months as required by the regulations.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Privacy Policy for your site that complies with the Colorado CPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what the Privacy Policy must contain for the CPA

**Visible and accessible link** on all pages, using the word "privacy" (4 CCR 904-3, Rule 6.02(E)).

**Available in all languages** used by the controller to interact with consumers (4 CCR 904-3, Rule 3.02(A)(3)).

**Accessible for people with disabilities**, following WCAG 2.1 (4 CCR 904-3, Rule 3.02(A)(2)).

**Categories of personal data processed**, with sufficient granularity (C.R.S. § 6-1-1308(1)(a)(I)).

**Purpose for each category**, without vague descriptions (C.R.S. § 6-1-1308(1)(a)(II)).

**Whether data will be sold, used for targeted advertising, or profiling** (4 CCR 904-3, Rule 6.03(A)(1)(c)).

**How to exercise all rights** guaranteed by the CPA, with processes and timelines (C.R.S. § 6-1-1308(1)(a)(III)).

**Appeal process** described with 45+60 day deadlines.

**Categories of personal data shared with third parties** (C.R.S. § 6-1-1308(1)(a)(IV)).

**Categories of third parties** with detail on type/business model (C.R.S. § 6-1-1308(1)(a)(V)).

**Opt-out method** clearly within and outside the notice (C.R.S. § 6-1-1308(1)(b)).

**Universal Opt-Out Mechanism** processing explained (4 CCR 904-3, Rule 6.03(A)(4)(e)).

**Sensitive data and sensitive data inferences** identified with how consent is obtained.

**Consent refresh policy** after 24 months of consumer inactivity (4 CCR 904-3, Rule 7.08).

**Date of last update** (4 CCR 904-3, Rule 6.03(A)(8)).

**Controller contact information**.

**Authentication process** described.

## FAQ: CPA and Privacy Policy

**1. Does the CPA require a Colorado-specific privacy notice?**
No. The regulations (4 CCR 904-3, Rule 6.02(B)) confirm that the controller does not need a separate Colorado notice, as long as the existing notice meets all CPA requirements and makes clear that Colorado consumers have the rights provided by C.R.S. § 6-1-1306.

**2. In how many languages must the privacy notice be available?**
The notice must be available in all languages in which the controller ordinarily provides web pages, interfaces, contracts, and other information to consumers (4 CCR 904-3, Rule 3.02(A)(3)). Communications sent directly to the consumer must be in the language the consumer ordinarily uses to interact with the controller.

**3. What are "Sensitive Data Inferences" and how do they affect the Privacy Policy?**
They are inferences made by the controller based on personal data indicating racial or ethnic origin, religious beliefs, health condition, sex life or sexual orientation, or citizenship status (4 CCR 904-3, Rule 2.02). Like the underlying sensitive data, these inferences require consent to be processed. If the controller uses the 24-hour deletion exception, the Policy must describe the inferences subject to this provision and the retention timeline.

**4. What is the 24-month consent refresh requirement?**
The regulations (4 CCR 904-3, Rule 7.08) require that when a consumer has not interacted with the controller in the past 24 months, consent for processing sensitive data or for secondary purposes involving significant profiling effects must be refreshed. This requirement is exclusive to Colorado and does not exist in other US state privacy laws.

**5. What changed in CPA enforcement from 2025?**
Before 2025, C.R.S. § 6-1-1311(1)(d) guaranteed 60 days to cure before legal action. From January 1, 2025, this provision was repealed. The Attorney General and District Attorneys now have discretion to investigate and act without any obligation to grant a prior correction period.

[Ready to build a Privacy Policy for your site that complies with the Colorado CPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


Colorado CPA: Privacy Policy

Utah is the most business-friendly state in the US privacy landscape.

The Utah Consumer Privacy Act (UCPA), Utah Code § 13-61-101 et seq., took effect on **December 31, 2023**. It is the leanest state privacy law among those approved so far in the US, with fewer obligations for businesses and stronger protection for the traditional business model.

But "lean" does not mean ignorable. The US$ 25 million revenue threshold creates a well-defined scope, and the Utah Attorney General has exclusive enforcement authority.

## What is the UCPA?

The Utah Consumer Privacy Act is Utah's state personal data protection law. It grants basic rights to state residents and creates obligations for businesses that process their data.

Enforcement follows a two-stage model: the Division of Consumer Protection receives and investigates consumer complaints. If it finds substantial evidence of a violation, it refers to the **Utah Attorney General**, who has exclusive authority to initiate enforcement actions.

There is no private right of action.

## When did the UCPA take effect?

On **December 31, 2023**.

## Who must comply with the UCPA?

Under Utah Code § 13-61-102(1), the law applies to controllers or processors that:

Conduct business in Utah or produce products or services targeted to state residents;

Have **annual revenue of US$ 25,000,000 or more**; and

Meet at least one of the following thresholds:

Control or process personal data of **100,000 or more consumers** during a calendar year; or

Derive more than **50% of gross revenue** from the sale of personal data and control or process personal data of **25,000 or more consumers**.

**The key differentiator from other laws:** the UCPA requires the business to satisfy the US$ 25 million revenue requirement AND at least one of the volume thresholds. Other state laws use one or the other. Here both are needed. This significantly reduces the number of businesses in scope.

Understanding the distinction between [controller and processor](https://goadopt.io/en/blog/responsibilities-of-a-data-protection-officer/) is fundamental to defining responsibilities in the processing chain.

### UCPA Exemptions

Under Utah Code § 13-61-102(2), the following are exempt:

Government entities and third parties contracted on their behalf.

Native American tribes.

Institutions of higher education.

Nonprofit corporations.

HIPAA covered entities and business associates.

HIPAA-protected health information and related health data in specific situations.

Regulated clinical research data.

Consumer credit data regulated by the Fair Credit Reporting Act.

Financial institutions and data regulated by the Gramm-Leach-Bliley Act.

Data regulated by the Driver's Privacy Protection Act.

Data regulated by FERPA.

Data regulated by the Farm Credit Act.

Employee, job applicant, and independent contractor data in an employment context.

Data processed for purely personal or household purposes.

Air carriers.

## What is personal data under the UCPA?

Under Utah Code § 13-61-101(24), personal data is any information linked or reasonably linkable to an identified individual or an identifiable individual.

Not personal data: de-identified data, aggregated data, and publicly available information.

The UCPA also defines pseudonymous data (§ 13-61-101(28)) as personal data that cannot be attributed to a specific individual without additional information kept separately and under appropriate technical and organizational measures. Pseudonymous data has limited protection under the UCPA.

## What is sensitive data under the UCPA?

Under Utah Code § 13-61-101(32), sensitive data includes:

Personal data revealing racial or ethnic origin, religious beliefs, sexual orientation, citizenship or immigration status, or information about medical history, physical or mental health condition, or medical treatment or diagnosis.

Processing of genetic personal data or biometric data, where the processing is for the purpose of identifying a specific individual.

Specific geolocation data.

**Note on the UCPA's sensitive data model:** unlike the CPRA and several other state laws, the UCPA does not require consent to process sensitive data. It only requires the business to present a clear notice and offer an opt-out opportunity before processing. This is one of the aspects that makes the UCPA more business-friendly than other state laws.

For data of known children (under 13), businesses must comply with COPPA requirements (§ 13-61-102(3)).

## What is specific geolocation data under the UCPA?

Under Utah Code § 13-61-101(33), specific geolocation data means information derived from technology, including GPS coordinates, that directly identifies an individual's specific location with a precision of **1,750 feet or less**.

## What are consumer rights under the UCPA?

Under Utah Code § 13-61-201, Utah residents have four rights:

**Right to confirm and access:** confirm whether the controller is processing personal data and access that data (§ 13-61-201(1)).

**Right to deletion:** request deletion of personal data the consumer provided to the controller. Note: the UCPA limits the deletion right to data the consumer provided. Data the controller obtained from other sources does not need to be deleted under the UCPA (§ 13-61-201(2)).

**Right to portability:** obtain a copy of the data in a portable format where technically feasible, for transmission to another controller without impediment (§ 13-61-201(3)).

**Right to opt-out:** refuse processing of personal data for targeted advertising or sale of personal data (§ 13-61-201(4)).

### What the UCPA does not include compared to other laws

No right to correct inaccurate data. The UCPA does not guarantee this right, unlike the CPRA, OCPA, VCDPA, and CTDPA.

No right to opt-out of profiling. The UCPA covers only targeted advertising and data sales.

No formal structured appeal process. The law does not define an appeal process for controller denials.

## Response deadlines for requests

Under Utah Code § 13-61-203:

**45 days** to respond from receipt of the request.

Extension of **+45 days** when reasonably necessary due to complexity or volume, with notification within the initial period.

**Free for the first request** from each consumer per 12-month period (§ 13-61-203(4)(a)).

From the second request in the same 12-month period, the business may charge a reasonable fee or refuse if the request is excessive, repetitive, technically infeasible, manifestly unfounded, or if the controller reasonably believes the primary purpose is not exercising a right.

## Sensitive data: opt-out, not consent

This is one of the most important points of the UCPA for businesses already compliant with other laws.

Under Utah Code § 13-61-302(3), the controller may not process sensitive data collected from a consumer without first:

Presenting the consumer with a clear notice; and

Offering the consumer the opportunity to opt out of the processing.

This opt-out model for sensitive data is substantially less restrictive than the opt-in (prior consent) model required by the CPRA, OCPA, CTDPA, and VCDPA. Businesses already compliant with the more restrictive laws will automatically be compliant with the UCPA on this point.

## Controller obligations under the UCPA

Under Utah Code § 13-61-302, the controller must:

**Privacy notice:** provide a reasonably accessible and clear privacy notice including: categories of personal data processed, purposes of processing, how consumers can exercise their rights, categories of data shared with third parties (if any), and categories of third parties with whom data is shared.

**Data security:** establish, implement, and maintain reasonable administrative, technical, and physical data security practices proportionate to the volume and nature of the data.

**Disclosure of sale and targeted advertising:** if the business sells data or uses data for targeted advertising, it must clearly and conspicuously inform the consumer and provide an opt-out mechanism.

**Non-discrimination:** may not discriminate against consumers who exercise their rights.

**Processor contracts:** before engaging processors, the controller must enter into contracts with specific requirements including processing instructions, confidentiality obligations, and subcontractor requirements.

## Cookies and the UCPA

Cookies that collect personal data or allow user identification fall within the UCPA's scope.

The site must display a clear [cookie notice](https://goadopt.io/en/blog/operation-of-cookie-banner/), provide an opt-out mechanism for targeted advertising and data sales, and describe in the privacy notice how consumers can exercise their rights.

[Correct tag categorization](https://goadopt.io/en/blog/best-practices-tag-categorization/) is what makes it possible to identify which cookies constitute targeted advertising or data sales.

The UCPA defines targeted advertising in § 13-61-101(34) as ads selected based on data obtained from the consumer's activities over time and across non-affiliated websites or applications. Ads based on activities within the controller's own site do not qualify.

**The UCPA does not require honoring the GPC.** Unlike the CPRA (California) and CTDPA (Connecticut), the UCPA does not mention the obligation to honor universal opt-out signals such as the Global Privacy Control. However, implementing the GPC is a best practice that covers requirements in other jurisdictions.

## Enforcement and penalties

Under Utah Code § 13-61-402, the Utah Attorney General has exclusive enforcement authority.

The process follows two stages:

**Stage 1:** the consumer files a complaint with the Division of Consumer Protection. The Division investigates and, if it finds substantial evidence of a violation, refers to the Attorney General.

**Stage 2:** the AG notifies the controller in writing, identifying violations and providing **30 guaranteed days to cure**.

If the controller cures the violation within 30 days and provides a written statement that the violation has been cured and will not recur, no action is initiated.

If the violation continues or the controller breaches the provided statement, the AG may initiate action and recover:

Actual damages to the consumer.

Up to **US$ 7,500 per violation**.

The 30-day cure period is **guaranteed permanently** by the UCPA, unlike other laws such as the OCPA and CPRA that have eliminated the cure period. This makes UCPA enforcement more predictable for businesses.

## How AdOpt helps with the UCPA

AdOpt records every consent and opt-out interaction, blocks trackers before acceptance, and generates the auditable log needed in an Attorney General investigation.

The automatic scan identifies all active [trackers](https://goadopt.io/en/blog/gdpr-cookies-explained/) on the site, feeding the data inventory required for the privacy notice. And when the law changes, the platform updates automatically.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Ready to bring your website into compliance with the Utah UCPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Comparing UCPA with other privacy laws

| Law | State | Threshold | Sensitive Data | Right to Correct | Cure Period | Effective Date |
|---|---|---|---|---|---|---|
| UCPA | Utah | US$ 25M + 100K or 25K + 50% | Opt-out (prior notice) | Not provided | 30 days guaranteed | Dec 2023 |
| OCPA | Oregon | 100K (excl. payments) or 25K + 25% | Opt-in (consent) | Provided | Eliminated (Jan 2026) | Jul 2024 |
| CTDPA | Connecticut | 100K (excl. payments) or 25K + 25% | Opt-in (consent) | Provided | Discretionary | Jul 2023 |
| VCDPA | Virginia | 100K or 25K + 50% | Opt-in (consent) | Provided | 30 days guaranteed | Jan 2023 |
| CPRA | California | US$ 25M or 100K or 50% | Opt-in + SPI limitation | Provided | Eliminated | Jan 2023 |

## The UCPA in practice: the three documents

Compliance with the UCPA rests on three documents that have to agree with each other: the [cookies policy](https://goadopt.io/en/blog/utah-ucpa-cookies-policy/), which declares every tracker and its purpose; the [privacy policy](https://goadopt.io/en/blog/utah-ucpa-privacy-policy/), which explains what you do with the data; and the [privacy portal](https://goadopt.io/en/blog/utah-ucpa-dsar-privacy-portal/), where the consumer exercises their rights and you keep the record of it.

## FAQ: Utah UCPA

**1. What makes the UCPA different from other US state privacy laws?**
The UCPA is the most business-friendly state privacy law among those approved in the US so far. Key differences: requires both US$ 25M revenue AND at least one volume threshold (dual requirement), while other laws use one or the other; uses opt-out for sensitive data, while most other laws require opt-in (consent); no right to correct data; no right to opt-out of profiling; and maintains a guaranteed 30-day cure period permanently, while other laws are eliminating that period.

**2. Why does the UCPA use opt-out for sensitive data instead of opt-in?**
The UCPA reflects the Utah legislature's philosophy of creating a law that protects consumers without creating excessive barriers for businesses. The opt-out model for sensitive data (Utah Code § 13-61-302(3)) requires the business to inform the consumer and give them the opportunity to refuse, but does not require active prior consent. This is significantly less restrictive than the consent standard required by the CPRA, OCPA, and other laws.

**3. Does the UCPA have a right to correct inaccurate data?**
No. This is one of the most notable absent rights in the UCPA. The law only guarantees four rights: confirm/access, deletion (limited to data provided by the consumer), portability, and opt-out from targeted advertising and data sales. Correction of inaccurate data is not among them, distinguishing the UCPA from the VCDPA, OCPA, CTDPA, and CPRA.

**4. What does the limited deletion right in the UCPA mean?**
The UCPA's deletion right (§ 13-61-201(2)) applies only to personal data the consumer provided to the controller. Data the controller obtained from other sources, such as data brokers, third-party lists, or inferences created from other data, do not need to be deleted under the UCPA. This is a significant difference from the OCPA and CTDPA, which require deletion of data from any source.

**5. What is the penalty for UCPA non-compliance?**
The Attorney General can recover actual consumer damages and up to US$ 7,500 per violation. Before initiating any action, the AG is required to notify the controller and grant 30 days to cure (§ 13-61-402(3)). This 30-day period is guaranteed permanently by the UCPA. If the controller cures the violation and provides a written statement, no action is initiated. There is no private right of action for consumers (§ 13-61-305).

[Ready to bring your website into compliance with the Utah UCPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


Utah UCPA and Cookies: All you need to know

The Oregon Consumer Privacy Act (OCPA, ORS 646A.570 et seq.) has two specific requirements for sites that process data for targeted advertising or sell personal data.

This page covers one piece of the picture. For the full scope of the OCPA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the OCPA and cookies](https://goadopt.io/en/blog/oregon-ocpa-and-cookies-all-you-need-to-know/).

The first is immediate: a clear and conspicuous link on the site to an opt-out page.

The second took effect on **January 1, 2026**: the obligation to honor opt-out signals sent by platforms, technologies, or mechanisms with consumer consent, such as the **Global Privacy Control (GPC)**.

This article focuses exclusively on what the OCPA requires from a Cookies Policy: what must be in the document, how opt-out must work, and what the law's specific requirements mean for each tracker on your site.

## Cookies Policy vs. cookie banner: the necessary distinction

The [cookie banner](https://goadopt.io/en/blog/how-to-choose-a-cookie-banner-for-your-website/) is the visual consent interface. It is what the visitor sees when they first access the site.

The Cookies Policy is the detailed document. It is where the user finds complete information about each technology: what it collects, what it is for, who receives the data, and how to exercise rights.

Both need to exist. Both need to be aligned. And the Cookies Policy must be accessible from a clear link within the [consent notice](https://goadopt.io/en/blog/operation-of-cookie-banner/) itself.

## What the OCPA specifically requires for cookies

### Specific purpose for each tracker category

Section 5(1)(a) requires the controller to specify the express purposes for collecting and processing personal data. And Section 5(2)(a) prohibits processing for purposes incompatible with those disclosed, except with new consent.

For cookies, each tracker category needs a specific purpose description, not a generic one.

What does not work: "cookies to improve your experience."

What works: "Analytics cookies: collect browsing behavior data including pages visited, traffic source, and session duration. Used to identify content improvement opportunities. Data is not sold or used for targeted advertising."

"Advertising cookies: collect behavioral identifiers shared with advertising platforms for targeted advertising on non-affiliated websites. Include pixels from Meta Ads and Google Ads. Consumers may exercise opt-out via the link on this page or via GPC."

### Cookie categories present on the site

The Policy must list tracker categories:

**Necessary cookies:** essential for basic functionality. Authentication, session security, shopping cart. Do not constitute targeted advertising or data sale. Must be documented but do not require opt-out.

**Analytics cookies:** depends on configuration. If data stays internal, generally does not constitute targeted advertising. If sent to third parties for targeting on other sites, may qualify and requires opt-out.

**Advertising cookies:** almost always constitute "targeted advertising" under the OCPA, which defines it as ads based on data collected from the consumer's activities over time and across non-affiliated websites or online applications (Section 1(19)).

**Functional cookies:** remember user preferences. Generally do not constitute targeted advertising or sale, but must be documented.

**Third-party cookies:** fired by external services. [Correct tag categorization](https://goadopt.io/en/blog/best-practices-tag-categorization/) is what makes accurate documentation possible.

### Targeted advertising: non-affiliated websites

The OCPA defines targeted advertising (Section 1(19)) as ads selected based on personal data obtained from the consumer's activities over time and across **non-affiliated** websites or online applications.

What does not constitute targeted advertising (Section 1(19)(b)):

Advertisements based on activities within the controller's own websites or applications.

Advertisements based on the context of the current search query or current visit.

Advertisements directed to a consumer in response to an information request.

Processing personal data solely to measure or report advertising frequency, performance, or reach.

Retargeting campaigns using behavioral data from other sites therefore almost always constitute targeted advertising under the OCPA.

### Sale of personal data

The OCPA defines sale (Section 1(17)) as the exchange of personal data for monetary or other valuable consideration by the controller to a third party.

Not a sale: disclosure to processors, disclosure for products or services requested by the consumer, disclosure to affiliates, disclosure directed by the consumer, and M&A transfers.

If the site shares data with partners in exchange for services or other economic benefits, it may constitute a sale even without direct cash payment.

### Categories of third parties receiving data via cookies

The Policy must identify the categories of third parties receiving data via cookies, with enough detail for the consumer to understand what type of entity each one is (Section 5(4)(e)).

This includes digital advertising platforms, analytics tools, programmatic advertising networks, email marketing platforms receiving behavioral data, and any other partner receiving identifiers or user behaviors collected via cookie.

### Retention period

The obligation to limit collection to what is necessary (Section 5(1)(b)) implies data should be retained only for as long as necessary. The Cookies Policy must document how long each cookie category stays active and how long data is retained in systems.

## The mandatory opt-out link on the site

Section 5(5)(b) requires a clear and conspicuous link on the controller's website to a page enabling the consumer or their agent to opt out of targeted advertising or sale of personal data.

This link must be visible on the page, not in obscure locations. The Cookies Policy must identify this link and describe how the opt-out works.

## The opt-out preference signal from January 2026

Section 5(5)(c) requires that from **January 1, 2026**, controllers processing for targeted advertising or selling data honor opt-out signals sent with consumer consent by a platform, technology, or mechanism.

In practical terms for cookies: when a user visits the site with the GPC activated in their browser, the site must interpret this as an opt-out of targeted advertising and data sale, and automatically block the corresponding trackers.

The mechanism must meet OCPA-specific requirements (Section 5(5)(c)):

Cannot unfairly disadvantage another controller.

Cannot be a default setting: must represent an affirmative, freely given, and unambiguous consumer choice.

Must be consumer-friendly and easy for the average consumer.

Must be as consistent as possible with similar mechanisms required by other laws.

Must enable the controller to accurately determine whether the consumer is an Oregon resident.

The Cookies Policy must describe how the site processes these signals.

## What constitutes valid consent for cookies under the OCPA

Section 1(6) defines consent as an affirmative act by which the consumer clearly and conspicuously communicates freely given, specific, informed, and unambiguous agreement. The interface may not have any mechanism with the purpose or substantial effect of obtaining consent by obscuring, subverting, or impairing the consumer's autonomy and decision-making. And inaction does not constitute consent.

The correct standard for cookies: non-essential technologies off by default. The user chooses what to enable, not what to disable.

### What is not valid consent

Accepting general terms with data processing descriptions alongside unrelated information.

Continuing to browse without any explicit action.

Interfaces designed to make opting out harder than accepting.

Banners that reappear until the user accepts.

Cookie walls that block content access until all cookies are accepted.

Section 1(6)(a) of the OCPA is explicit: the interface may not have "any mechanism that has the purpose or substantial effect of obtaining consent by obscuring, subverting or impairing the consumer's autonomy, decision-making or choice."

## The opt-out without authentication requirement

For opt-out requests for targeted advertising, data sales, and profiling, the OCPA does **not allow requiring authentication** (Section 4(5)(e)).

The controller may ask for information necessary to identify who is requesting the opt-out. But it cannot create barriers that make exercising the right more difficult. If the controller has a good faith, reasonable, and documented belief that a request is fraudulent, it may deny, but must notify the requestor with the reason.

This is more restrictive than what many other US state laws require and means the opt-out mechanism in the Cookies Policy must be functional without authentication steps.

## Do analytics cookies require opt-out under the OCPA?

In most cases, yes.

The OCPA defines personal data as including derived data and identifiers reasonably linkable to a consumer. Analytics cookies from major platforms collect identifiers that, when cross-referenced with other data the provider holds, can identify a specific user.

The [ANPD Cookie Guidance](https://goadopt.io/en/blog/anpd-cookies-guidance-personal-data-protection-lgpd/) has already flagged this point: major providers have the ability to cross-reference seemingly anonymous identifiers with other data they hold to re-identify users.

The safest approach: treat analytics cookies as non-necessary in the banner, block them until the consumer makes a choice, and document this categorization in the Cookies Policy.

## Special protection for minors' data

Section 5(2)(c) prohibits processing data of consumers aged 13 to 15 for targeted advertising, profiling for legal decisions, or data sales without consent, when the controller has actual knowledge of that age range.

As of **January 1, 2026**, protection was expanded: prohibition on selling data of minors under 16 and on using data of minors under 16 for targeted advertising and certain types of profiling.

For children under 13, COPPA applies per Section 5(2)(b) of the OCPA.

If the site may have users in these age ranges, the Cookies Policy must describe how their data is treated differently.

## The ban on selling precise geolocation data from 2026

As of **January 1, 2026**, controllers are prohibited from selling precise geolocation data of Oregon consumers.

The OCPA defines precise geolocation as data that identifies the consumer's location within a radius of **1,750 feet** (approximately 533 meters) using technologies such as GPS (Section 1(18)(a)(C)).

If any cookie or tracker on the site collects location data at that precision, the Cookies Policy must:

Explicitly identify this collection as sensitive data processing.

State that this data is not sold to third parties.

Describe that processing requires explicit consumer consent.

## When to update the Cookies Policy

The OCPA requires that processing stay limited to declared purposes (Section 5(2)(a)). Any change in the tool inventory requires a Policy update.

Situations that require an update:

Adding a new advertising pixel or tracker.

A new analytics tool sending data to third parties.

A new partner receiving behavioral data from site users.

Change in the use of cookie data for new purposes.

Any modification to opt-out mechanisms.

Continuous [data mapping](https://goadopt.io/en/blog/data-mapping-or-data-inventory/) is what keeps the cookie inventory synchronized with the document.

## Enforcement and the Cookies Policy

The first-year enforcement report (August 2025) identified three systemic problems directly related to cookies and trackers:

Businesses not offering the right to list the specific third parties that received data via pixels and trackers.

Back-end data such as marketing profiles created from trackers not being included in copy and deletion requests.

Opt-out forms and mechanisms not working correctly.

As of **January 1, 2026**, the 30-day cure period was eliminated. The AG can act without prior notice. An inadequate Cookies Policy and a broken opt-out mechanism are exactly what the Oregon DOJ is looking for in investigations.

## How AdOpt helps with the Cookies Policy under the OCPA

AdOpt's automatic scan identifies all active technologies on the site, feeding the list of categories that must appear in the Cookies Policy.

The [cookie notice](https://goadopt.io/en/blog/operation-of-cookie-banner/) configured through AdOpt blocks non-essential trackers before acceptance, presents categories with clear descriptions, offers targeted advertising opt-out without requiring authentication, detects and honors the GPC from January 2026, and logs every interaction.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Cookies Policy for your site that complies with the OCPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what your Cookies Policy needs for the OCPA

**Visible link** in the footer and within the cookie banner.

**Listing of cookie categories** with a description of what each does.

**Specific purpose for each category**, without vague descriptions (Section 5(1)(a)).

**Identification of cookies constituting targeted advertising or sale** (Section 5(4)(h)).

**Categories of third parties** receiving data via cookies, with entity type detail (Section 5(4)(e)).

**Clear and conspicuous opt-out link** for targeted advertising and sale on the site (Section 5(5)(b)).

**Opt-out preference signal**: description of how GPC is honored from January 2026 (Section 5(5)(c)).

**Opt-out without authentication** for targeted advertising, sale, and profiling (Section 4(5)(e)).

**Non-essential cookies disabled by default**, without manipulative design patterns (Section 1(6)(a)).

**Protection for teens aged 13 to 15** described where applicable (Section 5(2)(c)).

**Prohibition on selling data of minors under 16** from January 2026.

**Prohibition on selling precise geolocation data** from January 2026.

**Retention period** for each cookie category.

**Active email or online mechanism** for contacting the controller (Section 5(4)(f)).

**Accessible language**, without legal jargon.

**No cookie walls**.

## FAQ: OCPA and Cookies Policy

**1. Is the OCPA opt-out link different from the CCPA's "Do Not Sell" link?**
They are similar in function but different in requirement. The CCPA requires specific link texts: "Do Not Sell or Share My Personal Information" and "Limit the Use of My Sensitive Personal Information." The OCPA simply requires a clear and conspicuous link to an opt-out page for targeted advertising or data sale, without mandating specific text (Section 5(5)(b)). Businesses that already have the CCPA links likely satisfy the OCPA requirement, depending on the link's scope.

**2. Is the OCPA's opt-out preference signal the same as the GPC?**
The GPC is the best-known mechanism meeting the OCPA's technical specifications in Section 5(5)(c). The law does not name the GPC specifically, but the GPC was developed precisely for this type of legal requirement. As long as the mechanism is an affirmative consumer choice (not a default), does not create unfair disadvantage for the controller, and allows verification that the consumer is an Oregon resident, it meets the requirement. As of January 2026, honoring the GPC is mandatory, not optional.

**3. Do analytics cookies constitute targeted advertising under the OCPA?**
It depends on the tool and configuration. If analytics data stays internal or is sent to the provider only to generate reports without use for targeting on other sites, it generally does not qualify. If the tool sends data used for segmentation on other sites, it may. The OCPA's criterion is data "collected from the consumer's activities over time and across non-affiliated websites or online applications" (Section 1(19)). The criterion is the use of data in environments external to the controller's site.

**4. Does the OCPA require teens aged 13 to 15 to consent before any cookie?**
Section 5(2)(c) is specific: it prohibits processing data of 13-to-15-year-olds for targeted advertising, profiling for legal decisions, or data sales without those consumers' consent when the controller has actual knowledge. It does not require consent for other types of processing such as internal analytics. As of January 2026, the prohibition extends to minors under 16 for targeted advertising and certain types of profiling.

**5. What changes for geolocation cookies from January 2026?**
As of January 1, 2026, the OCPA prohibits selling precise location data (within 1,750 feet) of Oregon consumers. Precise geolocation data was already classified as sensitive data by Section 1(18)(a)(C) of the OCPA, requiring explicit consent for processing. With the sales ban now in effect, the Cookies Policy must be updated to explicitly state that precise location data is not sold to third parties.

[Ready to build a Cookies Policy for your site that complies with the OCPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


Oregon OCPA: Cookies Policy

A California resident visits your site, consumes your content, and at some point decides to exercise the rights the law guarantees. They want to know what you have about them. They want to correct inaccurate information. They want you to stop sharing their data with advertising networks.

This page covers one piece of the picture. For the full scope of the CPRA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the CPRA and cookies](https://goadopt.io/en/blog/california-cpra-and-cookies-all-you-need-to-know/).

What happens next?

The California Privacy Rights Act (CPRA) defines precisely what must happen: the channel for receiving the request, the response deadlines, what is free and what is not, and what happens when the business does not comply.

The major additions compared to the original CCPA: the right to correct data, the right to limit use of sensitive personal information, and automatic tripled penalties for violations involving consumers under 16.

This article covers everything.

## What is a DSAR under the CPRA?

DSAR stands for Data Subject Access Request. It is any formal request from a California consumer to exercise the rights the CPRA guarantees over their own data.

Under Civil Code § 1798.130, consumers exercise their rights through means established by the business and described in the privacy policy.

If you already know the [LGPD data subject portal](https://goadopt.io/en/blog/lgpd-cookies-all-you-need-to-know/), the logic is familiar. The CPRA adds new rights and strengthens protections for minors.

## What are consumer rights under the CPRA?

Under Civil Code § 1798.100 through § 1798.125, California residents have the following rights:

### Right to know

The consumer may request that the business disclose:

The categories of personal information collected about them.

The specific categories of sources from which information was collected.

The business or commercial purpose for collecting, selling, or sharing the information.

The categories of third parties to which the business discloses information.

The specific pieces of personal information collected about the consumer.

### Right to access

The consumer may obtain a copy of the specific personal information the business has collected in the past 12 months (Civil Code § 1798.100(a)).

### Right to deletion

The consumer may request deletion of their personal information, with some exceptions (Civil Code § 1798.105). Exceptions include: completing the transaction, security, debugging, internal research, and legal compliance.

### Right to correct

This is a new right the CCPA did not have (Civil Code § 1798.106). The consumer may request that the business correct inaccurate personal information it maintains about them, taking into account the nature of the information and the purposes of processing.

### Right to portability

The consumer may obtain personal information in a portable, usable format (Civil Code § 1798.100(a)).

### Right to opt-out of selling and sharing

The consumer may refuse the selling of personal information and the sharing for cross-context behavioral advertising (Civil Code § 1798.120). This right is exercised via the "Do Not Sell or Share My Personal Information" link.

### Right to limit SPI use

This is another new right from the CPRA (Civil Code § 1798.121). The consumer may limit use and disclosure of their sensitive personal information to essential purposes: providing the requested product or service, security and integrity, and legal compliance. This right is exercised via the "Limit the Use of My Sensitive Personal Information" link.

### Right to non-discrimination

The business cannot discriminate against consumers who exercise their rights, including denying products, charging different prices, or offering lower quality (Civil Code § 1798.125).

## What are the response deadlines?

Under Civil Code § 1798.130(a)(2):

**45 days** to respond from receipt of the verified request.

Extension of **+45 days** when reasonably necessary, with consumer notification within the initial period.

**Free up to 2 times per year** per consumer. For a third or subsequent request within the same 12-month period, the business may charge a reasonable fee.

The 45-day deadline applies to know/access, deletion, correction, and portability requests, and for confirmation that opt-outs and limitations have been applied.

## The opt-out process: no unnecessary barriers

The CPRA is explicit: the business cannot require the consumer to create an account or go through more than two steps to exercise the opt-out of selling and sharing (Civil Code § 1798.120(c)).

The opt-out process must:

Be direct and accessible via the "Do Not Sell or Share My Personal Information" link.

Not require creation of a new account.

Not involve more than two steps to opt-out confirmation.

Honor the Global Privacy Control (GPC) as a valid form of opt-out.

Be free of charge.

## The request process: reasonable authentication

For access, deletion, correction, and portability requests, the business may verify the consumer's identity using methods reasonably designed to verify that the requesting person is the consumer about whom data was collected (Civil Code § 1798.130(a)(2)).

Verification must be proportionate to the type of data involved. For low-risk data, email confirmation may be sufficient. For more sensitive data, a second verification factor may be justified.

What is never acceptable: requiring more information than necessary to verify identity, or creating deliberately burdensome processes to discourage requests.

The business cannot require the consumer to provide their password to exercise their rights.

## Authorized agents

The consumer may designate an authorized agent to submit requests on their behalf (Civil Code § 1798.130(a)(2)(C)).

For opt-out requests: the business must respect the agent's request if the consumer has provided the agent with signed written permission, or upon reasonable verification of both the consumer's identity and the agent's authority.

The Global Privacy Control (GPC) functions as a form of technological authorized agent: by activating the GPC, the consumer is designating their browser configuration as an agent to transmit the opt-out.

## What happens when the business denies a request?

The business may deny when:

It cannot verify the consumer's identity.

The request applies to information collected before January 2022 (for CPRA enforcement, except for the right to access).

There is a legal exception justifying retention.

In all cases, the denial must be communicated to the consumer, with:

Justification for the denial.

Information on how to contact the CPPA to submit a complaint.

## Special protection for minors under 16

The CPRA has specific rules for minors that directly affect the Privacy Portal.

For consumers under 16, the business cannot sell or share personal information without active opt-in. If the business receives a DSAR related to opt-out from a consumer under 16, that is moot because opt-in should never have occurred without permission.

If a consumer under 16 declined or revoked opt-in, the business must wait 12 months before requesting consent again for selling or sharing.

For consumers under 13, consent was given by parents or guardians. DSARs from consumers under 13 must be processed in coordination with parents or legal guardians.

Penalties for violations involving data of consumers under 16 are tripled and automatic: up to **US$ 7,500 per violation**, without needing to prove intent.

## The private right of action: the CPRA differentiator

The CPRA preserves and expands the private right of action that the CCPA introduced. This is a key differentiator from other US state laws like the VCDPA, OCPA, and CTDPA, which have no private right of action.

Consumers can sue the business directly when there is an unauthorized data security breach resulting in unauthorized access, theft, disclosure, use, modification, or destruction of unencrypted, unredacted personal information in specified categories.

Minimum damages are **US$ 100 to US$ 750 per consumer per incident**, or actual damages, whichever is greater. Class actions are permitted.

## Protection against discrimination

Civil Code § 1798.125 prohibits discriminating against consumers who exercise their rights, including denying goods or services, charging different prices, or offering different quality.

The exception is loyalty, rewards, premium features, or discount programs where the difference is reasonably related to the value the business derives from the data, provided the consumer participates voluntarily.

## Documentation and records

Each processed request must be documented. This includes:

Date and time of receipt.

Type of request and right exercised.

Identity verification process conducted.

Action taken (fulfilled, denied, or alternative adopted).

Date and form of response to the consumer.

If denied: justification recorded.

This documentation is what protects the business during a CPPA investigation.

## How AdOpt helps with the Privacy Portal

AdOpt records every consent, opt-out from selling and sharing, and SPI use limitation interaction, with a timestamp and unique identifier. When the consumer opts out via the site link or via the GPC, the system automatically updates the corresponding trackers.

AdOpt's auditable log serves as evidence of compliance for the CPPA. And when the law changes, the platform updates automatically.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Privacy Portal for your site that complies with the CPRA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what the Privacy Portal needs for the CPRA

**Request submission channel** described in the privacy policy (Civil Code § 1798.130).

**"Do Not Sell or Share My Personal Information"** link visible on homepage and collection pages (Civil Code § 1798.120).

**"Limit the Use of My Sensitive Personal Information"** link if SPI is collected (Civil Code § 1798.121).

**GPC honored** as a valid form of opt-out from selling and sharing.

**Coverage of all rights**: know, access, deletion, correction, portability, opt-out from selling/sharing, SPI limitation, non-discrimination.

**Right to correct** described with process and 45-day deadline (Civil Code § 1798.106).

**Right to limit SPI** described with process and 45-day deadline (Civil Code § 1798.121).

**Opt-out without unnecessary multiple steps** (maximum 2 steps to confirmation).

**Authorized agents** accepted for request submission (Civil Code § 1798.130 a(2)(C)).

**Deadlines**: 45 days to respond (+45 ext.); reasonable period for appeals.

**Free service** for up to 2 requests per consumer per year (Civil Code § 1798.130 a(3)).

**Documented record** of each request, action taken, and response sent.

**Protection for consumers under 16**: mandatory opt-in for selling/sharing.

**12-month waiting rule** after consumers under 16 decline consent.

**Information about CPPA** for submitting complaints after denials.

## Comparative: Privacy Portal deadlines under the CPRA

| Request type | Response deadline | Extension possible |
|---|---|---|
| Know, access, deletion, correction, portability | 45 days | +45 days with notification |
| Opt-out of selling and sharing | No specific deadline | Immediate recommended |
| Limit SPI use | No specific deadline | Immediate recommended |
| Free service per year | 2 times per consumer | Reasonable fee from 3rd request |

## FAQ: CPRA and Privacy Portal

**1. What is the new right to correct data under the CPRA and how must the Privacy Portal accommodate it?**
The right to correction (Civil Code § 1798.106) was added by the CPRA and did not exist under the CCPA. It allows consumers to request correction of inaccurate personal information maintained by the business. The Privacy Portal must have a specific option to request data correction, describe the verification and correction process, and respond within 45 days informing whether the correction was made or justifying why it was not possible. The business may maintain original data if it believes it is accurate, but must document the correction request and communicate the outcome to the consumer.

