Is there an ideal and _foolproof_ Privacy Policy?

This is one of the most difficult questions to answer nowadays. Especially considering all the jurisprudence already established in Europe with the GDPR, the extensive history of cases, and the numerous tips we see in the market. Not to mention the judicial decisions that are already emerging in Brazil with the LGPD.

I'll answer you promptly: No. And I'll help you understand why.

I believe it is possible to develop a line of reasoning that can assist each one of us entrepreneurs, DPOs, lawyers, third-party consultants, etc. Ultimately, everyone can have a clear understanding of how the game works to avoid being caught off guard.

Below is the logic behind a privacy policy and some principles to help you understand the game. Perhaps even assist you in adapting your company and addressing any doubts that may arise along the way.

What makes a privacy policy better or worse?

To be as straightforward as possible: Does it accurately reflect the reality of data usage and flow within the company?

Here is the key to understanding any privacy policy: It must truthfully reflect the motivations and data flow in the company's routines.

Therefore, before we evaluate the quality of a privacy policy, it is essential to understand why it exists and its purpose. Is it becoming clearer?

In a simple and direct manner, I would highlight that a company's privacy policy is:

A public declaration of the objectives, interests, and responsibilities that companies have regarding the use and application of data, especially personal data, for the execution of their business model.

In other words, the guidelines provided in the privacy policy give us a real understanding of how that business operates regarding data usage and the actual commercial and/or legal purposes for which the data is used.

What do I need to know and map out to create my Privacy Policy?

In essence, it is not possible to structure a privacy policy without understanding the foundations of the business. Don't worry, I'm not complicating things for the sake of it, but rather showing you that without this knowledge, even a lawyer charging thousands of dollars per hour won't be able to assist you.

By the way, a good piece of information for you is that the privacy policy does not necessarily need to be written by a lawyer or in "legalese." According to the LGPD, before anything else, it must be clear, educational, and easily readable for the data subject.

So, whether it's you, your lawyer, or anyone who understands the processes, purposes, or legislation of your market, it's all good. Prioritize readability, clarity, and the ability for any visitor or customer accessing your platforms to understand and interpret the information.

However, it is worth noting that we recommend at least seeking advice from a lawyer. There are certain criteria and potential complexities in the market that they can assist you with more adeptly. For example, the healthcare industry has specific legislation that already treats patient data differently, and therefore, it may sometimes supersede LGPD requirements.

We are in Brazil, my friend, so, as usual, everything depends on the specific circumstances.

Anyway, let's go through the essential points you need to know to create any privacy policy. Points such as:

1. ### Corporate structure;

2. ### Market sector;

3.### Relevant laws governing the activities of players in the market;

4.### Product and/or service portfolio;

5.### Revenue streams and distribution channels;

6.### Basic understanding of the company's organizational structure;
(Headquarters and branches, size, number of departments involved, decision-making hierarchy, etc.)

7.### Supply chain;

8.### Sales and after-sales service;

9.### Communication channels;
...

Without this initial detailed understanding, the privacy policy will be incomplete and consequently flawed.

For example, what good does it do if I state that I use data on Facebook, collect addresses, emails, and CPF (Brazilian individual taxpayer registry number) for signing up for my plan and for email marketing, with data disposal in case of opt-out, if there is a legislation in my market that requires me to store this data beyond the data subject's requests?

I believe it is clear now how much information we need to consider. However, this should not discourage you! In fact, it is precisely the knowledge of these processes, or in other words, the understanding of the entire operation, that will give you greater confidence to determine whether the privacy policy is "good" or not. Again, it must reflect the reality and day-to-day operations of the company.

One of the tools/processes that can help you confidently structure the privacy policy is Data Mapping. If you don't have one yet or haven't considered implementing it, I'll summarize it for you in the link below.

Data Mapping: The Life Jacket for LGPD


What is the ideal privacy policy for your company?

João Bruno Soares

Ignoring Terms of Use and their importance within a website, especially now with the [LGPD](https://goadopt.io/en/blog/lgpd-general-data-protection-law/), is a common error that both consumers and website owners often make.

Consumers tend to disregard them, while website owners often simply copy them from other sites and overlook the key points.

After all, who wants to waste time reading these documents or thinking about their development, right? Wrong! Of course, reading them doesn't promise a literary delight, I know that much.

However, it is necessary to ensure the safety of both the user and the page owner. It's not for nothing that they are present in most of those ubiquitous [cookie banners](https://goadopt.io/en/blog/why-are-cookie-banners-everywhere/) out there...

So, don't waste any more time and read below to learn everything about them and how Terms of Use have become essential in the era of LGPD.

## Terms of Use: What are they?

Terms of Use correspond to a document that provides detailed information about how a website functions, the contracting of services/products offered (or the use of information present), and the limits of responsibilities for both parties.

In essence, it's a textual document containing rules for the operation and use of the website and its services. These services can be commercial, informational, service-oriented, and so on.