**2. How does the right to limit use of sensitive personal information (SPI) work?**
The right to SPI limitation (Civil Code § 1798.121) allows consumers to instruct the business to limit use of their sensitive personal information to essential purposes: providing the requested product or service, security, debugging, internal research, and compliance. The Privacy Portal must have a mechanism to receive this request, or the business must provide the "Limit the Use of My Sensitive Personal Information" link that leads to a page where this right can be exercised without multiple steps.

**3. Why is the GPC a valid form of opt-out under the CPRA?**
The CPPA confirmed in its guidance that the Global Privacy Control (GPC) is a valid technological form of opt-out from selling and sharing personal information under the CPRA. By activating the GPC, the consumer is automatically instructing each site visited not to sell or share their data. Ignoring the GPC when a visitor has it enabled is equivalent to ignoring an explicit opt-out, which constitutes a CPRA violation. A properly configured CMP detects the GPC and automatically blocks advertising trackers for visitors who have it enabled.

**4. Does the CPRA have an appeal process for consumers whose requests were denied?**
The CPRA does not have a formal structured appeal process like the OCPA and CTDPA. When the business denies a request, it must inform the consumer that they can submit a complaint to the California Privacy Protection Agency (CPPA). The CPPA complaint process is the primary avenue of recourse for consumers whose requests were denied without adequate justification.

**5. How should the Privacy Portal handle requests from parents on behalf of minor children?**
For consumers under 13, parents or legal guardians are the holders of the consent right. A DSAR submitted by a parent on behalf of a child under 13 must be processed the same way as a request from the consumer themselves, after reasonable verification of the parent/guardian relationship. For teenagers aged 13 to 15, the business may require the teenager themselves to submit the request, since the law recognizes teenagers' ability to exercise their own rights, while opt-in for selling/sharing remains required.

[Ready to build a Privacy Portal for your site that complies with the CPRA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


California CPRA: DSAR and Privacy Portal

Texas TDPSA and Cookies: All You Need to Know

A Virginia resident visits your site, uses your content, and at some point decides to exercise the rights the law guarantees them. They want to know what you have on them. They want to correct an inaccuracy. They want you to stop using their data for ads.

This page covers one piece of the picture. For the full scope of the VCDPA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the VCDPA and cookies](https://goadopt.io/en/blog/virginia-vcdpa-and-cookies-all-you-need-to-know/).

What happens from that point on?

The Virginia Consumer Data Protection Act (VCDPA, Va. Code § 59.1-575 et seq.), in effect since January 1, 2023, defines exactly what must happen: the channel to receive the request, the deadline to respond, the appeal process in case of denial, and what happens when the business does not comply.

This article covers all of it.

## What is a DSAR?

DSAR stands for Data Subject Access Request. In practice, it is any formal request made by a consumer to exercise the rights the law grants them over their own data.

This includes asking to see what you collected, correcting incorrect information, requesting deletion of their data, asking for a portable copy, refusing the use of their data for targeted advertising, or contesting a decision you made about a previous request.

If you are already familiar with the [GDPR](https://goadopt.io/en/blog/gdpr-cookies-explained/), the DSAR framework is familiar. The VCDPA follows the same logic: the consumer needs a functional channel to exercise the rights the law guarantees.

## What are consumer rights under the VCDPA?

Under Va. Code § 59.1-577 A, Virginia residents have five main rights:

### Right to access and confirmation

The consumer can request confirmation that the business processes their data and obtain a copy of the personal data the business holds, under Va. Code § 59.1-577 A, 1.

The response must be provided in an accessible and comprehensible format.

### Right to correction

The consumer can request correction of inaccuracies in personal data, taking into account the nature of the data and the purposes of processing, under Va. Code § 59.1-577 A, 2.

This covers any outdated, incomplete, or incorrect data. The business cannot ignore this request.

### Right to deletion

The consumer can request deletion of data they provided or that was obtained about them, under Va. Code § 59.1-577 A, 3.

There is a valid alternative in the VCDPA that does not exist in other laws: if the business obtained data from a source other than the consumer, it can fulfill the deletion request in two ways. It can delete the data outright, or it can retain the minimum data necessary to ensure the consumer's personal data remains deleted from active records and is not used for any other purpose (Va. Code § 59.1-577 B, 5).

### Right to portability

The consumer can obtain a copy of their data in a portable and, where technically feasible, readily usable format, when processing is carried out by automated means, under Va. Code § 59.1-577 A, 4.

This makes it easier to transfer data to another controller.

### Right to opt-out

The consumer can refuse the processing of their data for three specific purposes (Va. Code § 59.1-577 A, 5):

Targeted advertising (ads based on activities across non-affiliated websites over time).

Sale of personal data to third parties.

Profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer (such as access to credit, housing, insurance, employment, or healthcare services).

## Right to appeal

Under Va. Code § 59.1-577 C, if the business denies a request, the consumer has the right to appeal the decision.

The appeal process must:

Be conspicuously available and easy to find.

Be comparable to the original request submission process.

Result in a written response within **60 days**, including the decision and the reasoning.

If the appeal is denied, the business must inform the consumer about how to contact the Virginia Attorney General to file a complaint. Va. Code § 59.1-577 C specifies that, if available, the mechanism to contact the Attorney General should be online.

## What are the response deadlines?

The VCDPA is direct on deadlines.

**45 days** from receipt of an authenticated request (Va. Code § 59.1-577 B, 1).

The deadline can be extended by another **45 days** when reasonably necessary, considering complexity and volume of requests, as long as the consumer is notified within the initial period with the reason for the extension.

**60 days** to respond to appeals (Va. Code § 59.1-577 C).

These deadlines start when the request is received and authenticated. If additional information is needed to verify the consumer's identity, the deadline is paused until authentication is completed.

## What counts as "receipt" of a request?

Va. Code § 59.1-577 B uses the term "receipt of the request." For deadline purposes, the request is received when the business has the minimum information needed to process it.

The identity verification process can influence this marker. If the business requests additional information to authenticate the consumer, the deadline is paused until authentication is completed, under Va. Code § 59.1-577 B, 4.

This is why the verification process must be agile, proportionate to the type of data involved, and clearly described in the submission channel.

## What should the request submission channel look like?

Under Va. Code § 59.1-578 E, the controller must establish and describe in the Privacy Policy at least one secure and reliable means for consumers to submit rights requests.

This means must:

Consider how consumers normally interact with the controller.

Ensure secure and reliable communication.

Allow the controller to authenticate the consumer's identity.

Not require the consumer to create a new account. The business may require use of an existing account, but cannot force the user to register a new one just to exercise a legal right.

A well-structured Privacy Portal offers:

A request submission form with clear categories (access, correction, deletion, portability, opt-out).

A proportionate and non-discriminatory identity verification process.

Automatic receipt confirmation with a tracking reference number.

A log of each request, action taken, and response sent.

An appeal channel for denied cases.

The [cookie consent on the site](https://goadopt.io/en/blog/operation-of-cookie-banner/) and the Privacy Portal must be integrated so that consumer preferences are reflected in real time in the business's operational systems.

## Identity verification: how to do it without creating barriers

The VCDPA requires the controller to authenticate the consumer's identity using commercially reasonable efforts, under Va. Code § 59.1-577 B, 4.

If authentication is not possible with commercially reasonable efforts, the business is not required to fulfill the request, but may ask for additional information that is reasonably necessary.

In practice, this means:

For low-risk data: an email confirmation may be sufficient.

For sensitive data or higher-risk situations: a second verification factor may be justified.

What is never acceptable: requiring physical ID documents for access to simple browsing data, creating deliberately burdensome processes to discourage requests, or denying requests based on impossible authentication when simpler methods are available.

## Fees: what the law says

Under Va. Code § 59.1-577 B, 3, request processing is free of charge **up to twice per year** per consumer.

This is an important point of difference from other state laws. The NHDPA, for example, provides free service only once per year. The VCDPA guarantees twice.

From the third request within the same 12-month period, the business may charge a reasonable fee or decline if the request is manifestly unfounded, excessive, or repetitive. The burden of demonstrating the excessive nature lies with the business.

## How to process each type of DSAR in practice

### Access request

Receive and authenticate the data subject.

Locate all personal data the business holds about this consumer across all systems.

Prepare a copy in a readable and accessible format.

Include in the response: categories of data, purposes of processing, third parties with whom the data was shared.

Send the response within the 45-day deadline.

An up-to-date data inventory is what makes this process viable at scale.

### Correction request

Receive and authenticate.

Identify which data is inaccurate and in which systems it is stored.

Correct in primary systems and, where applicable, notify third parties that received the data so they can also make the correction on their side.

Confirm to the consumer that the correction was made.

### Deletion request

Receive and authenticate.

Check whether a legal exception exists that allows retaining the data (legal obligation, judicial defense, protected purpose).

If no exception: delete from active systems. For data obtained from third parties, there is the option of retaining the minimum necessary to ensure the data remains deleted from active records (Va. Code § 59.1-577 B, 5).

Notify third parties that received the data to also delete it where applicable.

Confirm to the consumer what was deleted and, if any partial retention is justified, explain the legal basis.

### Portability request

Receive and authenticate.

Generate a file with the consumer's data in a portable and machine-readable format, such as JSON or CSV.

Deliver it to the consumer securely within the deadline.

### Opt-out request

The opt-out of targeted advertising, data sale, or profiling with significant effects must result in the effective cessation of processing for those purposes.

The VCDPA does not specify a separate cessation deadline, unlike the NHDPA which has a specific 15-day period. The legal standard is "without undue delay" within the general 45-day response period. In practice, well-configured systems process opt-outs in real time or within a few hours.

A [consent management platform](https://goadopt.io/en/blog/how-to-choose-cmp-consent-management-platform/) integrated with the business's systems automates this workflow.

## What happens when the business denies a request?

The business may deny a request when:

It cannot authenticate the consumer's identity with commercially reasonable efforts.

The request is manifestly unfounded or excessive.

A legal exception justifies continued processing or retention.

In all cases, the denial must be communicated to the consumer within the 45-day deadline, with:

The reason for the denial clearly stated.

Instructions on how to appeal the decision (Va. Code § 59.1-577 B, 2).

The appeal process must result in a written response within 60 days. If the appeal is also denied, the consumer must be informed about how to contact the Virginia Attorney General.

## Protection against discrimination

Va. Code § 59.1-578 A, 4 expressly prohibits businesses from discriminating against consumers who exercise their rights. This includes denying products or services, charging different prices, or offering lower quality.

The exception: voluntary loyalty, rewards, premium features, discount, or club card programs that offer benefits in exchange for data use are permitted, provided the consumer participates voluntarily.

## Special protection for children and minors

Va. Code § 59.1-578 F prohibits processing data of known children under 13 for targeted advertising, data sale, or profiling with significant effects.

For social media platforms, starting January 2026, protection extends to minors under 16, with a 1-hour daily usage limit (Va. Code § 59.1-577.1).

If your portal receives requests from users in these age ranges, the process must have a differentiated flow.

## Documentation and records

Every processed request must be documented. This includes:

Date and time of receipt.

Type of request.

Authentication process performed.

Action taken (fulfilled, denied, or alternative adopted).

Date and form of response to the consumer.

In case of denial: recorded justification.

In case of appeal: complete history and final decision.

This documentation is what protects the business in the event of an Attorney General investigation. Without records, there is no way to demonstrate that processes were completed within the required deadlines.

## The cure period and its relationship to DSARs

Before initiating any action, the Attorney General must send notice with **30 days** for the business to cure the violation (Va. Code § 59.1-584 B). If the business cures and provides a written correction statement, no action is initiated.

Businesses without a structured DSAR process have great difficulty correcting in 30 days what should have been implemented from the start. The cure period is a guarantee, not a compliance strategy.

If the violation continues, penalties can reach **US$ 7,500 per violation**, with each consumer whose right was violated potentially counting as a separate violation.

## How AdOpt helps with the Privacy Portal

AdOpt logs every consent and opt-out interaction with a timestamp and unique identifier. When the consumer opts out of targeted advertising through the Privacy Portal, the system automatically updates cookie and tracker triggers.

AdOpt's auditable log serves as evidence that processes were completed as required by the VCDPA. And when legislation changes, the platform updates automatically.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Privacy Portal for your site that complies with the VCDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what the Privacy Portal needs for the VCDPA

**Request submission channel** without requiring creation of a new account (Va. Code § 59.1-578 E).

**Coverage of all 5 rights** guaranteed by the VCDPA: access, correction, deletion, portability, and opt-out.

**Conspicuously available appeal process** comparable to the original submission channel (Va. Code § 59.1-577 C).

**45-day response deadline**, with the option to extend by another 45 days with notification (Va. Code § 59.1-577 B, 1).

**60-day deadline** to respond to appeals (Va. Code § 59.1-577 C).

**Commercially reasonable identity authentication** process (Va. Code § 59.1-577 B, 4).

**Free service up to twice per year** per consumer (Va. Code § 59.1-577 B, 3).

**Documented record** of each request, action taken, and response sent.

**Information about how to contact the Attorney General** in case of a denied appeal (Va. Code § 59.1-577 C).

**Non-discrimination protection** for consumers exercising their rights (Va. Code § 59.1-578 A, 4).

**Differentiated treatment** for known children under 13 (Va. Code § 59.1-578 F).

**Notification to third parties** where applicable for deletion or correction of shared data.

## Comparison: Privacy Portal deadlines under the VCDPA

| Request type | Response deadline | Extension possible |
|---|---|---|
| Access, correction, deletion, portability | 45 days | +45 days with notification |
| Opt-out (advertising, sale, profiling) | 45 days | +45 days with notification |
| Appeal of a decision | 60 days | Not specified |
| Cure period for violations | 30 days guaranteed | No extension |

## FAQ: VCDPA and Privacy Portal

**1. Does the VCDPA require a dedicated Privacy Portal?**
Not by name. Va. Code § 59.1-578 E requires the controller to establish and describe in the Privacy Policy at least one secure and reliable means for submitting requests. A dedicated Privacy Portal is the most organized way to meet this requirement, but a well-structured contact form or a monitored email address can also fulfill the obligation, as long as they meet the security and reliability criteria.

**2. Does the VCDPA have a specific deadline to cease processing after an opt-out?**
Not in the same way as the NHDPA, which specifies 15 days. The VCDPA uses the criterion "without undue delay" for the general response, with a maximum of 45 days (Va. Code § 59.1-577 B, 1). In practice, for targeted advertising opt-outs, the expectation is that cessation is processed with the greatest technically reasonable agility, within the formal response deadline.

**3. How many times per year must the business process DSARs free of charge?**
Twice per year per consumer, under Va. Code § 59.1-577 B, 3. From the third request within the same 12-month period, the business may charge a reasonable fee or decline if the request is manifestly unfounded, excessive, or repetitive. The burden of proving the excessive nature lies with the business.

**4. What happens if the business does not have a DSAR process when it receives an Attorney General notice?**
The Attorney General sends notice with 30 days to cure (Va. Code § 59.1-584 B). If the business fails to implement the process within the deadline or breaches the written correction statement provided, the AG may seek penalties of up to US$ 7,500 per violation. Each consumer whose right was violated can be a separate violation, which quickly escalates the financial exposure.

**5. How does the VCDPA handle data of consumers obtained from third parties in the context of a deletion request?**
Va. Code § 59.1-577 B, 5 offers a specific alternative for this case. A business that obtained data from a source other than the consumer may fulfill the deletion request in two ways: by deleting the data outright, or by retaining the minimum data necessary to ensure the consumer's personal data remains deleted from active records and is not used for any purpose other than maintaining that deletion. This alternative does not exist in the NHDPA or in some other US state privacy laws.

[Ready to build a Privacy Portal for your site that complies with the VCDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


Virginia VCDPA: DSAR Privacy Portal

In today's digital age, data is the lifeblood of businesses. Yet, the handling of personal data comes with great responsibility, which is where GDPR (General Data Protection Regulation) legal basis step in. Whether you're a seasoned programmer, a marketing guru, an enterprising entrepreneur, a legal expert, or an agency owner, comprehending GDPR legal basis is pivotal. In this article, we'll explore these foundations and provide practical insights from the basics to more advanced concepts.

## The Meaning of GDPR Legal Basis

Before diving into the intricacies, it's vital to grasp why GDPR legal basis hold immense importance. These legal basis essentially serve as the pillars upon which data processing activities are built. They answer the fundamental question, "Why are we collecting and using this personal data?"

Learn more about: [The differences between data operator and data controller]https://goadopt.io/en/blog/differences-data-controller-data-processor/)

### **1. Consent: The Power of Voluntary Agreement**

In Practice: [Consent](https://goadopt.io/en/blog/website-needs-cookie-consent-gdpr-lgpd-ccpa/) is perhaps the most familiar and widely recognized legal basis under GDPR.

Practical Perspective: It's akin to getting a clear green light from individuals before processing their data. Think of it as an enthusiastic "Yes!" from the data subject.

### **2. Contractual Necessity: Data for Service Delivery**

In Action: Sometimes, data processing is indispensable to fulfill a contract or service.

Real-world Scenario: Consider a scenario where you purchase a concert ticket online. The event organizers need your data to deliver the ticket to you, forming a contractual necessity.

### **3. Legal Obligation: Compliance with the Law**

In Action: GDPR permits data processing to meet legal obligations.

Practical Example: Think of tax reporting – when the law mandates sharing financial data, you're complying with legal obligations.

### **4. Vital Interests: Data for Life-Saving Purposes**

Caring for Others: Vital interests can serve as a legal basis when someone's life is at stake.

Practical Scenario: Imagine a hospital sharing a patient's medical data with another hospital in an emergency to save a life.

### **5. Legitimate Interests: Balancing Act**

Balancing Act: GDPR allows data processing when you have a legitimate reason and it doesn't infringe on individuals' rights.

Real-world Use: A company analyzing customer data to improve its services is a prime example of legitimate interests.

### **6. Public Task: Official Duties**

Public Duties: Public authorities can process data to perform their official tasks.

Everyday Context: Government agencies can collect data to fulfill their official duties, such as issuing licenses or permits.

### **7. Consent for Special Data: Special categories of data, like health information, require explicit consent.**

Real-world Scenario: Think of a healthcare provider obtaining explicit consent before processing sensitive patient health data.

## Why the Choice Matters: GDPR and Beyond

Choosing the right legal basis is not just about compliance; it's about respecting individual rights and ensuring responsible data usage. But GDPR is just one piece of the puzzle. Other global legislations like [LGPD (Brazil)](https://goadopt.io/en/blog/lgpd-cookies-all-you-need-to-know/), CCPA (California), and PIPEDA (Canada) also have their own sets of legal basis.

Comparing with [LGPD (Brazil)](https://goadopt.io/en/blog/lgpd-cookies-all-you-need-to-know/), CCPA (California), and PIPEDA (Canada)

LGPD: Brazil's [LGPD](https://goadopt.io/en/blog/lgpd-cookies-all-you-need-to-know/) draws parallels to GDPR, emphasizing consent, legitimate interest, and compliance with legal obligations. Read More

Learn more about: [LGPD legal basis.](https://goadopt.io/en/blog/lgpd-general-data-protection-law/)

CCPA: California's [CCPA](https://goadopt.io/en/blog/gdpr-lgpd-and-ccpa-what-are-these-laws-similarities-and-differences/) is similar to GDPR's consent and legitimate interests. It grants Californians rights over their data and the option to opt out. Read More

PIPEDA: Canada's PIPEDA focuses on obtaining meaningful consent, and it aligns with GDPR on consent, contractual necessity, and legal obligations. Read More

[Learn more about the similarities and differences between LGPD, GDPR and CCPA...](https://goadopt.io/en/blog/gdpr-lgpd-and-ccpa-what-are-these-laws-similarities-and-differences/)

## Choosing Wisely and Protecting Your Website

Selecting the appropriate legal basis is critical, not just for GDPR compliance but for respecting data subjects' rights and building trust. Ensuring that your website complies with GDPR and other applicable legislations is equally vital. Utilizing a robust cookie consent notice, such as the one provided by AdOpt ([https://goadopt.io](https://goadopt.io)), can significantly enhance website protection and user trust. It's your assurance that you're not just compliant but also dedicated to safeguarding user data in an ever-evolving digital landscape.

Learn more about: [What is a CMP - Consent Management Platform?](https://goadopt.io/en/blog/what-is-a-cmp-consent-management-platform/)

In conclusion, whether you're a developer, marketer, entrepreneur, legal expert, or agency owner, grasping GDPR legal basis empowers you to navigate the data privacy realm responsibly. Make your data processing decisions wisely, and ensure that your website remains a beacon of trust in the digital world.

In this article we guide you on: [How does a Cookie Banner work](https://goadopt.io/en/blog/operation-of-cookie-banner/).

And, if you need a [CMP to help you with your website consents, look for AdOpt as a great option](https://goadopt.io)!
Here in this article we help you on: [How to choose a cookie banner for your website](https://goadopt.io/en/blog/how-to-choose-a-cookie-banner-for-your-website/).


GDPR Legal Basis: An Introduction

The Florida Digital Bill of Rights (FDBR) guarantees seven rights to Florida consumers. For each of those rights, there is a corresponding obligation on your side: a channel to receive the request, a deadline to respond, a structured appeal process, and documentation of the entire flow.

This page covers one piece of the picture. For the full scope of the FDBR — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the FDBR and cookies](https://goadopt.io/en/blog/florida-fdbr-and-cookies-all-you-need-to-know/).

This article covers all of it: what a DSAR is under the FDBR, what the seven guaranteed rights are, how to process each type of request, the law's specific deadlines, and what happens when the process does not work as it should.

## What is a DSAR under the FDBR?

DSAR stands for Data Subject Access Request. In practice, it is any formal request from a Florida consumer to exercise the rights the FDBR (§§ 501.701 to 501.721) grants them over their own data.

The FDBR guarantees seven rights, two of which are exclusive to this law. This means that a Privacy Portal for a company within the FDBR's scope must cover more scenarios than portals configured for most other US state privacy laws.

If you are already familiar with the [GDPR](https://goadopt.io/en/blog/gdpr-cookies-explained/) rights framework, the structure is familiar. The logic is the same: the consumer needs a functional channel to exercise the rights the law guarantees.

## What are the seven consumer rights under the FDBR?

Under § 501.705(2), Florida residents have the following rights:

### 1. Right to access and confirmation

The consumer may confirm whether the business processes their data and obtain a copy of the personal data the business holds, under § 501.705(2)(a).

The response must be provided in an accessible format.

### 2. Right to correction

The consumer may request correction of inaccuracies in personal data, considering the nature of the data and the purposes of processing, under § 501.705(2)(b).

The business may, if it maintains a self-service correction mechanism, direct the consumer to use it. But it must inform the consumer of this option within the response deadline (§ 501.706(3)).

### 3. Right to deletion

The consumer may request deletion of any or all data provided by or obtained about them, under § 501.705(2)(c).

The FDBR allows two forms of compliance when data was obtained from a third party (§ 501.706(6)):

Delete the data and retain only the deletion request record and the minimum data necessary to ensure the consumer's data remains deleted, without using the retained data for any other purpose.

Opt the consumer out of the processing of that data for any non-exempt purpose.

### 4. Right to portability

The consumer may obtain a copy of their data in a portable and, where technically feasible, readily usable format, if the data is available in a digital format, under § 501.705(2)(d).

### 5. Right to opt out of targeted advertising, data sale, and profiling

The consumer may refuse processing of their data for targeted advertising, sale of personal data, and profiling in furtherance of decisions with legal or similarly significant effects (§ 501.705(2)(e)).

### 6. Right to opt out of sensitive data and geolocation

The consumer may opt out of the collection of sensitive data, including precise geolocation data, or the processing of sensitive data, under § 501.705(2)(f).

This is a right exclusive to the FDBR. Sensitive data includes racial or ethnic origin, religious beliefs, health diagnosis, sexual orientation, immigration status, genetic or biometric data, known children's data, and precise geolocation (§ 501.702(31)).

### 7. Right to opt out of voice and facial recognition

The consumer may opt out of data collection via voice recognition or facial recognition features, under § 501.705(2)(g).

This is the most exclusive right of the FDBR. If the business operates voice recognition technology (virtual assistants, audio commands) or facial recognition (identity verification, expression analysis), the consumer has the right to refuse data collection via these features.

### The device surveillance prohibition

§ 501.705(3) goes beyond opt-out rights. Devices with voice, video, facial recognition, audio, or other data collection sensors cannot use these features for surveillance when not in active use by the consumer, unless they have expressly authorized it.

## What are the response deadlines?

The FDBR has deadlines that differ from other US state privacy laws.

**45 days** from receipt of an authenticated request to respond (§ 501.706(2)).

The deadline can be extended **once by 15 additional days** when reasonably necessary, considering the complexity and number of requests, as long as the consumer is notified within the initial period with the reason. The FDBR's extension period is 15 days, not 45 like other laws.

After fulfilling the request, the controller must provide **notice to the consumer within 60 days** confirming compliance (§ 501.706(4)).

**60 days** to respond to appeals (§ 501.707(3)).

Service is free **at least twice per year** per consumer (§ 501.706(5)).

## Two or more channels required for request submission

§ 501.709 requires the controller to establish **two or more methods** for submitting requests. This is a requirement exclusive to the FDBR among US state privacy laws.

The methods must be:

Secure and reliable.

Clearly and conspicuously accessible.

Appropriate for the ways consumers normally interact with the controller.

Capable of supporting authentication of the consumer's identity.

Additionally, the controller must maintain a mechanism on its own website for request submission (§ 501.709(3)). Businesses operating exclusively online with a direct consumer relationship may additionally accept requests by email.

The business cannot require consumers to create a new account to exercise their rights. It may require use of an existing account.

## How the appeal process must work

Under § 501.707, the controller must establish an appeal process that is:

Conspicuously available and easy to find.

Similar to the original request submission process.

Capable of resulting in a written response within **60 days**, including the decision and the reasoning.

The FDBR does not explicitly mention that the consumer must be informed about how to contact the Department of Legal Affairs after a denied appeal, unlike the VCDPA. But the business should inform consumers of available escalation channels.

## Identity verification: how to do it without creating barriers

The business needs to verify that whoever is submitting the request is the data subject. But the process cannot be a disproportionate barrier.

Under § 501.706(3), if the business cannot authenticate the request, it is not required to fulfill it, but must make a reasonable effort to request additional information reasonably necessary to authenticate the consumer and the request.

In practice:

For low-risk data: email confirmation may be sufficient.

For sensitive data or high-risk situations: a second verification factor may be justified.

What is never acceptable: disproportionate barriers relative to the type of data involved, requiring creation of a new account, or requesting more personal data than necessary to authenticate.

## Free service: at least twice per year

Service is free **at least twice per year** per consumer (§ 501.706(5)). For requests beyond that limit, or that are manifestly unfounded, excessive, or repetitive, the business may charge a reasonable fee or decline. The burden of demonstrating the excessive nature lies with the controller.

## How to process each type of DSAR in practice

### Access request

Receive and authenticate the data subject.

Locate all personal data the business holds about this consumer across all systems.

Prepare a copy in a readable and accessible format.

Include: categories of data, purposes, third parties that received the data, retention period.

Send the response within the 45-day deadline.

Send a compliance notice within 60 days (§ 501.706(4)).

### Correction request

Receive and authenticate.

Identify the inaccurate data and which systems it is stored in.

Correct in primary systems and, where applicable, notify third parties that received the data.

Confirm to the consumer that the correction was made.

If the business maintains a self-correction mechanism, it may direct the consumer to use it, but must notify within the deadline.

### Deletion request

Receive and authenticate.

Check whether a legal exception allows retaining the data.

For data obtained from third parties, choose between the two options in § 501.706(6): delete outright, or opt the consumer out of all non-exempt processing.

Notify third parties that received the data when applicable.

Confirm to the consumer what was deleted.

### Portability request

Receive and authenticate.

Generate a file with the consumer's data in a portable format, when available digitally.

Deliver to the consumer securely within the deadline.

### Opt-out of targeted advertising and data sale

Receive and authenticate.

Cease processing for targeted advertising, data sale, and profiling with significant effects without undue delay.

Configure systems to ensure this consumer is not included in those practices.

Note: continuing to sell or share data after opt-out subjects the business to **tripled penalties** (§ 501.72(1)(c)).

A [consent management platform](https://goadopt.io/en/blog/how-to-choose-cmp-consent-management-platform/) integrated with the business's systems automates a large part of this workflow.

### Opt-out of sensitive data and geolocation

Receive and authenticate.

Identify all sensitive data collection points on the site or in the product.

Cease collection of sensitive data for this consumer as requested.

If precise geolocation was being collected, ensure that collection stops immediately.

Document the action taken.

### Opt-out of voice and facial recognition

Receive and authenticate.

Identify all voice and camera collection features in the product.

Configure the system to not collect voice or facial recognition data from this consumer.

Document the action taken.

## What happens when the business denies a request?

The business may deny a request when:

It cannot authenticate the consumer's identity with commercially reasonable efforts.

The request is manifestly unfounded or excessive.

A legal exception justifies continued processing.

In all cases, the denial must be communicated to the consumer within the 45-day deadline (§ 501.706(3)), with:

The reason for the denial clearly stated.

Instructions on how to appeal the decision.

The appeal process must result in a written response within 60 days.

## Protection against discrimination

§ 501.71(2)(c) prohibits businesses from discriminating against consumers who exercise their rights. This includes denying products or services, charging different prices, or offering lower quality.

The exception: financial incentive programs, including payments to consumers as compensation for data processing, are permitted if the consumer gives clear prior consent to the material terms, and provided such incentives are not unjust, coercive, or unreasonable. The consent may be revoked at any time.

## Special protection: "child" means under 18 years of age

The FDBR uses a higher threshold. "Known child" (§ 501.702(17)) is any individual under **18 years of age** of whose age the controller has actual knowledge or willfully disregards.

A controller that deliberately disregards a user's age is treated as having actual knowledge of it.

For requests from known children: parents or legal guardians may exercise the seven rights on behalf of the child (§ 501.705(1)).

Penalties for violations involving known children are **automatically tripled** by the FDBR (§ 501.72(1)(a)).

## Documentation and records

Every processed request must be documented. This includes:

Date and time of receipt.

Type of request (including which of the seven rights was exercised).

Authentication process performed.

Action taken.

Date the compliance notice was sent.

In case of denial: recorded justification.

In case of appeal: complete history and final decision.

This documentation is what protects the business in the event of a Department of Legal Affairs investigation. Penalties for failure to delete or correct data after an authenticated request are tripled (§ 501.72(1)(b)).

## The FDBR cure period and DSARs

The Department of Legal Affairs may grant a **45-day cure period** before initiating action (§ 501.72(2)), but this period is **discretionary**, not guaranteed.

And there is a critical exception: **violations involving known Florida children have no cure period available** (§ 501.72(2)). The Department may initiate immediate action.

Businesses without a structured DSAR process when they receive a Department notification face significant difficulty correcting in 45 days what should have been implemented from the start.

## How AdOpt helps with the Privacy Portal under the FDBR

AdOpt logs every consent and opt-out interaction with a timestamp and unique identifier. When the consumer exercises opt-out of targeted advertising, sensitive data, or voice/facial recognition through the Privacy Portal, the system automatically updates the corresponding triggers.

AdOpt's auditable log serves as evidence that processes were completed as required by the FDBR. And when legislation changes, the platform updates automatically.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Privacy Portal for your site that complies with the FDBR? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what the Privacy Portal needs for the FDBR

**Two or more submission channels** that are secure and clearly accessible (§ 501.709).

**Mechanism on the website** for request submission (§ 501.709(3)).

**Coverage of all 7 rights** guaranteed by the FDBR, including opt-out for sensitive data and voice/facial recognition.

**Conspicuously available appeal process** similar to the original submission channel (§ 501.707).

**45-day response deadline**, with extension of only 15 additional days when necessary (§ 501.706(2)).

**Compliance notice** sent to the consumer within 60 days of fulfillment (§ 501.706(4)).

**60-day deadline** to respond to appeals (§ 501.707(3)).

**Authentication process** using commercially reasonable efforts (§ 501.706(3)).

**Free service at least twice per year** per consumer (§ 501.706(5)).

**Documented record** of each request, including which right was exercised.

**Differentiated treatment** for known children under 18 years of age (§ 501.702(17)).

**Parents and legal guardians** may exercise rights on behalf of known children (§ 501.705(1)).

**Non-discrimination protection** for consumers exercising their rights (§ 501.71(2)(c)).

## Comparison: Privacy Portal deadlines under the FDBR

| Request type | Response deadline | Extension possible |
|---|---|---|
| All 7 rights | 45 days | +15 days only (not +45) |
| Compliance notice | 60 days after fulfillment | Does not apply |
| Appeal of a decision | 60 days | Not specified |
| Cure period (general violations) | 45 days (discretionary) | No extension |
| Cure period (violations with children) | Does not exist | N/A |

## FAQ: FDBR and Privacy Portal

**1. Why does the FDBR require two or more DSAR channels while other laws require only one?**
§ 501.709 explicitly requires two or more methods for submitting requests, signaling that the Florida legislature considered a single channel insufficient for different consumer profiles. The methods must be secure, reliable, and clearly accessible, taking into account how consumers normally interact with the controller. A business could use, for example, a website form as one channel and a dedicated email address as a second.

**2. Is the FDBR's extension period really only 15 additional days?**
Yes. § 501.706(2) allows an extension of only 15 additional days beyond the initial 45 days. Other state laws like the VCDPA and NHDPA allow extensions of 45 additional days. This means the maximum total response period under the FDBR is 60 days, versus up to 90 days under other laws. Businesses within the FDBR's scope need more agile processes to ensure compliance.

**3. Does the FDBR have a guaranteed cure period like the VCDPA?**
No. The FDBR's 45-day cure period is discretionary (§ 501.72(2)): the Department of Legal Affairs may or may not grant it, considering the number and frequency of violations, the substantial likelihood of public harm, and the safety of persons or property. Additionally, violations involving known Florida children have no cure period available. The Department may initiate immediate action in those cases.

**4. How does the FDBR treat children differently from other laws in the context of DSARs?**
The FDBR uses an 18-year threshold for "known child" (§ 501.702(17)), not 13 as most US laws do. Parents and legal guardians may exercise all seven rights on behalf of known children (§ 501.705(1)). Violations involving known children have no cure period and penalties are automatically tripled (§ 501.72(1)(a)). A controller that deliberately disregards a user's age is treated as having actual knowledge of it.

**5. What happens if the business continues selling data after the consumer opts out?**
§ 501.72(1)(c) lists continued sale or sharing of data after consumer opt-out as one of the violations that result in **automatically tripled penalties**. Each affected consumer can be counted as a separate violation, rapidly escalating the financial exposure. The base penalty reaches US$ 50,000 per violation, triplicable to US$ 150,000. For businesses with large user bases, this can represent significant financial risk.

[Ready to build a Privacy Portal for your site that complies with the FDBR? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


Florida FDBR: DSAR Privacy Portal

The Iowa Consumer Data Protection Act (ICDPA, Iowa Code § 715D) has a specific requirement for advertising cookies worth highlighting from the start.

This page covers one piece of the picture. For the full scope of the ICDPA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the ICDPA and cookies](https://goadopt.io/en/blog/iowa-icdpa-and-cookies-all-you-need-to-know/).

The law formally lists only the opt-out from data sales as a consumer right (§ 715D.3(1)(d)). But § 715D.4(6) requires that, if the business engages in targeted advertising, it must clearly disclose this and describe how the consumer can exercise an opt-out from that activity.

In practice, any site with advertising pixels must offer an opt-out from targeted advertising, even though it is technically a transparency obligation rather than a formally listed right.

This article focuses exclusively on what the ICDPA requires from a Cookies Policy.

## Cookies Policy vs. cookie banner: the necessary distinction

The [cookie banner](https://goadopt.io/en/blog/how-to-choose-a-cookie-banner-for-your-website/) is the consent interface. It is what the visitor sees when they first access the site.

The Cookies Policy is the detailed document. It is where the user finds complete information about each technology: what it collects, what it is for, who receives the data.

Both need to exist. Both need to be aligned. And the Cookies Policy must be accessible from a clear link within the [consent notice](https://goadopt.io/en/blog/operation-of-cookie-banner/) itself.

## What the ICDPA specifically requires for cookies

### Specific purpose for each tracker category

Under § 715D.4(5)(b), the privacy notice must include the purpose for processing personal data. For cookies, this translates into describing the purpose of each tracker category clearly.

What does not work: "cookies to improve your experience."

What works: "Analytics cookies: collect browsing behavior data to identify content improvement opportunities. Data is not sold to third parties."

"Advertising cookies: collect behavioral identifiers sent to advertising platforms for targeted advertising on non-affiliated websites. Consumers may opt out via the mechanism described in the privacy notice."

### Cookie categories present on the site

The Policy must list the tracker categories:

**Necessary cookies:** essential for basic functionality. Do not constitute targeted advertising or data sale. Must be documented.

**Analytics cookies:** measure browsing behavior. Depending on the tool, may constitute targeted advertising if data is sent to third parties for targeting on other sites.

**Advertising cookies:** feed ad pixels for targeted advertising on non-affiliated sites. Require disclosure and opt-out per § 715D.4(6).