Terms like Terms of Use, LGPD, [Privacy Policies](https://goadopt.io/en/blog/what-is-a-privacy-policy/), data collection... there are so many terms that come up in discussions about data protection and website obligations that navigating the internet now requires a dictionary and a degree.

```markdown
Calma, mesmo que você já seja o [Encarregado de Dados](https://goadopt.io/en/blog/responsibilities-of-a-data-protection-officer/) do seu site, por livre espontânea pressão, estamos aqui para te ajudar! :D

Mas você não precisa disso tudo para entender como esses termos conversam e qual é a importância deles. Hoje veremos de forma simples e sem complicações que exijam termos técnicos sobre o assunto.

## And what are Terms of Use for?

Terms of Use serve as a contract!

Can you imagine signing a contract without reading it in advance? Or even copying any contract that concerns rules meant to protect you, without knowing if they apply to your case?

Well, that's why ignoring Terms of Use is no longer an option. In fact, it's a major irresponsibility, let's admit it.

It serves to establish rules for users or customers to use the website or platform. In other words, when you accept the terms, you accept the conditions set by the page. When you make a purchase on an e-commerce site, you're following the rules imposed there.

Of course, this document also follows rules like the Consumer Protection Code, but in general, the contract is imposed by the website. Therefore, it's the website's responsibility to develop it with quality, transparency, and accessibility (easy readability).

Similarly, it's the visitor's responsibility to read the terms, and if they don't agree with them, they should leave the site or stop using it. After all, if they agree, they should adhere to its limits (provided they're not abusive, but that's a legal matter).

In summary, Terms of Use serve to establish the limits of website use, its responsibilities, the correct use of services, the duties and rights of each party, and what is offered there.

It's also worth noting that each type of Terms is different. After all, a news website doesn't offer the same services (nor does it have the same responsibilities) as a page that sells products.

Therefore, thinking about this document is always very important for website owners. Similarly, it's important for you, the reader, as it indicates your rights and duties.

## What's the relationship between Terms of Use and LGPD?

Terms of Use are part of the transparency that websites owe to their visitors and users. They go hand in hand with Privacy Policies. These indicate how the treatment, collection, and security of data that may be collected there are carried out.

And it's precisely these documents that formalize the central themes of the [LGPD, the General Data Protection Law (in Portuguese)](https://goadopt.io/blog/lgpd-lei-geral-de-protecao-de-dados/). It is recent and came into effect in August 2020.

Therefore, more than ever, it's essential for websites to pay attention to the need to develop these documents that affect the privacy and rights of consumers/visitors in accordance with LGPD. Otherwise, they risk receiving significant penalties. Among these, quite significant fines.

Although many websites choose to present them in a single document, it is of paramount importance that they are available on the website in separate and unique documents. In other words, one for the Terms of Use and another for the Privacy Policy.

While the Terms of Use limit the use of data and services available there, responsibilities of the parties, rights, duties, and intellectual property, Privacy Policies provide information on the treatment and collection of data from users and visitors.

## How to develop the Terms of Use for my website?

When creating the Terms of Use in accordance with LGPD, there are some essential considerations.

Firstly, although the Terms of Use correspond to a contract for the use of the website and its services, it does not require legal language. In fact, the clearer it can be, the better!

After all, it's essential for all visitors to be able to understand the terms presented, as they relate to their rights and duties in using the page. Therefore, remember to keep it simple.

Another issue concerns the specificity of the terms. Remember that we mentioned the (terrible) habit of some websites that simply copy the Terms of Use from others? Well, that's wrong precisely because this document should relate specifically to what each page offers.

For example, an informational website, an e-commerce website, and one that offers online calculation tools will each have specific and different Terms of Use. Even among e-commerce websites, this varies.

Another point to consider is the LGPD's delineations regarding the roles of [Data Controller and Data Processor](https://goadopt.io/en/blog/differences-data-controller-data-processor/). This is because these roles can often be confused or even inverted during the provision of services.

After all, they must contain information about the types of products they sell, the data required for purchase, among other issues that are extremely unique to each business.

Finally, remember that the Terms of Use must include, in addition to the delineation of services, limitations of responsibilities and obligations, as well as copyright and industrial property statements.

With all of this, it is possible to ensure LGPD-compliant, secure, clear, and complete Terms of Use! If you want, you can use the [AdOpt Terms of Use](https://goadopt.io/termos-de-uso) as a reference.

## Want to delve deeper into the subject?

We have another article that helps you with [tips for when you need to update your Terms](https://goadopt.io/en/blog/notification-to-users-terms-of-use/).



What are Terms of Use and their importance for the LGPD?

ROPA in LGPD? Get to Know the Records of Processing Activities

The [LGPD - General Data Protection Law](https://goadopt.io/en/blog/lgpd-general-data-protection-law/) brought with it several acronyms and specific terms. Many of them imported from other countries and legislations. One of them is ROPA (Record Of Processing Activities), adapted in Brazil to _Registros das Atividades de Tratamento_. An essential document for any DPO, Data Processor.

If you work in the field or are in the process of adapting your company, this article was made to help you better understand this document.

ROPA (_Record Of Processing Activities_), is nothing more than a document that organizes the company's official records about:

- **How data collection is done**, its processes, and activities;
- **What is done with the data**, if there is any processing or sharing;
- **How data is deleted**, if applicable.

In other words, the essential questions and answers in case of consultation by the ANPD - National Data Protection Authority, to your company. Below, we'll discuss each of these points in more detail.

It's worth noting that all documents and processes mapped by the company's Data Processor are "living," constantly being updated and changed. A new process created in department X can change the ROPA, the [Privacy Policy](https://goadopt.io/en/blog/ideal-privacy-policy/), and many other controls.

So, regardless of the size of your company, documents should always reflect reality and be constantly updated.

Smaller companies may not feel the need or complexity of keeping these "Mapping of flows" updated, after all, everything is smaller and involves fewer people. Now, for a larger company, there are already software solutions that help with this control in a more automated way, such as [LGPDNOW](http://lgpdnow.com.br/), for example.

## What is ROPA?

ROPA (_Record Of Processing Activities_), translated by the Brazilian market to Records of Processing Activities, is an official document of companies, generated by a system or not, that records all flows, processing, and activities involving personal data.

In it, mainly list all the purposes and reasons why the company needs that data(s) for its operation, legal basis ([Legal Basis](https://goadopt.io/en/blog/legal-bases-of-lgpd/)), security criteria, data storage/retention period.

## Is ROPA the Same as Data Mapping?

The easy answer is: _it depends_.

[Data Mapping or Data Inventory](https://goadopt.io/en/blog/data-mapping-or-data-inventory/) functions as a visual map of the flow of personal data within the Data Controller, bringing much more than ROPA, such as system and international transfer maps, ISO compliance parameters, NIST, among others.

On the other hand, ROPA focuses on activities involving data processing. In a more structured company, it may happen that a Data Mapping contains some ROPAs as part of it.

In any case, recording activities is an essential part of both documents. The perspective and methodology applied in each can be their differential.