**Functional cookies:** remember user preferences. Generally do not constitute targeted advertising or data sale.

**Third-party cookies:** fired by external services. [Correct tag categorization](https://goadopt.io/en/blog/best-practices-tag-categorization/) is what makes accurate documentation possible.

### Targeted advertising: the ICDPA criterion

Under § 715D.1(28), targeted advertising consists of ads selected based on data obtained from the consumer's activities over time and across **non-affiliated** websites or online applications.

What does not constitute targeted advertising:

Ads based on activities within the controller's own site or affiliated sites.

Ads based on the context of the current search query or current visit.

Ads in response to consumer information requests or feedback.

Processing solely to measure advertising performance, reach, or frequency.

Retargeting campaigns using consumer behavior data from other sites almost always constitute targeted advertising.

### The distinction between "sale" and "targeted advertising" under the ICDPA

The ICDPA distinguishes:

**Sale of data** (§ 715D.1(25)): exchange for monetary consideration to third parties. Consumer has a formal opt-out right.

**Targeted advertising** (§ 715D.1(28)): use of behavior data from non-affiliated sites to select ads. Not a formally listed opt-out right in § 715D.3, but the controller is required to disclose and offer opt-out per § 715D.4(6).

This creates an operational distinction: the business must offer opt-out from targeted advertising as part of transparency obligations, even though the consumer cannot formally "invoke" this opt-out in the same way they can invoke opt-out from data sales.

### Categories of third parties receiving data via cookies

Under § 715D.4(5)(d) and (e), the privacy notice must identify categories of data shared with third parties and categories of third parties with whom data is shared.

For cookies, this includes digital advertising platforms, analytics tools that send data to third parties, and any partner receiving behavioral data from site users.

### Retention period

The ICDPA does not require the Cookies Policy to specify data retention periods. This is a CPRA requirement, but not an ICDPA requirement.

Including retention information is a best practice for sites serving consumers in other jurisdictions, but it is not required by Iowa law.

## The opt-out mechanism for sales and targeted advertising

Under § 715D.4(6), the controller must clearly describe how the consumer can opt out of both data sales and targeted advertising.

The format of the opt-out mechanism is not specified. It may be a footer link, a button in the cookie notice, or an online form described in the privacy notice.

The Cookies Policy must identify this mechanism and describe what happens when the consumer exercises the opt-out: which technologies are deactivated.

A well-configured [consent management platform](https://goadopt.io/en/blog/how-to-choose-cmp-consent-management-platform/) ensures that when the user exercises opt-out, all advertising pixels and trackers automatically stop firing.

## Sensitive data collected via cookies

Under § 715D.1(26), sensitive data includes precise geolocation data (within 1,750 feet) and biometric data for identification.

If the site collects precise geolocation data via cookies, that is sensitive data under the ICDPA.

For sensitive data, the ICDPA requires (§ 715D.4(2)):

Presenting the consumer with a clear notice before processing.

Offering an opt-out opportunity.

This is the same opt-out model as the UCPA. It does not require prior consent, only notice and opt-out.

## Do analytics cookies constitute targeted advertising under the ICDPA?

If Google Analytics sends user behavior data to Google and that data is used for advertising on other sites, this may constitute targeted advertising under the ICDPA.

The [ANPD Cookie Guidance](https://goadopt.io/en/blog/anpd-cookies-guidance-personal-data-protection-lgpd/) has documented how major analytics providers can cross-reference data for advertising purposes.

The safest approach: include Google Analytics in the category of cookies that may constitute targeted advertising, offer opt-out, and document this categorization in the Cookies Policy.

## When to update the Cookies Policy

Situations requiring an update:

Adding a new advertising pixel or tracker.

A new analytics tool sending data to third parties for targeting.

A new partner receiving behavioral data from site users.

Change in the use of cookie data for new purposes.

Any modification to opt-out mechanisms.

Continuous [data mapping](https://goadopt.io/en/blog/data-mapping-or-data-inventory/) is what keeps the cookie inventory synchronized with the document.

## The 90-day cure period and the Cookies Policy

The AG must grant **90 guaranteed days** to cure before initiating any action (§ 715D.8(2)). An inadequate Cookies Policy can be corrected within that period if the business has structured processes.

If the violation continues after 90 days, penalties can reach **US$ 7,500 per violation**.

## How AdOpt helps with the Cookies Policy under the ICDPA

AdOpt's automatic scan identifies all active technologies on the site, feeding the list of categories that must appear in the Cookies Policy.

The [cookie notice](https://goadopt.io/en/blog/operation-of-cookie-banner/) configured through AdOpt blocks non-necessary trackers, presents categories with clear descriptions, offers opt-out from data sales and targeted advertising, and logs every interaction for audit purposes.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Cookies Policy for your site that complies with the ICDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what your Cookies Policy needs for the ICDPA

**Visible link** in the footer and in the cookie banner.

**Listing of cookie categories** with a description of what each does.

**Specific purpose for each category** (§ 715D.4(5)(b)).

**Identification of cookies constituting targeted advertising** (§ 715D.1(28)).

**Identification of cookies constituting data sales** (§ 715D.1(25)).

**Categories of third parties** receiving data via cookies (§ 715D.4(5)(e)).

**Opt-out mechanism for data sales**, clear and accessible (§ 715D.3(1)(d) and 715D.4(6)).

**Opt-out mechanism for targeted advertising**, clear and accessible (§ 715D.4(6)).

**Notice and opt-out** for sensitive data collected via cookies (§ 715D.4(2)).

**Accessible language**, without legal jargon.

## FAQ: ICDPA and Cookies Policy

**1. Does the ICDPA require a formal opt-out right from targeted advertising?**
Not as a formally listed right in § 715D.3, but required in practice. § 715D.4(6) requires that if the controller engages in targeted advertising, it must clearly disclose this and describe the opt-out method. This creates a practical obligation equivalent to a right, even though it is technically a transparency obligation rather than a formally listed right. The Cookies Policy must offer this opt-out.

**2. What is the difference between opt-out from "sales" and opt-out from "targeted advertising" under the ICDPA?**
"Sale of data" (§ 715D.1(25)) is the exchange for monetary consideration, and opt-out is a formal consumer right in § 715D.3(1)(d). "Targeted advertising" (§ 715D.1(28)) is the use of behavior data from non-affiliated sites to select ads, and opt-out is a controller transparency obligation in § 715D.4(6), not a formally listed right. In practice, the Cookies Policy must offer opt-out for both activities, but the legal bases are different.

**3. Do analytics cookies like Google Analytics constitute targeted advertising under the ICDPA?**
It depends on the configuration. If Google Analytics only generates internal usage reports, it generally does not constitute targeted advertising. If data is used by Google for advertising on other sites, it may. The ICDPA defines targeted advertising as ads based on data obtained "from the consumer's activities over time and across non-affiliated websites or online applications" (§ 715D.1(28)). The specific GA4 configuration and privacy options activated determine whether targeted advertising is occurring.

**4. Does the ICDPA use the same opt-out model for sensitive data as the UCPA?**
Yes. Both the ICDPA (§ 715D.4(2)) and the UCPA use the opt-out model for sensitive data: clear notice and opt-out opportunity before processing, without requiring prior consent. This model differs from the opt-in required by the CPRA, OCPA, VCDPA, and CTDPA. For precise geolocation data collected via cookies, the Cookies Policy must inform and offer opt-out before activating those trackers.

**5. What happens with opt-out from targeted advertising after the consumer exercises it?**
The ICDPA does not specify a separate cessation deadline after opt-out from targeted advertising, beyond the general 90-day response deadline for requests (§ 715D.3(2)(a)). In practice, a well-configured [consent management platform](https://goadopt.io/en/blog/how-to-choose-cmp-consent-management-platform/) processes the opt-out from targeted advertising immediately, deactivating corresponding trackers at the moment the consumer exercises the option, without waiting 90 days.

[Ready to build a Cookies Policy for your site that complies with the ICDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


IOWA ICDPA: Cookies Policy

Montana MTCDPA: DSAR Policy

While internet cookies, commonly referred to as just "cookies," are widely recognized today, some companies also use Local Storage and Session Storage as other methods used by programmers to store persistent information in a visitor's browser. However, what's the main difference between cookies and local storage, and why choose one over the other? This article will help you with these questions!

As mentioned earlier, [Cookies](https://goadopt.io/en/blog/lgpd-cookies-all-you-need-to-know/), Local Storage, and Session Storage are methods used through programming languages to store information in a website visitor's browser.

In other words, they store information in your browser about your access and how you navigate the website. Many of these have been used maliciously, even capable of storing all the information entered in text fields in forms, for example.

## Relax, cookies and local storage aren't synonymous with invasion of privacy.

Few people know that cookies were originally developed by hackers to capture people's data on the internet. Later, this technology gained a commercial purpose and is now widely used across the web.

Before you get alarmed or want to reject all internet cookies and storage, remember, they make your life much easier.

Thanks to them, your products stay in the shopping cart when you switch tabs or go back to the store to add more items.

They keep a pre-filled form in case there's a connection glitch, preventing you from starting over.

And they also welcome you by recognizing your previous access, without needing to log in to your account hundreds of times a day.

## What are the Key Differences Between [Cookies](https://goadopt.io/en/blog/lgpd-cookies-all-you-need-to-know/), Local Storage, and Session Storage?

Now that we've discussed the similarities, let's delve into the differences using three main criteria: **storage capacity, storage location, data persistence, and performance.**

### - Storage Capacity

This capacity usually varies between browsers. In general, cookies can store up to 4096 bytes or 4KB, while Local Storage can handle 5MB, and Session Storage ranges from 5MB to 10MB.

Moreover, there's a maximum limit on the number of cookies per domain, and it's not recommended to exceed 30 cookies.

Some browsers, such as Opera, will prompt the user to allow more data usage when this limit is reached.

### - Storage Location

Cookie information is stored in both the browser and the originating server of the referenced service.

Local Storage and Session Storage use only the browser as the storage location for data.

### - Data Persistence

Data persistence refers to HOW and WHEN the stored information is deleted, erased, or invalidated.

### Cookies

Cookies have an expiration date, causing the stored information to become invalid and outdated when that date is reached. However, whenever a visitor deletes cookies from a website, that information is also removed from the browser.

Some browsers automatically clear cookies periodically, and you can usually configure this in settings.

[Learn how to clear cookies and browser cache.](https://goadopt.io/en/blog/delete-cookies-cache-chrome/)

Today, due to privacy regulations like LGPD, GDPR, and CCPA, websites using these trackers must inform their visitors of their existence using a cookie banner. This technology, called a [CMP (Consent Management Platform)](https://goadopt.io/en/blog/what-is-a-cmp-consent-management-platform/), must then block cookies based on user consent.

[To learn all about GDPR, CCPA, and LGPD, we have this article for you.](https://goadopt.io/en/blog/lgpd-general-data-protection-law/)

### Local Storage

Local Storage has no expiration date, so the information persists in the browser until the user performs a cleanup and deletion. Additionally, there are fewer browsers that offer features to block or periodically delete Local Storage data.

Regarding privacy regulations, especially [GDPR](https://goadopt.io/), the same obligation to inform its usage applies to Local Storage. Therefore, when choosing your cookie banner, ensure that it also lists third-party tracker Local Storage used on your site.

To learn more about [how a CMP works](https://goadopt.io/en/blog/what-is-a-cmp-consent-management-platform/), here's an article to help you understand.

### Session Storage

In Local Storage, information remains stored until a deletion is performed. However, in Session Storage, the information is automatically deleted whenever the visitor leaves the site or closes the browser tab.

This is the main difference between Local and Session Storage.

### - Performance

To analyze performance between web storage (Local and Session) and cookies, a highly technical language would be necessary. However, let's try to simplify the facts.

Every website has a visually coded part connected to a server. The server keeps the site online, and when someone accesses that URL, it operates those visual settings and responds to interactions on the screen.

This interaction is performed by the [browser (Chrome, Safari, Opera, Brave...)](https://goadopt.io/en/blog/delete-cookies-cache-chrome/)

If your browser has cookies from that site, in addition to communicating with the site's server, it must also await the server's reading of those cookies and their respective servers. This is because there may be cookies from that specific site and cookies from third-party companies installed.

Therefore, when using cookies, all requests you make to the site also depend on sending cookie information to your origin server and then to the site. Hence, simply using a cookie in your application consumes a bit more "bandwidth" and "data" to read and execute it on the site, and present it in the browser.

**In contrast, Local and Session Storage do not require this triangulation between servers, resulting in less bandwidth needed for the site to respond to the information contained in web storage.**

## How to Create a Consent Strategy as the [Legal Basis for LGPD](https://goadopt.io/en/blog/legal-bases-of-lgpd/)?

Want to learn more about [how a LGPD cookie banner works](https://goadopt.io/en/blog/operation-of-cookie-banner/)? In this link, I explain the step-by-step of the technology developed by [AdOpt](https://goadopt.io/en/blog/why-are-cookie-banners-everywhere/) and used on thousands of websites.

After all, if your site uses cookies, you can't simply [ignore LGPD](https://goadopt.io/en/blog/ignoring-LGPD/). You need to choose a strategy to avoid the [fines](https://goadopt.io/en/blog/fines-in-LGPD/) associated with this new legislation.



What is the difference between cookies, local storage, and session storage?

The California Privacy Rights Act (CPRA) brought a change that directly affects any site with advertising pixels installed.

This page covers one piece of the picture. For the full scope of the CPRA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the CPRA and cookies](https://goadopt.io/en/blog/california-cpra-and-cookies-all-you-need-to-know/).

The CCPA talked about "selling" data. The CPRA added "sharing": the disclosure of personal information for cross-context behavioral advertising across different sites, even if no money changes hands directly.

This means the Meta Pixel on your site may constitute "sharing" of personal information under the CPRA, even if you receive no money for that specific sharing.

This article focuses exclusively on what the CPRA requires from a Cookies Policy: what the document must contain, how opt-out must work, and what changes for each tracker on your site.

## Cookies Policy vs. cookie banner: the necessary distinction

The [cookie banner](https://goadopt.io/en/blog/how-to-choose-a-cookie-banner-for-your-website/) is the consent interface. It is what the visitor sees when they first access the site.

The Cookies Policy is the detailed document. It is where the user finds complete information about each technology: what it collects, what it is for, who receives the data, and how to exercise rights over it.

Both need to exist. Both need to be aligned. And the Cookies Policy must be accessible from a clear link within the [consent notice](https://goadopt.io/en/blog/operation-of-cookie-banner/) itself.

## What the CPRA specifically requires for cookies

### Specific purpose for each tracker category

The CPRA requires businesses to collect personal information only for specific, explicit, and legitimate purposes and not to process data in ways incompatible with those purposes (Civil Code § 1798.100(a)(2)).

For cookies, each category needs a concrete purpose description.

What does not work: "cookies to improve your experience."

What works: "Analytics cookies: collect browsing behavior data including pages visited, traffic source, and session duration, to identify content and experience improvement opportunities. Data is sent to Google Analytics and retained for 14 months."

"Advertising cookies: collect behavioral identifiers sent to Meta and Google for creating advertising audiences and displaying personalized ads on other platforms. This constitutes sharing of personal information under the CPRA. Consumers may refuse this sharing via the 'Do Not Sell or Share My Personal Information' link or by activating the Global Privacy Control."

### Cookie categories present on the site

The Policy must list the tracker categories operating on the site:

**Strictly necessary cookies:** essential for basic functionality. Do not constitute selling or sharing. Must be documented.

**Analytics cookies:** measure browsing behavior. Depending on the tool, may constitute sharing of personal information if data is sent to third parties who use it for advertising on other sites.

**Advertising and sharing cookies:** feed ad pixels, build behavioral profiles for cross-site behavioral advertising. Almost always constitute "sharing" under the CPRA. Require an opt-out link.

**Functional cookies:** remember user preferences. Generally do not constitute selling or sharing.

**Third-party cookies:** fired by external services. [Correct tag categorization](https://goadopt.io/en/blog/best-practices-tag-categorization/) is what makes accurate documentation possible.

### The CPRA distinction between "selling" and "sharing"

This is the most important concept differentiating the CPRA from other laws for cookie purposes.

**Selling** is the exchange of personal information for monetary or other valuable consideration.

**Sharing** is the disclosure of personal information to a third party for cross-context behavioral advertising purposes, regardless of whether there is direct payment (Civil Code § 1798.140(ah)).

In practice, this means that when the Meta Pixel sends visitor behavior data from your site to Meta, that transmission may constitute "sharing" under the CPRA even if the business receives no money specifically for that data. What Meta does with that data to display ads on other platforms is the criterion.

Not a sale or sharing: disclosure to service providers processing data exclusively on behalf of the business, disclosure to provide the product or service requested by the consumer, and M&A transfers.

### Categories of third parties receiving data via cookies

The Policy must identify the categories of third parties to which data is sold or shared via cookies (Civil Code § 1798.130).

This includes digital advertising platforms (Meta, Google, TikTok, Pinterest), programmatic advertising networks, analytics platforms that use data for other purposes, and any other partner receiving behavioral data from site users.

### Retention period for each category

The CPRA introduced the requirement to disclose data retention periods, which the original CCPA did not have (Civil Code § 1798.130 a(5)(A)).

For the Cookies Policy, this means documenting:

How long each cookie remains active on the user's device.

How long data collected via cookies is retained in the business's servers and/or by involved third parties.

When and how data is deleted after the retention period.

### The "Do Not Sell or Share My Personal Information" link

The CPRA requires this link to be visible on the homepage and on any page where personal information is collected (Civil Code § 1798.120(a)).

This link must:

Be clear and conspicuous, not buried in menus.

Lead to a page where the consumer can opt out of selling and sharing.

Not require the consumer to create an account or go through multiple steps to opt out.

The Cookies Policy must identify this link and describe how the opt-out works in practice: which technologies are deactivated when the consumer clicks the link.

### The Global Privacy Control (GPC)

The Global Privacy Control (GPC) is a technical signal that consumers activate in their browser to automatically request opt-out of selling and sharing across all sites visited.

The CPPA (California Privacy Protection Agency) confirmed that the GPC constitutes a valid form of opt-out from selling and sharing under the CPRA. When a visitor accesses the site with the GPC enabled, the site must treat that as if the consumer had clicked "Do Not Sell or Share My Personal Information."

The Cookies Policy must state that the business recognizes and honors the GPC.

### The "Limit the Use of My Sensitive Personal Information" link

If the site collects sensitive personal information via cookies (such as precise geolocation data), the business must provide the "Limit the Use of My Sensitive Personal Information" link (Civil Code § 1798.121(a)).

Precise geolocation is one of the most relevant SPI categories for cookies: any cookie or technology that captures device location with enough precision to identify the user's position within a city block may constitute SPI collection.

If the site collects precise geolocation, the Cookies Policy must:

Identify this collection as SPI.

Describe the purpose of the use.

Explain how the consumer can limit that use via the specific link.

## What constitutes valid consent for cookies under the CPRA?

The CPRA uses an opt-out model for most personal information: processing is permitted by default for most purposes, and the consumer has the right to refuse selling and sharing.

But for sensitive personal information, the standard is different: use of SPI beyond essential purposes must be disclosed to the consumer, who has the right to limit that use.

And for consumers under 16, the standard is opt-in: the business cannot sell or share data of minors without active opt-in.

What is not valid as opt-out: processes requiring unnecessary multiple steps, account creation requirements to exercise opt-out, and any design that deliberately makes exercising the right more difficult.

## Special protection for minors

The CPRA has strict rules for minors that must be described in the Cookies Policy.

For consumers under 16: the business cannot sell or share personal information (including via advertising cookies) without active opt-in.

For consumers under 13: opt-in must be given by parents or legal guardians.

If a consumer under 16 declines consent, the business must wait 12 months before requesting consent again.

Penalties for violations involving data of consumers under 16 are tripled and automatic.

If the site may have users in these age ranges, the Cookies Policy must describe how advertising cookies are deactivated for this audience and how opt-in is obtained.

## Do analytics cookies constitute "sharing" under the CPRA?

Google Analytics, for example, collects browsing behavior data and sends it to Google's servers. Depending on how Google uses that data for its own advertising purposes or to provide advertising services to other advertisers, sending that data may constitute "sharing" under the CPRA.

The [ANPD Cookie Guidance](https://goadopt.io/en/blog/anpd-cookies-guidance-personal-data-protection-lgpd/) has documented how major analytics providers can cross-reference apparently anonymous data with other data they hold.

The safest approach: include Google Analytics in the category of cookies that may constitute sharing, offer opt-out, and document this categorization in the Cookies Policy.

## When to update the Cookies Policy

Situations requiring an update:

Adding a new advertising pixel or tracker.

A new analytics tool sending data to third parties.

A new partner receiving behavioral data from site users.

Changes to retention periods for any category.

Change in the use of cookie data for new purposes.

Any modification to opt-out mechanisms or mandatory links.

Continuous [data mapping](https://goadopt.io/en/blog/data-mapping-or-data-inventory/) is what keeps the cookie inventory synchronized with the document.

## How AdOpt helps with the Cookies Policy under the CPRA

AdOpt's automatic scan identifies all active technologies on the site, feeding the list of categories that must appear in the Cookies Policy.

The [cookie notice](https://goadopt.io/en/blog/operation-of-cookie-banner/) configured through AdOpt blocks non-necessary trackers before acceptance, presents categories with clear descriptions, honors the GPC automatically, and logs every interaction for audit purposes.

The integration with the "Do Not Sell or Share My Personal Information" link ensures that opt-outs are processed automatically and the corresponding trackers are deactivated.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Cookies Policy for your site that complies with the CPRA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what your Cookies Policy needs for the CPRA

**Visible link** in the footer and within the cookie notice.

**Listing of cookie categories** with a description of what each does on the site.

**Specific purpose for each category**, including whether it constitutes selling or sharing (Civil Code § 1798.100).

**Identification of cookies constituting "sharing"** for cross-context behavioral advertising (Civil Code § 1798.140(ah)).

**Categories of third parties** receiving data via cookies, including advertising platforms (Civil Code § 1798.130).

**Retention period** for each cookie category (Civil Code § 1798.130 a(5)(A)).

**"Do Not Sell or Share My Personal Information"** link visible on homepage and data collection pages (Civil Code § 1798.120).

**"Limit the Use of My Sensitive Personal Information"** link if SPI is collected via cookies (Civil Code § 1798.121).

**GPC recognized and honored** as a valid opt-out.

**Protection for consumers under 16**: mandatory opt-in for selling and sharing via advertising cookies.

**12-month waiting rule** after consumers under 16 decline consent.

**Accessible language**, without legal jargon.

**No unnecessary multiple steps** to exercise opt-out.

## FAQ: CPRA and Cookies Policy

**1. What is "sharing" of data under the CPRA and why is it different from "selling"?**
The CCPA used only the concept of "selling" data (exchange for monetary consideration). The CPRA added "sharing," defined in Civil Code § 1798.140(ah) as disclosing personal information to third parties for cross-context behavioral advertising purposes, regardless of whether there is direct payment. This means that when the Meta Pixel sends visitor behavior data from your site to Meta, this may constitute "sharing" under the CPRA even if the business receives no money specifically for that data. The CPRA requires opt-out from both selling and sharing.

**2. Is the GPC mandatory for sites serving California consumers?**
Yes, in practice. The CPPA confirmed that the GPC constitutes a valid form of opt-out from selling and sharing personal information under the CPRA. This means that if a visitor arrives at your site with the GPC enabled in their browser, the site is required to treat that signal as an opt-out from selling and sharing. Ignoring the GPC may constitute a CPRA violation. A properly configured CMP detects and honors the GPC automatically.

**3. Do analytics cookies like Google Analytics constitute "sharing" under the CPRA?**
It depends on how the provider uses the data. If Google Analytics only generates usage reports for the business that installed the tool, it may be configured as a service provider without constituting "sharing." If data is used by Google for its own advertising purposes or to provide advertising services to other advertisers, it may constitute sharing. Google offers privacy-safe configurations in GA4 that can reduce this risk. The safest approach is to offer opt-out and consult a specialist to evaluate the specific configuration.

**4. What must change in the Cookies Policy to update from CCPA to CPRA?**
The main changes are: replace references to "selling" data to include "selling and sharing"; add description of what constitutes sharing for cross-context behavioral advertising; update the opt-out link from "Do Not Sell My Personal Information" to "Do Not Sell or Share My Personal Information"; add the "Limit the Use of My Sensitive Personal Information" link if SPI is collected via cookies; include retention periods for each cookie category; and add mention of the GPC as a valid form of opt-out.

**5. If a consumer under 16 declines consent for advertising cookies, what can the business do?**
It may keep strictly necessary cookies active, as those do not require consent. It must deactivate all advertising and sharing cookies. And it must wait 12 months before requesting consent for advertising cookies again. This 12-month rule is one of the most specific elements of the CPRA compared to other US state laws, and it reflects the legislature's intent to protect minor consumers from repeated consent requests.

[Ready to build a Cookies Policy for your site that complies with the CPRA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


California CPRA: Cookies Policy

If you've reached this article, you're certainly searching and wondering: What is the best [cookie banner](https://goadopt.io/en/blog/what-is-a-cmp-consent-management-platform/) for your website, and how do you choose among the many options on the market? What are the criteria for this choice, and what are the strengths and weaknesses of each option? Well, we're here to help you because this decision needs to be well thought out!

Therefore, below we have listed the answers into key points that should be carefully analyzed.

1. Why do I need this banner, really?
2. But [cookies](https://goadopt.io/en/blog/lgpd-cookies-all-you-need-to-know/) are anonymous, so why all this?
3. Legislation and Language.
4. [LGPD](https://goadopt.io/en/blog/lgpd-general-data-protection-law/) and the cookie banner, technical aspects of the Law.
5. [Design](https://goadopt.io/en/blog/what-is-privacy-by-design/).
6. Truth.
7. Detailed Purposes.
8. Freedom of choice.
9. Blocking third-party cookies.
10. Price
11. Integrations.

## Why do I need this banner, really?

First of all, **does your website REALLY need an [LGPD](https://goadopt.io/en/blog/gdpr-lgpd-and-ccpa-what-are-these-laws-similarities-and-differences/) Cookie banner?**

What do you mean? I'm already in this article to choose a cookie software, and you still want to tell me who actually needs the LGPD [Cookie](https://goadopt.io/en/blog/operation-of-cookie-banner/) banner?

Exactly! Because there are many people who come to us to install the cookie banner on a website that simply does not use cookies. Seriously! Sometimes it seems like our banner is synonymous with website quality (okay, I confess, I agree), but there are limits.

It's like buying sunscreen for a nighttime stroll or mosquito repellent for diving.

The key point is confusing for many!

1. Just because many websites are using it doesn't mean you need to as well!
2. Pay attention to other legal bases that can support your business, in addition to consent.
3. The key question: If you don't use cookies on your website, why have a cookie banner? In times of such complex legislation, less is more!

Here, we have highlighted some points from the LGPD to support our reasoning:

**Article 8** addresses how the controller should request the data subject's consent. The first and most important rule is that the consent clauses must be separate from others, allowing the data subject to have a clear understanding of what they are consenting to.

Article 8 - § 2: The burden of proving that consent has been obtained in accordance with this Law lies with the controller.

_What does this mean? _
As the controller (your website), you must keep a record of all consents obtained, and these must be stored and documented.

Because at any time, data subjects have the right to request such records and any data you may have about them.

Refer to Article 19:

**Article 19: Confirmation of the existence of personal data or access to personal data shall be provided upon request by the data subject:**
_
I - in a simplified format, immediately;_ or

_II - through a clear and complete statement indicating the origin of the data, the absence of a record, the criteria used, and the purpose of the processing, subject to trade and industrial secrets, provided within a period of up to 15 (fifteen) days from the date of the data subject's request._

1. Personal data shall be stored in a format that facilitates the exercise of the right of access.

2. Information and data may be provided, at the data subject's discretion. § 3. The processing of personal data based on defective consent is prohibited. § 4. Consent must relate to specific purposes, and generic authorizations for the processing of personal data shall be void. § 5. Consent may be revoked at any time by the data subject's express manifestation, by means of a free and facilitated procedure, without prejudice to the processing carried out under the previously given consent until the request for elimination, as provided for in item VI of the main section of Article 18 of this Law.

## But, aren't Cookies anonymous? Why all this?

If you're not familiar with the digital world, let me explain to you with the most popular phrase from privacy policies ("Cookies are small pieces of text that are stored in your browser when you access a website on the internet.")

With this information from cookies, companies can do a lot, and I mean a lot! They can accurately profile your psychology and cross-reference this information with extremely personal data, known in the market as data enrichment or "data farming."

### The logic is always very similar: Browser -> cookie -> personal data (email, phone) -> person/registration -> CPF (Brazilian individual taxpayer registry) -> income, IRPF (Brazilian income tax return), marital status

Several companies do this, and virtually all of those that have tags installed on their websites can somehow convert this information and target any individual specifically. Whether it's directly through their own database (Google), or by cross-referencing with third-party databases (such as Serasa).

In other words:

**Cookies are not anonymous but rather anonymized.**

## Legislation and Language.
This is an excellent variable to consider when looking for a cookie banner! Questions like: Does it support multiple languages, can that be an advantage? But, before that, does it accept multiple legislations?

For example, if your website is Brazilian and someone accesses it from Italy, it wouldn't be enough for the banner to be in Italian. The visitor is actually under the jurisdiction of the [GDPR](https://goadopt.io/en/blog/key-differences-LGPD-GDPR/), unless the LGPD has more "private" provisions in those specific areas (as required by the visitor's country's law).

In other words, just because your site has multiple languages and versions doesn't mean that all the legislations are correctly implemented and complied with regarding the cookie banner. Is it clearer now?

Pay attention to compliance with the applicable legislations, especially for your target audience! Language and accessibility are crucial, but not the only factors when it comes to foreign accesses.

## LGPD and the Cookie Banner, Technical Aspects of the Law.
Now that we understand the context of the law, the complexities of cookies, and the parallel legislations that may influence the use of the Cookie Banner on your website, let's discuss some key points that will help you make this choice.

1. **Design**
Why design when we're talking about technical aspects? Precisely because of that, after all, what are the main metrics of a website, an e-commerce? How do you analyze the conversion from visitors to leads and then to sales? Is Bounce Rate a concern? What are the KPIs of your site? Does usability and visitor experience matter?

Yes, they matter A LOT!

Thus, look for a cookie banner with refined and responsive design that allows you to customize colors, logos, and placement on the site in a way that harmonizes with the overall structure of the site. Don't just throw a senseless banner in the middle of the visitor's screen; respect the attention the visitor is giving you!

Be cautious with designs that occupy the entire screen! We understand that the law requires clear and assertive communication, and many are overwhelmed by the uncertainties in the market. However, you shouldn't disturb the visitor or act impulsively because of that!

We know how every second counts in capturing visitors' attention, so make it count!

Do you really want to use a banner that steals attention instead of fulfilling a simple and even basic role required by the law?

![aviso barcelona.png](https://strapi.goadopt.io/uploads/aviso_barcelona_1cc05ad647.png?updated_at=2022-08-17T18:16:59.332Z)

This Barcelona F.C. banner is like having ten players blocking the goal...

2. **Transparency**
I may sound sensationalistic, but I dare say:

**"Most of the cookie plugins and banners we see on the internet are just fake buttons. Yes, digital components that don't record or organize anything."**

In addition to the _"fakeness"_ of these mentioned points, always use assertive and direct language. Don't try to be "cool" or trendy. Of course, using too much legal jargon can push people away.

![aviso seção verdade.png](https://strapi.goadopt.io/uploads/aviso_secao_verdade_3a5ce550cc.png?updated_at=2022-08-17T18:18:11.830Z)

Not to mention that if I have no way to refuse, how would it block then? So, in the end, it's the same thing, don't you agree?

## Detailed Reasons.

This is one of the crucial points we consider in a good cookie banner. According to LGPD, consent must be given for specific purposes. Therefore, a simple "OK" or even "Accept" without the option to explore my choices and understand their purposes and legal bases can be somewhat coercive.

Consent is not a salvation or a general acceptance. It is the formalization of acceptance for that specific purpose presented.

![aviso sem finalidade.png](https://strapi.goadopt.io/uploads/aviso_sem_finalidade_db0539333e.png?updated_at=2022-08-17T18:18:58.036Z)

## Freedom of Choice.
The General Data Protection Law (LGPD) lists a series of legal bases through which companies can use data with ease. If you have chosen consent for your company, use it with respect and always value the privacy of your data subjects.

There is no better or stronger legal basis. Instead, choose the one that best fits your business model and market. Similarly, a cookie banner should understand the context in which consent will be communicated and collected, and should provide visitors with the freedom to choose fully, partially, or not at all.

Always look for cookie banners that break down the listing of tags and cookies into categories and subcategories. This is essential to demonstrate that a particular purpose is presented within category "X," and visitors can freely choose whether to accept it or not.

## Blocking Third-Party Cookies.
The cookie banner is not just an interactive button; it must have authority over the behavior of other tags used on the website, authorizing or blocking their firing based on the consent collected during that visitor's session.

For example, the Google Analytics tag should only be fired when the visitor accepts the statistical category of tags. Before that, the notice informs and waits for visitor interaction.

For more information on how to configure the [AdOpt Cookie Banner](https://goadopt.io/) to enable automatic blocking of third-party tags, see our tutorial.

## Price
The price of a cookie banner should be:

### - Affordable
Low prices that do not eat into your marketing budget. If there is a free plan, even better! The cookie banner only solves a part of the law's compliance, and it's likely that you will need other services or consultations in the future. Therefore, don't spend too much of your budget on this product.

A cookie banner does not cover all the obligations regulations like the GDPR, CCPA, LGPD... for example.

If you have other internal processes that use personal data, you will need to use other controls and even systems for that management.

The cookie banner should take care of the "digital gates" and reinforce the legal basis of consent.

How?

By recognizing and categorizing all users with their choices of total opt-in, partial opt-in, or opt-out and sending these requests directly to the [Data Protection Officer (DPO)](https://goadopt.io/en/blog/responsibilities-of-a-data-protection-officer/), or even systems like CRM, ERP...

### - Scalable
Look for cookie banners that offer billing with scalability parameters. In other words, they should have little to no impact initially, and as your website grows and your audience expands, you will pay for that processing power.

Additionally, the volume and value tiers should be broad enough to accommodate any seasonality, so you don't


How to choose a Cookie Banner for your website

## New Hampshire NHDPA: Cookies Policy

Cookies operate in silence.

This page covers one piece of the picture. For the full scope of the NHDPA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the NHDPA and cookies](https://goadopt.io/en/blog/new-hampshire-nhdpa-and-cookies-all-you-need-to-know/).

You install an advertising pixel, set up Google Analytics, add a support chat widget. Each of these tools places something on the visitor's device and starts collecting data, usually before any question is asked.

The New Hampshire Data Privacy Act (NHDPA, RSA 507-H), in effect since January 1, 2025, broke that silence for good.

This article focuses exclusively on what the NHDPA requires from a Cookies Policy: what the document must contain, how tracker consent must work, what is prohibited, and what the law says specifically about each point.

## Cookies Policy vs. cookie banner: the difference that matters

The [cookie banner](https://goadopt.io/en/blog/how-to-choose-a-cookie-banner-for-your-website/) is what the visitor sees when they first access the site. It is the visual interface for consent, where the user chooses what they accept. It must be clear, offer real options, and block non-consented trackers before they fire.

The Cookies Policy is the detailed document. It is where the user finds complete information about every technology operating on the site.

Both need to exist. Both need to be aligned. And the Policy must be accessible through a simple link within the [consent notice](https://goadopt.io/en/blog/operation-of-cookie-banner/) itself.

## What the NHDPA specifically requires for cookies

### Specific purpose for each category

RSA 507-H:6, I, b prohibits processing data for purposes incompatible with those disclosed to the consumer, unless new consent is obtained. And RSA 507-H:6, III, b requires the purpose of processing to be included in the privacy notice.

For cookies, this translates into specific descriptions for each category. Writing "we use cookies to improve your experience" does not work. It is not a purpose. It is a phrase that offers the business no protection whatsoever.

What works:

"Analytics cookies: collect browsing behavior data, including pages visited and traffic source. Used to identify opportunities to improve site content and experience."

"Advertising cookies: collect behavioral data across different websites to build interest profiles and display personalized ads. Includes pixels from platforms such as Meta Ads and Google Ads."

### The categories of cookies present on the site

The Policy must list the categories of trackers operating on the site. The main ones:

**Necessary cookies:** essential for basic functionality. Authentication, session security. These do not require consent but must be documented.

**Analytics cookies:** measure browsing behavior. Google Analytics, Hotjar, and similar tools. These require consent because they collect data that may identify the user through cross-referencing.

**Advertising cookies:** feed ad pixels, build behavioral profiles, enable remarketing. These always require explicit consent.

**Functional cookies:** remember user preferences. May or may not require consent depending on the nature of the data.

**Third-party cookies:** fired by external services integrated into the site. [Correct tag categorization](https://goadopt.io/en/blog/difference-cookies-local-storage-session-storage/) is what makes it possible to document each one accurately.

### Who receives data collected via cookies

RSA 507-H:6, III, d and e require the Policy to disclose the categories of data shared with third parties and the categories of third parties that receive them.

If the site has a Meta Pixel, data goes to Meta. If it uses Google Analytics, to Google. If it uses HubSpot, to HubSpot. Each data flow must be categorized and declared.

RSA 507-H:6, IV goes further: if the business sells data or processes it for targeted advertising, this practice must be clearly and conspicuously disclosed, along with the opt-out mechanism.

### The retention period for each category

The minimization principle in RSA 507-H:6, I, a requires that collection be limited to what is adequate, relevant, and reasonably necessary for the stated purposes.

For cookies, this translates into the need to disclose how long data is stored, both on the user's device and in the company's systems.

### The opt-out mechanism for targeted advertising

The NHDPA guarantees consumers the right to opt out of the processing of their data for targeted advertising, under RSA 507-H:4, I, e.