## What Should a ROPA Include?

According to the [ICO (Information Commissioner’s Office), a ROPA must include at least:](https://ico.org.uk/for-organisations/accountability-framework/records-of-processing-and-lawful-basis/#requirements)

- Name and contact details of your organization, whether it's a controller or a processor (and where applicable, the joint controller, its representative, and the DPO);
- The purposes of processing;
- A description of the categories of individuals and personal data;
- Categories of recipients of personal data;
- Details of transfers to third countries, including a record of the safeguards in place for the transfer mechanism;
- Retention/storage times;
- A description of the technical and organizational security measures in place.
- If you have an internal record of all processing activities carried out by any processor on behalf of your organization.

### ### Questions the ROPA Should Answer

- Have you considered the effectiveness of your accountability measures?
- Would staff say you have effective processes to keep the record up-to-date, accurate, and ensure data is minimized?
- Could staff explain their responsibilities and how they carry them out in practice?

## Best Practices for a Good ROPA.

Also, according to the [ICO (Information Commissioner’s Office)](https://ico.org.uk/for-organisations/accountability-framework/records-of-processing-and-lawful-basis/#requirements), ROPA also includes or links to documentation covering:

- Information needed for privacy banners, such as the legal basis for processing and the source of personal data;
- Consent records;
- Controller-processor contracts;
- The location of personal data;
- DPIA reports;
- Records of personal data breaches;
- Information needed for processing special category data or criminal conviction and offense data under the Data Protection Act 2018 (DPA 2018); and
- Retention and deletion policy documents.

### Questioning for the creation of your ROPA

- Have you considered the effectiveness of your accountability measures?
- Do staff understand how to access other relevant documents linked to the ROPA?
- Is it easy for staff to access relevant documentation from the ROPA?
- Could staff explain this process and how it impacts their role?

## How to Create a ROPA for LGPD?

A good example for those starting out or with a smaller company is to use spreadsheets for this control and organization.

In addition, on the [gov.br website, there are various guides and templates to help you comply with LGPD.](https://www.gov.br/governodigital/pt-br/seguranca-e-protecao-de-dados/guias-operacionais-para-adequacao-a-lei-geral-de-protecao-de-dados-pessoais-lgpd)

For larger companies that need to structure these processes better, a privacy management and data mapping platform can be very helpful!

That's why we recommend that you schedule a meeting with the [LGPDNOW](http://lgpdnow.com.br/) team for a no-obligation conversation to see how they can help you develop your ROPA for LGPD.

Templates and models imported from other companies can be very helpful. But it's essential that you can clearly and objectively translate the reality of your company.

Every time we are faced with the complexity of justifying and basing the collection of data, we should always prioritize privacy throughout all processes, as taught by [Privacy by Design](https://goadopt.io/en/blog/what-is-privacy-by-design/).

## How Can AdOpt Help with ROPA?

According to the recommendations of the ICO listed above, AdOpt's LGPD Platform helps you map and organize:

- [Cookie Banner](https://goadopt.io/en/blog/how-to-choose-a-cookie-banner-for-your-website/) within ICO, LGPD, GDPR, CCPA standards.
- Records of all written consents; (organized by user with date, time, and details of each consent.)
- API Integration with your other platforms to enrich the collected data with the consent information recorded.
- And more, depending on the size of your company.

We're here to help!

So, in this [link](https://meetings.hubspot.com/murilo-andrade/adopt-meeting1-murilo), our calendar is open to discuss your business's adaptation challenges.


ROPA in LGPD? Get to Know the Records of Processing Activities.

A privacy policy is a document that outlines how an organization collects, uses, discloses, and manages a customer's data. It's essential for building trust with users and complying with legal requirements.

While it's not exactly breaking news, discussions about privacy policies have been popping up more frequently since the start of GDPR (General Data Protection Regulation) in Europe in 2018. And despite it seeming coincidental, it's not!
After all, this term is directly linked to several other regulations that came into effect since then. However, if you're not familiar with it, don't worry as we're here to help you.

Below, you'll find everything about this type of policy, how it works, and its importance. Also, take the opportunity to learn how to develop one for your company and thus, comply with the legislation that's already in effect in your country or even, state.
## Why is a Privacy Policy Important?

Privacy policies are crucial for compliance with various global privacy laws, such as [GDPR](https://goadopt.io/en/blog/gdpr-cookies-explained/), [CCPA](https://goadopt.io/en/blog/gdpr-lgpd-and-ccpa-what-are-these-laws-similarities-and-differences/) (California Consumer Privacy Act), and [LGPD](https://goadopt.io/en/blog/anpd-cookies-guidance-personal-data-protection-lgpd/) (Brazilian General Data Protection Law).
They help protect consumer data and ensure transparency in data handling practices. By clearly explaining how your company manages data, you can foster trust and demonstrate your commitment to privacy.

It's time for you to understand once and for all what these terms are and why you shouldn't ignore them when visiting a website! After all, your security and your data's security are at stake. Want to understand how? Read on!

### Applications of a Privacy Policy

Privacy policies apply to the online and offline environment and concern the protection of your data. In general terms, they correspond to a company's statement regarding how it handles your information, and now, with all these new regulations blooming, specifically, your personal data.

But how is that so? Well, your online and offline activities leave traces… You fill up forms to win "free gifts"on hotels and restaurants, subscribing to newsletters; sounds familiar?

That is all personal data that stores, websites and social networks store, generating information about you. Similarly, these are recorded by CRM systems, or mostly in your browser. However, this can't happen inadvertently because merely "browsing these environments" already generates data and, consequently, personalized data collection.

In other words, the legislation protects us citizens from companies simply collecting information and using it as they see fit. Of course that the online environment favors its applications, but, nonetheless all data collection must be considered.

This, in fact, is the focus of all regulations like [GDPR](https://goadopt.io/en/blog/gdpr-cookies-explained/), [TDPSA](https://goadopt.io/en/blog/texas-tdpsa-and-cookies-all-you-need-to-know/), CCPA, LGPD. This makes it even more evident that a website should have an easily accessible privacy policy that formally organizes this information.

First and foremost, data collection can only occur with the user's explicit authorization. Whether through express consent or other [Legal Basis](https://goadopt.io/en/blog/gdpr-legal-basis/) that support data collection by the company. Therefore, you are a key player in determining what information can be collected, stored, and eventually be used.

> **Here's a significant gain provided by Privacy Regulations for all citizens - the power to exercise their rights of access or restriction to anything related to their personal data. Citizens can now actively participate in the decision, freely and protected by the law.**

However, it doesn't stop there!

According to most laws, companies are not only responsible for collecting data within the visitors' will when they visit their websites, installations or networks.

They must also clearly demonstrate how they store and for what purposes they use such data. After all, they belong to someone! Their use must align precisely with their intended purpose, ensuring that the information is not misused or leaked, which could lead to serious problems.

## Privacy Policy and cookies, are they related?

Before we dive into how this policy affects you and how to write a good one, let's clarify something. Many people confuse cookies and such policies. Although they are closely related, they are not synonyms.

Remember the data we mentioned earlier, the focus of the privacy policy? Well, some of it is collected through cookies! After all, the website needs to know which data you've given permission to access. Similarly, it needs to know what "marks" it can leave in your browser.

These data are usually collected for commercial or digital marketing purposes, i.e., for promoting products and services online. However, they also often contribute to navigation and the visitor's experience.

But how does this work? You've probably visited websites where you're already registered, and when you do, you see your login and password automatically filled in. This is nothing more than the action of these "marks" on your browser.

The same thing happens when you look at a product, think about it, and leave it in your online cart. It probably kept following you after that, right? Whether through advertisements on social networks or on websites, it surely didn't stop appearing.

Again, we have the action of cookies, which provide access information to web pages. Therefore, as they relate to personal data, Privacy Regulations care about them.

So, where does the privacy policy come in? Well, it's precisely the information that the website provides to the visitor about how it handles data, how it stores and secures it, and its intended use. Both for data that enables direct identification - i.e., data that directly identifies the individual (Name, Email, ID, Tax ID, etc.), and indirect data that, when combined, can lead to an individual (IP, Address, Position, Profession, etc.).

**In other words, the policy acts like a code of conduct.**

It's important because it's a public commitment by the website to the visitor. By having it, the site assumes a responsibility that must be strictly followed.

## Key Elements of a Privacy Policy

Now that we know more about privacy policies, data collection, cookies, and how regulations has made them so important, the question arises: how to create a high-quality policy? This is a crucial issue if you have a website, regardless of its purpose.

### Use simple and clear terms
First and foremost, it's crucial that the terms are clear. Avoid using legal jargon and opt for simple language. This ensures that users can easily understand how the website handles their data and reduces the likelihood of them being overlooked.

Leaving no room for doubts or suspicions is crucial and also helps in building the page's image. So, remember to adopt a simple and very clear language.

### Types of Data Collected
Your privacy policy should clearly list the types of data your organization collects. This includes:

- **Personal Information**: This can be anything from names and dates of birth to location data. It's the kind of data that can identify an individual.

- **Technical Data**: Information like IP addresses, browser types, and device details fall into this category. These are used to improve user experience and ensure site functionality.

>#tip Always check your local official regulatory documents. and look for their definition of Personal Data and mainly the Sensitive Data. It should not vary from country to country, state to state, but it is always good to have it double-checked. Because, you may find different guidelines for specific cases and market applications.

__________________________________________
Interested in learning how AdOpt can help your business' privacy policy? [Schedule a demo](https://meetings.hubspot.com/murilo-andrade/adopt-meeting1-murilo) with our specialist today!

### Methods of Data Collection
Explain how you collect data from your users. Common methods include:

- **User Entries**: Data provided directly by users, such as filling out forms or creating accounts.
- **[Cookies](https://goadopt.io/en/blog/gdpr-cookies-explained/) and other Tracking Technologies**: These are small files stored on users' devices that track their activity on your site. They help in personalizing user experience and improving website functionality. (LocalStorage also counts as a tracker…)

### Purpose of Data Usage
It's important to be transparent about why you're collecting data. Typical purposes include:

- **Marketing**: Using data to create personalized ads or email campaigns.
- **Service Functionality / Performance**: Enhancing user experience by remembering preferences and login details.
- **Analytics**: Understanding user behavior to improve site performance and content.

Ps.: Once you have a Cookie Banner with all your tags/cookies correctly categorized, you should reply the same categorization scheme from the policy to the banner.

### Data Sharing Practices
Detailing your data sharing practices helps users understand who else might have access to their data. This includes:

- **Third-Party Partners**: Data shared with advertising networks or analytics providers.

- **Service Providers**: Companies that host your website or provide customer support services.

Ps.: Some companies create a separated document with all third-party Sub-processors that may interact with user data. [Here is AdOpt's](https://goadopt.io/en/support/faq/other/adopt-sub-processors/), to help you understand this stage.

### Data Protection Measures
Assure your users that their data is safe by explaining your security measures. This can involve:

- **Storage Locations**: Where and how data is stored, such as in secure data centers or cloud services.

- **Security Protocols**: Measures like encryption and access controls to protect data from unauthorized access.

### User Rights and Opt-Out Options

Every regulation determines guidelines for DSARs or DSRs which stands for Data Subject Access Request, or simply Data Subject Request. So, make sure you always check your local official regulatory documents! Look for their definition and guidelines for User Rights.

Mainly because they may vary depending on how the request is made, the mandatory time to respond depending on the company size, parallel regulations, etc. In short, all DSRs can be compiled into two main categories:

Data Opt-Out / Deletion
Data Access / Download.

For both of these cases you need to give Instructions on how users can ask for their data to be deleted. And, if needed, the steps for opting out of [cookies](https://goadopt.io/en/blog/why-are-cookie-banners-everywhere/) and other tracking technologies.

### Effective Date and Updates
Your privacy policy should include:

- **Effective Date**: When the policy takes effect.
- **Policy Updates**: How users will be informed about any changes to the policy.

This is important because it will guide the way a company may change certain data processing over time.

For example, if you gave consent to a policy, prior to a major change, like a new advertising provider selected to run the ads and marketing. Do you agree that you shouldn't receive any ad from this company?  Therefore, the company's campaign public should have a segregation, actionable data collected "prior to" and "after" the change date.

### Provide complete and informative information

Another essential aspect when developing a privacy policy is to provide complete information. In other words, don't leave anything out and provide a full understanding of what's being done with the data and how it's being handled.

Among the essential pieces of information are:

- Information about the company behind the website;
- Data collection sources;
- Data usage (purpose);
- Cookie policies;
- Information about visitor's rights;
- Storage duration.

You might wonder, with the list above, how do I identify all this? Where do I start? The simplest answer would be to understand that the Privacy Policy is the result of a series of other readings and data mappings you should go through to write it more securely.

[Data Mapping or Data Inventory, the DPO's Lifesaver](https://goadopt.io/en/blog/data-mapping-or-data-inventory/)

[Is there and Ideal Privacy Policy for Your Company?](https://goadopt.io/en/blog/ideal-privacy-policy/)

## How to Create a Privacy Policy
Creating a comprehensive privacy policy can be daunting, but there are tools to help:

- **Templates and Generators**: Many online tools can help you draft a privacy policy. But, please make sure you can edit the final text with a more concise and tailored version reflecting your business details.

- **Legal Consultation**: It's wise to consult with legal experts to ensure your policy complies with all relevant laws.

- **Customizing for Specific Needs**: Tailoring the policy to fit your business practices and specific data handling processes.

- **Keep it updated**:  A Privacy Policy must evolve with the business so that it reflects all process changes and needs.

## Common Privacy Policy Mistakes to Avoid
To maintain compliance and build user trust, avoid these common pitfalls:

- **Vague Descriptions**: Be clear and transparent about your data practices.

- **Ignoring Updates**: Regularly update your policy to reflect any changes in data handling.