RSA 507-H:6, V, a, 1 specifically requires a clear and conspicuous link on the site directing consumers to a page where they can exercise this opt-out.

If the site uses a Meta Pixel, Google Ads, TikTok Pixel, or any programmatic advertising tool, it is operating targeted advertising. The Policy must state this and the opt-out must actually work.

A well-configured [consent management platform](https://goadopt.io/en/blog/how-to-choose-cmp-consent-management-platform/) ensures that when the user exercises the opt-out, the corresponding trackers immediately stop firing.

### The opt-out preference signal (GPC)

RSA 507-H:6, V, a, 1, B requires businesses to honor opt-out preference signals sent by platforms, technologies, or mechanisms indicating the consumer's intent to opt out of processing.

But there is an important nuance directly in the text of the law: the signal must "require the consumer to make an affirmative, freely given, and unambiguous choice to opt-out." The GPC is only valid when the consumer configured it actively and deliberately, not as an automatic default setting of the device or browser.

The Cookies Policy must state that the site respects the GPC when actively configured by the user, not as an automatic default. And the [cookie notice operation](https://goadopt.io/en/blog/operation-of-cookie-banner/) must be configured to detect and honor that signal correctly.

### The 15-day deadline after revocation

RSA 507-H:6, I, f is direct: after consent is revoked, the business must cease processing "as soon as practicable, but not later than 15 days after the receipt of such request."

This has a direct operational impact. When a user revokes consent for advertising or analytics cookies, marketing and tracking systems must be updated within 15 days.

A [CMP](https://goadopt.io/en/blog/what-is-a-cmp-consent-management-platform/) integrated with the company's systems automates a large part of this process.

## What constitutes valid consent for cookies under the NHDPA

RSA 507-H:1, VII defines consent as a clear affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreement.

What is not valid consent:

Accepting general terms that contain data processing descriptions alongside other information.

Hovering over, muting, pausing, or closing a piece of content.

Any agreement obtained through dark patterns.

The correct standard: necessary cookies on, all others off by default. The user chooses what to enable, not what to disable.

### Dark patterns prohibited by law

Dark patterns are defined in RSA 507-H:1, XII as interfaces designed with the substantial effect of subverting or impairing the autonomy, decision-making, or choice of the user.

In the context of cookies, common examples include:

An "accept all" button in a prominent position, with the reject button hidden or low-contrast.

Non-essential cookies enabled by default, requiring the user to go through multiple clicks to disable them.

Confusing language in the choice options.

Cookie walls: blocking access to content until all cookies are accepted.

Consent pop-ups that reappear until the user accepts.

Any of these patterns invalidates consent obtained under the NHDPA.

## Do analytics cookies require consent under the NHDPA?

The answer is: in most cases, yes.

The NHDPA defines personal data as any information linked or reasonably linkable to an individual. Analytics cookies from major platforms collect data that, when cross-referenced with other information, can identify a specific user.

The [ANPD Cookie Guidance](https://goadopt.io/en/blog/anpd-cookies-guidance-personal-data-protection-lgpd/) already flagged this point in Brazil: major providers have the ability to cross-reference seemingly anonymous identifiers with other data they possess.

The safest approach: treat analytics cookies as non-necessary in the banner, block them before acceptance, and document this in the Cookies Policy.

## Special protection for teenagers between 13 and 15 years old

RSA 507-H:6, I, g prohibits using cookies for targeted advertising and selling data without consent when the controller knows the consumer is between 13 and 15 years old.

If your site may have teenage users, the Cookies Policy must mention this protection and explain how it is implemented operationally.

## When to update the Cookies Policy

Whenever the site begins using a new tool that fires cookies. RSA 507-H:6, III, g requires the date of last update to be clearly visible in the document.

Situations that require an update:

Adding a new advertising pixel.

A new analytics tool.

A new chat or support plugin.

A new CRM or email platform integration.

Any new partner that receives behavioral data.

[Data mapping](https://goadopt.io/en/blog/what-is-privacy-by-design/) is what keeps this in sync. When the inventory of tools on the site changes, the Cookies Policy must change with it.

## The shift in enforcement from 2026

In 2025, there was a guaranteed 60-day cure period before litigation. From 2026 onward, the cure period is discretionary (RSA 507-H:11, III). An inadequate Cookies Policy may result in direct action with no guaranteed time to correct.

Violations are treated under RSA 358-A:2, with reference [penalties](https://goadopt.io/en/blog/fines-in-LGPD/) of up to US$ 10,000 per violation.

## How AdOpt helps with the Cookies Policy under the NHDPA

AdOpt's automatic scan identifies all technologies active on the site, feeding the list of categories that must appear in the Policy.

The [cookie notice](https://goadopt.io/en/blog/operation-of-cookie-banner/) configured through AdOpt blocks non-necessary trackers before acceptance, presents categories with clear descriptions, offers real choice options, respects the GPC when actively configured by the user, and logs every interaction for auditing purposes.

The integration with the company's systems helps process revocations within the 15-day deadline required by law.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Cookies Policy for your site that complies with the NHDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what your Cookies Policy needs for the NHDPA

**Visible link in the footer** and within the cookie banner itself.

**Listing of cookie categories** with a description of what each one does.

**Specific purpose for each category**, without vague descriptions.

**Categories of data shared with third parties** and categories of partners that receive them (RSA 507-H:6, III, d and e).

**Retention period** for each category.

**Disclosure of targeted advertising** with an opt-out mechanism accessible via a conspicuous link (RSA 507-H:6, IV and V, a, 1).

**GPC honored when actively configured** by the user, with the nuance of affirmative choice (RSA 507-H:6, V, a, 1, B).

**15-day deadline** to cease processing after revocation (RSA 507-H:6, I, f).

**Non-necessary cookies disabled by default** in the banner, without dark patterns (RSA 507-H:1, XII).

**Protection for teenagers between 13 and 15 years old** (RSA 507-H:6, I, g).

**Date of last update** visible in the document (RSA 507-H:6, III, g).

**No cookie walls**.

**Accessible language**, without legal jargon.

## FAQ: NHDPA and Cookies Policy

**1. Does the NHDPA require a document specifically called a "Cookies Policy"?**
Not by name. But RSA 507-H:6, III, IV, and V require the privacy notice to cover cookie-based collection practices with specific purposes, information about sharing with third parties, a targeted advertising opt-out mechanism, and an update date. A dedicated Cookies Policy is the clearest way to organize this information.

**2. Does the 15-day deadline apply to any consent revocation?**
Yes. RSA 507-H:6, I, f states that after receiving a revocation request, the business must cease processing as soon as practicable, no later than 15 days. This applies to any consent revocation, including the opt-out of non-essential cookies.

**3. Does the GPC need to be automatically honored by the site?**
RSA 507-H:6, V, a, 1, B requires respect for the opt-out preference signal, but with the condition that it represents an affirmative and free choice by the consumer, not an automatic default setting. The site must be configured to detect and honor the GPC when the user has activated it deliberately.

**4. Do analytics cookies require consent under the NHDPA?**
In most cases, yes. Analytics cookies from major platforms collect data that may identify users through cross-referencing, falling within the definition of personal data in RSA 507-H:1, XIX. Tools with genuine anonymization and no individual identification capability may be an exception.

**5. What changed in NHDPA enforcement from 2026?**
In 2025, RSA 507-H:11, II guaranteed 60 days to cure before litigation. From 2026, RSA 507-H:11, III made the cure period discretionary. The Attorney General may or may not grant it, considering factors such as the number of violations, company size, and probability of harm to the public.

With AdOpt, you're covered.

[Ready to bring your Cookies Policy into compliance with the NHDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)



New Hampshire NHDPA: Cookies Policy

The Virginia Consumer Data Protection Act (VCDPA), codified at Va. Code § 59.1-575 et seq., came into effect on **January 1, 2023**. It establishes clear rights for state consumers and specific obligations for businesses that process personal data of those individuals.

If your website serves users from Virginia, this guide explains what changes for you.

## What is the VCDPA?

The VCDPA is Virginia's state-level personal data protection law. It follows the logic of the major modern privacy regulations around the world: giving people back control over their own data.

If you are already familiar with the [LGPD](https://goadopt.io/en/blog/lgpd-general-data-protection-law/), the GDPR, or the California CCPA, the VCDPA framework will feel familiar. The law is organized around three pillars: consumer rights, controller obligations, and enforcement by the Attorney General.

Enforcement is the exclusive responsibility of the Virginia Attorney General. There is no private right of action for consumers.

## When did the VCDPA come into effect?

On **January 1, 2023**.

Virginia was a pioneer among US states, passing the law in 2021 and giving businesses nearly two years to comply. That does not mean enforcement is lenient, only that the runway was generous.

## Who needs to comply with the VCDPA?

Under Va. Code § 59.1-576, the law applies to persons that conduct business in Virginia or produce products or services targeted to state residents and that, during a calendar year:

Control or process personal data of at least **100,000 consumers**, or

Control or process personal data of at least **25,000 consumers** and derive more than **50% of gross revenue** from the sale of personal data.

The focus is not on where the business is headquartered. It is on who the users are. If your site has Virginia traffic at scale, the law may reach you regardless of where your business operates.

Understanding the difference between [controller and processor](https://goadopt.io/en/blog/responsibilities-of-a-data-protection-officer/) is the first step in defining which role your business plays in the processing relationship.

### VCDPA Exemptions

Under Va. Code § 59.1-576 B, the following are exempt:

State and local government bodies and their political subdivisions.

Financial institutions regulated by the Gramm-Leach-Bliley Act (Title V).

Covered entities and business associates regulated by HIPAA.

Nonprofit organizations.

Institutions of higher education.

Also exempt are specific categories of data, including protected health information under HIPAA, data regulated by FERPA, consumer credit information regulated by the FCRA, and employee and job applicant data when used in that capacity.

## What is personal data under the VCDPA?

Under Va. Code § 59.1-575, personal data is any information linked or reasonably linkable to an identified or identifiable natural person. This includes name, email address, IP address, browsing history, location data, device identifiers, and any information that allows a person to be tracked.

De-identified data and publicly available information are excluded.

A thorough [data mapping](https://goadopt.io/en/blog/what-is-privacy-by-design/) exercise reveals where this data is being generated and processed in your digital environment.

## What is sensitive data under the VCDPA?

Under Va. Code § 59.1-575, sensitive data includes:

Personal data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status.

Genetic or biometric data processed to uniquely identify an individual.

Personal data collected from known children (under 13 years of age).

Precise geolocation data (within a radius of 1,750 feet).

Sensitive data cannot be processed without the consumer's explicit consent, under Va. Code § 59.1-578 A, 5.

## Special protection for minors on social media platforms

Starting **January 1, 2026**, the VCDPA includes a specific section for operators of social media platforms (Va. Code § 59.1-577.1).

"Minor," for purposes of this section, is any person under **16 years of age** (not 13, but 16).

Social media platform operators must:

Use commercially reasonable methods, such as a neutral age screen mechanism, to determine whether a user is a minor.

Limit minors' use to **1 hour per day** per service or application.

Allow parents or legal guardians to give verifiable parental consent to increase or decrease the daily time limit.

Use data collected for age determination solely for that purpose, without applying it to other processing operations.

This is one of the most concrete protections for teenagers among US state privacy laws, with direct impact on platforms such as social networks, entertainment apps, and any service that enables social online interaction.

## What are consumer rights under the VCDPA?

Under Va. Code § 59.1-577, the law guarantees Virginia residents five main rights:

**Right to access and confirmation:** knowing whether the business processes their data and obtaining a copy in an accessible format.

**Right to correction:** correcting inaccuracies in personal data, considering the nature of the data and the purposes of processing.

**Right to deletion:** requesting the deletion of data the consumer provided or that was obtained about them.

**Right to portability:** obtaining data in a portable and, where technically feasible, readily usable format, when processing is carried out by automated means.

**Right to opt-out:** refusing the processing of personal data for targeted advertising, sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.

The controller has **45 days** to respond. The deadline can be extended by another 45 days when reasonably necessary, considering complexity and volume of requests, as long as the consumer is notified within the initial period with the justification (Va. Code § 59.1-577 B, 1).

Service is **free up to twice per year** per consumer. For requests that are manifestly unfounded, excessive, or repetitive, the business may charge a reasonable fee or decline, but the burden of demonstrating the excessive nature lies with the business (Va. Code § 59.1-577 B, 3).

### Right to appeal

Under Va. Code § 59.1-577 C, the controller must establish a process for the consumer to appeal denial decisions. The process must be conspicuously available and similar to the original request submission mechanism.

The business has **60 days** to respond to the appeal in writing, including the decision and the reasoning. If the appeal is denied, the consumer must be informed about how to contact the Attorney General to submit a complaint.

## Consent: what the VCDPA requires

Under Va. Code § 59.1-575, consent is a clear affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreement. It may include a written statement, including by electronic means, or any other unambiguous affirmative action.

The correct standard for cookies: non-essential technologies off by default, with the user choosing what to enable, not what to disable.

## Controller obligations under the VCDPA

Under Va. Code § 59.1-578, the controller must:

Limit collection to what is adequate, relevant, and reasonably necessary for the disclosed purposes.

Not process data for purposes incompatible with those disclosed, except with consumer consent.

Implement reasonable technical, administrative, and physical data security practices proportionate to the volume and nature of the data.

Not process data in violation of anti-discrimination laws. Not discriminate against consumers who exercise their rights.

Not process sensitive data without prior consent.

For known children: compliance with COPPA's verifiable parental consent requirements constitutes compliance with the VCDPA's parental consent obligations.

Provide a reasonably accessible, clear, and meaningful privacy notice covering all elements required by law.

Establish at least one secure and reliable means for consumers to submit rights requests, without requiring the creation of a new account.

Conduct and document Data Protection Assessments for high-risk activities.

## Cookies and the VCDPA

Cookies that collect personal data or allow user identification fall directly within the scope of the VCDPA.

Before firing any non-essential cookie, the site must display a clear [cookie notice](https://goadopt.io/en/blog/operation-of-cookie-banner/), obtain affirmative consent, block trackers until acceptance, and offer real opt-out options.

[Correct tag categorization](https://goadopt.io/en/blog/difference-cookies-local-storage-session-storage/) is what makes it possible to identify which cookies are necessary and which require consent.

If the site uses advertising pixels or any targeted advertising tool (Va. Code § 59.1-575 defines targeted advertising as ads based on consumer activities across non-affiliated websites over time), the law requires clear and conspicuous disclosure of this practice, along with an accessible opt-out mechanism (Va. Code § 59.1-578 D).

## Data Protection Assessments

Under Va. Code § 59.1-580, the controller must conduct and document Data Protection Assessments for:

Processing personal data for targeted advertising.

Sale of personal data.

Processing for profiling where there is a reasonably foreseeable risk of harm to consumers.

Processing sensitive data.

Any processing presenting a heightened risk of harm.

Since 2024, the assessment requirement has been expanded to include online services directed at children (Va. Code § 59.1-580 B).

Assessments are confidential and exempt from public disclosure. The Attorney General may request access via civil investigative demand, and disclosure in response to such a request does not constitute waiver of attorney-client privilege.

## Enforcement and penalties

Under Va. Code § 59.1-584, the Virginia Attorney General has exclusive authority to enforce the VCDPA. There is no private right of action.

Before initiating any action, the Attorney General must send **written notice** identifying the specific violations and granting **30 days to cure**. If the controller cures the violation within the period and provides a written statement that the violations have been cured and will not recur, no action is initiated.

If the violation continues after the cure period or the controller breaches the written statement provided, the Attorney General may seek:

Injunctive relief to stop the violations.

Civil penalties of up to **US$ 7,500 per violation**.

Recovery of reasonable investigation and case preparation expenses, including attorney fees.

## How to comply with the VCDPA in practice

### 1. Data mapping
Understand what you collect, where it lives, how it is used, and with whom it is shared. [Data mapping](https://goadopt.io/en/blog/what-is-privacy-by-design/) is the foundation of any compliance program.

### 2. Update your privacy policy
The document must cover all five required information categories under Va. Code § 59.1-578 C.

### 3. Implement a functional cookie notice
A [cookie banner](https://goadopt.io/en/blog/how-to-choose-a-cookie-banner-for-your-website/) that blocks non-essential trackers before acceptance, records consent, and offers real control options.

### 4. Create channels for DSARs
At least one secure and reliable mechanism to receive requests. No new account creation required.

### 5. Document Data Protection Assessments
For each high-risk activity, conduct and document the assessment as required by Va. Code § 59.1-580.

### 6. Prepare for the cure period
The 30-day cure period is guaranteed by law, but it is not a compliance strategy. Having processes structured from the start is what makes correction within the deadline viable.

Applying [privacy by design](https://goadopt.io/en/blog/what-is-privacy-by-design/) from product conception is what makes compliance sustainable over time.

## How AdOpt helps with the VCDPA

AdOpt records every consent interaction, blocks trackers before acceptance, and generates the auditable log you would need to present in an Attorney General investigation.

The automatic scan identifies all active [trackers](https://goadopt.io/en/blog/gdpr-cookies-explained/) on the site, feeding the data inventory required for the privacy notice and the Data Protection Assessments. And when the law changes, the platform updates automatically.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Ready to bring your website into compliance with the VCDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Comparing the VCDPA with other privacy laws

| Law | State | Consumer Volume | Penalty | Cure Period | Effective Date |
|---|---|---|---|---|---|
| VCDPA | Virginia | 100K or 25K + 50% revenue | Up to US$ 7,500/violation | 30 days guaranteed | Jan 2023 |
| NHDPA | New Hampshire | 35K or 10K + 25% revenue | Up to US$ 10K/violation | Discretionary (2026) | Jan 2025 |
| TDPSA | Texas | 25K residents | Up to US$ 7,500/violation | 30 days (2024) | Jul 2024 |
| MTCDPA | Montana | 25K residents | Up to US$ 7,500/violation | 60 days | Oct 2024 |
| CPA | Colorado | 100K or 25K + 50% revenue | Up to US$ 20K/violation | Discretionary (2025) | Jul 2023 |

To understand how these [privacy laws](https://goadopt.io/en/blog/gdpr-lgpd-and-ccpa-what-are-these-laws-similarities-and-differences/) compare in terms of structure and practical impact, our comparative guide goes deeper on the subject.

## The VCDPA in practice: the three documents

Compliance with the VCDPA rests on three documents that have to agree with each other: the [cookies policy](https://goadopt.io/en/blog/virginia-vcdpa-cookies-policy/), which declares every tracker and its purpose; the [privacy policy](https://goadopt.io/en/blog/virginia-vcdpa-privacy-policy/), which explains what you do with the data; and the [privacy portal](https://goadopt.io/en/blog/virginia-vcdpa-dsar-privacy-portal/), where the consumer exercises their rights and you keep the record of it.

## FAQ: Virginia VCDPA

**1. What is the VCDPA and when did it come into effect?**
The Virginia Consumer Data Protection Act (Va. Code § 59.1-575 et seq.) is Virginia's state-level personal data protection law. It came into effect on January 1, 2023. It establishes rights for consumers residing in the state and compliance obligations for businesses that process the personal data of those individuals.

**2. Who needs to comply with the VCDPA?**
Businesses that conduct operations in Virginia or produce products and services targeted to its residents, and that control or process personal data of at least 100,000 consumers per year, or of at least 25,000 consumers while deriving more than 50% of gross revenue from the sale of personal data (Va. Code § 59.1-576 A).

**3. What is the penalty for non-compliance?**
The Attorney General may seek civil penalties of up to US$ 7,500 per violation, plus recovery of investigation costs and attorney fees. Before initiating any action, written notice with a 30-day cure period is mandatory. There is no private right of action (Va. Code § 59.1-584).

**4. How long does a business have to respond to a consumer request?**
45 days from receipt of an authenticated request. The deadline can be extended by another 45 days when reasonably necessary, with notification within the initial period. Service is free up to twice per year per consumer. For appeals, 60 days (Va. Code § 59.1-577 B and C).

**5. What are the consumer rights under the VCDPA?**
Consumers have five rights: access and confirmation, correction, deletion, portability, and opt-out of processing for targeted advertising, data sale, and profiling with legal or similarly significant effects. They also have the right to appeal any denial decision by the controller (Va. Code § 59.1-577).

[Ready to bring your website into compliance with the VCDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


Virginia VCDPA and Cookies: All you need to know

The Utah Consumer Privacy Act (UCPA, Utah Code § 13-61-101) is the most straightforward state privacy law in its Privacy Policy requirements.

This page covers one piece of the picture. For the full scope of the UCPA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the UCPA and cookies](https://goadopt.io/en/blog/utah-ucpa-and-cookies-all-you-need-to-know/).

No actively monitored contact channel like the OCPA requires. No mandatory retention periods like the CPRA. No detailed description of how each third party may process data like the OCPA requires. Five categories of information that must be in the document, and that is it.

But simple does not mean trivial. The law still requires real transparency about what is happening with Utah consumers' data.

This article focuses exclusively on what the UCPA requires from the Privacy Policy, based on the official text of the law.

## What the UCPA calls a Privacy Notice

The law uses the term "privacy notice." In practice, it is the Privacy Policy most sites already have.

Utah Code § 13-61-302(1)(a) requires the controller to provide consumers with a privacy notice that is "reasonably accessible and clear."

## What must be in the Privacy Policy under the UCPA

### 1. Categories of personal data processed

The notice must list the categories of personal data the controller processes (§ 13-61-302(1)(a)(i)).

Personal data under the UCPA is any information linked or reasonably linkable to an identified or identifiable individual. This includes identifiers such as name, email, IP address, browsing history, location data, and any data that allows tracking a person.

De-identified data, aggregated data, and publicly available information are excluded.

### 2. The purposes for processing

The notice must explain the purposes for which each category of data is processed (§ 13-61-302(1)(a)(ii)).

The UCPA does not explicitly list that purposes must be as specific as required by other laws like the VCDPA, but the requirement that the notice be "reasonably accessible and clear" implies that "improve services" is not sufficient. "Behavioral data to identify usability improvement opportunities" is the correct level.

### 3. How consumers exercise their rights

The notice must describe how consumers can exercise the rights guaranteed by the UCPA (§ 13-61-302(1)(a)(iii)).

The four rights under the UCPA are:

**Confirm and access:** know whether the controller processes data and access that data.

**Deletion:** request deletion of data the consumer provided to the controller.

**Portability:** obtain a copy of the data in a portable format for transmission to another controller.

**Opt-out:** refuse processing for targeted advertising or data sales.

For each right, the notice must describe the request submission channel and the 45-day response deadline.

**What the UCPA does not require to be described:** a formal appeal process (the law has no such structured mechanism), a right to correct (the UCPA does not provide this right), and a right to opt-out of profiling (not covered by the law).

### 4. Categories of personal data shared with third parties

If the business shares data with third parties, the notice must list which categories of data are shared (§ 13-61-302(1)(a)(iv)).

This covers analytics tools, advertising platforms, CRMs, payment processors, and any external service that receives user data.

The UCPA uses the concept of "sale" of data, defined in § 13-61-101(31) as the exchange of personal data for monetary consideration to third parties. Sharing without monetary consideration does not constitute "sale" under the UCPA, unlike the CPRA which includes the concept of "sharing" for behavioral advertising even without payment.

### 5. Categories of third parties with whom data is shared

Beyond the categories of data, the notice must identify the categories of third parties with whom data is shared (§ 13-61-302(1)(a)(v)).

Categories such as "audience analytics platforms," "marketing automation tools," and "payment processors" are valid examples.

The UCPA does not require the level of detail the OCPA demands (entity type and how each third party may process data). Identifiable categories are sufficient.

## Disclosure of targeted advertising and data sale

If the business sells data or uses data for targeted advertising, Utah Code § 13-61-302(1)(b) requires clear and conspicuous disclosure, along with the opt-out method.

Targeted advertising, per § 13-61-101(34), consists of ads selected based on data obtained from the consumer's activities over time and across non-affiliated websites or online applications. Ads based on activities within the controller's own site do not qualify.

If the site uses a Meta Pixel, Google Ads, or any pixel that sends data to external advertising networks, the business is operating targeted advertising and must disclose this explicitly.

## Sensitive data: notice and opt-out, not consent

This is the point that most differentiates the UCPA from other state laws. Utah Code § 13-61-302(3) requires that, before processing sensitive data, the controller:

Present the consumer with a clear notice; and

Offer the consumer the opportunity to **opt out**.

**Prior consent is not required.** The business may process sensitive data, provided it informs the consumer and gives them the option to refuse before starting.

Sensitive data under the UCPA includes: health and medical data, genetic and biometric data for identification, specific geolocation data, racial or ethnic origin, religious beliefs, sexual orientation, and citizenship or immigration status.

For data of known children (under 13), the business must comply with COPPA (§ 13-61-102(3)), which in practice requires verifiable parental consent.

The Privacy Policy must:

Identify whether the business processes sensitive data.

Describe how the sensitive data notice is presented to the consumer.

Explain how the consumer can exercise the opt-out from sensitive data processing.

## What the UCPA does not require in the Privacy Policy

For businesses that already have Privacy Policies written for other state laws, it is worth noting what the UCPA does not require:

**No mandatory retention periods.** The CPRA requires specifying how long each data category is retained. The UCPA has no such requirement.

**No actively monitored contact channel.** The OCPA requires an actively monitored email or online mechanism. The UCPA only requires the notice to describe how consumers can exercise their rights.

**No detail about third parties.** The OCPA requires describing how each third party may process data. The UCPA only requires categories.

**No right to correct to describe.** Since the UCPA does not provide this right, the policy does not need to describe it.

**No formal appeal process.** The UCPA has no structured appeal mechanism like the OCPA and CTDPA.

This makes the UCPA Privacy Policy the simplest to structure among current US state privacy laws.

## Data security: what the policy needs to mention

Utah Code § 13-61-302(2) requires the controller to establish, implement, and maintain reasonable administrative, technical, and physical data security practices, proportionate to the size, scope, type, and volume of data processed.

The Privacy Policy should mention that the business implements appropriate security measures to protect consumers' personal data, even without needing to detail each specific measure.

## Non-discrimination

Utah Code § 13-61-302(4) expressly prohibits the business from discriminating against consumers who exercise their rights. This includes denying goods or services, charging different prices, or offering different quality.

The exception is voluntary loyalty programs and situations where the consumer opted out of targeted advertising and the business adjusted the price accordingly, provided the price difference is reasonably related to the value the data provides the business.

The Privacy Policy must mention this non-discrimination policy.

## The cure period and its relationship to the Policy

Before initiating any action, the Utah Attorney General is required to notify the controller and grant **30 days to cure** (§ 13-61-402(3)). This deadline is guaranteed permanently by the UCPA, unlike other laws that have eliminated it.

An outdated or incomplete Privacy Policy is one of the easiest violations to identify. Correcting it within 30 days after a notification is achievable with the right processes. But structuring the policy correctly from the start is always more efficient.

## How AdOpt supports UCPA compliance

AdOpt ensures that what is written in the Policy has real correspondence with what actually happens on the site.

The automatic scan identifies all active technologies, feeding the list of data categories and third parties that must appear in the document. The [consent management platform](https://goadopt.io/en/blog/how-to-choose-cmp-consent-management-platform/) ensures the opt-out mechanism works as described.

Every interaction is logged. If the Attorney General requests evidence, the record is available.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Privacy Policy for your site that complies with the UCPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what the Privacy Policy must contain for the UCPA

**Visible and accessible link** on all pages of the site.

**Categories of personal data processed**, with sufficient description for the consumer to understand (§ 13-61-302(1)(a)(i)).

**Purposes of processing** for each category (§ 13-61-302(1)(a)(ii)).

**How to exercise the 4 rights** guaranteed by the UCPA: confirm/access, deletion, portability, opt-out, with channel and 45-day deadline (§ 13-61-302(1)(a)(iii)).

**Categories of personal data shared with third parties**, if any (§ 13-61-302(1)(a)(iv)).

**Categories of third parties** with whom data is shared (§ 13-61-302(1)(a)(v)).

**Disclosure of targeted advertising or data sale** with accessible opt-out (§ 13-61-302(1)(b)).

**Sensitive data treatment**: clear notice and opt-out opportunity before processing (§ 13-61-302(3)).

**Children's data treatment**: COPPA compliance for children under 13 (§ 13-61-102(3)).

**Non-discrimination policy** for consumers exercising rights (§ 13-61-302(4)).

**Free service** for the first request per 12-month period (§ 13-61-203(4)(a)).

## FAQ: UCPA and Privacy Policy

**1. Does the UCPA Privacy Policy need to specify data retention periods?**
No. The UCPA does not require the Privacy Policy to specify how long each data category is retained. This distinguishes the UCPA from the CPRA, which requires this information explicitly. The UCPA only requires the policy to describe the categories of data processed and the purposes, without detailing retention periods.

**2. Do I need to describe the right to correct in the UCPA Privacy Policy?**
No. The UCPA does not guarantee the right to correct inaccurate data, unlike the CPRA, OCPA, VCDPA, and CTDPA. The policy only needs to describe the four rights the law actually guarantees: confirm/access, deletion (limited to data provided by the consumer), portability, and opt-out from targeted advertising and data sales.

**3. How does the UCPA treat sensitive data differently from other state laws?**
Utah Code § 13-61-302(3) requires only a clear notice and an opt-out opportunity before processing sensitive data. Laws like the CPRA, OCPA, VCDPA, and CTDPA require active prior consent (opt-in) for sensitive data. This difference is fundamental: under the UCPA, the business can process sensitive data unless the consumer actively refuses. Under the other laws, the business can only process with the consumer's active consent.

**4. Does the UCPA Privacy Policy need to describe an appeal process?**
No. The UCPA does not define a formal appeal process for when the controller denies a consumer request. Unlike the OCPA (45 days for appeal), CTDPA (60 days), and VCDPA (60 days), the UCPA has no such structured mechanism. The Policy only needs to describe the four rights and the request submission channel.

**5. What happens if the Privacy Policy is incomplete when the Attorney General investigates?**
The AG sends notification identifying violations and gives 30 days to cure (§ 13-61-402(3)). This 30-day period is guaranteed permanently by the UCPA. If the business corrects the Policy and provides a written statement that the violation has been cured and will not recur, no formal action is initiated. If not corrected or if the statement is breached, the AG may seek penalties of up to US$ 7,500 per violation. An outdated Policy is one of the easiest violations to identify and to correct.

[Ready to build a Privacy Policy for your site that complies with the UCPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


Utah UCPA: Privacy Policy

## Do you want to understand why there are cookie banners on every website you visit today? This article is for you!

Cookie banners, cookie notices, GDPR notices or Privacy Notices… call them what you want. (We’ve even heard them called “that boring legal notice,” but more on that later.)

In fact, all the world’s largest and most serious companies have already added a cookie banner to their website, and this is for a good reason: GDPR, LGPD, CCPA and many others are live!

Completely inspired by the GDPR ,the LGPD in Brazil, as it’s commonly known, is a regulation that was created in 2018 specifically to address the way that personal data, such as a user’s name, e-mail, telephone number, address, etc.,  is collected and utilized by companies.

## The GDPR, LGPD…CCPA and cookie banners are here to stay!

Why does the GDPR require cookie banners? Does every website now need a banner?

The LGPD, as said, was inspired by the European Union’s General Data Protection Regulation (GDPR), and similar laws are already being enacted all over the world. Even North Korea now has its own privacy regulation! That is to say, this is not a passing trend and must be taken seriously.

This shift does not necessarily mean more bureaucracy, but it does mean real empowerment. Thanks to these new privacy laws, ordinary citizens now have the right to authorize, deny, or even revoke companies’ ability to use their data!

## You mean I didn’t already have the right to decide what happens with my data?!

Don’t worry, we can explain!

The answer is not that simple, as this law needs to function in parallel with innumerable others that also govern individual rights, including consumer, health, and internet law, among others.
Keep going, it will be worth it! Soon you’ll be able to speak like an expert on this subject.

With the advancement of advertising technologies that are linked to [digital marketing](https://br.sharpspring.com/marketing-digital/) and the exponential growth of social media, everyone now has a machine that generates and stores valuable data in the palm of their hands: cellphones. Every time an individual accesses a website, e-commerce account, Instagram, Facebook, or any similar platform, the visit generates data that is collected and stored by cookies.

Cookies are simply text files that are capable of storing information generated by websites.

## Want a practical example of cookie technology?

I'm sure you know when you enter a website through your browser and it recognizes that you’ve already accessed the page before, allowing you to re-enter the site without signing in again? This happens because your browser has already stored a cookie from that site which can authorize your access.

In the same way, cookies can also store data like which photos you’ve liked on Instagram or if you “forgot” a product in your shopping cart. All of this information is saved for later use.  

## And this is very valuable!

Did you know that a person needs, on average, at least six interactions with a product or service before making the decision to purchase?

It’s no wonder that when you “forget something in your shopping cart,” the product seems to follow you all over the internet with ads. Only then do you end up making the purchase. Is this a coincidence, or magic?
Neither, these are the processes and technologies that utilize cookies for advertising.

If you’ve been through this, welcome! You’re in good company.

Simply put, cookies are a piece of the wheel that moves the internet. It’s the use of data for advertising that allows us to consume the content that we love for free. After all, who do you think pays for that cool, free YouTube video? Advertisers! And now you know they use cookies to find you on your favorite channel.

The use of cookies is not necessarily positive or negative, but it reached a point where individuals like you or I were not fully in control of what the internet giants were doing with our data. This is why privacy laws like the GDPR, LGPD and CCPA were created: to rebalance the relationship between companies and people.

Ok, but weren’t you going to talk about data, privacy, and the rights I have?

Yes! When the LGPD was enacted by Brazil in August of 2020 it forced companies to examine the way that they handled the plethora of consumer data generated by their business, and to make changes to their processes and databases. One of these changes was the obligation to inform visitors of the reason for their data collection, as well as the legal basis for it.

Thus, in accordance with the LGPD, GDPR, CCPA and several others, every business must present a clear and objective communication that informs visitors of their purposes for collecting personal data. Whether on or offline, it is essential that every citizen is notified of the collection of their personal data as well as the many ways it might be used.

As for us data “subjects,” as some law refers to us, we are now able to make a “free, informed, and unequivocal declaration,” as to whether or not we permit its use. That is to say, if we consent to the terms outlined by the business, we authorize them to use our data.

In Brazil, for example if businesses violate this flow by collecting data without consent, they could face serious consequences including being fined up to 2% of their annual revenue, with a ceiling of 50 million real. Has your business ever considered the threat of being fined simply for not having a cookie banner on its website?

Want to understand exactly how the GDPR, LGPD and CCPA impact your business? Here are some articles on the subject.

## But how do I know what they already do, or will now do with my data? Will the cookie banner tell me?
Who among us has actually read the privacy policy or terms of use of a website we use? Not many, but it’s precisely in these official documents that these answers are found.

According to the Privacy Laws, businesses must comply with certain official documentation requirements and legal basis to inform users of their entire data collection process and its purposes. Well-known by lawyers, the “Privacy document kit” fulfills the standard that every company must meet, including a privacy policy, terms of use, data mapping, and contact information of the DPO, among others.

## Now the good news!
These documents don’t need to be written in “legalese,” nor should they be, as LGPD, GDPR and CCPA requires that the information presented be “clear and accessible.” A user cannot consent to the collection of their data if they cannot understand the banner.

What’s the use of a company acting cool in its marketing and communications, or speaking beautifully in advertisements, if when addressing privacy and transparency it starts speaking in code? It doesn’t make sense, right?

Anyway, this article aims to inform you that, along with the laws like GDPR, LGPD and CCPA, we also have new rights and duties, both as citizens and, especially, as companies. In this matter, the cookie banners actually serve a noble purpose! Businesses that use these banners correctly are able to show customers that they care about their individual rights, freedom of choice, and privacy.

## A good cookie banner should meet certain minimal requirements outlined by the GDPR, LGPD and CCPA:

Inform users clearly and objectively of all of the ways in which the company collects consumer data.
Point to official documents such as the privacy policy, terms of use, etc. (referring back to the Privacy document kit mentioned above).

List the options that you as the data owner have to fully or partially accept “the rules of the game” with that company, thus allowing you to receive their content or consume their products or services.

Make it clear where, upon accepting the cookies, you could access the data that the company will gather about you, and how to opt-out if you change your mind.

Allow users to consent to the data collection in a way that is free, informed, and unambiguous.

### Last but not least

When you see the banner: “If you continue browsing, we understand that you consent…” know that the law has determined this to be insufficient, and there are several arguments why. Mainly, this banner without further detail does not give the visitor enough information to give their consent in a manner that is “free, informed, and unambiguous.”

We hope this article helped you to understand the “why” of the now popular cookie banners, which will soon be installed on all company websites. With this new regulation, there is no going back.

## We’ll leave you with two final invitations:

1. Do you know a business that needs to know more about cookie banners?

Again, any and all companies that collect personal data, such as name, email, or telephone number on their site, and use third-party services like the Facebook pixel, Google Analytics, etc. MUST include this banner.

We at AdOpt are experts in cookie banners and can help them today! And even better, for many it’s free! Send this article to whoever you know that could use this content. They will thank you when they avoid an unpleasant fine!

2. Want to dive deeper into the subject of cookie banners?
We’ve got more articles for you [here (in Portuguese)](https://goadopt.io/blog/significado-da-lgpd/) para você:).



Why are cookie banners everywhere?

When the California Consumer Privacy Act (CCPA) came into effect on January 1, 2020, the United States still had no federal privacy law. California decided not to wait and passed the most comprehensive data protection law in the country, which became the reference for virtually everything that followed.

Two years later, California voters went to the polls and approved Proposition 24, which created the California Privacy Rights Act (CPRA). And this is where things get a little confusing for outsiders.

This guide explains what each one is, what changed, and what the current California law requires from anyone handling data of state consumers.

## CCPA and CPRA: the same law or different laws?

Good question, and the answer is not simple.

The **CCPA** (California Consumer Privacy Act) is the original law. It was passed as AB 375 in 2018 and came into effect on January 1, 2020. It is codified at California Civil Code § 1798.100 to § 1798.199.100.