- **Non-Compliance**: Ensure your policy meets all legal requirements and industry standards.

- **Legalese**: Ensure your policy is written using simple terms in order to increase acceptance and comprehension.

## Privacy Policy Jurisdictions and Enforcement
Understanding the legal landscape for privacy policies is essential as it varies across different regions. Here's a breakdown of key jurisdictions and their enforcement:

### United States
In the United States, privacy regulations can be complex due to the mix of federal and state laws:

- **Federal Laws**: The Health Insurance Portability and Accountability Act (HIPAA) protects medical information, while the Children's Online Privacy Protection Act (COPPA) safeguards the privacy of children under 13.

- **State Laws**: States like California have implemented robust privacy laws such as the California Consumer Privacy Act (CCPA). Other states have their own specific regulations that businesses must comply with, making it essential to be aware of the laws relevant to each state where you operate.

In the articles below we can help you understand some of the new local state regulations.

- [Texas TDPSA: All you need to know.](https://goadopt.io/en/blog/texas-tdpsa-and-cookies-all-you-need-to-know/)
- Florida
- Colorado
- Oregon

### European Union
The European Union has some of the strictest data protection regulations in the world:

- **[GDPR](https://goadopt.io/en/blog/gdpr-cookies-explained/)**: The General Data Protection Regulation (GDPR) applies to all EU citizens and imposes stringent requirements on how businesses collect, store, and manage personal data. It mandates transparency, user consent, and gives individuals significant control over their personal information. Non-compliance can result in heavy fines.

### Other Regions
Countries outside the US and EU also have their own privacy laws that businesses need to be aware of:

- **Australia, Canada, India**: Each of these countries has established privacy regulations that require organizations to handle personal data responsibly. For instance, Australia has the Privacy Act, Canada has PIPEDA (Personal Information Protection and Electronic Documents Act), and India is working on its own data protection bill. Staying informed about these laws ensures global compliance and fosters trust with users from these regions.

### Schedule a Demo

Interested in learning how AdOpt can help your business' privacy policy? [Schedule a demo](https://meetings.hubspot.com/murilo-andrade/adopt-meeting1-murilo) with our specialist today!

## FAQ: What is a Privacy Policy?

### What is privacy in simple words?
Privacy, simply put, is the right to be left alone or free from intrusion. Specifically, information privacy entails having some control over how your personal information is collected and used.

### What is the standard privacy policy?
A standard privacy policy is a document that outlines how your website collects, uses, shares, and protects personal information. It must adhere to specific legal requirements depending on applicable laws.

### How to create a privacy policy?
Creating a privacy policy involves drafting it in clear, understandable language. Regular updates to reflect legal changes, business modifications, or protocol adjustments are essential. Users should be informed of updates, including an effective date with the policy.

### What is the GDPR privacy policy?
Under the GDPR, data processing must adhere to principles of fairness, accountability, and specific purposes outlined in your privacy policy. Only necessary data should be collected, and transparency is paramount.

### What do you write in a privacy policy?
A comprehensive privacy notice should include your contact details, types of collected personal data, sources of data, purposes of data usage, lawful basis, data sharing practices, data retention duration, and disposal methods.

### Can I write my own privacy policy?
Yes, you can craft your own privacy policy using templates. Legal expertise isn't mandatory, but ensuring all necessary clauses regarding data handling are included is crucial.

### How do you manage privacy policy?
Practical tips include designing products/services to minimize privacy risks, publicly sharing a privacy policy, collecting de-identified data where possible, obtaining consent for new data uses, and facilitating easy contact for privacy inquiries.

### How to improve privacy policy?
To enhance your privacy policy, make it business-centric, specific, and meaningful. Address more than just cookies, provide privacy choices, facilitate access, update information regularly, ensure ease of contact, and use plain language for clarity.

### What is this privacy policy?
A privacy policy elucidates how personal information collected through mobile apps or websites will be used. It serves as a legal document, sometimes called a privacy statement or notice, safeguarding both company and consumer interests.

### What happens if you don't have a privacy policy?
Companies without a privacy policy risk fines from government agencies and potential lawsuits from customers feeling their privacy have been violated.

### What is the ISO for privacy?
ISO/IEC 27701 provides a framework for managing data privacy, also known as a privacy information management system. It ensures compliance with privacy standards.

### What is the privacy policy specification?
A privacy policy outlines how a company processes and safeguards personal data collected. It should include clauses on data collection, processing, and protection measures.

### What are the 7 main principles of GDPR?
The seven main principles of GDPR are: Lawfulness, fairness, and transparency; Purpose limitation; Data minimization; Accuracy; Storage limitation; Integrity and confidentiality; and Accountability.

### What is the difference between GDPR and privacy?
Unlike the GDPR, other privacy laws may not include provisions for sensitive data, pseudonymized data, automated processing, or clear definitions of data processing types falling under their scope.



What is a privacy policy?

Texas TDPSA and Cookies: All You Need to Know

Florida FDBR and Cookies: All You Need to Know

Oregon passed a privacy law with at least three characteristics you will probably not find in any other US state legislation.

The Oregon Consumer Privacy Act (OCPA), ORS 646A.570 to 646A.589, took effect on **July 1, 2024**. Developed by the Attorney General's Consumer Privacy Task Force with more than 150 experts involved, and signed by Governor Tina Kotek.

In the first year of enforcement: 214 complaints received, 38 investigations opened. Enforcement is real.

## What is the OCPA?

The OCPA is Oregon's state personal data protection law. It grants rights to state residents and creates obligations for businesses that process their data.

Enforcement is the exclusive responsibility of the **Oregon Attorney General**. There is no private right of action.

## When did the OCPA take effect?

On **July 1, 2024**.

Two important changes came into force on **January 1, 2026**: the obligation to honor universal opt-out signals such as the Global Privacy Control (GPC), and the elimination of the 30-day cure period. From that date, the Attorney General can act without prior notice.

## Who needs to comply with the OCPA?

Under Section 2(1) of the law, it applies to persons that conduct business in Oregon or produce products or services targeted to state residents and that, during a calendar year:

Control or process personal data of at least **100,000 consumers**, excluding personal data controlled or processed solely for the purpose of completing a payment transaction.

Or control or process personal data of at least **25,000 consumers** while deriving **25% or more** of annual gross revenue from selling personal data.

Three points that distinguish the OCPA from virtually all other state laws:

**The payment transaction exclusion from the 100K threshold:** data processed exclusively to complete payments does not count toward the 100K threshold. This is different from other laws that do not make this exclusion.

**The 25% revenue threshold:** most state laws use 50% of revenue from data sales. The OCPA uses 25%, making the second criterion easier to reach.

**The inclusion of derived data in the definition of personal data:** profiles created from the consumer's data are also personal data under the OCPA. This directly impacts the scope of access and deletion requests.

Understanding the distinction between [controller and processor](https://goadopt.io/en/blog/responsibilities-of-a-data-protection-officer/) is fundamental to defining responsibilities in the processing chain.

### OCPA Exemptions

Under Section 2(2), the following are exempt:

Government entities and public corporations of Oregon, including Oregon Health and Science University and the Oregon State Bar.

Protected health information processed by covered entities or business associates under HIPAA.

Information used solely for public health purposes.

Clinical research data regulated by federal standards.

Data processed solely in the context of employment, contractual relationships with business entities, or employer benefits.

Data regulated by the Fair Credit Reporting Act, Gramm-Leach-Bliley Act, FERPA, and Airline Deregulation Act (within each law's limits).

Financial institutions and their affiliates engaged solely in financial activities.

Insurers, insurance producers, and insurance consultants.

Non-profit organizations established to detect and prevent insurance fraud.

Non-commercial activities of press outlets and licensed radio and TV broadcasters.

### Two recent additions

As of **July 1, 2025**, non-profit organizations under section 501(c)(3) of the Internal Revenue Code became subject to the OCPA.

As of **September 26, 2025**, all auto manufacturers that collect personal data from Oregon consumers are subject to the law regardless of thresholds.

## What is personal data under the OCPA?

Under Section 1(13), personal data means data, **derived data**, or any unique identifier linked to or reasonably linkable to a consumer or to a device that identifies, is linked to, or is reasonably linkable to one or more consumers in a household.

De-identified data and data lawfully available through government records or widely distributed media are excluded.

The explicit inclusion of derived data is a key differentiator of the OCPA. Marketing profiles, behavioral scores, and audience segment classifications created from consumer data are personal data under the law.

## What is sensitive data under the OCPA?

Under Section 1(18), sensitive data includes:

Data revealing racial or ethnic background, national origin, religious beliefs, mental or physical condition or diagnosis, sexual orientation, status as transgender or nonbinary, status as a crime victim, or citizenship or immigration status.

Personal data of children under 13.

Precise geolocation data within a radius of **1,750 feet** (approximately 533 meters).

Genetic or biometric data.

Sensitive data cannot be processed without explicit consumer consent, per Section 5(2)(b) of the OCPA.

## What are consumer rights under the OCPA?

The Oregon Department of Justice created the **L.O.C.K.E.D.** acronym to summarize the rights guaranteed by Section 3(1) of the OCPA:

**L (List):** obtain a list of the specific entities to which the controller disclosed their personal data, or a list of any personal data disclosed.

**O (Opt-out):** refuse processing of data for targeted advertising, sale of personal data, and profiling for decisions with legal effects or effects of similar significance.

**C (Copy):** obtain a copy of all personal data the controller has processed, in a portable and readily usable format where technically feasible.

**K (Know):** confirm whether the controller processes or has processed their data and which categories are involved.

**E (Edit):** correct inaccuracies in personal data, taking into account the nature and purpose of processing.

**D (Delete):** request deletion of personal data, including data provided by the consumer, obtained from other sources, and derived data.

The controller has **45 days** to respond (Section 4(5)(a)). The deadline may be extended by an additional 45 days when reasonably necessary, with notification within the initial period.

Response is **free once** per 12-month period per consumer. For subsequent requests within the same period, the business may charge a reasonable fee, except when the request verifies compliance with a prior correction or deletion (Section 4(5)(c)).

### Right to appeal

Section 4(6) requires the controller to establish an appeal process. It must be conspicuously available, similar to the original submission method, and result in a written response within **45 days** with the decision and reasoning.

If the appeal is denied, the notice must provide information enabling the consumer to contact the Attorney General.

## Consent: what the OCPA requires

Under Section 1(6), consent is an affirmative act by which the consumer clearly and conspicuously communicates freely given, specific, informed, and unambiguous agreement. The interface may not have any mechanism with the purpose or substantial effect of obtaining consent by obscuring, subverting, or impairing the consumer's autonomy and decision-making. And inaction does not constitute consent.

The correct standard for cookies: non-essential technologies off by default. The user chooses what to enable, not what to disable.

## Controller obligations under the OCPA

Under Section 5, the controller must:

Specify in the privacy notice the express purposes for collecting and processing personal data.

Limit collection to what is adequate, relevant, and reasonably necessary for the declared purposes.

Implement reasonable technical, administrative, and physical safeguards to protect the data.

Provide a consent revocation mechanism at least as easy as the consent mechanism. After revocation, cease processing **within 15 days** (Section 5(1)(d)).

Not process data for purposes incompatible with those declared, unless the consumer consents.

Not process sensitive data without prior consumer consent.

Not process data of consumers aged 13 to 15 for targeted advertising, profiling, or data sales without explicit consent.

Not discriminate against consumers who exercise their rights.

Provide an accessible, clear, and meaningful privacy notice with an actively monitored contact channel.

Establish a DSAR channel without requiring creation of a new account.

Conduct and document Data Protection Assessments for high-risk activities.

## Special protection for teens aged 13 to 15

Section 5(2)(c) prohibits processing data of consumers aged 13 to 15 for targeted advertising, profiling for decisions with legal effects, or data sales without those consumers' consent, when the controller has actual knowledge or willfully disregards that age range.

As of **January 1, 2026**, protection was expanded: prohibition on selling data of minors under 16 and on using data of minors under 16 for targeted advertising and certain types of profiling.

## The 15-day consent revocation deadline

Section 5(1)(d) requires the controller to provide an effective consent revocation mechanism at least as easy as the consent mechanism. After revocation, the controller must cease processing **as soon as practicable, but not later than 15 days**.

## Cookies and the OCPA

Cookies that collect personal data or allow user identification fall directly within the OCPA's scope.

The controller must display a clear [cookie notice](https://goadopt.io/en/blog/operation-of-cookie-banner/), provide an opt-out mechanism for targeted advertising, block non-necessary trackers before they fire, and honor consumer preferences.

[Correct tag categorization](https://goadopt.io/en/blog/best-practices-tag-categorization/) is what makes it possible to identify which cookies constitute targeted advertising or data sales.

Section 1(19) defines targeted advertising as ads selected based on data collected from the consumer's activities over time and across one or more non-affiliated websites or online applications.

As of **January 1, 2026**, Section 5(5)(c) requires controllers to honor opt-out signals sent with the consumer's consent by platforms, technologies, or mechanisms such as the Global Privacy Control (GPC). A visitor with the GPC enabled is equivalent to a visitor who clicked the opt-out button.

## Data Protection Assessments

Under Section 8, the controller must conduct and document Data Protection Assessments for:

Processing data for targeted advertising.

Processing sensitive data.

Selling personal data.

Profiling that presents a reasonably foreseeable risk of unfair treatment, financial, physical, or reputational harm, intrusion into privacy, or other substantial harm.

Assessments must be retained for at least **five years** (Section 8(6)) and are confidential. The Attorney General may request access during investigations without that constituting a waiver of attorney-client privilege.

## Enforcement and penalties

Under Section 9, the Oregon Attorney General has exclusive enforcement authority. There is no private right of action.

**Through December 31, 2025:** the AG was required to notify the controller and grant 30 days to cure violations before initiating formal action.

**As of January 1, 2026:** the cure period was eliminated by Section 11. The AG may initiate action directly.

If violations are identified, the AG may seek:

Injunction to stop the violations.

Civil penalties of up to **US$ 7,500 per violation** (Section 9(4)(a)).