The **CPRA** (California Privacy Rights Act) is Proposition 24, passed by popular vote on November 3, 2020, with most provisions operative starting January 1, 2023. The CPRA did not create a separate law. It **amended and expanded** the CCPA. In other words: what exists today is the CCPA with the CPRA amendments incorporated.

### What the CCPA had originally

The 2020 CCPA guaranteed California consumers basic rights: knowing what was collected, requesting deletion of their data, and refusing the sale of their data. It was a pioneering and important law, but with significant gaps.

### What the CPRA changed starting in 2023

The CPRA made deep changes:

**Created the California Privacy Protection Agency (CPPA):** an independent regulatory agency with full administrative power to implement and enforce the law. Before, it was the Attorney General who enforced compliance. Now the CPPA has its own structure, investigative powers, authority to impose administrative fines, and a guaranteed budget.

**Added new rights:** the right to correct inaccurate data and the right to limit the use and disclosure of sensitive personal information.

**Created the "sharing" category:** separated "sale" from "sharing" for cross-context behavioral advertising. This means sharing data with advertising platforms for targeting, even without receiving money directly, now requires an opt-out.

**Expanded the definition of sensitive data:** added genetic data, neural data, health information, sexual orientation, and sex life.

**Required the "Limit the Use of My Sensitive Personal Information" link:** in addition to the existing "Do Not Sell or Share My Personal Information."

**Imposed data minimization and proportionate retention requirements.**

| Aspect | CCPA (2020) | CCPA + CPRA (2023) |
|---|---|---|
| Enforcement | Attorney General | CPPA (independent agency) + AG |
| Consumer rights | 5 rights | 7 rights |
| Required links | "Do Not Sell My Personal Information" | "Do Not Sell or Share" + "Limit Sensitive PI" |
| Sensitive data | Basic category | Expanded (includes neural data) |
| Private right of action | Security breaches only | Security breaches only |
| Full effect | Jan 2020 | Jan 2023 |

In the California articles on this blog, we cover the current law: **CCPA as amended by the CPRA**. For the specific CPRA changes, we have a dedicated guide on the [California CPRA](https://goadopt.io/en/blog/california-cpra-and-cookies-all-you-need-to-know/).

## What is the CCPA/CPRA today?

The California Consumer Privacy Act, as amended by the CPRA, is the most comprehensive data protection law in the United States. It guarantees broad rights to California consumers and creates detailed obligations for businesses that handle their data.

Enforcement today is shared between the **California Privacy Protection Agency (CPPA)** and the **California Attorney General**, with distinct and complementary powers.

## When did the CCPA come into effect?

The original CCPA came into effect on **January 1, 2020**.

The CPRA amendments became operative on **January 1, 2023**.

The current version of the law, with all rights and obligations in effect, has applied since January 2023.

## Who needs to comply with the CCPA?

Under § 1798.140(d), the law applies to for-profit businesses that do business in California, collect personal information from consumers, and meet at least **one** of the following thresholds:

Annual gross revenues in excess of **US$ 25 million** in the preceding calendar year.

Annually buys, sells, or shares the personal information of **100,000 or more consumers or households**.

Derives **50% or more** of annual revenues from selling or sharing consumers' personal information.

The US$ 25 million threshold is the lowest among all US state privacy laws, making the CCPA the law with the broadest reach in terms of businesses affected.

Understanding the distinction between [controller and processor](https://goadopt.io/en/blog/responsibilities-of-a-data-protection-officer/) is fundamental to defining responsibilities in the processing chain.

### CCPA Exemptions

Exempt from most obligations:

Protected health information under HIPAA and data of covered entities.

Data regulated by the California Confidentiality of Medical Information Act.

Consumer credit information regulated by the Fair Credit Reporting Act.

Financial data regulated by the Gramm-Leach-Bliley Act or the California Financial Information Privacy Act.

Data regulated by the Driver's Privacy Protection Act.

Academic or public health research data with appropriate safeguards.

Employee and job applicant data when used in that capacity.

## What is personal information under the CCPA?

Under § 1798.140(v), personal information is any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.

This includes identifiers such as name, address, IP address, email, Social Security number, driver's license, and passport number. It also includes commercial information, browsing history, geolocation data, audio and visual information, employment data, education data, and inferences drawn to create consumer profiles.

De-identified data and publicly available information are excluded.

## What is sensitive personal information under the CCPA/CPRA?

The CCPA, after CPRA amendments, has an expanded category of "sensitive personal information" (§ 1798.140(ae)):

Social Security number, driver's license, state identification card, or passport number.

Account login, financial account, debit or credit card number in combination with any required security code or password.

Precise geolocation (radius of 1,850 feet or less).

Racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership.

Contents of a consumer's mail, email, and text messages, unless the business is the intended recipient.

Genetic data.

Neural data: information generated by measuring the activity of a consumer's central or peripheral nervous system.

Processing of biometric information for unique identification.

Health information collected and analyzed.

Information about sex life or sexual orientation.

The inclusion of neural data is exclusive to the CCPA/CPRA among US state privacy laws.

## What are consumer rights under the CCPA/CPRA?

The law guarantees seven main rights:

**Right to know and access:** confirming whether the business processes their data and obtaining specific information collected, including categories of data, sources, purposes, third parties, and the specific pieces of personal information. The request covers the **preceding 12 months** (§ 1798.110, 1798.115).

**Right to deletion:** requesting deletion of personal data collected by the business, with the obligation to notify service providers, contractors, and third parties to also delete (§ 1798.105).

**Right to correction:** requesting correction of inaccurate personal data, added by the CPRA (§ 1798.106).

**Right to opt-out of sale and sharing:** directing the business not to sell or share personal data, exercisable at any time (§ 1798.120).

**Right to limit use of sensitive personal information:** restricting use of sensitive personal information to what is necessary to provide the products or services reasonably expected. Added by the CPRA (§ 1798.121).

**Right of non-discrimination:** exercising any right without being discriminated against by the business (§ 1798.125).

**Private right of action for security breaches:** filing a civil lawsuit for damages of US$ 100 to US$ 750 per consumer per incident. Unique among US state privacy laws (§ 1798.150).

The business has **45 days** to respond. The deadline can be extended by another **45 days** when reasonably necessary, with notification within the initial period. Service is free. The business is not obligated to provide information to the same consumer more than **twice in a 12-month period** (§ 1798.130(b)).

## The two required links on the site

The CCPA/CPRA requires specific links on the business's homepage (§ 1798.135):

**"Do Not Sell or Share My Personal Information":** a clear and conspicuous link to a page where the consumer can opt out of sale and sharing of their data.

**"Limit the Use of My Sensitive Personal Information":** a link allowing the consumer to limit the use of sensitive personal information to what is necessary to provide the products or services.

The business may use a single combined link for both purposes, as long as it clearly allows exercising both options.

Both links need somewhere to land. In practice that destination is a [privacy portal where the consumer submits and tracks the request](https://goadopt.io/en/blog/california-ccpa-dsar-privacy-portal/) — the same channel that receives access, deletion, and correction requests within the statutory deadline.

It is also possible to comply by honoring the opt-out preference signal of the **Global Privacy Control (GPC)** when sent by the user.

## "Sale" vs "sharing" under the CCPA/CPRA

This distinction created by the CPRA is fundamental.

**Sale** (§ 1798.140(ad)): transfer of data for monetary or **other valuable consideration** to third parties.

**Sharing** (§ 1798.140(ah)): transfer of data to third parties for **cross-context behavioral advertising**, whether or not for monetary consideration.

Cross-context behavioral advertising (§ 1798.140(k)): targeting ads based on personal information obtained from consumer activity across businesses, distinctly branded websites, applications, or services other than where the consumer is currently interacting.

In practice: if your site passes data to an advertising platform so it can display personalized ads to the user on other sites, that is "sharing" under the CCPA/CPRA, even if you receive no money directly.

## Cookies and the CCPA/CPRA

Cookies that collect personal information or allow user identification fall directly within the scope of the CCPA/CPRA.

Before firing any non-essential cookie, the site must display a clear [cookie notice](https://goadopt.io/en/blog/operation-of-cookie-banner/), offer opt-out of sale and sharing, block non-consented trackers, and honor the GPC.

[Correct tag categorization](https://goadopt.io/en/blog/difference-cookies-local-storage-session-storage/) is what makes it possible to identify which cookies constitute sale or sharing and which require the opt-out links.

That same inventory is what you publish to visitors: a [CCPA cookie policy](https://goadopt.io/en/blog/california-ccpa-cookies-policy/) needs to list each category of tracker, its purpose, its retention period, and whether it results in sale or sharing of personal information.

## Protection for consumers under 16 years of age

§ 1798.120(c) prohibits the sale or sharing of data of consumers under 16 without affirmative authorization:

For consumers between 13 and 15: the consumer's own authorization.

For consumers under 13: authorization from a parent or legal guardian.

A business that willfully disregards the consumer's age is deemed to have actual knowledge of it.

## The California Privacy Protection Agency (CPPA)

The CPPA (§ 1798.199.10) is governed by a five-member board with terms of up to eight years. It has power to:

Impose administrative fines of up to **US$ 2,500 per violation** and up to **US$ 7,500 for intentional violations** or violations involving minors.

Investigate businesses on its own initiative or based on complaints.

Conduct audits.

Issue and revoke regulations.

The Attorney General retains power to seek **civil penalties** of up to US$ 2,500 per violation and US$ 7,500 for intentional violations or violations involving minors.

There is no guaranteed cure period before CPPA actions. The agency has discretion to investigate and act without any obligation to grant advance notice.

## The toll-free number is mandatory

§ 1798.130(a)(1) requires two or more designated methods for submitting requests. One of those methods must be, at minimum, a **toll-free telephone number**.

Businesses that operate exclusively online with a direct consumer relationship may limit themselves to an email address.

## Privacy notice: update every 12 months

§ 1798.130(a)(5) requires the business to update the privacy notice **at least once every 12 months**, including lists of the categories of data collected, sold, shared, and disclosed for business purposes in the preceding 12 months.

This is the annual review that keeps a [CCPA privacy policy](https://goadopt.io/en/blog/california-ccpa-privacy-policy/) valid — an outdated notice is, in practice, a notice out of compliance.

## How AdOpt helps with the CCPA/CPRA

AdOpt records every consent and opt-out interaction, honors the GPC when sent by the user, blocks trackers before acceptance, and generates the auditable log needed in a CPPA or Attorney General investigation.

The automatic scan identifies all active [trackers](https://goadopt.io/en/blog/gdpr-cookies-explained/) on the site, feeding the data inventory. And when the law changes, the platform updates automatically.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Ready to bring your website into compliance with the CCPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Comparing CCPA/CPRA with other privacy laws

| Law | State | Threshold | Penalty | Enforcer | Effective Date |
|---|---|---|---|---|---|
| CCPA/CPRA | California | US$ 25M OR 100K consumers OR 50% revenue | Up to US$ 7,500/violation | CPPA + AG | Jan 2020/Jan 2023 |
| VCDPA | Virginia | 100K or 25K + 50% revenue | Up to US$ 7,500/violation | AG | Jan 2023 |
| FDBR | Florida | US$ 1B+ global revenue | Up to US$ 50K/violation | Dept. Legal Affairs | Jul 2024 |
| NHDPA | New Hampshire | 35K or 10K + 25% revenue | Up to US$ 10K/violation | AG | Jan 2025 |
| CPA | Colorado | 100K or 25K + 50% revenue | Up to US$ 20K/violation | AG | Jul 2023 |

To understand how these [privacy laws](https://goadopt.io/en/blog/gdpr-lgpd-and-ccpa-what-are-these-laws-similarities-and-differences/) compare in structure and practical impact, our comparative guide goes deeper.

## Continue learning about privacy in California

The CCPA is the starting point, not the whole picture. To see what changed when Proposition 24 took effect, read our guide to the [CPRA and cookies](https://goadopt.io/en/blog/california-cpra-and-cookies-all-you-need-to-know/). And to compare California's approach with the European and Brazilian models, see [how the GDPR, LGPD, and CCPA differ in practice](https://goadopt.io/en/blog/gdpr-lgpd-and-ccpa-what-are-these-laws-similarities-and-differences/).

## The CCPA in practice: the three documents

Compliance with the CCPA rests on three documents that have to agree with each other: the [cookies policy](https://goadopt.io/en/blog/california-ccpa-cookies-policy/), which declares every tracker and its purpose; the [privacy policy](https://goadopt.io/en/blog/california-ccpa-privacy-policy/), which explains what you do with the data; and the [privacy portal](https://goadopt.io/en/blog/california-ccpa-dsar-privacy-portal/), where the consumer exercises their rights and you keep the record of it.

## FAQ: California CCPA/CPRA

**1. What is the difference between the CCPA and the CPRA?**
The CCPA is California's original privacy law, in effect since January 1, 2020. The CPRA (Proposition 24) was passed by voters in November 2020 and amended the CCPA with full effect from January 2023. The CPRA is not a separate law: it modified and expanded the CCPA. The most important changes were the creation of the California Privacy Protection Agency (CPPA), the addition of rights to correct data and limit use of sensitive personal information, the separation of "sale" from "sharing," and the expanded definition of sensitive personal information.

**2. Who needs to comply with the CCPA?**
For-profit businesses that do business in California and meet at least one threshold: annual revenues exceeding US$ 25 million; buying, selling, or sharing personal information of 100,000 or more consumers or households per year; or deriving 50% or more of annual revenues from selling or sharing personal data (§ 1798.140(d)).

**3. What is the difference between "sale" and "sharing" under the CCPA/CPRA?**
"Sale" is the transfer of data for monetary or other valuable consideration to third parties. "Sharing" is the transfer for cross-context behavioral advertising, with or without monetary consideration. The distinction ensures that advertising targeting practices are also subject to opt-out, even without direct payment to the site.

**4. What are the "Do Not Sell or Share" and "Limit the Use of My Sensitive Personal Information" links?**
These are mandatory links on the business's homepage (§ 1798.135). The first allows the consumer to opt out of sale and sharing of their data. The second allows limiting the use of sensitive personal information. They can be two separate links or a single combined link that clearly allows exercising both options.

**5. What is the private right of action under the CCPA and why is it unique?**
§ 1798.150 grants consumers the right to file a civil lawsuit when unencrypted and unredacted data is exposed in a security breach due to the business's failure to implement reasonable security measures. The consumer can recover US$ 100 to US$ 750 per incident or actual damages when greater. This private right of action is exclusive to the CCPA among US state privacy laws.

[Ready to bring your website into compliance with the CCPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


California CCPA and Cookies: All You Need to Know

The Iowa Consumer Data Protection Act (ICDPA, Iowa Code § 715D) has privacy notice requirements very similar to Utah's UCPA, with one important operational difference: the response deadline for consumer requests is **90 days**, not 45.

This page covers one piece of the picture. For the full scope of the ICDPA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the ICDPA and cookies](https://goadopt.io/en/blog/iowa-icdpa-and-cookies-all-you-need-to-know/).

For the Privacy Policy, this means the process described in the document for exercising rights must reflect this longer deadline. Iowa consumers will have to wait up to three months to receive a response, and the notice must be clear about this.

This article focuses exclusively on what the ICDPA requires from the Privacy Policy.

## What the ICDPA calls a Privacy Notice

The law uses the term "privacy notice." Under § 715D.4(5), the controller must provide a notice that is "reasonably accessible, clear, and meaningful."

## What must be in the Privacy Policy under the ICDPA

### 1. Categories of personal data processed

The notice must list the categories of personal data the controller processes (§ 715D.4(5)(a)).

Personal data under the ICDPA is any information linked or reasonably linkable to an identified or identifiable natural person (§ 715D.1(18)). This includes identifiers such as name, email, IP address, browsing history, and data that allows tracking a person.

De-identified data, aggregate data, and publicly available information are excluded.

### 2. The purpose for processing

The notice must explain the purpose for which data is processed (§ 715D.4(5)(b)).

The law does not specify that purposes must be highly detailed, but the requirement that the notice be "clear and meaningful" implies that generalities like "improve services" are insufficient.

### 3. How consumers exercise their rights and how to appeal

The notice must describe how consumers can exercise the rights guaranteed by the ICDPA, including how to appeal a controller decision (§ 715D.4(5)(c)).

The four rights under the ICDPA are:

**Confirm and access:** confirm whether the controller processes data and access that data (§ 715D.3(1)(a)).

**Deletion:** request deletion of data the consumer provided to the controller (§ 715D.3(1)(b)).

**Portability:** obtain a copy of the data in a portable format (§ 715D.3(1)(c)).

**Opt-out from data sales:** refuse the sale of personal data (§ 715D.3(1)(d)).

**The deadline that must be described: 90 days** to respond from receipt of the request, with a possible extension of 45 more days with notification within the initial period (§ 715D.3(2)(a)).

**The appeal process:** the notice must describe how the consumer can appeal a denial decision, with a 60-day response deadline for appeals (§ 715D.3(3)). If the appeal is denied, the consumer must be informed of how to contact the Attorney General online.

### 4. Categories of personal data shared with third parties

The notice must identify the categories of personal data the controller shares with third parties, if any (§ 715D.4(5)(d)).

### 5. Categories of third parties with whom data is shared

The notice must identify the categories of third parties with whom data is shared, if any (§ 715D.4(5)(e)).

The ICDPA does not require the level of detail about how each third party may process data that the OCPA demands. Identifiable categories are sufficient.

## Disclosure of targeted advertising and data sales

If the business sells data or engages in targeted advertising, § 715D.4(6) requires clear and conspicuous disclosure of that activity, with description of the method by which the consumer can exercise the opt-out for each activity.

Targeted advertising, per § 715D.1(28), consists of ads selected based on data obtained from the consumer's activities over time and across non-affiliated websites or applications.

Although opt-out from targeted advertising is not listed as a formal right in § 715D.3, the disclosure obligation in § 715D.4(6) creates the practical requirement to offer this opt-out in the privacy notice.

## The request submission channel

Under § 715D.4(7), the controller must establish secure and reliable means for consumers to submit rights requests, and describe those means in the privacy notice.

These means must:

Consider how consumers normally interact with the controller.

Ensure secure and reliable communication.

Allow authentication of the consumer's identity.

The controller may not require the consumer to create a new account to exercise their rights. It may require use of an existing account (§ 715D.4(7)).

## Sensitive data: notice and opt-out, not consent

Under § 715D.4(2), the controller may not process sensitive data without first presenting the consumer with a clear notice and offering an opt-out opportunity.

Sensitive data includes: racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data for unique identification, data of known children, and precise geolocation data.

This opt-out model for sensitive data is identical to the UCPA's. It is less restrictive than the opt-in required by the CPRA, OCPA, VCDPA, and CTDPA.

For data of known children, the business must comply with COPPA (§ 715D.2(2)(r) and 715D.4(2)).

The Privacy Policy must:

Identify whether the business processes sensitive data.

Describe how the sensitive data notice is presented to consumers.

Explain how the consumer can exercise the opt-out from sensitive data processing.

## What the ICDPA does not require in the Privacy Policy

Comparing with other laws:

**No mandatory retention periods.** The CPRA requires specifying how long each data category is retained. The ICDPA has no such requirement.

**No detail about third parties.** The OCPA requires describing how each third party may process data. The ICDPA requires only categories.

**No right to correct to describe.** Since the ICDPA does not provide this right, the policy does not need to describe it.

**The 90-day deadline must be clearly described.** Consumers familiar with VCDPA, OCPA, and CTDPA expect responses within 45 days. A notice that clearly states the ICDPA's 90-day deadline avoids unnecessary complaints.

## Non-discrimination

Under § 715D.4(3), the business may not discriminate against consumers who exercise their rights. This includes denying goods or services, charging different prices, or offering different quality.

The exception is voluntary loyalty programs and situations where the consumer opted out of targeted advertising and the business adjusted prices accordingly.

## The 90-day cure period and its relationship to the Policy

Before initiating any action, the Iowa Attorney General must notify the controller and grant **90 days to cure** (§ 715D.8(2)). This is the longest cure period of all US state privacy laws.

An outdated or incomplete Privacy Policy can be corrected within 90 days with the right processes. But structuring it correctly from the start is always more efficient.

## How AdOpt supports ICDPA compliance

AdOpt ensures that what is written in the Policy has real correspondence with what actually happens on the site.

The automatic scan identifies all active technologies, feeding the list of data categories and third parties. The [consent management platform](https://goadopt.io/en/blog/how-to-choose-cmp-consent-management-platform/) ensures the opt-out mechanism works as described.

Every interaction is logged. If the Attorney General requests evidence, the record is available.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Privacy Policy for your site that complies with the ICDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what the Privacy Policy must contain for the ICDPA

**Visible and accessible link** on all pages of the site.

**Categories of personal data processed** (§ 715D.4(5)(a)).

**Purpose for processing** each category (§ 715D.4(5)(b)).

**How to exercise the 4 rights** with channel and **90-day** deadline (§ 715D.4(5)(c)).

**Appeal process** with **60-day** response deadline (§ 715D.3(3)).

**How to contact the Attorney General** if appeal is denied (§ 715D.3(3)).

**Categories of personal data shared with third parties** (§ 715D.4(5)(d)).

**Categories of third parties** with whom data is shared (§ 715D.4(5)(e)).

**Disclosure of data sales or targeted advertising** with opt-out method (§ 715D.4(6)).

**Request submission channel** described, without requiring new account (§ 715D.4(7)).

**Sensitive data treatment**: clear notice and opt-out before processing (§ 715D.4(2)).

**COPPA compliance** for children's data (§ 715D.4(2)).

**Non-discrimination policy** (§ 715D.4(3)).

**Free service for 2 requests** per year per consumer (§ 715D.3(2)(c)).

## FAQ: ICDPA and Privacy Policy

**1. Why must the ICDPA Privacy Policy clearly state the 90-day deadline?**
Most consumers who have interacted with privacy notices from other jurisdictions expect responses within 45 days. The ICDPA establishes 90 days as the standard deadline (§ 715D.3(2)(a)), which is significantly different. A Policy that clearly describes this deadline helps manage expectations and avoids complaints from consumers expecting a faster response. Describing the correct deadline also demonstrates that the business knows its specific legal obligations.

**2. Does the privacy notice need to mention the ICDPA's appeal process?**
Yes. § 715D.4(5)(c) requires the notice to describe how consumers can exercise their rights "including how a consumer may appeal a controller's decision with regard to the consumer's request." This means the appeal process, with a 60-day response deadline (§ 715D.3(3)), must be described. If the appeal is denied, the notice should also indicate how the consumer can contact the Attorney General.

**3. Does the ICDPA have the same free-service policy as the UCPA?**
Not exactly. The ICDPA guarantees free service for **2 requests** per consumer per 12-month period (§ 715D.3(2)(c)). The UCPA guarantees free service for only **1 request** per 12-month period. The VCDPA also guarantees 2 free requests per year. The Privacy Policy must correctly reflect this number, as stating "free once per year" when the law guarantees 2 would be an inaccuracy that could generate complaints.

**4. Does the ICDPA use the same opt-out model for sensitive data as the UCPA?**
Yes. Both the ICDPA (§ 715D.4(2)) and the UCPA require only a clear notice and opt-out opportunity before processing sensitive data, without requiring active prior consent. This model differs from the opt-in required by the CPRA, OCPA, VCDPA, and CTDPA. A business already compliant with the UCPA on this point will be compliant with the ICDPA as well.

**5. Does the ICDPA require the same level of detail about third parties as the OCPA?**
No. The OCPA requires describing third parties at a level of detail that enables the consumer to understand what type of entity each third party is and how it may process data. The ICDPA (§ 715D.4(5)(d) and (e)) requires only the categories of data shared and the categories of third parties, without the additional detail the OCPA demands. Categories such as "digital advertising platforms" and "analytics tools" are sufficient under the ICDPA.

[Ready to build a Privacy Policy for your site that complies with the ICDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


IOWA ICDPA: Privacy Policy

More than 30,000 people use [AdOpt's cookie notice](https://goadopt.io) daily to comply with various privacy regulations around the world.

In our "**Big Dream**," all goals and aspirations point toward a global operation.

Today, we can confidently say that AdOpt is getting closer to this goal every day!

## Assisting small businesses worldwide in respecting the privacy of internet users.

The [Cookie Plugin for WordPress](https://wordpress.org/plugins/adopt/#description) is a crucial element in our global expansion strategy!

## One of the largest website-building platforms in the world!

The WordPress platform powers nearly 450 million websites globally, and it's estimated that 50% of Brazilian websites are on this platform. In other words, there are many people using and contributing to the community daily!

But getting here wasn't easy!

The initial sketches of the plugin began in 2020. At that time, AdOpt was virtually unknown, and very few believed that [LGPD](https://goadopt.io/en/blog/lgpd-general-data-protection-law/) would actually come into effect. So, as we always prioritize transparency, agility, and quality, our plugin, on one of the world's largest platforms, couldn't be "just another one."

Therefore, we outlined some key objectives that would lead us to develop our Cookie Plugin for WordPress with excellence!

- **Implement Version 2 of the Platform, more robust and scalable** - Released in Dec/2021

- **Allow AdOpt users to comply with multiple regulations and languages!** - Released in Apr/2021

- **Provide more autonomy and flexibility for our customers to customize 100% of the Cookie Banner text as needed** - Released in Apr/2021

We have listed the above points as the pillars of our minimum requirements to offer a good plugin worthy of the WordPress community. We believe that in doing so, we reinforce our value of providing "[compliance with LGPD, GDPR, and CCPA... even with the free plan](https://goadopt.io)"!

At AdOpt, we are obsessed with a platform that is always easier and more intuitive for users.

So, know that many more exciting features are yet to come!

We are working tirelessly to expand our integrations and partnerships so that anyone, even without any coding or programming experience, can confidently ensure their websites comply with all the world's privacy laws with just a few clicks.

## Want to install the [Cookie Plugin for WordPress](https://wordpress.org/plugins/adopt/#description) from AdOpt on your website?

Below is a tutorial to help you!

1. Install the [Cookie Plugin for WordPress](https://wordpress.org/plugins/adopt/#description).

2. Simply copy the ID of your Cookie Notice from AdOpt.
![Fast tutorial WP 1.png](https://strapi.goadopt.io/uploads/Fast_tutorial_WP_1_4184f033e9.png)

3. Activate the Plugin and paste the Banner ID.
![Fast tutorial WP 2.png](https://strapi.goadopt.io/uploads/Fast_tutorial_WP_2_e1742f229f.png)

4. Save.

5. That's it! The plugin will automatically install AdOpt's tag on your site.
**No coding, no complications.**

### If you have any questions, here's a [**more detailed tutorial**](https://goadopt.io/en/support/integrations/wordpress/adopt-cookie-banner-wordpress/) for your reference, okay?



We've created a cookie banner plugin.

## New Hampshire NHDPA: Everything You Need to Know

One more US state has entered the data privacy map.

The New Hampshire Data Privacy Act (NHDPA), codified under RSA 507-H, came into effect on January 1, 2025. It guarantees rights for consumers in the state and creates clear obligations for businesses that process the personal data of those individuals.

If your website serves users from New Hampshire, this guide is for you.

## What is the NHDPA?

The New Hampshire Data Privacy Act (RSA 507-H) is New Hampshire's state-level personal data protection law. It follows the same logic as the major modern privacy regulations: giving people back control over the data companies collect about them.

If you are already familiar with the [LGPD](https://goadopt.io/en/blog/lgpd-general-data-protection-law/), the GDPR, or the CCPA, the NHDPA framework will feel familiar. The differences are in the details, and some of those details matter quite a bit.

Enforcement falls under the Data Privacy Unit within the Consumer Protection and Antitrust Bureau of the New Hampshire Department of Justice. The state's Attorney General holds exclusive authority to enforce the law.

## When did the NHDPA come into effect?

On **January 1, 2025**.

There is no grace period. There are no friendly warnings from regulators. Any business that meets the criteria should already be in compliance.

## Who needs to comply with the NHDPA?

Under RSA 507-H:2, the law applies to persons that conduct business in New Hampshire or produce products or services targeted to state residents and that, during a calendar year:

Control or process personal data of at least **35,000 unique consumers**, excluding data processed solely to complete a payment transaction, or

Control or process personal data of at least **10,000 unique consumers** and derive more than **25% of gross revenue** from the sale of personal data.

The law does not focus on where the business is headquartered. It focuses on who the users are. If you have traffic from New Hampshire and process data from those people at scale, the law may reach you.

Understanding the difference between [controller and processor](https://goadopt.io/en/blog/responsibilities-of-a-data-protection-officer/) is the first step in defining which role your business plays and what your responsibilities are.

### NHDPA Exemptions

Under RSA 507-H:3, the following are exempt:

State and local government bodies and their subdivisions.

Nonprofit organizations.

Higher education institutions.

Financial institutions regulated by the Gramm-Leach-Bliley Act.

Entities regulated by HIPAA.

National securities associations registered with the SEC.

## What is personal data under the NHDPA?

Under RSA 507-H:1, XIX, personal data is any information linked or reasonably linkable to an identified or identifiable individual. This includes name, email, IP address, browsing history, location data, device identifiers, and any information that allows a person to be tracked.

De-identified data and publicly available information are excluded.

A well-executed [data mapping](https://goadopt.io/en/blog/what-is-privacy-by-design/) exercise reveals where this data is being generated and processed in your digital environment.

## What is sensitive data under the NHDPA?

Under RSA 507-H:1, XXVIII, sensitive data includes:

Data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life, sexual orientation, citizenship or immigration status.

Genetic or biometric data processed to identify an individual.

Personal data collected from known children (under 13 as defined by COPPA).

Precise geolocation data (within a radius of 1,750 feet).

Sensitive data cannot be processed without the consumer's explicit prior consent, as required by RSA 507-H:6, I, d.

## Special protection for teenagers between 13 and 15 years old

The NHDPA goes beyond protections for children under 13. RSA 507-H:6, I, g expressly prohibits controllers from processing data of consumers for targeted advertising or data sale purposes without consent when the controller has actual knowledge and deliberately ignores that the consumer is between 13 and 15 years old.

This additional protection for teenagers is a distinguishing feature of the NHDPA compared to other US state laws.

## What are consumer rights under the NHDPA?

Under RSA 507-H:4, the law guarantees residents of New Hampshire the following rights:

**Right to access and confirmation:** knowing whether the business processes their data and obtaining a readable copy.

**Right to correction:** correcting inaccuracies in personal data.

**Right to deletion:** requesting the deletion of data they provided or that was collected about them.

**Right to portability:** obtaining data in a portable, usable format, when processing is carried out by automated means.

**Right to opt-out:** refusing processing for targeted advertising, personal data sale, and profiling with legal or similarly significant effects.

**Right to appeal:** challenging any request denied by the controller.

The controller has **45 days** to respond. The deadline can be extended by another 45 days in complex cases, as long as the consumer is notified within the initial timeframe (RSA 507-H:4, III, a).

Service is **free once per year** per consumer. For requests that are manifestly unfounded, excessive, or repetitive, the business may charge a reasonable fee or refuse, but the burden of proving the excessive nature of the request lies with the business (RSA 507-H:4, III, c).

## Consent: the foundation of the NHDPA

Under RSA 507-H:1, VII, consent is a clear affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreement.

What is not valid consent: accepting general terms of use that contain data processing descriptions alongside unrelated information, hovering over or closing a piece of content, and any agreement obtained through dark patterns.

Dark patterns, defined in RSA 507-H:1, XII, are interfaces designed with the substantial effect of subverting or impairing the autonomy, decision-making, or choice of the user.

### The 15-day deadline to cease processing after revocation

A specific and important point of the NHDPA is in RSA 507-H:6, I, f: after a consumer revokes consent, the business must cease processing the data as soon as practicable, but **no later than 15 days** after receiving the request.

This is a shorter deadline than the DSAR response period and directly impacts how marketing and tracking systems are configured.

## Controller obligations under the NHDPA

Under RSA 507-H:6, the controller must:

Limit data collection to what is adequate, relevant, and reasonably necessary for the stated purposes.

Not process data for purposes incompatible with those disclosed, except with consent.

Implement reasonable technical, administrative, and physical security practices proportionate to the volume and nature of the data.

Not process sensitive data without prior consent.

Not discriminate against consumers who exercise their rights.

Offer a consent revocation mechanism that is as easy to use as the consent mechanism itself.

Provide a clear and meaningful privacy notice covering all elements required by law.

Conduct Data Protection Assessments for high-risk activities.

A [Records of Processing Activities (ROPA)](https://goadopt.io/en/blog/ropa-for-lgpd/) document that is kept up to date records all of these activities and serves as evidence of compliance in the event of an investigation.

## Cookies and the NHDPA

Cookies that collect personal data or allow user identification fall directly within the scope of the NHDPA.

Before firing any non-essential cookie, the website must display a clear [cookie notice](https://goadopt.io/en/blog/operation-of-cookie-banner/), obtain affirmative consent, block trackers until acceptance, and offer real opt-out options without dark patterns.

[Correct tag categorization](https://goadopt.io/en/blog/difference-cookies-local-storage-session-storage/) is what makes it possible to identify which cookies are necessary and which require consent.

The law also requires respect for the opt-out preference signal, such as the Global Privacy Control (GPC), under RSA 507-H:6, V, a, 1, B. But with an important nuance: the signal is only valid when the consumer configured it in an affirmative and voluntary manner, not as an automatic device default.

## Enforcement and penalties

Under RSA 507-H:11, the Attorney General holds exclusive authority to enforce the NHDPA. There is no private right of action.

**In 2025** (RSA 507-H:11, II): the Attorney General was required to issue a notice of violation and give the controller **60 days** to cure before filing a lawsuit.

**From 2026 onward** (RSA 507-H:11, III): the cure period became **discretionary**. The Attorney General may or may not grant the cure period, considering factors such as the number of violations, the size and complexity of the business, the nature of the processing, the risk to the population, and whether the violation was caused by human or technical error. There is no longer an automatic right to an opportunity to correct.

Violations are treated as unfair trade practices under RSA 358-A:2 (New Hampshire Consumer Protection Act), which provides for significant civil [penalties](https://goadopt.io/en/blog/fines-in-LGPD/). The market reference value is up to **US$ 10,000 per violation**.

## How to comply with the NHDPA in practice

### 1. Data mapping
Understand what you collect, where it lives, how it is used, and with whom it is shared. [Data mapping](https://goadopt.io/en/blog/what-is-privacy-by-design/) is the foundation of everything.

### 2. Update your privacy policy
The document must cover all requirements of RSA 507-H:6, III, with the date of the last update clearly visible.

### 3. Implement a functional cookie notice
A [cookie banner](https://goadopt.io/en/blog/how-to-choose-a-cookie-banner-for-your-website/) that blocks, records, respects the GPC as an affirmative choice, and offers real control options.

### 4. Create channels for DSARs
At least one secure and reliable mechanism to receive requests. No requirement for the consumer to create a new account.

### 5. Configure the 15-day deadline
Ensure your systems can cease processing within 15 days of a consent revocation.

### 6. Document everything
ROPA, data protection assessments, processor agreements. This documentation is your defense.

Applying [privacy by design](https://goadopt.io/en/blog/what-is-privacy-by-design/) from the conception of products is what makes compliance sustainable.

## How AdOpt helps with the NHDPA

AdOpt records every consent interaction, blocks trackers before acceptance, automatically respects the GPC when configured by the user, and generates the auditable log you would need to present in an investigation.

The automatic scan identifies all active [trackers](https://goadopt.io/en/blog/gdpr-cookies-explained/) on the site, feeding the data inventory. And when the law changes, the platform updates automatically.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Ready to bring your website into compliance with the NHDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Comparing the NHDPA with other privacy laws

| Law | State | Consumer Volume | Penalty | Effective Date |
|---|---|---|---|---|
| NHDPA | New Hampshire | 35K or 10K + 25% revenue | Up to US$ 10K/violation | Jan 2025 |
| TIPA | Tennessee | 175K or 25K + 50% revenue | US$ 7,500/violation | Jul 2025 |
| TDPSA | Texas | 25K residents | US$ 7,500/violation | Jul 2024 |
| MTCDPA | Montana | 25K residents | US$ 7,500/violation | Oct 2025 |
| CPA | Colorado | 100K residents | US$ 20,000/violation | Jul 2023 |

To understand how these [privacy laws](https://goadopt.io/en/blog/gdpr-lgpd-and-ccpa-what-are-these-laws-similarities-and-differences/) compare in terms of structure, our comparative guide goes deeper on the subject.

## The NHDPA in practice: the three documents

Compliance with the NHDPA rests on three documents that have to agree with each other: the [cookies policy](https://goadopt.io/en/blog/new-hampshire-nhdpa-cookies-policy/), which declares every tracker and its purpose; the [privacy policy](https://goadopt.io/en/blog/new-hampshire-nhdpa-privacy-policy/), which explains what you do with the data; and the [privacy portal](https://goadopt.io/en/blog/new-hampshire-nhdpa-dsar-privacy-portal/), where the consumer exercises their rights and you keep the record of it.

## FAQ: New Hampshire NHDPA

**1. What is the NHDPA and when did it come into effect?**
The New Hampshire Data Privacy Act (RSA 507-H) is New Hampshire's state-level data protection law. It came into effect on January 1, 2025. It guarantees rights to consumers in the state and imposes compliance obligations on businesses that process the personal data of those individuals.

**2. Who needs to comply with the NHDPA?**
Businesses that conduct operations in New Hampshire or target products and services to its residents, and that process data from at least 35,000 unique consumers per year, or from at least 10,000 consumers while deriving more than 25% of revenue from the sale of personal data (RSA 507-H:2).

**3. What is the penalty for non-compliance?**
Violations are treated as unfair trade practices under RSA 358-A:2. The reference value is up to US$ 10,000 per violation. In 2025, there was a guaranteed 60-day cure period. From 2026 onward, the cure period is discretionary and may not be granted (RSA 507-H:11).

**4. How long does a business have to respond to a consumer request?**
45 days from the receipt of an authenticated request. The deadline can be extended by another 45 days in complex cases, with notification within the initial period. For appeals, 60 days. Free once per year per consumer (RSA 507-H:4, III).