Recovery of attorney fees and investigation costs.

The AG has **five years** from the last act constituting the violation to bring an action.

## How to comply with the OCPA in practice

### 1. Data mapping
Understand what you collect, including derived data, where it is, how it is used, and who it is shared with. [Data mapping](https://goadopt.io/en/blog/data-mapping-or-data-inventory/) is the foundation of any compliance program.

### 2. Update your privacy policy
The document must cover all requirements of Section 5(4), including an actively monitored contact channel and a detailed description of third-party categories.

### 3. Implement a functional cookie notice
A [cookie banner](https://goadopt.io/en/blog/how-to-choose-a-cookie-banner-for-your-website/) that blocks non-necessary trackers before acceptance, records preferences, offers opt-out from targeted advertising, and honors the GPC from January 2026.

### 4. Create a DSAR channel
At least one secure and reliable mechanism for receiving requests, without requiring creation of a new account.

### 5. Document Data Protection Assessments
For each high-risk processing activity, conduct and document the assessment per Section 8. Retain for at least 5 years.

### 6. Update contracts with processors
Contracts with service providers that process data on your behalf must meet the requirements of Section 6 of the OCPA.

Applying [privacy by design](https://goadopt.io/en/blog/what-is-privacy-by-design/) from the start of product development is what makes compliance sustainable over time.

## How AdOpt helps with the OCPA

AdOpt records every consent interaction, blocks trackers before acceptance, honors the GPC from January 2026, processes consent revocations within 15 days, and generates the auditable log needed in an Oregon Attorney General investigation.

The automatic scan identifies all active [trackers](https://goadopt.io/en/blog/gdpr-cookies-explained/) on the site, feeding the data inventory. And when the law changes, the platform updates automatically.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Ready to bring your website into compliance with the Oregon OCPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Comparing OCPA with other privacy laws

| Law | State | Threshold | Revenue % | Cure Period | GPC/Opt-out Signal | Effective Date |
|---|---|---|---|---|---|---|
| OCPA | Oregon | 100K (excl. payment tx.) or 25K + 25% | 25% | Eliminated (Jan 2026) | Jan 2026 | Jul 2024 |
| CTDPA | Connecticut | 100K (excl. payment tx.) or 25K + 25% | 25% | Discretionary (Jan 2025) | Jan 2025 | Jul 2023 |
| VCDPA | Virginia | 100K or 25K + 50% | 50% | 30 days guaranteed | Not required | Jan 2023 |
| CPA | Colorado | 100K or 25K + 50% | 50% | Discretionary (Jul 2025) | Jul 2024 | Jul 2023 |
| CCPA/CPRA | California | US$ 25M or 100K | 50% | Discretionary | GPC required | Jan 2020/2023 |

To understand how these [privacy laws](https://goadopt.io/en/blog/gdpr-lgpd-and-ccpa-what-are-these-laws-similarities-and-differences/) compare in depth, our comparative guide goes further.

## The OCPA in practice: the three documents

Compliance with the OCPA rests on three documents that have to agree with each other: the [cookies policy](https://goadopt.io/en/blog/oregon-ocpa-cookies-policy/), which declares every tracker and its purpose; the [privacy policy](https://goadopt.io/en/blog/oregon-ocpa-privacy-policy/), which explains what you do with the data; and the [privacy portal](https://goadopt.io/en/blog/oregon-ocpa-dsar-privacy-portal/), where the consumer exercises their rights and you keep the record of it.

## FAQ: Oregon OCPA

**1. What is the OCPA and when did it take effect?**
The Oregon Consumer Privacy Act (ORS 646A.570–646A.589) is Oregon's state personal data protection law. It took effect on July 1, 2024. It has specific differentiators from other state laws: the payment transaction exclusion from the 100K threshold, the 25% revenue threshold from data sales, the inclusion of derived data in the personal data definition, and the express 15-day deadline for cessation after consent revocation. As of January 2026, it added the GPC requirement and eliminated the 30-day cure period.

**2. What makes the OCPA threshold different from other state laws?**
The OCPA has two particularities in the threshold: it explicitly excludes data processed solely for payment transactions from the 100K consumer count, and uses 25% of revenue from data sales as the second criterion (vs. 50% in laws like the VCDPA and Colorado CPA). The 25% threshold is shared with Connecticut's CTDPA, but the payment transaction exclusion makes both laws the most specific on this point among all US state privacy laws.

**3. What is the 15-day consent revocation deadline in the OCPA?**
Section 5(1)(d) requires that after receiving a consumer's consent revocation, the controller cease processing as soon as practicable, but not later than 15 days. This express deadline is unique to the OCPA (shared with Connecticut's CTDPA) and distinguishes both from other US state laws that require cessation "without undue delay" without a specific timeframe.

**4. What is the Global Privacy Control and why does the OCPA require honoring it?**
The Global Privacy Control (GPC) is a technical signal that consumers activate in their browsers to automatically request opt-out from data sales and targeted advertising on all sites they visit. As of January 1, 2026, Section 5(5)(c) of the OCPA requires controllers to honor this signal as a valid opt-out request. A visitor with GPC enabled is equivalent to a visitor who clicked the opt-out button.

**5. What is the penalty for non-compliance with the OCPA?**
The Attorney General may seek civil penalties of up to US$ 7,500 per violation, plus injunctive relief and recovery of attorney fees and investigation costs. As of January 2026, there is no longer a 30-day cure period before formal action. The AG may act directly without prior notice. There is no private right of action (Section 9).

[Ready to bring your website into compliance with the Oregon OCPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


Oregon OCPA and Cookies: All You Need to Know

Compliance doesn't have to be a nightmare, whether you are a marketing professional or a **[Data protection officer](https://goadopt.io/en/blog/responsibilities-of-a-data-protection-officer/)**, making simple mistakes can easily ruin your brand's reputation.

Facing million-dollar **[fines](https://goadopt.io/en/blog/company-fined-the-end/)** and losing user trust are the biggest risks today. Everything starts with how you manage **[cookies](https://goadopt.io/en/blog/lgpd-cookies-all-you-need-to-know/)** at the front door of your website.

We are here to simplify this for you. Let's dive into the five biggest market mistakes and how a solid **[Cookie notice/banner](https://goadopt.io/en/blog/operation-of-cookie-banner/)** solves this on autopilot.

## How to Avoid GDPR and CCPA Legal Issues

The global privacy landscape is changing extremely fast. Because of that, knowing if your **[website needs cookie consent](https://goadopt.io/en/blog/website-needs-cookie-consent-gdpr-lgpd-ccpa/)** is no longer a choice, it's a mandatory rule.

Tech giants have paid millions in **[fines](https://goadopt.io/en/blog/gdpr-lgpd-and-ccpa-what-are-these-laws-similarities-and-differences/)** just for ignoring basic transparency and data tracking guidelines.

The good news is that you don't need to pause your operations. Our technology protects everything, from your blog to your **[e-commerce](https://goadopt.io/en/blog/impact-ecommerce-lgpd/)**, without any headaches.

Common Issue: Unclear Cookie Banner Text
Many businesses rely on cookie consent notices filled with confusing or vague language. Here are some common pitfalls:

![common-privacy-dark-patterns.png](/uploads/common_privacy_dark_patterns_1a54e06b8c.png)

### 1. Confusing Consent Text

Using technical jargon or generic text only pushes visitors away. Global laws like the **[LGPD](https://goadopt.io/en/blog/lgpd-general-data-protection-law/)** demand total clarity and transparency in your communication.

Pre-made phrases like "we use technologies to improve your experience" mean absolutely nothing. You need to clearly explain the true role of **[cookies](https://goadopt.io/en/blog/lgpd-cookies-all-you-need-to-know/)** on your page.

The solution is a colloquial and direct language. A great **[Cookie banner](https://goadopt.io/en/blog/why-are-cookie-banners-everywhere/)** must detail the collection purposes without sounding like a boring contract.

### 2. Hiding the Reject Option

Hiding the reject button in difficult menus is a dark pattern that generates heavy **[fines](https://goadopt.io/en/blog/company-fined-the-end/)** in Europe and the Americas.