**5. What is the deadline to cease processing after consent is revoked?**
15 days from the receipt of the revocation request, under RSA 507-H:6, I, f. This deadline is separate from the DSAR response period and must be factored into the configuration of marketing and tracking systems.

[Want to bring your website into compliance with the NHDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)



New Hampshire NHDPA and Cookies: All you need to know

The Oregon Consumer Privacy Act (OCPA, ORS 646A.570 et seq.) has a specific requirement for the privacy notice that does not appear as explicitly in other US state privacy laws: the notice must include an **active email address or other online method** that the controller **actively monitors**.

This page covers one piece of the picture. For the full scope of the OCPA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the OCPA and cookies](https://goadopt.io/en/blog/oregon-ocpa-and-cookies-all-you-need-to-know/).

Publishing an email is not enough. It needs to be genuinely monitored. The first-year enforcement report (August 2025) identified non-functional contact channels as one of the most common problems found during investigations.

This article focuses exclusively on what the OCPA requires from the Privacy Policy, based on the official text of the law.

## What the OCPA calls a Privacy Notice

The law uses the term privacy notice. In practice, it is the Privacy Policy that most sites already have, but with OCPA-specific content elements.

Section 5(4) requires the controller to provide consumers with a privacy notice that is "reasonably accessible, clear, and meaningful."

## What must be in the Privacy Policy under the OCPA

### 1. Categories of personal data processed, including sensitive data

The notice must list the categories of personal data processed by the controller, including categories of sensitive data (Section 5(4)(a)).

Personal data under the OCPA includes derived data, an important differentiator from other laws. Marketing profiles and behavioral scores created from the consumer's data are personal data under the law.

Sensitive data, per Section 1(18), includes: racial or ethnic background, religious beliefs, mental or physical condition, sexual orientation, status as transgender or nonbinary, status as a crime victim, citizenship or immigration status, precise geolocation data (within 1,750 feet), genetic or biometric data, and personal data of children under 13. Any of these categories must be explicitly listed.

### 2. The purpose for processing

The notice must describe the controller's purposes for processing personal data (Section 5(4)(b)).

Section 5(2)(a) prohibits processing for purposes not reasonably necessary or compatible with those declared, except with consumer consent.

Vague descriptions like "improve your services" or "personalize your experience" do not meet the requirement. "Behavioral data collected via analytics to identify pages with high abandonment rates and prioritize usability improvements" is the correct level of specificity.

### 3. How consumers exercise their rights and file appeals

The notice must describe how consumers can exercise the rights guaranteed by the OCPA and how to appeal a denial decision (Section 5(4)(c)).

It is not enough to list that rights exist. The process must be described: which channel to use, how identity authentication works, the 45-day response deadline, and how the appeal process works with its 45-day response period.

The [data protection officer](https://goadopt.io/en/blog/responsibilities-of-a-data-protection-officer/) or compliance lead must have this workflow mapped and operationally functional.

### 4. Categories of data shared with third parties, including sensitive data

If the business shares data with third parties, the notice must disclose all categories of personal data shared, including categories of sensitive data (Section 5(4)(d)).

This covers email marketing tools, CRMs, analytics platforms, advertising networks, payment processors, and any external service that receives user data.

### 5. Categories of third parties and how each may process data

This is the OCPA's most specific requirement compared to other US state laws. Section 5(4)(e) requires that the notice describe all categories of third parties with whom data is shared at a level of detail that enables the consumer to understand what type of entity each third party is and, to the extent possible, how each third party may process personal data.

Generic categories like "business partners" are not sufficient. The correct level is something like: "audience analytics platforms that use browsing data to generate aggregated usage reports" or "digital advertising networks that use behavioral identifiers to display personalized ads on other sites the consumer visits."

### 6. Active email address or online contact mechanism, actively monitored

Section 5(4)(f) requires the notice to include an email address or other online method the consumer may use to contact the controller, and that channel must be **actively monitored** by the controller.

This is one of the OCPA's most specific requirements. Publishing an email address that nobody checks does not comply. The 2025 enforcement report confirmed that non-functional contact channels were among the most frequent problems found during investigations.

### 7. Complete identification of the controller

The notice must identify the controller, including the business name registered with the Oregon Secretary of State and any assumed business name used in the state (Section 5(4)(g)).

If the company operates under a brand different from its legal name, both must be identified.

### 8. Description of targeted advertising and profiling with opt-out

If the business processes data for targeted advertising or profiling for decisions with legal effects or effects of similar significance, the notice must describe this clearly and conspicuously, with the opt-out procedure accessible (Section 5(4)(h)).

Targeted advertising, per Section 1(19), consists of ads based on data collected from the consumer's activities over time and across non-affiliated websites or online applications. Contextual ads based on the current session are not included.

If your site uses a Meta Pixel, Google Ads, TikTok Pixel, or any programmatic advertising tool that collects data in other environments, you are operating targeted advertising and must disclose this explicitly.

### 9. Method for submitting rights requests, including GPC recognition

The notice must describe the method or methods the controller has established for consumers to submit rights requests (Section 5(4)(i)).

Per Section 5(5), this method must:

Consider how consumers normally interact with the controller.

Ensure security and reliability in communications.

Allow authentication of the consumer's identity.

Provide a clear and conspicuous link for opting out of targeted advertising.

As of **January 1, 2026**, it is also mandatory to honor universal opt-out signals, such as the Global Privacy Control (GPC), provided they meet specific technical requirements (Section 5(5)(c)).

Must not require the consumer to create a new account. The business may require use of an existing account, but cannot force new registration to exercise rights guaranteed by law (Section 4(2)).

## Disclosure of targeted advertising and data sale

If the business sells personal data or processes it for targeted advertising, Section 5(4)(h) requires clear and conspicuous disclosure in the Privacy Policy, along with the opt-out procedure.

The first-year enforcement report identified that many businesses were not offering consumers the right to list the specific third parties that received their data. This was the most frequently denied right in Oregon during the first year.

## Sensitive data: additional requirements

Sensitive data receives special treatment and must be specifically identified in the Policy.

If the business collects any data in this category, the Policy must:

Explicitly identify that sensitive data is collected.

Describe the specific purpose for processing each category.

Explain how consumer consent is obtained prior to processing.

Detail how that consent can be revoked, respecting the **15-day** cessation deadline after revocation (Section 5(1)(d)).

For children's data, the business must comply with COPPA requirements, per Section 5(2)(b) of the OCPA.

## Protection for teens aged 13 to 15

Section 5(2)(c) prohibits processing data of consumers aged 13 to 15 for targeted advertising, profiling for decisions with legal effects, or data sales without those consumers' consent, when the controller has actual knowledge of that age range.

As of **January 1, 2026**, protection was expanded: prohibition on selling data of minors under 16 and on using data of minors under 16 for targeted advertising and certain types of profiling.

The Privacy Policy must specifically reflect these protections if the business may reach this audience.

## Data Protection Assessments: what the Policy needs to address

Section 8 requires controllers to conduct and document Data Protection Assessments for high-risk activities, including targeted advertising, data sales, profiling with foreseeable risk of harm, and sensitive data processing.

Assessments do not need to be published in the Policy, but must be documented, retained for at least **five years** (Section 8(6)), and available to the Attorney General upon request. They are confidential and exempt from public disclosure (Section 8(7)).

The Policy should make clear that the business conducts impact assessments for high-risk activities as part of its compliance program.

## Non-discrimination policy

Section 5(2)(d) expressly prohibits businesses from discriminating against consumers who exercise their rights. This includes denying products or services, charging different prices, or offering lower quality as a consequence.

The exception is voluntary loyalty, rewards, premium features, discount, or club card programs that offer benefits in exchange for data use, provided the consumer participates voluntarily (Section 5(3)(b)).

## The elimination of the cure period and its impact on the Policy

Through December 31, 2025, the Attorney General was required to notify the business and grant 30 days to cure violations before initiating formal action.

**As of January 1, 2026, that cure period was eliminated.** The AG may initiate action directly, without prior notice (Section 11 of the OCPA).

An incomplete Privacy Policy is one of the easiest violations to identify. Updating the document before an investigation was efficient when the cure period existed. Now, it is the only way to protect the business.

## How AdOpt supports compliance with the OCPA

AdOpt ensures that what is written in the Policy has real correspondence with what actually happens on the site.

The automatic scan identifies all active technologies, feeding the list of data categories and third parties that must appear in the document. The [consent management platform](https://goadopt.io/en/blog/how-to-choose-cmp-consent-management-platform/) ensures the consent and opt-out mechanism works as described, including automatic recognition of the GPC from January 2026 and processing of revocations within 15 days.

Every interaction is logged. If the Attorney General requests evidence, the record is available.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Privacy Policy for your site that complies with the OCPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what the Privacy Policy must contain for the OCPA

**Visible and accessible link** on all pages of the site.

**Categories of personal data processed**, with explicit mention of sensitive data and derived data (Section 5(4)(a)).

**Purpose of processing** for each category, without vague descriptions (Section 5(4)(b)).

**How to exercise all L.O.C.K.E.D. rights** with process, channel, and 45-day response deadline (Section 5(4)(c)).

**Appeal process** with a 45-day deadline and information about the Attorney General (Section 4(6)).

**All categories of personal data shared with third parties**, including sensitive data (Section 5(4)(d)).

**Categories of third parties** with detail about entity type and how each may process data (Section 5(4)(e)).

**Active email or online contact method, actively monitored** by the controller (Section 5(4)(f)).

**Complete controller identification**, including assumed business name if applicable (Section 5(4)(g)).

**Description of targeted advertising or data sale** with accessible opt-out (Section 5(4)(h)).

**Request submission method** described, without requiring a new account (Section 5(4)(i) and 5(5)).

**GPC recognition** from January 2026 (Section 5(5)(c)).

**15-day deadline** for honoring consent revocation (Section 5(1)(d)).

**Protection for teens aged 13 to 15** with consent requirement (Section 5(2)(c)).

**Prohibition on data sales and targeted advertising for minors under 16** from January 2026.

**Non-discrimination policy** for consumers exercising their rights (Section 5(2)(d)).

**Reference to Data Protection Assessments** for high-risk activities (Section 8).

## FAQ: OCPA and Privacy Policy

**1. Why does the OCPA require the contact channel to be actively monitored?**
Section 5(4)(f) specifically requires the controller to specify an email or other online method that the controller "actively monitors." This distinguishes the OCPA from other state laws that simply require an available channel. The 2025 enforcement report identified non-functional rights request forms as one of the most frequent problems during investigations, confirming that the AG verifies whether channels actually work.

**2. What is derived data and why does the OCPA include it in personal data?**
Derived data is data created or inferred from other consumer data. Marketing profiles, propensity scores, audience segment classifications. The OCPA explicitly includes derived data in the personal data definition (Section 1(13)), meaning that when a consumer requests a copy or deletion of their data, derived data is also in scope. The enforcement report identified that businesses were not including back-end data in responses, which constitutes a direct violation.

**3. Why does the OCPA require more detail about third parties than other state laws?**
Section 5(4)(e) requires the description of third-party categories to be at a level of detail that enables the consumer to understand "what type of entity each third party is and, to the extent possible, how each third party may process personal data." This goes beyond what laws like the VCDPA require, which ask only for categories of third parties without the detail about how they process data. In practice, "business partners" is not sufficient.

**4. What happens to sensitive data if the consumer revokes consent?**
Section 5(1)(d) requires the controller to provide a revocation mechanism at least as easy as the consent mechanism. After revocation, the controller must cease processing as soon as practicable, but **not later than 15 days**. This 15-day deadline is a differentiator of the OCPA. The Privacy Policy must inform consumers of this deadline so they know what to expect.

**5. How does the elimination of the cure period affect the urgency of updating the Privacy Policy?**
Before January 2026, the AG was required to notify the business and grant 30 days to cure violations. With that period eliminated by Section 11 of the OCPA, the AG may initiate action directly. An incomplete Privacy Policy that previously could have been corrected after notification now represents immediate risk of penalties of up to US$ 7,500 per violation. Each affected consumer can be counted as a separate violation.

[Ready to build a Privacy Policy for your site that complies with the OCPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


Oregon OCPA: Privacy Policy

## **Why Every Business Today Needs an Effective CMP**

In today’s digital landscape, **privacy** is paramount. With regulations such as **[GDPR](https://goadopt.io/en/blog/gdpr-legal-basis/)** and **[LGPD](https://goadopt.io/en/blog/gdpr-lgpd-and-ccpa-what-are-these-laws-similarities-and-differences/)**, businesses must prioritize **[consent management](https://goadopt.io/en/blog/operation-of-cookie-banner/)** to protect users and stay compliant, an effective **[Consent Management Platform (CMP)](https://goadopt.io/en/blog/what-is-a-cmp-consent-management-platform/)** like **AdOpt** turns privacy from a blocker into part of the **user experience**: clear choices, **[granular consent]**, and **[encrypted consent logs]** that prove compliance.

## **How to Choose a CMP (Consent Management Platform)**

Look for a CMP that balances **compliance** and **UX**:  

- **Ease of use & quick setup** (seamless with your design).  
- **[Granular consent controls]**.  
- **[Dashboards & reports]** for consent rates and banner performance.  
- **Multi-language** and **multi-legislation** support.  
- **Human support with SLAs by plan** (no blanket “24/7” promise).

## Navigating **GDPR**, **LGPD**, **CCPA** and Beyond

Different laws emphasize different rights, but the baseline is the same: **transparency**, **choice**, and **evidence of consent**, a robust CMP helps you implement **prior blocking** (non-essential tags wait for consent), offer **opt-in/opt-out** by category, and **log consents** securely.

## The Cost of Non-Compliance

Non-compliance can trigger **enforcement actions and significant fines**, a reliable CMP helps **[collect and manage consent correctly](https://goadopt.io/en/blog/company-fined-the-end/)**, reducing risk while **preserving user trust**.

## **Essential Features** of a Top-Notch CMP

- **Customizable [cookie banner](https://goadopt.io/en/blog/how-to-choose-a-cookie-banner-for-your-website/)** (brand-aligned, accessible).  
- **[Granular consent]** by **purpose/category**.  
- **Tag scanning & categorization** to keep your inventory mapped.  
- **[Encrypted consent logs]**, **audit trail**, and **versioning** of policies.  
- **[Reports & KPIs]()**.  
- **Integrations** with **[Google Tag Manager (GTM)]** and **[Google Consent Mode]**.  
- **Multi-language** and **multi-legislation** operation.

## Choose a CMP That Provides **Rich Information**

Beyond capturing consent, AdOpt offers **actionable analytics** to improve banner UX and **increase legitimate consent rates** without dark patterns.

## Prefer **Granular, One-by-One** Consent

Let users **opt-in or opt-out** of **specific categories**, that’s what we call **“real consent”** respecting preferences and complying with **[GDPR/LGPD](https://goadopt.io/en/blog/key-differences-LGPD-GDPR/)**.

## Think **Beyond Your Country**

Operate across regions with **multi-jurisdiction** support and standards such as **TCF 2.2**, **Global Privacy Control (GPC)** and, when relevant, **Global Privacy Platform (GPP)**.

## Know Your Platform’s **Data Security**

AdOpt uses **encrypted storage** for consent records and provides **auditability** to prove what was collected, when, and under which **legal basis**.

## **Customize** the Banner Experience

Your **[cookie banner](https://goadopt.io/en/blog/how-to-choose-a-cookie-banner-for-your-website/)** is a UX component not just a compliance checkbox, with AdOpt, tailor **layout, copy, and controls** to your brand while keeping choices **clear and symmetrical** (“Accept all” / “Reject all” / “Customize”).

## Discover How AdOpt Helps You Stay **Compliant** (and Keep Ads Eligible)

For publishers and advertisers, **Google-certified CMP** status and **TCF 2.2** support help keep **ad delivery compliant** in regulated regions, aligning signals with platform requirements.

## Advanced Capabilities that Matter in Practice

- **Tag scanning & categorization** for accurate grouping.  
- **Callbacks, webhooks and APIs** to orchestrate consent across systems.  
- **Reports & KPIs** to iterate on UX and compliance.

## Criteria for Evaluating CMP Providers

### Integrate Seamlessly with Your **Tech Stack**

Check **API compatibility**, implementation paths **GTM**, direct tag, and **customization** options.

### Assess Market **Reputation** and Reliability

Look for independent reviews (e.g., **G2** highlights on **ease of use**) and adoption at scale (e.g., **trusted by 40,000+ sites worldwide**).

## Best Practices for Deployment & Engagement

### A **Secure and Intuitive Cookie Banner**

Prior-block non-essential tags, ensure **symmetry** between **Accept** and **Reject**, and keep copy **clear**.

Use **reports & KPIs** to refine UX and improve consent quality over time.

## **Manage KPIs and Metrics**

Track **consent rates**, **banner interactions**, and **opt-out requests**, iterate continuously.

## **Google Tag Manager (GTM)** and **Google Consent Mode**

Integrate AdOpt with **GTM and Consent Mode** to respect consent state while keeping measurement and ads **compliant**.

## **Multilingual** and **Multi-Legislation**

Serve the right experience for **GDPR**, **LGPD**, and other regimes with localized copy and **standards-based** signaling **TCF 2.2**, **GPC**, **GPP** where applicable.

## **TCF (Transparency & Consent Framework)**

AdOpt CMP supports **TCF 2.2**, aligning vendor signaling and user choices in EEA/UK.

## **GPC (Global Privacy Control)**

Respect **GPC** signals automatically to honor user preferences at the browser/extension level.

## **Plugins for Tray and WordPress**

Install via **Tray** or **WordPress** plugins, or implement via **GTM** / direct tag / API.

## Your Cookie Compliance in **7 Steps**

1. **Assess** your current setup (what scripts run, which are essential).  
2. Choose a **brand-aligned design** for the **cookie banner**.  
3. Implement **granular consent** (category/purpose).  
4. Use callbacks/webhooks/APIs to propagate consent.  
5. **Test** flows (accept/reject/customize + logging).  
6. **Monitor** KPIs and iterate on copy/UX.  
7. **Stay updated** on standards and platform requirements TCF 2.2, GPC and GPP.

## Why Choose **AdOpt**?

A **secure**, **elegant** CMP that makes **privacy** part of your **user experience** not a roadblock.  
**[Install now](https://goadopt.io/en)**
**[Talk to our team](https://meetings.hubspot.com/murilo-andrade/adopt-meeting1-murilo)

## FAQ — Frequently Asked Questions

## 1) What is a **CMP** and why do I need one?
A **Consent Management Platform (CMP)** informs, collects, and records user choices before non-essential tags fire.

With **AdOpt CMP**, you get **prior blocking**, **granular consent**, and **encrypted consent logs** to prove compliance while keeping UX smooth.

## 2) Which regulations does AdOpt help with?
AdOpt supports **multi-legislation** scenarios (e.g., **GDPR**, **LGPD**) and industry standards like **TCF 2.2**, **GPC**, and where relevant **GPP**.

**The goal: consistent, standards-based consent across regions.**

## 3) Is AdOpt a Google-certified CMP and **TCF 2.2** compatible?
Yes. AdOpt is a **[Google-certified CMP]()** and supports **TCF 2.2**, aligning consent signaling for advertising in regulated regions (EEA/UK).

## 4) Does AdOpt work with **Google Consent Mode** and **GTM**?
Yes. We integrate with **Google Tag Manager** and **Google Consent Mode** so tags respond to the user’s consent state, non-essential tags wait; essentials keep working.

## 5) Will a CMP hurt my analytics or ads?
A proper setup **preserves eligibility** while keeping you compliant, with **Consent Mode** and **tag gating** measurement adapts to consent without dark patterns.

## 6) What does “**granular consent**” mean in practice?
Users can **opt in/out by category/purpose** (e.g., analytics, marketing), that’s “real consent”: clear options, symmetric **Accept**/**Reject**, and a **Customize** path.

## 7) How does AdOpt block tags before consent?
AdOpt implements **preventive blocking** of non-essential scripts until consent is given, via GTM, direct tag, or API.

## 8) How are consent decisions stored?
All consents are **encrypted** and **timestamped**, you have an **audit trail** and **versioning** for key documents, helping you demonstrate compliance over time.

## 9) Can I customize the **cookie banner** to match my brand?
Yes. Adjust layout, copy, and controls to your brand while keeping **clarity and symmetry** (Accept/Reject/Customize).

## 10) Does AdOpt support **multiple languages** and regions?
Yes. Serve localized copy and jurisdiction-appropriate flows across markets with standards-based signals (**TCF 2.2**, **GPC**, **GPP** where applicable).

## 11) Which platforms does AdOpt integrate with?
Setup paths include **GTM**, **direct tag**, **APIs/callbacks**, and plugins for **WordPress** and **Tray**.

## 12) What kind of **reports & KPIs** do I get?
Dashboards show **consent rates**, **banner interactions**, and **opt-outs**. Use them to iterate on copy/UX and improve consent quality.

## 13) Can I manage multiple **sites/teams**?
Yes. You can organize multiple properties and manage access permissions across teams.

## 14) Does AdOpt support **GPC** and **GPP**?
AdOpt **respects GPC signals** automatically and supports **GPP** where relevant to your stack and regions.

## 15) How fast can I implement AdOpt CMP?
Typical paths (GTM, plugin, or direct tag) are **quick to deploy**. Your team chooses the path that fits your stack.

## 16) What does support look like?
You get **human support with SLAs by plan**. Need more? Talk to us about extended coverage options for critical operations.

## 17) Is AdOpt suitable for both **publishers** and **brands**?
Yes. Standards compliance (**TCF 2.2**, [Consent Mode](https://goadopt.io/en/blog/google-consent-mode-beginner-to-advanced-guide/)) helps publishers keep delivery compliant and brands maintain trustworthy measurement.

## 18) How do I get started?
- **[Talk to our team](https://meetings.hubspot.com/murilo-andrade/adopt-meeting1-murilo)**

## More than a CMP: a trusted partner
Choosing a **Consent Management Platform (CMP)** is about far more than showing a cookie banner. It’s about building **transparency** with your users and securing **legal peace of mind** for your business without sacrificing experience.

**AdOpt** is built to handle the technical and regulatory complexity for you **prior blocking**, **granular consent**, **encrypted consent logs**, and native integrations like **GTM** and **Google Consent Mode** so your team can focus on what truly matters: **growth**.

Trusted by **40,000+ sites** worldwide, **Google-certified as a CMP**, and **recognized on G2** for ease of use, your path to **real compliance** is one click away.

**Start free** and join the companies turning privacy into great experience.

*[Talk to a specialist](https://meetings.hubspot.com/murilo-andrade/adopt-meeting1-murilo)**


AdOpt CMP

Tennessee TIPA and Cookies: All You Need to Know

Every tool you install on your site places something on the visitor's device before any question is asked.

This page covers one piece of the picture. For the full scope of the VCDPA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the VCDPA and cookies](https://goadopt.io/en/blog/virginia-vcdpa-and-cookies-all-you-need-to-know/).

An advertising pixel starts tracking behavior as soon as the page loads. Google Analytics begins measuring sessions before the first click. A support chat already knows where the user came from before any message is sent.

The Virginia Consumer Data Protection Act (VCDPA, Va. Code § 59.1-575 et seq.), in effect since January 1, 2023, changed the relationship between these trackers and user consent.

This article focuses exclusively on what the VCDPA requires from a Cookies Policy: what the document must contain, how tracker consent must work, and what the law says about each specific point.

## Cookies Policy vs. cookie banner: the distinction that matters

The [cookie banner](https://goadopt.io/en/blog/how-to-choose-a-cookie-banner-for-your-website/) is the visual consent element. It is what the visitor sees when they first access the site. It must be clear, offer real options, and block non-essential trackers before they fire.

The Cookies Policy is the detailed document. It is where the user finds complete information about every technology operating on the site, its purposes, the data it collects, who receives it, and how long it is retained.

Both need to exist. Both need to be aligned. And the Cookies Policy must be accessible through a clear link within the [consent notice](https://goadopt.io/en/blog/operation-of-cookie-banner/) itself.

## What the VCDPA specifically requires for cookies

### Specific purpose for each tracker category

Va. Code § 59.1-578 A, 2 prohibits processing data for purposes incompatible with those disclosed, except with new consent. And Va. Code § 59.1-578 C, 2 requires the purpose of processing to be included in the privacy notice.

For cookies, each category needs a purpose description specific enough for the consumer to understand what they are agreeing to.

What does not work: "we use cookies to improve your experience." That is not a purpose. It is a vague description that does not create compliance and does not protect the business.

What works:

"Analytics cookies: collect browsing behavior data, including pages visited, session duration, and traffic source. Used to identify opportunities to improve site content and user experience."

"Advertising cookies: collect behavioral data across non-affiliated websites over time to build interest profiles and display personalized ads on other platforms. Include pixels from platforms such as Meta Ads, Google Ads, and TikTok."

### The categories of cookies present on the site

The Policy must list the categories of trackers operating on the site. The main ones:

**Necessary cookies:** essential for basic functionality. Authentication, session security, shopping cart. These do not require consent but must be documented.

**Analytics cookies:** measure browsing behavior. Google Analytics, Hotjar, Clarity, and similar tools. These require consent in most cases because they collect data that may identify users through cross-referencing.

**Advertising cookies:** feed ad pixels, build behavioral profiles, enable remarketing. These always require explicit consent and, if used for targeted advertising as defined by the VCDPA, require specific disclosure and an opt-out.

**Functional cookies:** remember user preferences, such as selected language or recently viewed items. May or may not require consent depending on the nature of the data retained.

**Third-party cookies:** fired by external services integrated into the site. [Correct tag categorization](https://goadopt.io/en/blog/difference-cookies-local-storage-session-storage/) is what makes it possible to document each one accurately and keep the inventory up to date.

### Targeted advertising: the specific disclosure requirement

The VCDPA has a requirement that goes beyond the general privacy notice. Va. Code § 59.1-578 D requires that if the business processes data for targeted advertising, it must disclose this **clearly and conspicuously**, with the opt-out mechanism accessible.

Targeted advertising, under Va. Code § 59.1-575, consists of ads based on data collected from the consumer's activities over time and across non-affiliated websites or applications. This covers any retargeting pixel, custom audience in ad platforms, or any technology that carries data from your site to an external advertising network.

What does not constitute targeted advertising under the VCDPA:

Ads based on activities within the controller's own websites or applications.

Contextual ads based on the consumer's current search query or current site visit.

Ads directed to a consumer in response to their request for information.

Data processed solely for measuring advertising performance, reach, or frequency.

If your site has any pixel that sends data to an external advertising network, you are operating targeted advertising under the VCDPA definition. The Cookies Policy must explicitly state this and the opt-out must work.

### Categories of data shared with third parties via cookies

Va. Code § 59.1-578 C, 4 and 5 require the privacy notice to disclose which categories of data are shared with third parties and which categories of third parties receive them.

For cookies, this translates into clearly declaring:

If a Meta Pixel transfers behavioral data to Meta, it must be documented.

If Google Analytics sends session data to Google, it must be stated.

If CRM tools receive form submission data from the site, they must be identified.

Every data flow leaving the controller's environment must be categorized and described.

### Retention period for each category

Va. Code § 59.1-578 A, 1 requires that collection be limited to what is adequate, relevant, and reasonably necessary for the declared purposes. The minimization principle implies the need to disclose how long data is stored.

For the Cookies Policy, this means documenting:

How long each cookie category remains active on the user's device.

How long data collected via cookies is retained in the business's systems.

When and how data is deleted after the retention period.

### The targeted advertising opt-out mechanism

The VCDPA guarantees consumers the right to opt out of the processing of their data for targeted advertising, under Va. Code § 59.1-577 A, 5.

Va. Code § 59.1-578 D requires that the disclosure of targeted advertising come with the opt-out mechanism. The Cookies Policy must describe how the consumer can exercise this opt-out and the link must be accessible.

A well-configured [consent management platform](https://goadopt.io/en/blog/how-to-choose-cmp-consent-management-platform/) ensures that when the user opts out of targeted advertising, all corresponding pixels and trackers stop firing automatically.

## What constitutes valid consent for cookies under the VCDPA

Va. Code § 59.1-575 defines consent as a clear affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreement. This may include a written statement, including by electronic means, or any other unambiguous affirmative action.

The correct standard for cookies: non-essential technologies off by default. The user chooses what to enable, not what to disable.

### What is not valid consent

Accepting general terms of use that contain data processing descriptions mixed with other conditions.

Continuing to browse the site without any explicit action.

Interfaces that use design to make opting out harder than accepting.

Banners that reappear until the user accepts.

Cookie walls that block access to content until all cookies are accepted.

The VCDPA does not use the term "dark patterns" explicitly as the NHDPA does, but the principle of free, specific, informed, and unambiguous consent renders the same manipulative design patterns invalid.

## Do analytics cookies require consent under the VCDPA?

In most cases, yes.

The VCDPA defines personal data as any information linked or reasonably linkable to an individual. Analytics cookies from major platforms collect identifiers that, when cross-referenced with other data the provider holds, can identify a specific user.

The safest approach: treat analytics cookies as non-necessary in the banner, block them before acceptance, and document this categorization in the Cookies Policy.

## Special protection for minors' data

Va. Code § 59.1-578 F establishes specific protections for known children under 13:

Prohibition on processing for targeted advertising, data sale, and profiling with significant effects.

Processing only when reasonably necessary to provide the online service, product, or feature.

No use of data for purposes beyond those disclosed at collection.

Retention only for the time necessary to provide the service.

For social media platforms, protection extends to minors under 16 starting January 2026 (Va. Code § 59.1-577.1), with a 1-hour daily usage limit.

If your site may have users under 13, the Cookies Policy must describe how their data is treated differently.

## When to update the Cookies Policy

Whenever the site begins using a new tool that fires cookies or trackers. The technology inventory of the site must stay synchronized with the document.

Situations that require an update:

Adding a new advertising pixel.

A new analytics or heatmap tool.

A new chat, support, or engagement plugin.

A new CRM or email marketing platform integration.

Any new partner that receives behavioral data from site users.

Continuous [data mapping](https://goadopt.io/en/blog/what-is-privacy-by-design/) is what maintains this synchronization. When the technology inventory changes, the Cookies Policy must change with it.

## The Cookies Policy and the VCDPA cure period

The Attorney General must provide a **guaranteed 30-day cure period** before initiating any action (Va. Code § 59.1-584 B). An inadequate Cookies Policy can be corrected within that period if the business has its processes structured.

However, if the violation continues or the business breaches the correction statement provided, penalties can reach **US$ 7,500 per violation**, with each affected consumer potentially constituting a separate violation.

## How AdOpt helps with the Cookies Policy under the VCDPA

AdOpt's automatic scan identifies all technologies active on the site, feeding the list of categories that must appear in the Cookies Policy.

The [cookie notice](https://goadopt.io/en/blog/operation-of-cookie-banner/) configured through AdOpt blocks non-essential trackers before acceptance, presents categories with clear descriptions, offers real choice options, and logs every interaction for audit purposes.

The integration with the business's systems ensures that targeted advertising opt-outs are processed automatically.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Cookies Policy for your site that complies with the VCDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what your Cookies Policy needs for the VCDPA

**Visible link** in the site footer and within the cookie banner itself.

**Listing of cookie categories** with a description of what each one does on the site.

**Specific purpose for each category**, without vague descriptions (Va. Code § 59.1-578 C, 2).

**Clear and conspicuous disclosure of targeted advertising** with an accessible opt-out mechanism (Va. Code § 59.1-578 D).

**Categories of data shared with third parties** via cookies (Va. Code § 59.1-578 C, 4).

**Categories of third parties** that receive data via cookies (Va. Code § 59.1-578 C, 5).

**Retention period** for each cookie category.

**Non-essential cookies disabled by default** in the banner, without manipulative design patterns.

**Protection for data of known children under 13** with a differentiated flow (Va. Code § 59.1-578 F).

**Protection for minors under 16 on social media platforms** where applicable (Va. Code § 59.1-577.1, effective Jan 2026).

**Accessible language**, without legal jargon.

**No cookie walls**.

## FAQ: VCDPA and Cookies Policy

**1. Does the VCDPA require a separate document called a "Cookies Policy"?**
Not by name. The disclosure requirements for trackers are distributed between the privacy notice (Va. Code § 59.1-578 C) and the targeted advertising disclosure requirement (Va. Code § 59.1-578 D). A dedicated Cookies Policy is the most organized way to meet all of these requirements in a user-accessible format.

**2. Do analytics cookies always require consent under the VCDPA?**
In most cases, yes. Analytics cookies from major platforms collect data that may identify users through cross-referencing with other information the provider holds, falling within the definition of personal data in Va. Code § 59.1-575. Tools with genuine anonymization and no technical re-identification capability may be an exception. The safest approach is to treat them as non-necessary in the banner.

**3. How quickly must the opt-out of targeted advertising be processed?**
The VCDPA does not specify a separate cessation deadline after opt-out, unlike the NHDPA which has a specific 15-day period. In the VCDPA, the criterion is "without undue delay" for the general response, with a maximum of 45 days (Va. Code § 59.1-577 B, 1). In practice, for targeted advertising opt-outs, the expectation is that cessation is processed with the greatest technically reasonable agility.

**4. Does a third-party advertising pixel constitute "sale of data" under the VCDPA?**
It depends on the structure. The VCDPA defines sale as the exchange of data for monetary consideration. If the pixel sends data to an ad platform and in return the business receives paid advertising services, there are divergent legal positions on whether this constitutes a sale. The safest approach is to treat it as targeted advertising (which also requires opt-out) and disclose explicitly in the Cookies Policy.

**5. What changes for social media platforms starting January 2026?**
Va. Code § 59.1-577.1 comes into effect on January 1, 2026 and requires social media platforms to determine if users are under 16, limit their use to 1 hour per day, and allow parents to adjust this limit through verifiable parental consent. The Cookies Policy must describe how age identification data is collected and used solely for that purpose, without application to other processing activities.

[Ready to build a Cookies Policy for your site that complies with the VCDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


Virginia VCDPA: Cookies Policy

The Colorado Privacy Act (CPA) has a set of rules for the Privacy Portal that goes beyond the statute. The Attorney General promulgated the Colorado Privacy Act Rules (4 CCR 904-3), which specify exactly how each aspect of the DSAR process must work, including the minimum content of each request record, the record-keeping deadline, and how to handle authorized agents.

This page covers one piece of the picture. For the full scope of the CPA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the CPA and cookies](https://goadopt.io/en/blog/colorado-cpa-and-cookies-all-you-need-to-know/).

This article covers all of it: what a DSAR is under the CPA, the five guaranteed rights, the law's specific deadlines, the Universal Opt-Out Mechanism, and what the regulations require from the process.

## What is a DSAR under the CPA?

DSAR stands for Data Subject Access Request, or Data Rights request in the language of the CPA. It is any formal request from a Colorado consumer to exercise the rights the law grants over their own data.

Under C.R.S. § 6-1-1306(1), the consumer may submit a request at any time using the methods specified by the controller in the privacy notice.

If you are already familiar with the [GDPR](https://goadopt.io/en/blog/gdpr-cookies-explained/) data subject rights framework, the structure is familiar. The CPA adds the Universal Opt-Out Mechanism as an alternative channel for exercising opt-out of targeted advertising and data sale.

## What are consumer rights under the CPA?

Under C.R.S. § 6-1-1306(1), Colorado residents have five rights:

### Right to opt-out

The consumer may refuse the processing of their personal data for three purposes (C.R.S. § 6-1-1306(1)(a)):

Targeted advertising.

Sale of personal data.

Profiling in furtherance of decisions with legal or similarly significant effects (access to financial or lending services, housing, insurance, education, criminal justice, employment, healthcare, or essential goods).

The consumer may also exercise the opt-out through an authorized agent, including via UOM (such as the GPC), when the controller can authenticate the consumer's identity and the agent's authority with commercially reasonable effort (C.R.S. § 6-1-1306(1)(a)(II)).

The regulations (4 CCR 904-3, Rule 4.03(A)(1)(b)) detail: if the opt-out is submitted online and the controller cannot identify the consumer to cease processing of connected offline data, it may request additional information. And if a consumer submitted multiple DSARs, the opt-out must be processed first.

### Right of access

The consumer may confirm whether the controller processes their data and access the personal data (C.R.S. § 6-1-1306(1)(b)).

The regulations (4 CCR 904-3, Rule 4.04(A)(1)) clarify that "specific pieces of personal data" include final profiling decisions, inferences, derivative data, marketing profiles, and any other personal data created by the controller linked to the consumer.

The response must be provided in a common, accessible electronic format, in the language the consumer uses to interact with the controller, without incomprehensible internal codes.

The controller does not need to disclose in response to an access request: government-issued identification numbers, financial account numbers, biometric data or biometric identifiers. But must inform the consumer that it holds these types of data (e.g., "We collect unique biometric data including fingerprint scan" without revealing the actual scan).

### Right to correction

The consumer may request correction of inaccuracies in personal data, taking into account the nature and purposes of processing (C.R.S. § 6-1-1306(1)(c)).

The regulations (4 CCR 904-3, Rule 4.05) detail:

The controller corrects in active systems but may delay for archive or backup systems until they are restored or accessed.

If the correction can be made by the consumer through account settings, the controller may provide instructions, provided the process is not unduly burdensome.

The controller may request documentation to verify data accuracy.

If the controller did not receive the data directly from the consumer and has no supporting documentation, the consumer's assertion of inaccuracy is sufficient to establish that the data is inaccurate.

### Right to deletion

The consumer may request deletion of personal data (C.R.S. § 6-1-1306(1)(d)).

The regulations (4 CCR 904-3, Rule 4.06) detail:

The controller permanently and completely erases from active systems, or de-identifies so it cannot reasonably be linked to the individual.

Also instructs processors to delete.

May delay for archive or backup systems until they are restored.

For data obtained from third parties (not directly from the consumer), may comply by retaining only the deletion request record and the minimum necessary to ensure the data remains deleted, or opting the consumer out of all processing.

If partial retention is justified by a legal exception, must inform the consumer of which categories were not deleted and which exception applies.

### Right to data portability

When exercising the right of access, the consumer may obtain data in a portable and, where technically feasible, readily usable format that allows transmission to another entity without hindrance (C.R.S. § 6-1-1306(1)(e)).

Portability may be exercised **no more than twice per calendar year**. This differs from other US state privacy laws that do not impose this limit on the right to portability.

The controller is not required to provide data in a manner that discloses trade secrets. But must provide as much data as possible in portable format without disclosing the secret.

## What are the response deadlines?

The CPA's deadlines have a specific structure.

**45 days** from receipt of the request to respond (C.R.S. § 6-1-1306(2)(a)).

The deadline may be extended by another **45 days** when reasonably necessary, considering complexity and number of requests, as long as the consumer is notified within the initial period with the reason.

For **appeals**: **45 days** to respond, extendable by another **60 days** in cases of complexity or large number of requests (C.R.S. § 6-1-1306(3)(b)).

The first request is free. For subsequent requests within the same 12-month period, the business may charge a fee calculated under C.R.S. § 24-72-205(5)(a).

## The appeal process with distinct deadlines

The CPA has a very specific appeal process (C.R.S. § 6-1-1306(3)):

The controller must establish an internal appeal process that is conspicuously available and as easy to use as the original request submission process.

The process must be actionable within a reasonable period after the consumer receives the denial notice.

The appeal response must include the decision and the written justification.

If the appeal is denied, the controller must **inform the consumer of the ability to contact the Attorney General** (C.R.S. § 6-1-1306(3)(c)).

## What should the request submission channel look like?

The regulations (4 CCR 904-3, Rule 4.02(B)) detail the requirements:

**Online-only businesses with a direct consumer relationship:** a single email address is sufficient.

**Other businesses:** two or more designated methods, and if the business maintains a website, application, or digital presence, one method must be through that digital presence (web form).

**Businesses that interact in person:** must consider an in-person method (printed form, tablet/computer portal, or telephone for a toll-free call).

The method must:

Consider how consumers normally interact with the controller.

Enable the consumer to submit the request at any time.

Use reasonable data security measures.

Be easy to execute, with a minimal number of steps.

Not require creating a new account (but may require using an existing password-protected account).

## Authentication: how to do it right

The regulations (4 CCR 904-3, Rule 4.08) are specific:

The controller must use a commercially reasonable method to authenticate each request. To determine what is reasonable, consider:

The right being exercised, the type, sensitivity, value, and volume of data involved.

The level of possible harm from improper access.

The cost of authentication to the controller.

The controller should avoid requesting additional personal data if it can authenticate using data it already has.

The controller cannot charge an authentication fee to the consumer (e.g., cannot require notarization without compensating the consumer for the cost).

If unable to authenticate with reasonable effort, the controller is not required to comply. But must inform the consumer that their identity could not be authenticated and how to remedy deficiencies.

## Mandatory documentation for 24 months

The regulations (4 CCR 904-3, Rule 6.11(A)) require records of all DSARs to be maintained for at least **24 months**. Each record must include at minimum:

The date of the request.

The type of request.

The date of the controller's response.

The nature of the response.

The basis for denial if the request was denied in whole or in part.

The existence and resolution of any appeal.

Records of DSARs already complied with must also be maintained for 24 months and made available to any new controller in a merger, acquisition, or other transaction where a third party assumes control of personal data.

## The Universal Opt-Out Mechanism in the Privacy Portal

The UOM (including the GPC) does not replace the Privacy Portal, but covers the opt-out for targeted advertising and data sale.

When the consumer sends a valid UOM signal, the controller must:

Cease processing for the indicated purposes as soon as feasibly possible, without undue delay (4 CCR 904-3, Rule 4.03(A)(1)).

Maintain a record of the opt-out (4 CCR 904-3, Rule 4.03(A)(2)).

Continue treating the browser, device, and consumer as having exercised opt-out until the consumer consents again (4 CCR 904-3, Rule 5.08(A)(2)).

If the consumer wants to opt out of profiling with significant effects, this still requires submission through the Privacy Portal, since the UOM covers only targeted advertising and data sale.

## Protection against discrimination

C.R.S. § 6-1-1308(1)(c)(II) prohibits the controller from, based solely on the exercise of a right and unrelated to feasibility or the value of a service, increasing the cost or decreasing the availability of the product or service.

The exception is loyalty programs, rewards, premium features, discounts, or club card programs (C.R.S. § 6-1-1308(1)(d)). The regulations (4 CCR 904-3, Rule 6.05) detail extensively the obligations related to loyalty programs.

## Enforcement: AG and District Attorneys

The CPA is enforced by the **Attorney General** and **District Attorneys** of Colorado (C.R.S. § 6-1-1311). There is no private right of action.

From January 1, 2025, the 60-day cure period was repealed. AG and DAs have discretion to act without a guaranteed prior correction period.

## How AdOpt helps with the Privacy Portal

AdOpt logs every consent and opt-out interaction with a timestamp and unique identifier, maintaining documentation for 24 months as required by the regulations.

The GPC and other UOMs are detected and honored automatically. When the consumer exercises opt-out via Portal or via UOM, the system updates the corresponding trackers. The auditable log serves as evidence for the AG or District Attorneys.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Privacy Portal for your site that complies with the Colorado CPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what the Privacy Portal needs for the CPA

**Two or more submission methods** for non-online-only businesses, including a digital channel if the business has digital presence (4 CCR 904-3, Rule 4.02(B)(1)(b)).

**Email only** for online-only businesses with a direct consumer relationship (4 CCR 904-3, Rule 4.02(B)(1)(a)).

**Coverage of 5 rights**: opt-out, access, correction, deletion, portability.

**Portability limited to 2x per calendar year** (C.R.S. § 6-1-1306(1)(e)).

**Universal Opt-Out Mechanism** honored automatically from July 2024 (C.R.S. § 6-1-1306(1)(a)(IV)(B)).

**Conspicuously available appeal process** as easy as the original submission process.

**Deadlines**: 45 days for response (+45 ext.); 45 days for appeals (+60 ext.).

**Information to consumer** on how to contact the AG in case of denied appeal.

**Authentication** with commercially reasonable effort, no fee charged, no unnecessary data requested.

**Records maintained for 24 months** with the 6 mandatory fields (4 CCR 904-3, Rule 6.11(A)).

**Free first request**; second may be charged under C.R.S. § 24-72-205(5)(a).

**Consent refresh** configured for 24 months of consumer inactivity.

**Notification to processors** when a deletion or correction is fulfilled.

## Comparison: Privacy Portal deadlines under the CPA

| Request type | Response deadline | Extension possible |
|---|---|---|
| Opt-out, access, correction, deletion | 45 days | +45 days with notification |
| Portability (max 2x/year) | 45 days | +45 days with notification |
| Appeal of a decision | 45 days | +60 days with notification |
| Cure period (general violations) | Discretionary (2025) | No guarantee |

## FAQ: CPA and Privacy Portal

**1. Does the CPA require a dedicated Privacy Portal or is an email address sufficient?**
It depends on the type of business. Online-only businesses with a direct consumer relationship only need an email address (4 CCR 904-3, Rule 4.02(B)(1)(a)). Others need two or more methods, and a business with a website must offer a digital option (web form). A dedicated Privacy Portal is the most organized approach, but it is not the name the law requires.

**2. How does the twice-per-year limit on portability work?**
The right to portability under the CPA may be exercised no more than twice per calendar year (C.R.S. § 6-1-1306(1)(e)). This is a limit exclusive to the CPA among US state privacy laws. The right of access (without portable format) does not have this explicit limit in the statute, although the first request is free and subsequent ones may be charged.

**3. What must the controller do when a consumer has not interacted for 24 months?**
The regulations (4 CCR 904-3, Rule 7.08) require the controller to refresh consent for processing sensitive data and for secondary purposes involving profiling with significant effects, when the consumer has not interacted in the past 24 months. This means the Privacy Portal and consent management systems need to track the consumer's last interaction and trigger consent refresh flows.

**4. What happens after a denied appeal under the CPA?**
C.R.S. § 6-1-1306(3)(c) requires the controller to inform the consumer of the ability to contact the Attorney General. This differs from other laws that require specific instructions on how to contact the authority. The CPA is more open: the controller must communicate that this option exists. The consumer can then file a complaint with the AG or the District Attorney of the relevant jurisdiction.

**5. Does the CPA have specific obligations about data found during an access request that the controller cannot disclose?**
Yes. The regulations (4 CCR 904-3, Rule 4.04(D)) list categories of data the controller does not need to disclose in the access response: government-issued identification numbers, financial account numbers, health insurance or medical identification numbers, passwords, security questions, biometric data, and biometric identifiers. But the controller must inform the consumer that it holds these types of data, with sufficient particularity (e.g., "We collect unique biometric data including a fingerprint scan") without revealing the actual data.

[Ready to build a Privacy Portal for your site that complies with the Colorado CPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


Colorado CPA: DSAR Privacy Portal

Iowa has the longest response deadline for consumer requests of all US state privacy laws.

The Iowa Consumer Data Protection Act (ICDPA), Iowa Code § 715D, took effect on **January 1, 2025**. It was signed by Governor Kim Reynolds in March 2023, giving businesses nearly two years to prepare.

The most distinctive feature: **90 days** to respond to a consumer request, with a possible 45-day extension. And a **90-day cure period** guaranteed before any Attorney General action, the longest among current state laws.

## What is the ICDPA?

The ICDPA is Iowa's state personal data protection law. It grants rights to state residents and creates obligations for businesses that process their data.

The law follows the model of other US state privacy laws, with a structure close to Virginia's VCDPA and Utah's UCPA. But it has considerably longer deadlines for businesses to respond.

Enforcement is the exclusive responsibility of the **Iowa Attorney General**. There is no private right of action (§ 715D.8(4)).

## When did the ICDPA take effect?

On **January 1, 2025**.

The law was signed in March 2023, giving businesses nearly two years to prepare.

## Who must comply with the ICDPA?

Under Iowa Code § 715D.2(1), the law applies to persons that conduct business in Iowa or produce products or services targeted to state residents and that, during a calendar year:

Control or process personal data of at least **100,000 consumers**; or

Control or process personal data of at least **25,000 consumers** and derive more than **50% of gross revenue** from the sale of personal data.

**Key difference from Utah's UCPA:** the ICDPA does not require a minimum revenue of US$ 25 million as an additional criterion. If a business controls or processes data of 100,000 Iowa consumers, it is in scope regardless of revenue. This may bring smaller businesses into scope under the ICDPA that would be outside the UCPA's scope.

Understanding the distinction between [controller and processor](https://goadopt.io/en/blog/responsibilities-of-a-data-protection-officer/) is fundamental to defining each party's responsibilities.

### ICDPA Exemptions

Under § 715D.2(2) and (3), the following are exempt:

The State of Iowa and its political subdivisions.

Financial institutions, affiliates, and data subject to the Gramm-Leach-Bliley Act.

Entities subject to and compliant with HIPAA.

Nonprofit organizations.

Institutions of higher education.

HIPAA-protected health information and health records.

Regulated clinical research data.

Consumer credit data regulated by the Fair Credit Reporting Act.

Data regulated by the Driver's Privacy Protection Act.

Data regulated by FERPA.

Data regulated by the Farm Credit Act.

Employee, job applicant, and agent data in an employment context.

Data processed in accordance with COPPA.

## What is personal data under the ICDPA?

Under § 715D.1(18), personal data is any information linked or reasonably linkable to an identified or identifiable natural person.

Not personal data: de-identified data, aggregate data, and publicly available information.

## What is sensitive data under the ICDPA?

Under § 715D.1(26), sensitive data includes:

Racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status (except when used to avoid discrimination under anti-discrimination law).

Genetic or biometric data processed for the purpose of uniquely identifying a natural person.

Personal data collected from a known child (under 13).

Precise geolocation data.

**Sensitive data model:** like the UCPA, the ICDPA uses an **opt-out** model for sensitive data. The controller cannot process sensitive data without first presenting a clear notice and offering an opt-out opportunity (§ 715D.4(2)). Prior consent is not required.

## What is precise geolocation data?

Under § 715D.1(19), precise geolocation data is information derived from technology, including GPS coordinates, that identifies the specific location of a natural person with precision within a radius of **1,750 feet**.

## What are consumer rights under the ICDPA?

Under § 715D.3(1), Iowa residents have four rights:

**Confirm and access:** confirm whether the controller processes personal data and access that data (§ 715D.3(1)(a)).

**Deletion:** request deletion of personal data the consumer provided to the controller (§ 715D.3(1)(b)). Like the UCPA, the scope is limited to data provided by the consumer.

**Portability:** obtain a copy of the data in a portable and, where technically practicable, readily usable format for transmission to another controller without impediment (§ 715D.3(1)(c)).

**Opt-out from data sales:** refuse the sale of personal data (§ 715D.3(1)(d)).

**Note on targeted advertising:** the ICDPA lists only opt-out from data sales as a formal right in § 715D.3(1)(d). However, § 715D.4(6) requires that if the controller engages in targeted advertising, it must clearly disclose this and describe how the consumer can exercise an opt-out. In practice, the controller must offer an opt-out from targeted advertising in the privacy notice, even though it is technically a transparency obligation rather than a formally listed right.

### What the ICDPA does not have

No right to correct inaccurate data (same as UCPA).

No formal opt-out of profiling.

Deletion limited to data provided by the consumer.

## Response deadlines: the longest of all state privacy laws

This is the ICDPA's most distinctive feature. Under § 715D.3(2)(a):

**90 days** to respond from receipt of the request.

Extension of **+45 days** when reasonably necessary due to complexity or volume, with notification within the initial period.

Comparison of response deadlines:

| Law | Base deadline | Extension |
|---|---|---|
| ICDPA (Iowa) | 90 days | +45 days |
| VCDPA (Virginia) | 45 days | +45 days |
| UCPA (Utah) | 45 days | +45 days |
| OCPA (Oregon) | 45 days | +45 days |
| CTDPA (Connecticut) | 45 days | +45 days |

**Free service:** up to **2 times per year** per consumer (§ 715D.3(2)(c)). From the third request in the same 12-month period, the controller may charge a reasonable fee or refuse if the request is manifestly unfounded, excessive, repetitive, technically infeasible, or if the primary purpose is not to exercise a right.

## Right to appeal: 60 days

Under § 715D.3(3), the controller must establish an appeal process. It must be conspicuously available and similar to the original submission method. Within **60 days** of receiving an appeal, the controller must inform the consumer in writing of any action taken or not taken, with explanation of the reasons.

If the appeal is denied, the controller must provide the consumer with an online mechanism to contact the Attorney General to submit a complaint.

## Controller obligations under the ICDPA

Under § 715D.4, the controller must:

Adopt and implement reasonable administrative, technical, and physical data security practices, proportionate to the volume and nature of the data.

Not process sensitive data without presenting a clear notice and offering an opt-out opportunity first.

Not discriminate against consumers who exercise their rights.

Provide a reasonably accessible, clear, and meaningful privacy notice with the five required elements.

Clearly and conspicuously disclose if it sells data or engages in targeted advertising, with opt-out method for each activity.

Establish secure and reliable means for request submissions, described in the privacy notice.

Not require the consumer to create a new account to exercise rights.

## Cookies and the ICDPA

Cookies that collect personal data or allow user identification fall within the ICDPA's scope.

The site must display a clear [cookie notice](https://goadopt.io/en/blog/operation-of-cookie-banner/), offer opt-out from data sales and targeted advertising, and describe in the privacy notice how consumers can exercise their rights.

[Correct tag categorization](https://goadopt.io/en/blog/best-practices-tag-categorization/) is what makes it possible to identify which cookies constitute targeted advertising or data sales.

The ICDPA defines targeted advertising in § 715D.1(28) as ads selected based on data obtained from the consumer's activities over time and across non-affiliated websites or applications. Ads based on activities within the controller's own site or affiliated sites do not qualify.

The ICDPA uses "sale" as monetary consideration (§ 715D.1(25)), without including the concept of "sharing" for behavioral advertising without payment, as the CPRA does.

## Enforcement and penalties

Under § 715D.8, the Iowa Attorney General has exclusive enforcement authority.

**Cure period: 90 days guaranteed.** Before initiating any action, the AG must notify the controller in writing identifying violations and granting **90 days to cure** (§ 715D.8(2)). This is the longest cure period of all current US state privacy laws.

If the controller cures the violation within 90 days and provides an express written statement that violations have been cured and will not recur, no action is initiated.

If the violation continues or the controller breaches the provided statement, the AG may initiate action and seek:

Injunction to stop the violations.

Civil penalties of up to **US$ 7,500 per violation** (§ 715D.8(3)).

## How AdOpt helps with the ICDPA

AdOpt records every consent and opt-out interaction, blocks trackers before acceptance, and generates the auditable log needed in an Iowa Attorney General investigation.

The automatic scan identifies all active [trackers](https://goadopt.io/en/blog/gdpr-cookies-explained/) on the site, feeding the data inventory required for the privacy notice. And when the law changes, the platform updates automatically.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Ready to bring your website into compliance with the Iowa ICDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Comparing ICDPA with other privacy laws

| Law | State | Threshold | Response Deadline | Appeal | Cure Period | Free/Year |
|---|---|---|---|---|---|---|
| ICDPA | Iowa | 100K or 25K + 50% | 90 days | 60 days | 90 days | 2x |
| UCPA | Utah | US$ 25M + 100K or 25K + 50% | 45 days | Not structured | 30 days | 1x |
| VCDPA | Virginia | 100K or 25K + 50% | 45 days | 60 days | 30 days | 2x |
| OCPA | Oregon | 100K or 25K + 25% | 45 days | 45 days | Eliminated | 1x |
| CTDPA | Connecticut | 100K or 25K + 25% | 45 days | 60 days | Discretionary | 1x |

## The ICDPA in practice: the three documents

Compliance with the ICDPA rests on three documents that have to agree with each other: the [cookies policy](https://goadopt.io/en/blog/iowa-icdpa-cookies-policy/), which declares every tracker and its purpose; the [privacy policy](https://goadopt.io/en/blog/iowa-icdpa-privacy-policy/), which explains what you do with the data; and the [privacy portal](https://goadopt.io/en/blog/iowa-icdpa-dsar-privacy-portal/), where the consumer exercises their rights and you keep the record of it.

## FAQ: Iowa ICDPA

**1. What is the ICDPA and what is its key differentiator?**
The Iowa Consumer Data Protection Act (Iowa Code § 715D) is Iowa's state personal data protection law. It took effect on January 1, 2025. Its key differentiator is the response deadline for consumer requests: 90 days, with a possible extension of 45 more. This is the longest deadline of all current US state privacy laws, compared to 45 days in Virginia, Oregon, Utah, Connecticut, and other states. The 90-day cure period guaranteed before any AG action is also the longest among state laws.

**2. Why does the ICDPA have a 90-day deadline instead of 45 days like other laws?**
The ICDPA was designed with longer deadlines to reduce operational burden on businesses. § 715D.3(2)(a) explicitly establishes 90 days, which is double the 45-day standard adopted by most US state laws. This means businesses have more time to organize their DSAR processes, authenticate requests, and prepare responses. But the longer deadline for businesses also means consumers wait longer to receive a response.

**3. What distinguishes the ICDPA threshold from Utah's UCPA?**
The UCPA requires businesses to satisfy both the US$ 25 million revenue requirement AND at least one volume threshold (dual requirement). The ICDPA has no minimum revenue requirement. If a business controls or processes data of 100,000 Iowa consumers, it is in scope regardless of revenue. This may bring smaller businesses into ICDPA scope that would be outside UCPA scope. The 25,000 consumer + 50% revenue from data sales threshold is identical in both laws.

**4. Does the ICDPA have a formal opt-out right for targeted advertising?**
The ICDPA lists opt-out from data sales as a formal right in § 715D.3(1)(d), but does not list opt-out from targeted advertising as a formal right in the same way. However, § 715D.4(6) requires that if the controller engages in targeted advertising, it must clearly disclose this and describe the opt-out method. In practice, the controller must offer and accept opt-out requests for targeted advertising in the privacy notice, even though the legal basis is a transparency obligation rather than a formally listed right.

**5. What is the penalty for ICDPA non-compliance?**
The Attorney General may seek an injunction and civil penalties of up to US$ 7,500 per violation (§ 715D.8(3)). Before initiating any action, the AG must notify the controller and grant 90 days to cure. If the controller cures the violation and provides a written statement, no action is initiated. If not cured or if the statement is breached, the AG may proceed. There is no private right of action for consumers (§ 715D.8(4)).

[Ready to bring your website into compliance with the Iowa ICDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


IOWA ICDPA and Cookies: All you need to Know

The Oregon Consumer Privacy Act (OCPA, ORS 646A.570 et seq.) has several particularities in the DSAR process that distinguish it from other US state laws.

This page covers one piece of the picture. For the full scope of the OCPA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the OCPA and cookies](https://goadopt.io/en/blog/oregon-ocpa-and-cookies-all-you-need-to-know/).

The most important: opt-out requests **do not require authentication**. And the right to list third parties that received personal data was the most frequently denied right in the first year of enforcement. The report from Attorney General Dan Rayfield (August 2025) showed businesses simply did not have that record structured.

This article covers everything: what a DSAR is under the OCPA, what rights are guaranteed under the L.O.C.K.E.D. system, specific deadlines, authentication rules, and how to build a Privacy Portal that works for Oregon law.

## What is a DSAR under the OCPA?

DSAR stands for Data Subject Access Request. It is any formal request made by an Oregon resident to exercise the rights the OCPA guarantees over their own data.

Under Section 4(1), consumers exercise their rights through means established by the controller and described in the privacy notice.

If you already know the [LGPD data subject portal](https://goadopt.io/en/blog/legal-bases-of-lgpd/), the structure is familiar. The OCPA adds specific rules about derived data, opt-out without authentication, and the role of universal opt-out signals via technology.

## What are consumer rights under the OCPA?

The **L.O.C.K.E.D.** system from the Oregon Department of Justice summarizes the rights of Section 3(1) of the OCPA:

### L: Right to list third parties

The consumer may request a list of the specific entities to which the controller has disclosed their personal data, or a list of any personal data disclosed (Section 3(1)(a)(B)).

The controller may choose to provide: (i) a list of specific third parties that received the individual consumer's data, or (ii) a list of any third party that received any personal data from the controller.

This was the most frequently denied right in the first year of enforcement. Businesses did not have the record of data sharing structured in a way that allowed them to respond to this request.

### K: Right to know and confirm

The consumer may obtain confirmation that the controller processes or has processed their personal data and which categories are involved (Section 3(1)(a)(A)).

### C: Right to copy

The consumer may obtain a copy of **all** personal data the controller has processed, in a portable format and readily usable where technically feasible (Section 3(1)(a)(C)).

This scope includes derived data. Marketing profiles, behavioral scores, and audience segment classifications created from the consumer's data are part of the copy that must be delivered.

The enforcement report identified that businesses were not including back-end data such as marketing profiles in responses to copy requests. This constitutes a direct violation of the law.

### E: Right to correction

The consumer may request correction of inaccuracies in personal data, taking into account the nature and purpose of processing (Section 3(1)(b)).

### D: Right to deletion

The consumer may request deletion of personal data, including (Section 3(1)(c)):

Data the consumer provided directly to the business.

Data the business obtained from other sources about the consumer.

Derived data created by the business from other data.

For data obtained from third parties, the OCPA provides an alternative. The controller may fulfill the deletion request by either deleting the data entirely, or opting the consumer out of processing their data for any purpose other than those exempt under Section 2(3) (Section 4(7)).

### O: Right to opt-out

The consumer may refuse processing of data for three specific purposes (Section 3(1)(d)):

Targeted advertising.

Sale of personal data.

Profiling in furtherance of decisions that produce legal effects or effects of similar significance (such as access to credit, housing, insurance, employment, or health care services).

## What are the response deadlines?

Under Section 4(5)(a):

**45 days** to respond from receipt of the request.

Extension of **+45 days** when reasonably necessary, considering complexity and volume of requests, with notification within the initial period.

**Appeal: 45 days** for a written response with decision and reasoning (Section 4(6)(d)).

**Free** once per 12-month period per consumer (Section 4(5)(c)). For subsequent requests, may charge a reasonable fee, except when verifying compliance with a prior correction or deletion.

A key distinction from Connecticut's CTDPA: the OCPA sets a 45-day appeal deadline, while the CTDPA sets 60 days. The OCPA is faster on appeals.

## The appeal process

Section 4(6) requires the controller to establish an appeal process that is conspicuously available and similar to the original submission process.

The process must:

Allow a reasonable period after the consumer receives the denial for them to appeal.

Be comparable to the original request submission process.

Result in a written response within **45 days** with the decision and reasoning.

If the appeal is denied, the notice must provide or specify information enabling the consumer to contact the Attorney General to submit a complaint (Section 4(6)(d)).

## Authentication: the special rule for opt-outs

Section 4(5)(e) of the OCPA has a different authentication rule for opt-outs:

For exercising access, correction, deletion, and portability rights: the controller may request additional information reasonably necessary to authenticate. If unable to authenticate, it is not required to comply, but must notify the consumer (Section 4(5)(d)).

For **opt-out requests**: the controller **cannot require authentication**. It may ask only for information necessary to identify who is making the opt-out request. If it has a good faith, reasonable, and documented belief that a request is fraudulent, it may deny, but must notify the requestor explaining why and that it will not comply.

This distinction matters for the Privacy Portal: the opt-out mechanism must work without authentication barriers.

## Authorized agents and opt-out signals

Section 4(4) allows consumers to designate another person as an authorized agent to exercise the opt-out on their behalf. This includes via technology: an internet link, browser setting, browser extension, or global device setting.

The controller must honor the opt-out received from an authorized agent if it can verify, with commercially reasonable effort, the identity of the consumer and the authority of the agent.

As of **January 1, 2026**, controllers processing for targeted advertising or selling data must accept opt-outs via signal sent with consumer consent (Section 5(5)(c)). This includes the Global Privacy Control (GPC).

## How the request submission channel must work

Sections 5(4)(i) and 5(5) require the controller to establish and describe in the privacy notice the method for submitting requests. This method must:

Consider how consumers normally interact with the controller.

Ensure security and reliability in communications.

Allow authentication of the consumer's identity.

Provide a clear and conspicuous link for opting out of targeted advertising.

The controller cannot require creation of a new account (Section 4(2)). It may require use of an existing account.

Additionally, Section 5(5)(b) specifically requires a clear and conspicuous link on the site to an opt-out page for targeted advertising and data sale.

As of **January 1, 2026**, the channel must also recognize and honor universal opt-out signals such as the GPC, per Section 5(5)(c).

A well-structured Privacy Portal offers:

A submission form with clear categories (list of third parties, access/copy, correction, deletion, opt-out from advertising/sale/profiling).

A proportionate and non-discriminatory identity verification process.

Automatic receipt confirmation with a tracking number.

A record of each request, action taken, and response sent.

An appeal channel for denied requests.

The [site consent mechanism](https://goadopt.io/en/blog/operation-of-cookie-banner/) and the Privacy Portal must be integrated so that consumer preferences are reflected across the business's operational systems.

## How to process each type of DSAR in practice

### List of third parties request

Receive and authenticate the consumer's identity.

Consult the data sharing record.

Decide whether to provide: (i) a list of specific third parties that received the consumer's data, or (ii) a list of any third party that received any personal data.

Prepare response within 45 days.

Without a structured sharing record, compliance is impossible. Building a data sharing map is a prerequisite.

### Access and copy request

Receive and authenticate.

Locate all personal data in systems, including derived data such as marketing profiles and behavioral scores.

Prepare response in portable format within 45 days.

### Deletion request

Receive and authenticate.

Check for a legal exemption (Section 2(3)).

For data provided by the consumer: delete from all relevant systems.

For data obtained from third parties: delete entirely or opt the consumer out of processing for non-exempt purposes (Section 4(7)).

Confirm to the consumer within 45 days.

### Opt-out from targeted advertising and sale

Receive the request (via Portal, site link, or opt-out signal such as the GPC from 2026).

**Authentication is not required** to process.

Monitor for fraud indicators. If there is documented reasonable suspicion: notify the requestor.

Otherwise: cease processing for the indicated purposes.

### Opt-out from profiling

Receive via Portal.

Identify whether the profiling in question is for decisions with legal effects or effects of similar significance.

If yes: cease using the data for those decisions.

Inform the consumer of the result within 45 days.

## What happens when the controller denies a request?

Under Section 4(5)(b), the controller that does not take action must inform the consumer without undue delay, but no later than 45 days, with:

The justification for not taking action.

Instructions on how to appeal the decision.

## Consent revocation: 15 days

If the consumer had consented to processing of sensitive data or other consent-based processing and then decides to revoke, Section 5(1)(d) requires:

A revocation mechanism at least as easy as the consent mechanism.

Cessation of processing as soon as practicable, but **not later than 15 days** after receiving the revocation.

This deadline must be built into consent management systems and Privacy Portal operational processes.

## Special protection for children and teenagers

Section 4(3) allows parents or legal guardians to exercise rights on behalf of children under 13.

Section 4(3) also allows guardians or conservators to exercise rights on behalf of consumers under guardianship, conservatorship, or other protective arrangement.

For teens aged 13 to 15: the controller cannot process data for targeted advertising or sale without those consumers' consent (Section 5(2)(c)).

As of January 2026: prohibition on selling data of minors under 16 and on using data of minors under 16 for targeted advertising.

## Protection against discrimination

Section 5(2)(d) prohibits discriminating against consumers who exercise their rights, including denying goods or services, charging different prices, or offering different quality.

The exception is voluntary loyalty programs where the difference is reasonably related to the value the data provides (Section 5(3)(b)).

## The elimination of the cure period and DSARs

Through December 31, 2025, the AG was required to notify the business and grant 30 days to cure violations before initiating formal action.

**As of January 1, 2026, that period was eliminated.** The AG may act directly (Section 11 of the OCPA).

Businesses without a structured DSAR process cannot correct in 30 days what should have been implemented from the start. Without the cure period, the risk is even greater. Penalties can reach **US$ 7,500 per violation**, with each consumer whose right was violated potentially counting as a separate violation.

## How AdOpt helps with the Privacy Portal

AdOpt records every consent, opt-out, and revocation interaction with a timestamp and unique identifier. When the consumer exercises opt-out via the Portal or via a signal like the GPC from 2026, the system automatically updates the corresponding trackers.

The system processes consent revocations and ensures cessation within 15 days. AdOpt's auditable log serves as evidence of compliance for the Attorney General.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Privacy Portal for your site that complies with the OCPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what the Privacy Portal needs for the OCPA

**Request submission channel** without requiring creation of a new account (Section 4(2)).

**Clear and conspicuous link** on the site for opt-out from targeted advertising and sale (Section 5(5)(b)).

**Opt-out preference signal** honored from January 2026 (Section 5(5)(c)).

**Coverage of all L.O.C.K.E.D. rights**: list of third parties, access/confirmation, copy (including derived data), correction, deletion, opt-out.

**Derived data included** in the scope of copy and deletion (Sections 3(1)(a)(C) and 3(1)(c)).

**Opt-out without mandatory authentication** for targeted advertising, sale, and profiling (Section 4(5)(e)).

**Fraud denial process** documented for opt-outs denied on suspicion of fraud.

**Authorized agents** accepted for opt-out, including via technology (Section 4(4)).

**Deadlines**: 45 days to respond (+45 ext.); **45 days** for appeal.

**Appeal mechanism** conspicuously available and similar to original process (Section 4(6)).

**Reference to the AG** provided when appeal is denied (Section 4(6)(d)).

**Free service** once per 12-month period per consumer (Section 4(5)(c)).

**15-day consent revocation** honored (Section 5(1)(d)).

**Documented record** of each request, action taken, and response sent.

**Parents/legal guardians** may exercise rights for children under 13 (Section 4(3)).

**Guardians/conservators** may exercise rights for consumers under protective arrangements (Section 4(3)).

**Teen protection 13-15**: consent process before processing for advertising/sale.

## Comparative: Privacy Portal deadlines under the OCPA

| Request type | Response deadline | Extension possible |
|---|---|---|
| Access, list, copy, correction, deletion | 45 days | +45 days with notification |
| Opt-out (no authentication required) | No specific deadline | Immediate recommended |
| Appeal | 45 days | Not specified |
| Consent revocation | Max. 15 days | No extension |
| Cure period for violations | Eliminated (Jan 2026) | No guarantee |

## FAQ: OCPA and Privacy Portal

**1. Why does opt-out not require authentication under the OCPA?**
Section 4(5)(e) establishes that for opt-out requests from targeted advertising, sale, and profiling, the controller must comply without requiring authentication. The rationale is that opt-out is a basic right that should not have unnecessary barriers. The controller may deny only if it has a documented good-faith belief that the request is fraudulent, and must notify the requestor with the reason. Without that notification, the denial may be considered a violation.

**2. Why was the right to list third parties the most denied right in the first year?**
The report from AG Dan Rayfield (August 2025) identified that businesses simply did not have the structured record of who had received personal data. To comply with Section 3(1)(a)(B), the controller must know exactly which entities received data from a specific consumer, or which entities received any personal data from the controller. Without an updated data sharing map, it is impossible to respond to this request.

**3. What makes the deletion of derived data a key differentiator of the OCPA?**
The OCPA explicitly includes derived data in the personal data definition (Section 1(13)) and in the scope of the right to deletion (Section 3(1)(c)). When a consumer requests deletion, marketing profiles, propensity scores, and audience segment classifications created from their data must also be deleted. The enforcement report identified that businesses were not including this data in responses, which constituted a direct violation.

**4. Who may exercise rights on behalf of other consumers under the OCPA?**
Section 4(3) allows parents or legal guardians to exercise rights on behalf of children under 13, and guardians or conservators to exercise rights on behalf of consumers under protective arrangements. Section 4(4) allows any consumer to designate an authorized agent for opt-out, including via technology such as a browser extension or device setting.

**5. What happens if the controller does not have a DSAR process when the Attorney General investigates?**
As of January 2026, there is no longer a 30-day cure period. The AG may initiate action directly (Section 11 of the OCPA). If violations are identified, penalties of up to US$ 7,500 per violation may be sought. Each consumer whose right was violated can be counted as a separate violation, quickly escalating the financial exposure. The 2025 enforcement report showed that inaccessible or non-functional rights forms were among the most common problems found during investigations.

[Ready to build a Privacy Portal for your site that complies with the OCPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


Oregon OCPA: DSAR Privacy Portal

Montana MTCDPA: Cookies Policy

The Connecticut Data Privacy Act (CTDPA, Public Act No. 22-15) has a few DSAR process peculiarities that set it apart from other US state privacy laws.

This page covers one piece of the picture. For the full scope of the CTDPA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the CTDPA and cookies](https://goadopt.io/en/blog/connecticut-CTDPA-and-cookies-all-you-need-to-know/).

The most important: opt-out requests **do not require authentication**, but the controller may deny them if it has a documented belief of fraud. And the appeal response deadline is **60 days**, not 45 like the initial request deadline.

This article covers all of it: what a DSAR is under the CTDPA, the five guaranteed rights, the specific deadlines, the authentication rules, and how to build a Privacy Portal that works for Connecticut law.

## What is a DSAR under the CTDPA?

DSAR stands for Data Subject Access Request, or Data Rights request in the language of the CTDPA. It is any formal request from a Connecticut resident to exercise the rights the law grants over their own data.

Under Section 4(b), the consumer exercises their rights by a secure and reliable means established by the controller and described in the privacy notice.

If you are already familiar with the [GDPR](https://goadopt.io/en/blog/gdpr-cookies-explained/) data subject rights framework, the structure will feel familiar. The CTDPA adds specific rules on opt-out authentication and the role of authorized agents via technology.

## What are consumer rights under the CTDPA?

Under Section 4(a), Connecticut residents have five rights:

### 1. Right to confirm and access

The consumer may confirm whether the controller processes their data and access the personal data (Section 4(a)(1)).

A CTDPA-specific limitation: if confirmation or access would require the controller to **reveal a trade secret**, the controller is not obligated to do so. This differs from other state laws that do not mention trade secrets in the access right context.

### 2. Right to correction

The consumer may request correction of inaccuracies in personal data, taking into account the nature of the data and the purposes of processing (Section 4(a)(2)).

### 3. Right to deletion

The consumer may request deletion of personal data provided by or obtained about them (Section 4(a)(3)).

For data obtained from third parties (not from the consumer themselves), the controller may comply by retaining only the deletion request record and the minimum data necessary to ensure the data remains deleted (without using that data for any other purpose), or by opting the consumer out of processing that data (Section 4(c)(5)).

### 4. Right to portability

The consumer may obtain a copy of data in a portable and, where technically feasible, readily usable format that allows transmission to another controller without hindrance, where processing is by automated means (Section 4(a)(4)).

The controller is **not required to reveal trade secrets** to fulfill a portability request.

### 5. Right to opt-out

The consumer may refuse processing of personal data for three purposes (Section 4(a)(5)):

Targeted advertising.

Sale of personal data (except as provided in Section 6(b) on loyalty programs).

Profiling in furtherance of **solely automated** decisions that produce legal or similarly significant effects.

The third point is the most important CTDPA distinction: the profiling opt-out applies only to **solely** automated decisions. If there is any human review in the final decision, this opt-out may not apply.

## What are the response deadlines?

Under Section 4(c)(1):

**45 days** to respond from receipt of the request.

Extension of **+45 days** when reasonably necessary, considering complexity and number of requests, with notification within the initial period.

**Free** once per consumer during any 12-month period (Section 4(c)(3)).

For manifestly unfounded, excessive, or repetitive requests: may charge a reasonable fee or decline, with the burden of demonstrating the excessive nature on the controller.

## The appeal process: 60 days, not 45

The CTDPA has a distinctive feature: the appeal response deadline is **60 days**, not 45 like the initial request deadline (Section 4(d)).

The appeal process must be:

Conspicuously available and similar to the request submission process.

Actionable within a reasonable period after the consumer receives the decision.

The response must include any action taken or not taken, along with a written explanation of the reasons.

If the appeal is denied, the controller must provide the consumer with an online mechanism, if available, or other method through which the consumer may contact the **Attorney General** to submit a complaint.

## Authentication: the special rule for opt-outs

The CTDPA has a different authentication rule for opt-outs (Section 4(c)(4)):

For exercising access, correction, deletion, and portability rights: the controller may deny if it cannot authenticate using commercially reasonable efforts. Must notify the consumer that authentication failed and additional information is needed.

For **opt-out requests**: the controller is **not required to authenticate**, but **may deny** if it has a good faith, reasonable, and documented belief that the request is fraudulent. If denying, it must send a notice to the requestor disclosing that it believes the request is fraudulent, why it believes so, and that it will not comply.

This distinction matters for Portal design: the opt-out channel must function without requiring verification, but the controller may have a fraud monitoring process.

## Authorized agents and opt-out signals

Section 5 allows the consumer to designate another person as an authorized agent to exercise opt-out rights on their behalf. This includes via technology such as an Internet link, browser setting, browser extension, or global device setting.

The controller must comply with an opt-out from an authorized agent if it can verify, with commercially reasonable effort, the consumer's identity and the agent's authority.

From **January 1, 2025**, controllers processing for targeted advertising or selling data must accept opt-outs via signal sent with consumer consent (Section 6(e)(1)(A)(ii)). This includes the GPC.

## What should the request submission channel look like?

Section 6(e)(1) requires the controller to establish and describe in the privacy notice one or more secure and reliable means for submitting requests. The means must take into account:

The ways consumers normally interact with the controller.

The need for secure and reliable communication.

The controller's ability to verify the consumer's identity.

The controller cannot require creation of a new account. May require use of an existing account.

Additionally, Section 6(e)(1)(A)(i) specifically requires a clear and conspicuous link on the site to an opt-out page.

## How to process each type of DSAR in practice

### Access request

Receive and authenticate with commercially reasonable efforts.

Locate all personal data about this consumer in systems.

Check whether confirmation or access would reveal trade secrets: if so, may deny that specific part.

Prepare response in accessible format within 45 days.

### Correction request

Receive and authenticate.

Identify the inaccurate data.

Correct in primary systems.

Confirm to the consumer within 45 days.

### Deletion request

Receive and authenticate.

Check whether a legal exception allows retaining the data.

For data obtained from third parties: choose between deleting outright or opting the consumer out of all processing.

Confirm to the consumer what was done.

### Portability request

Receive and authenticate.

Generate a portable data file without revealing trade secrets.

Deliver securely within 45 days.

### Opt-out of targeted advertising and data sale

Receive the request (via Portal, site link, or opt-out signal like GPC).

No authentication required; however, monitor for fraud signals.

If there is reasonable, documented suspicion of fraud: notify the requestor.

Otherwise: cease processing for the indicated purposes.

If the opt-out signal conflicts with an existing controller-specific setting or loyalty program, comply with the opt-out but may notify the consumer of the conflict.

### Opt-out of solely automated profiling

Receive via Portal.

Assess whether the profiling in question is **solely automated** (no human review). If there is significant human review, the opt-out may not apply.

If solely automated: cease using the data for those decisions.

Inform the consumer of the outcome.

## What happens when the controller denies a request?

Under Section 4(c)(2), the controller must inform the consumer without undue delay, but not later than 45 days, with:

The justification for not taking action.

Instructions on how to appeal the decision.

## Consent revocation: 15 days

If the consumer had consented to processing of sensitive data or other consent-based processing and then revokes, Section 6(a)(6) requires:

A revocation mechanism at least as easy as the consent mechanism.

Cessation of processing not later than **15 days** after receiving the revocation.

This 15-day deadline must be factored into consent management systems and Privacy Portal operational processes.

## Special protection for children and teens

For known children (under 13 under COPPA): parents or legal guardians may exercise rights on the child's behalf (Section 4(b)).

For consumers under guardianship or conservatorship: the guardian or conservator may exercise rights on the consumer's behalf (Section 4(b)).

For teens aged 13 to 15: the controller cannot process data for targeted advertising or sale without their consent (Section 6(a)(7)).

## Protection against discrimination

Section 6(a) expressly prohibits discrimination against consumers who exercise their rights, including denying goods or services, charging different prices, or offering different quality.

The exception is voluntary loyalty programs, rewards, premium features, discounts, or club card programs.

## Enforcement: AG exclusively

Section 11(a) grants the Connecticut Attorney General **exclusive authority** to enforce the CTDPA. No District Attorneys are involved (unlike Colorado) and there is no private right of action.

From January 2025, the cure period is discretionary. The AG may consider multiple factors before acting or not.

## How AdOpt helps with the Privacy Portal

AdOpt logs every consent, opt-out, and revocation interaction with a timestamp and unique identifier. When the consumer exercises opt-out via Portal or via signal like the GPC, the system automatically updates the corresponding trackers.

The system processes consent revocations and ensures cessation within 15 days. AdOpt's auditable log serves as evidence of compliance for the Attorney General.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Privacy Portal for your site that complies with the CTDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what the Privacy Portal needs for the CTDPA

**One or more secure and reliable channels** described in the privacy notice (Section 6(e)(1)).

**Clear and conspicuous link** on the site for opt-out of targeted advertising/sale (Section 6(e)(1)(A)(i)).

**Opt-out preference signal** honored from January 2025 (Section 6(e)(1)(A)(ii)).

**Coverage of 5 rights**: access/confirmation, correction, deletion, portability, opt-out.

**Profiling: only solely automated decisions** covered by the opt-out (Section 4(a)(5)(C)).

**Opt-out without mandatory authentication**: process accepting opt-outs without requiring verification (Section 4(c)(4)).

**Documented fraud denial process** if opt-outs are denied based on fraud suspicion, including mandatory notification.

**Authorized agents** accepted for opt-out via technology (Section 5).

**Deadlines**: 45 days for initial response (+45 ext.); **60 days** for appeals (not 45).

**Conspicuously available appeal process** similar to the original submission process.

**Reference to AG** provided when appeal is denied (Section 4(d)).

**Free** first request per 12-month period (Section 4(c)(3)).

**Consent revocation honored within 15 days** (Section 6(a)(6)).

**Parents/guardians** may exercise rights for children (Section 4(b)).

**Guardians/conservators** may exercise rights for consumers under protection (Section 4(b)).

**Teen 13-15 protection**: process for obtaining consent before targeted advertising/data sale.

## Comparison: Privacy Portal deadlines under the CTDPA

| Request type | Response deadline | Extension possible |
|---|---|---|
| Access, correction, deletion, portability | 45 days | +45 days with notification |
| Opt-out (no authentication required) | No specific deadline | Immediate recommended |
| Appeal of a decision | **60 days** | Not specified |
| Consent revocation | **Max. 15 days** | No extension |
| Cure period (general violations) | Discretionary (2025) | No guarantee |

## FAQ: CTDPA and Privacy Portal

**1. Why do opt-outs not require authentication under the CTDPA?**
Section 4(c)(4) establishes that the controller is not required to authenticate opt-out requests. The rationale is that opt-out is a basic right that should not have unnecessary barriers. The controller may, however, deny if it has a documented good-faith belief of fraud and must notify the requestor with the justification. This balances ease of exercising the right with protection against abuse.

**2. Why does the appeal have a 60-day deadline instead of 45 like initial requests?**
Section 4(d) explicitly establishes 60 days for appeal responses, while initial requests have a 45-day deadline (Section 4(c)(1)). The longer deadline for appeals likely reflects the need for more careful review of an already-made decision. There is no mentioned extension for appeal deadlines.

**3. Is the CTDPA profiling opt-out more restrictive than in other laws?**
Yes. Section 4(a)(5)(C) limits the profiling opt-out to **solely automated** decisions with legal or significant effects. Virginia's VCDPA and Colorado's CPA cover such decisions without the sole-automation requirement. In practice, if the controller uses automated profiling but a human reviews and makes the final decision, the CTDPA profiling opt-out may not apply.

**4. Who can exercise rights on behalf of other consumers under the CTDPA?**
Section 4(b) allows parents or legal guardians to exercise rights on behalf of known children, and guardians or conservators to exercise rights on behalf of consumers under protective arrangements. Additionally, Section 5 allows any consumer to designate an authorized agent to exercise the opt-out, including via technology such as a browser extension or device setting.

**5. What happens if the controller denies an opt-out for fraud suspicion?**
Section 4(c)(4) allows denial if there is a good faith, reasonable, and documented belief that the opt-out is fraudulent. But it requires notification to the requestor with three elements: that the controller believes the request is fraudulent, why it believes so, and that it will not comply. Without this notification, the denial may itself constitute a violation of the law.

[Ready to build a Privacy Portal for your site that complies with the CTDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


Connecticut CTDPA: DSAR Privacy Portal

What is a CMP (Consent Management Platform)?

California has a requirement that no other US state privacy law has: the "Do Not Sell or Share My Personal Information" link visibly displayed on the homepage.

This page covers one piece of the picture. For the full scope of the CCPA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the CCPA and cookies](https://goadopt.io/en/blog/california-ccpa-and-cookies-all-you-need-to-know/).

That link exists because of cookies.

When a site installs an advertising pixel, that pixel collects data about user behavior and sends it to the advertising platform. This constitutes "sharing" of data for cross-context behavioral advertising under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). And sharing requires an opt-out.

This article focuses exclusively on what the CCPA/CPRA requires from a Cookies Policy: what must be in the document, how consent and opt-out must work, and what the law's specific requirements mean for each tracker on your site.

## Cookies Policy vs. cookie banner: the necessary distinction

The [cookie banner](https://goadopt.io/en/blog/how-to-choose-a-cookie-banner-for-your-website/) is the visual interface. It is what the visitor sees when they access the site and where they make choices about what they accept.

The Cookies Policy is the detailed document. It is where the user finds complete information about every technology operating on the site: what it collects, what it is for, who receives the data, how long it is retained, and how to exercise rights.

Both need to exist. Both need to be aligned. And the Cookies Policy must be accessible from a link within the [consent notice](https://goadopt.io/en/blog/operation-of-cookie-banner/) itself.

## "Sale" and "sharing" of data via cookies

The distinction created by the CPRA is fundamental to understanding what the CCPA requires in the context of cookies.

**Sale** (§ 1798.140(ad)): transfer of data for monetary or other valuable consideration to third parties.

**Sharing** (§ 1798.140(ah)): transfer of data to third parties for cross-context behavioral advertising, with or without monetary consideration.

Cross-context behavioral advertising (§ 1798.140(k)): ads targeted based on personal information obtained from consumer activity across different businesses, distinctly branded websites, applications, or services.

In practice: if your site has a pixel that sends user behavior data to an advertising platform to display ads on other sites, that is "sharing" under the CCPA/CPRA, even if you receive no money directly. And sharing requires:

The "Do Not Sell or Share My Personal Information" link on the homepage.

Clear and conspicuous disclosure in the privacy notice.

Honoring the opt-out when exercised.

## What the CCPA/CPRA specifically requires for cookies

### Specific purpose for each category

§ 1798.100(a)(1) requires the business to inform consumers, at or before the point of collection, of the categories of personal information to be collected and the purposes for which they are collected or used, and whether that information is sold or shared.

For cookies, each tracker category needs a specific purpose description. "Cookies to improve your experience" is not a purpose.

What works:

"Analytics cookies: collect browsing behavior data including pages visited, traffic source, and session duration. Used to identify opportunities for content improvement. This data is not sold or shared with third parties for advertising."

"Advertising cookies: collect behavioral identifiers that are shared with advertising platforms for cross-context behavioral advertising. Data is shared with partners such as Meta Ads and Google Ads. Consumers can opt out via the 'Do Not Sell or Share My Personal Information' link."

### Cookie categories present on the site

The Policy must list the tracker categories:

**Necessary cookies:** essential for basic functionality. Do not constitute sale or sharing and do not require the opt-out link. But must be documented.

**Analytics cookies:** depends on configuration. If data stays within company systems and is not sent to third parties for targeting, they generally do not constitute "sale" or "sharing." But most major analytics platform cookies send data to the provider, which may constitute a business purpose disclosure.

**Advertising and retargeting cookies:** almost always constitute "sharing" under the CCPA/CPRA. Meta Pixel, Google Ads, TikTok Pixel, programmatic DSP pixels: all send data to platforms that use that data to display behavioral ads to the user on other sites.

**Functional cookies:** remember user preferences. Generally do not constitute sale or sharing if the data stays internal.

**Third-party cookies:** fired by external services integrated into the site. [Correct tag categorization](https://goadopt.io/en/blog/difference-cookies-local-storage-session-storage/) is what makes it possible to document each one accurately.

### Who receives data via cookies

The Policy must identify the categories of third parties receiving data via cookies.

§ 1798.115(a) requires the business to disclose, upon consumer request, the categories of third parties to whom it sold or shared data, by category of personal information.

For cookies, this means documenting that, for example: browsing behavior data was shared with digital advertising platforms; session data was disclosed to analytics service providers; user identifiers were shared with programmatic advertising networks.

### Retention period for each category

§ 1798.100(a)(3) requires the business to disclose the length of time it intends to retain each category of data, or the criteria used to determine that period.

For cookies, the Policy must document:

How long each cookie category remains active on the user's device.

How long data collected via cookies is retained in company systems.

Whether and when data is deleted.

## The Global Privacy Control (GPC): how to handle it in the context of cookies

§ 1798.135(b) allows the business to comply with opt-out requirements by honoring the opt-out preference signal sent by platforms, technologies, or mechanisms with the consumer's consent.

The Global Privacy Control (GPC) is the best-known mechanism implementing this functionality. When the user activates the GPC in their browser, the site must interpret this signal as an opt-out of sale and sharing.

The Cookies Policy must state whether the site respects the GPC and how this mechanism works.

A well-configured [consent management platform](https://goadopt.io/en/blog/how-to-choose-cmp-consent-management-platform/) detects and honors the GPC automatically.

## The "Limit the Use of My Sensitive Personal Information" link and cookies

Precise geolocation data (radius of 1,850 feet or less) is sensitive personal information under the CCPA/CPRA (§ 1798.140(ae)(1)(C)).

If the site collects precise geolocation data via cookies or location scripts for purposes beyond what is necessary to provide the requested product or service, the consumer has the right to limit this use via the "Limit the Use of My Sensitive Personal Information" link (§ 1798.121).

The Cookies Policy must identify whether precise geolocation data is collected, what it is used for, and how the consumer can limit its use.

## Special protection for consumers under 16 years of age

§ 1798.120(c) prohibits the sale or sharing of data of consumers under 16 without affirmative authorization.

For consumers between 13 and 15: the consumer's own authorization.

For consumers under 13: parental or legal guardian authorization.

If the site may have users under 16, the Cookies Policy must describe how data from those users is treated differently, including how advertising cookies are blocked without adequate authorization.

## When to update the Cookies Policy

§ 1798.130(a)(5) requires updating the privacy notice at least once every 12 months. For the Cookies Policy, this means a mandatory annual review.

Situations requiring immediate update:

Adding a new advertising pixel.

A new analytics tool that sends data to third parties.

A new chat or support plugin.

A new CRM or email marketing platform integration.

Any new partner receiving behavioral data.

Continuous [data mapping](https://goadopt.io/en/blog/what-is-privacy-by-design/) is what keeps the cookie inventory synchronized with the document.

## The CCPA/CPRA anti-avoidance provision

§ 1798.190 provides that transactions or series of steps intentionally created to avoid the definition of "sale" or "sharing," including eliminating monetary consideration to circumvent the law, will be disregarded.

This means that structuring data exchange agreements without monetary consideration to avoid the opt-out is not a valid strategy. The CCPA/CPRA looks at the substance of the transaction, not just its form.

## Enforcement and penalties

The **California Privacy Protection Agency (CPPA)** can impose administrative fines of up to **US$ 2,500 per violation** and up to **US$ 7,500 for intentional violations** or violations involving minors. The **Attorney General** can seek civil penalties in the same amounts.

There is no guaranteed cure period before CPPA actions. The agency has discretion to investigate and act.

Additionally, § 1798.150 grants consumers the private right of action for security breaches: US$ 100 to US$ 750 per consumer per incident.

## How AdOpt helps with the Cookies Policy under the CCPA/CPRA

AdOpt's automatic scan identifies all technologies active on the site, feeding the list of categories that must appear in the Cookies Policy.

The [cookie notice](https://goadopt.io/en/blog/operation-of-cookie-banner/) configured through AdOpt blocks non-essential trackers before acceptance, presents categories with clear descriptions, offers real opt-out options, honors the GPC automatically, and logs every interaction for audit purposes.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Cookies Policy for your site that complies with the CCPA/CPRA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what your Cookies Policy needs for the CCPA/CPRA

**Visible link** in the site footer and within the cookie banner.

**Listing of cookie categories** with a description of what each one does.

**Specific purpose for each category**, including a statement of whether data is sold or shared.

**Identification of cookies that constitute "sale" or "sharing"** under the CCPA/CPRA definition.

**Categories of third parties** that receive data via cookies.

**"Do Not Sell or Share My Personal Information" link** on the homepage when there is sale or sharing.

**"Limit the Use of My Sensitive Personal Information" link** when precise geolocation data is collected for purposes beyond the necessary.

**Global Privacy Control (GPC):** statement that the site honors the signal when sent by the user.

**Retention period** for each cookie category.

**Protection for minors** aged 13 to 15 and under 13.

**Annual update** of the document.

**Accessible language**, without legal jargon.

**No dark patterns** in opt-out mechanisms.

## FAQ: CCPA/CPRA and Cookies Policy

**1. Does an advertising pixel always constitute "sharing" under the CCPA/CPRA?**
Almost always, yes. The CCPA/CPRA defines "sharing" as the transfer of data for cross-context behavioral advertising, with or without monetary consideration. A pixel that sends user behavior data from your site to a platform that uses that data to display ads to the same user on other sites constitutes sharing. The site needs the "Do Not Sell or Share My Personal Information" link and must honor the opt-out.

**2. Does Google Analytics constitute "sharing" under the CCPA/CPRA?**
It depends on the configuration. Google Analytics in its default configuration sends data to Google, which has its own data use policies. If that data is used by Google for ad targeting on other sites (which may occur depending on settings), there is a risk of constituting sharing. The safest approach is to use GA with enhanced privacy settings and review the data processing terms with Google.

**3. What is the Global Privacy Control (GPC) and must the site respect it?**
The GPC is a browser signal that the user can activate to indicate their opt-out preference for sale and sharing of data. § 1798.135(b) allows the business to comply with opt-out requirements by honoring the GPC, instead of maintaining the "Do Not Sell or Share" and "Limit Sensitive PI" links on the site. Both approaches are valid: visible links on the site, or honoring the GPC. The business may choose one of the two strategies.

**4. Do analytics cookies need the "Do Not Sell or Share" link under the CCPA/CPRA?**
It depends on how the data is used. If analytics data stays only within company systems and is not sent to third parties for targeting purposes, it generally does not constitute "sale" or "sharing." But if the analytics tool is from a major provider that may use the data for other purposes including targeting, there is risk. Reviewing the tool's data processing terms is essential.

**5. What happens if the consumer opts out and the site continues sharing data?**
Continued sale or sharing after opt-out is a direct violation of § 1798.120(d). The CPPA may investigate and impose fines of up to US$ 2,500 per violation or US$ 7,500 for intentional violations. Additionally, the affected consumer may have grounds for a civil lawsuit. The business must wait at least 12 months before requesting the consumer's consent to sale or sharing again.

[Ready to build a Cookies Policy for your site that complies with the CCPA/CPRA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


California CCPA: Cookies Policy

## **Cookies and the TDPSA**

 

This page covers one piece of the picture. For the full scope of the TDPSA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the TDPSA and cookies](https://goadopt.io/en/blog/texas-tdpsa-and-cookies-all-you-need-to-know/).

**Cookies** are small data files stored on users’ devices that help websites remember preferences, track behavior, and deliver personalized ads.

Under the **Texas Data Privacy and Security Act (TDPSA),** businesses that operate in Texas and use **cookies** must now follow specific requirements related to **transparency, consent, and consumer rights**.

If you’re collecting data through cookies, here’s everything you need to know to stay **compliant**.

 

## **Do Cookies Count as Personal Data?**

 

Yes **[cookies](https://goadopt.io/en/blog/operation-of-cookie-banner/)** can be considered personal data under the **Texas Data Privacy and Security Act (TDPSA).**

While they might seem like harmless snippets of code, many cookies collect information that can identify, track, or build a profile about a user.

This includes tracking cookies, advertising cookies, and analytics **cookies**, all of which play a key role in digital marketing and website performance.

 

If a **cookie** can be linked to an individual either directly through data like an IP address, or indirectly by analyzing browsing behavior over time it is considered personal data under the **TDPSA**.

That means the same legal obligations apply as they would for a person’s name, email, or phone number.

This covers a wide range of **cookie** types, especially those used for behavioral advertising or tracking site interactions across multiple sessions.

 

Businesses using these types of **cookies** must ensure they are handling the data properly.

That includes obtaining valid user consent, providing clear notices, and offering easy ways for users to manage their preferences.

Ignoring this can put you at risk of non-**compliance**. To better understand which **cookies** on your site might fall into this category, check out our **cookie compliance guide**.

 

---
 

## **What Must Be Disclosed in a Cookie Policy?**

 

Creating a **cookie policy** that meets the requirements of the **Texas Data Privacy and Security Act (TDPSA)** means going beyond vague statements.

Your **policy** must be clear, accessible, and written in plain language.

Most importantly, it needs to provide transparency around how cookies are used and what users can do to control them.

 
 

Start by explaining the types of cookies your site uses such as essential, analytics, and advertising cookies and what kind of data each one collects.

Be specific: does it collect location data, browsing habits, or identifiers like IP addresses? If third parties (like ad networks or analytics providers) have access to this data, that must also be clearly stated.

 

Users need to know why cookies are in use whether it’s to **enhance functionality, track performance, or deliver targeted ads.**

Additionally, your **cookie policy** should include easy-to-follow instructions for users to opt out or adjust their **cookie** settings.

This could be through a **cookie** preference center or a clear link in your **consent banner.**

**Ideally**, your policy should be integrated into your broader **privacy** notice or at least linked from your website footer and any banners shown to first-time visitors.

Need help creating a compliant policy that fits your brand? Book a free consultation with one of our privacy experts.

 

## **Do You Need Consent for Cookies?**

 

Yes — under the **TDPSA**, consent is required for certain types of **cookies**. While strictly necessary **cookies** (those essential for your site to load or function properly) can be used without **consent**, any **cookie** used for personalized advertising, cross-site tracking, or behavioral analytics requires explicit, prior permission from the user.

 

The **Texas Data Privacy** and Security Act empowers consumers to opt out of the sale of personal data and the use of their information for targeted advertising.

Since many **cookies** enable these very practices, businesses must ensure that their websites provide a way for users to reject non-essential **cookies** before any tracking occurs.

This makes having a proper **[cookie consent banner](https://goadopt.io/en/blog/why-are-cookie-banners-everywhere/)** or preference management tool not just best practice but a legal necessity.

To stay **compliant**, your banner must be more than a passive notice. It should include a “reject” option as clearly as the “accept” one and offer access to a settings panel where users can manage their preferences.

**Cookies** for tracking should not fire until the user has opted in.

Want to see what a compliant setup looks like? Try our consent solution and see how easy it is to get aligned with the **TDPSA**.

 

## **How Can Users Opt Out?**
Under the **Texas Data Privacy and Security Act (TDPSA)**, users have the right to say no and businesses must make it easy for them to do so.

Specifically, individuals must be given clear, accessible ways to opt out of **cookies** that enable targeted advertising, the sale of personal data, or profiling that could impact decisions related to employment, credit, or other significant outcomes.

 

To meet this requirement, your website should offer multiple opt-out options. A **cookie banner** should not only inform but also empower users with granular controls allowing them to accept some types of **cookies** and reject others.

You should also provide a preference center where users can revisit and adjust their **cookie** settings at any time.

This helps reinforce **transparency** and gives users a sense of control over their data.

Additionally, a clearly labeled “Do Not Sell or Share My Personal Information” link in the footer is highly recommended. It signals your commitment to user privacy and helps you meet TDPSA obligations head-on.

These steps not only keep you **compliant** but also build trust with your audience. Want to make your opt-out tools easier to manage and more effective? Schedule a free demo and see how we can help.

 

## **What Happens If You Don’t Comply?**
Non-**compliance** with the **Texas Data Privacy and Security Act (TDPSA)** isn't just a legal risk it's a reputational one too. If your website fails to provide proper cookie notices or doesn't honor user preferences (like rejecting tracking **cookies**), you could face enforcement actions from the **Texas Attorney General**.

This may include fines, formal warnings, or mandatory corrective measures to bring your practices into alignment.

But beyond the legal penalties, there’s a bigger cost: loss of consumer trust.

More users today are aware of their **privacy** rights, and many actively avoid websites that lack transparent cookie consent banners or that make opting out difficult.

This is especially true for privacy-conscious users, who are often the most vocal and influential when it comes to brand perception online.

By taking the **TDPSA** seriously and prioritizing cookie compliance, you don’t just avoid fines you show your audience that their privacy matters.

This builds long-term loyalty and sets you apart from competitors who treat data protection as an afterthought. Want to make sure you're covered? Speak to a **privacy** expert and get a full **cookie compliance** check-up.

 

---
 

## **Best Practices for Cookie Compliance**

To ensure your cookie strategy is fully **TDPSA**-**compliant**, following these best practices will keep your business on the right track and build user trust:

Audit your website’s **cookies** regularly to identify what data is being collected and for what purposes.

Understand the types of cookies in use whether they’re essential, analytics, or advertising so you can manage them effectively.

Use a **cookie consent** platform like AdOpt to easily manage opt-ins, track user consent, and ensure compliance with the **TDPSA**.

A solid platform also helps you create a transparent cookie banner that meets legal standards.

Keep your **cookie policy** up to date, ensuring it’s written in plain language and reflects any changes in your **cookie practices** or third-party relationships.

This gives users clarity and reassures them about how their data is being used.

Make sure your site allows users to opt out easily and **respects their choices** at all times.

Providing accessible opt-out options helps you comply with user rights under the **TDPSA** and strengthens your privacy practices.

Review third-party cookies **periodically**, and carefully vet any vendors who have access to user data through your site.

This ensures that all third parties **comply** with the same high standards you set for your own business.

By implementing these practices, you not only stay **compliant** with the **TDPSA** but also show your commitment to user privacy and build stronger, more trusting relationships with your customers.

Need assistance with auditing or setting up your cookie **compliance** strategy? Book a demo with one of our **[experts today!](https://meetings.hubspot.com/murilo-andrade/adopt-meeting1-murilo)**

Cookies and the TDPSA

How to Choose a CMP (Consent Management Platform)?

GDPR and Cookies all you need to know

## Virginia VCDPA: Privacy Policy

Every business that collects data from Virginia residents needs a public document that clearly and specifically explains what it does with that information.

This page covers one piece of the picture. For the full scope of the VCDPA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the VCDPA and cookies](https://goadopt.io/en/blog/virginia-vcdpa-and-cookies-all-you-need-to-know/).

That document is the Privacy Policy.

The Virginia Consumer Data Protection Act (VCDPA, Va. Code § 59.1-575 et seq.), in effect since January 1, 2023, defines what must be in that document, how it should be presented, and what happens when it is incomplete or outdated.

This article focuses exclusively on that: what the VCDPA requires from your Privacy Policy, point by point, based on the official text of the law.

## What the VCDPA calls a Privacy Notice

The law uses the term privacy notice. In practice, it is the Privacy Policy that most websites already have.

Va. Code § 59.1-578 C requires the controller to provide consumers with a privacy notice that is "reasonably accessible, clear, and meaningful." The document must be easy to find and easy to understand.

Unlike the NHDPA, the VCDPA does not explicitly require accessibility accommodations for people with disabilities or mandate inclusion of the date of last update in the text of the law. However, the standard of reasonable accessibility and clarity requires the document to be navigable and comprehensible by any user.

## What must be in the Privacy Policy under the VCDPA

Va. Code § 59.1-578 C lists five categories of information the Privacy Policy must contain. Let's go through each one.

### 1. Categories of personal data processed

The document must list the categories of personal data the business processes (Va. Code § 59.1-578 C, 1).

Personal data under the VCDPA is any information linked or reasonably linkable to an identified or identifiable natural person, as defined in Va. Code § 59.1-575. This includes name, email address, IP address, browsing history, location data, and any identifier that allows a person to be tracked.

De-identified data and publicly available information are excluded.

### 2. The purpose of processing

The document must explain what the data is used for (Va. Code § 59.1-578 C, 2).

The purposes must be specific. Va. Code § 59.1-578 A, 2 prohibits processing data for purposes that are not reasonably necessary or compatible with the disclosed purposes, without the consumer's consent.

Vague descriptions such as "improve your experience" or "personalize your journey" do not meet the requirement. "Behavioral data collected via analytics to identify pages with high abandonment rates and prioritize usability improvements" is the correct level of specificity.

### 3. How consumers exercise their rights

The document must describe how consumers can exercise the five rights guaranteed by the VCDPA and how to appeal a denial decision (Va. Code § 59.1-578 C, 3).

It is not enough to list that rights exist. The process must be described: which channel to use, how identity authentication works, what the 45-day response deadline is, and how the appeal process works with a 60-day response period.

The [data protection officer](https://goadopt.io/en/blog/responsibilities-of-a-data-protection-officer/) or compliance lead must have this workflow mapped and operationally functional before publishing the Policy.

### 4. Categories of data shared with third parties

If the business shares data with third parties, the document must disclose which categories of data are shared (Va. Code § 59.1-578 C, 4).

This covers email marketing tools, CRMs, analytics platforms, advertising networks, payment processors, and any other service that receives user data.

It is important to distinguish what constitutes data sharing under the VCDPA. Transfers to processors that process data exclusively on behalf of the controller do not constitute "sale of data." But any transfer for monetary consideration to independent third parties may constitute a sale and require specific disclosure.

### 5. Categories of third parties that receive data

In addition to the types of data, the Policy must disclose which categories of third parties receive them (Va. Code § 59.1-578 C, 5).

Categories such as "digital advertising platforms," "analytics tools," "CRM systems," and "payment processors" are valid examples. It is not necessary to list the name of every product, but the categories must be identifiable and descriptive enough for the consumer to understand who has access to their data.

## Disclosure of targeted advertising and data sale

If the business sells personal data to third parties or processes it for targeted advertising, Va. Code § 59.1-578 D requires clear and conspicuous disclosure of this practice in the Privacy Policy, along with the manner in which the consumer can exercise the opt-out.

Targeted advertising, as defined by the VCDPA, consists of ads based on data collected from the consumer's activities over time and across non-affiliated websites or applications. Contextual ads based on the current session are not included in this definition.

If your site uses a Meta Pixel, Google Ads, TikTok Pixel, or any programmatic advertising tool that collects data in other environments, you are operating targeted advertising and must disclose this explicitly.

## The request submission mechanism

Va. Code § 59.1-578 E requires the controller to establish and describe in the Privacy Policy at least one secure and reliable means for consumers to submit rights requests.

This means must:

Consider how consumers normally interact with the controller.

Ensure secure and reliable communication.

Allow the controller to authenticate the consumer's identity.

Not require the consumer to create a new account. The business may require use of an existing account, but cannot force the user to register a new one just to exercise a right guaranteed by law.

## Sensitive data: additional requirements

Sensitive data receives special treatment under the VCDPA and must be identified in the Privacy Policy.

Under Va. Code § 59.1-575, sensitive data includes: racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data for identification, known children's personal data, and precise geolocation data.

If the business collects any data in this category, the Policy must:

Explicitly identify that sensitive data is collected.

Describe the specific purpose for which each category is processed.

Explain how the consumer's consent is obtained prior to processing.

Detail how that consent can be revoked.

For children's data, the VCDPA takes a specific approach: businesses that comply with the verifiable parental consent requirements of COPPA (Children's Online Privacy Protection Act) are deemed compliant with the VCDPA's parental consent obligations (Va. Code § 59.1-576 D).

## Protection of minors on social media platforms

Starting January 1, 2026, Va. Code § 59.1-577.1 imposes specific obligations on social media platform operators related to users under **16 years of age**.

If the business operates a social media platform, the Privacy Policy must describe:

How the business determines whether a user is a minor under 16.

The 1-hour daily usage limit for minors.

How parents or legal guardians can provide verifiable parental consent to adjust the limit.

That data collected for age determination is used solely for that purpose.

## Data Protection Assessments: what the Policy needs to address

Va. Code § 59.1-580 requires controllers to conduct and document Data Protection Assessments for high-risk activities, including targeted advertising, data sale, profiling with foreseeable risk of harm, sensitive data processing, and online services directed at children.

Assessments do not need to be published in the Policy, but must be documented and available to the Attorney General upon request. They are confidential and exempt from public disclosure under the Virginia Freedom of Information Act (Va. Code § 59.1-580 D).

The Privacy Policy should, however, make clear that the business conducts impact assessments for high-risk activities as part of its compliance program.

## Non-discrimination policy

Va. Code § 59.1-578 A, 4 expressly prohibits businesses from discriminating against consumers who exercise their rights. This includes denying products or services, charging different prices, or offering lower quality as a consequence of a consumer exercising a right.

The Privacy Policy must state that consumers will not be discriminated against for exercising their rights.

The exception: voluntary loyalty, rewards, premium features, discount, or club card programs that offer benefits in exchange for data use are permitted, provided the consumer participates voluntarily.

## The cure period and its relationship to the Policy

Before initiating any action, the Attorney General must notify the business and provide **30 days to cure** the violation (Va. Code § 59.1-584 B). This period is guaranteed by law.

If the business cures the violation within the period and provides a written statement that the violations have been remedied and will not recur, no action is initiated.

However, if the business continues in violation after the cure period or breaches the written statement provided, the Attorney General may seek penalties of up to **US$ 7,500 per violation**, plus recovery of costs and [attorney fees](https://goadopt.io/en/blog/fines-in-LGPD/).

An incomplete Privacy Policy is one of the easiest violations to identify. Updating the document before receiving a notice is significantly more efficient than scrambling to adjust within 30 days.

## How AdOpt supports compliance with the VCDPA

AdOpt ensures that what is written in the Policy has real correspondence with what actually happens on the site.

The automatic scan identifies all active technologies, feeding the list of data categories and third parties that must appear in the document. The [consent management platform](https://goadopt.io/en/blog/how-to-choose-cmp-consent-management-platform/) ensures the consent and opt-out mechanism works exactly as described.

Every consent interaction is logged. If the Attorney General requests evidence, the record is available.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Privacy Policy for your site that complies with the VCDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what the Privacy Policy must contain for the VCDPA

**Visible and accessible link** on all pages of the site.

**Categories of personal data processed**, with specific descriptions (Va. Code § 59.1-578 C, 1).

**Purpose of processing** for each category, without vague descriptions (Va. Code § 59.1-578 C, 2).

**How to exercise each right** guaranteed by the VCDPA, with process, channel, and 45-day response deadline (Va. Code § 59.1-578 C, 3).

**Appeal process** described with a 60-day deadline and information about contacting the Attorney General (Va. Code § 59.1-577 C).

**Categories of data shared with third parties** (Va. Code § 59.1-578 C, 4).

**Categories of third parties** that receive data (Va. Code § 59.1-578 C, 5).

**Disclosure of targeted advertising or data sale** with accessible opt-out (Va. Code § 59.1-578 D).

**Request submission mechanism** described, without requiring a new account (Va. Code § 59.1-578 E).

**Identification of sensitive data** and how prior consent is obtained (Va. Code § 59.1-578 A, 5).

**Protection of minors on social media platforms** for businesses operating those services (Va. Code § 59.1-577.1, effective Jan 2026).

**Non-discrimination policy** for consumers who exercise their rights (Va. Code § 59.1-578 A, 4).

**Free service up to twice per year** per consumer (Va. Code § 59.1-577 B, 3).

## FAQ: VCDPA and Privacy Policy

**1. Does the VCDPA require a document specifically called a "Privacy Policy"?**
The law requires a privacy notice that is reasonably accessible, clear, and meaningful, under Va. Code § 59.1-578 C. In practice, it is the Privacy Policy. What the law defines are the five mandatory content categories the document must cover.

**2. Does the Privacy Policy need to mention Data Protection Assessments?**
It does not need to publish the content of assessments, which are confidential. But it is advisable for the Policy to mention that the business conducts Data Protection Assessments for high-risk activities as part of its compliance commitment. The Attorney General may request the assessments via civil investigative demand (Va. Code § 59.1-580 D).

**3. How many times per year is DSAR processing free of charge?**
Twice per year per consumer, under Va. Code § 59.1-577 B, 3. This differs from the NHDPA, which provides free service only once per year. From the third request within the same 12-month period, the business may charge a reasonable fee or decline if the request is manifestly unfounded, excessive, or repetitive, provided the business demonstrates the excessive nature.

**4. What happens if the business does not have a compliant Privacy Policy when it receives an Attorney General notice?**
The Attorney General sends notice with 30 days to cure (Va. Code § 59.1-584 B). If the business fails to implement the required elements within the deadline or breaches the written correction statement provided, the AG may seek penalties of up to US$ 7,500 per violation. Each consumer affected can be counted as a separate violation, which escalates the financial exposure quickly.

**5. How does the VCDPA treat teenager protection for ages 13 to 15?**
The VCDPA does not have a specific protection for this age range in the general law framework, unlike the NHDPA. For children under 13, COPPA applies. Protection for teenagers aged 13 to 15 appears only in the specific section for social media platforms (Va. Code § 59.1-577.1), where "minor" is defined as any person under 16, with a 1-hour daily usage limit and verifiable parental consent requirements.

[Ready to build a Privacy Policy for your site that complies with the VCDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


All posts