Your visitor must have the exact same ease to accept or reject tracking. This balance is the core of why a **[website needs cookie consent](https://goadopt.io/en/blog/website-needs-cookie-consent-gdpr-lgpd-ccpa/)**.

Avoid buttons with muted colors or tiny fonts. Let your **[Data protection officer](https://goadopt.io/en/blog/responsibilities-of-a-data-protection-officer/)** validate the interface to ensure no deceptive patterns exist.

![table-2.png](/uploads/table_2_2f71ca54e2.png)

### 3. Firing Cookies Before Permission

This is the fatal error that destroys many traffic managers' strategies. Loading tracking scripts before the "accept" click is a clear violation of the **[LGPD](https://goadopt.io/en/blog/lgpd-general-data-protection-law/)** and GDPR.

The golden rule is: block everything that isn't strictly essential. You do not want marketing tools and **[cookies](https://goadopt.io/en/blog/lgpd-cookies-all-you-need-to-know/)** running without the user's green light.

To be sure your site is running clean, instruct your tech team to **[delete cookies](https://goadopt.io/en/blog/delete-cookies-cache-chrome/)** and simulate accesses as a first-time visitor.

### 4. Poor Consent Record Management

A beautiful banner is useless if you don't store the logs correctly. Remember that a proper **[website needs cookie consent](https://goadopt.io/en/blog/website-needs-cookie-consent-gdpr-lgpd-ccpa/)** involves keeping safe proof of actions.

During an audit, your company and the **[Data protection officer](https://goadopt.io/en/blog/responsibilities-of-a-data-protection-officer/)** will need to present data such as date, time, and exact user preferences.

Losing this information leaves your operation completely vulnerable. A lack of documentation is a direct shortcut to **[fines](https://goadopt.io/en/blog/fines-in-LGPD/)** that can shut down your business.

### 5. Pre-checked Boxes and Assumed Consent

The era of assuming a user agreed just by scrolling the page is over. Modern frameworks like the **[LGPD](https://goadopt.io/en/blog/lgpd-general-data-protection-law/)** strictly prohibit implied consent.

Pre-checked boxes or forced cookie walls are not allowed. The power of choice regarding **[cookies](https://goadopt.io/en/blog/lgpd-cookies-all-you-need-to-know/)** must be actively in the hands of the visitor.

Respecting this autonomy builds a much stronger brand perception. At the end of the day, it increases trust in your **[e-commerce](https://goadopt.io/en/blog/impact-ecommerce-lgpd/)** and brings qualified leads.

## How AdOpt Solves This For You

Adapting your marketing processes doesn't have to be ugly or exhausting. Our CMP technology resolves your **[Cookie notice/banner](https://goadopt.io/en/blog/why-are-cookie-banners-everywhere/)** installation in a few clicks.

With our platform, script blocking happens automatically, protecting your campaigns and mitigating 100% of the risk of **[fines](https://goadopt.io/en/blog/fines-in-LGPD/)** from improper tracking.

We keep the entire consent history encrypted and organized. It's the security your **[Data protection officer](https://goadopt.io/en/blog/responsibilities-of-a-data-protection-officer/)** needs, with the design your brand deserves.

## Frequently Asked Questions (FAQ) About Cookie Consent

### 1. Why should I care about cookie consent?
Ignoring permission tracking is a critical **compliance** error that directly hurts your business. If you receive international traffic, knowing exactly why your **[website needs cookie consent](https://goadopt.io/en/blog/website-needs-cookie-consent-gdpr-lgpd-ccpa/)** is the first step to avoiding penalties and protecting your brand.

### 2. Can I leave the accept box pre-checked?
Absolutely not, as modern privacy rules require affirmative action. Strict frameworks, like the **[LGPD](https://goadopt.io/en/blog/lgpd-general-data-protection-law/)** and GDPR, prohibit implied consent, ensuring the visitor has total control over their data.

### 3. What happens if I hide the reject button?
Making it hard to refuse trackers is a deceptive practice highly penalized by regulatory authorities. Besides destroying user trust, this flaw attracts heavy financial **[fines](https://goadopt.io/en/blog/fines-in-LGPD/)** that can cripple your company's budget.

### 4. Should cookies be blocked before the user accepts?
Exactly, because no advertising or marketing script should be fired in the browser without prior authorization. Our AdOpt platform blocks these tags before the visitor interacts with the **[Cookie banner](https://goadopt.io/en/blog/why-are-cookie-banners-everywhere/)**, doing all the heavy lifting for you.

### 5. Who is responsible for managing these consents?
While the tech team handles the installation, the responsibility for keeping records secure falls on managers and the **[Data protection officer](https://goadopt.io/en/blog/responsibilities-of-a-data-protection-officer/)**. These professionals use our automated reports to prove legality during an audit.

## Take the Next Step Towards Compliance

Don't let bureaucratic mistakes harm your **[LGPD e-commerce](https://goadopt.io/en/blog/impact-ecommerce-lgpd/)** performance or your agency's metrics.

Compliance technology doesn't have to be an expensive and complex hurdle, and we are ready to show you how fast and smooth it can be.

Book a free demo with our team of experts right now through **[our HubSpot](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria?uuid=e1bc9e87-710e-4f13-894e-4ade5ce7af10)** and discover how to automate your consent management.


5 Common Cookie Consent Mistakes Hurting Your Compliance

California was the first US state to have a comprehensive data privacy law. And when it decided it could do better, it did.

The California Privacy Rights Act (CPRA), also known as Proposition 24, was approved by California voters in November 2020 and took effect on **January 1, 2023**. It did not replace the CCPA. It expanded it, strengthened it, and created an independent regulatory agency to enforce it.

If you already dealt with [the CCPA and its cookie obligations](https://goadopt.io/en/blog/california-ccpa-and-cookies-all-you-need-to-know/), you will recognize the structure. But you will need to update everything.

## The timeline: where the CPRA came from

To understand the CPRA, you need to understand California's data privacy trajectory.

**2018:** The California Consumer Privacy Act (CCPA) is signed by Governor Jerry Brown after more than 629,000 Californians sign petitions to put it on the ballot. The legislature approves a negotiated version before the deadline to avoid the more restrictive version that would have gone to voters.

**January 1, 2020:** The CCPA takes effect. For the first time, California consumers gain rights to access, deletion, and opt-out of data sales.

**July 2020:** CCPA enforcement begins by the California Attorney General's office.

**November 2020:** Voters approve Proposition 24, the CPRA, with 56.2% in favor. Because it was passed by ballot initiative, the state legislature cannot repeal it. Any amendment must be "consistent with and further the purpose and intent" of the law.

**January 1, 2022:** The CPRA begins applying to data collected from this date forward.

**January 1, 2023:** The CPRA becomes fully operational. The California Privacy Protection Agency (CPPA) takes over enforcement, replacing the Attorney General in that role.

**July 1, 2023:** Formal enforcement by the CPPA begins for data collected on or after January 1, 2022.

## What is the CPRA?

The CPRA is California's current consumer privacy law. It amends and expands the CCPA, adding new rights, a new category of sensitive personal information with specific controls, a prohibition on retaining data beyond what is necessary, and a dedicated regulatory agency.

Enforcement is the responsibility of the **California Privacy Protection Agency (CPPA)**, an independent agency created by the CPRA itself. The Attorney General retains concurrent authority for certain violations.

## Who must comply with the CPRA?

The CPRA applies to businesses that conduct business in California or collect personal information from California residents and that meet any one of the following criteria:

Have **annual gross revenue exceeding US$ 25 million** in the preceding calendar year.

Buy, sell, or share personal information of **100,000 or more consumers or households** per year.

Derive **50% or more** of annual revenue from selling personal information of consumers.

### The threshold change from the CCPA

The original CCPA used a threshold of 50,000 consumers or households. The CPRA doubled that number to 100,000, potentially excluding some smaller businesses. But at the same time, it expanded the concept of "selling" to include "sharing" data, which brought many businesses back into scope.

The focus remains on where consumers are, not where the company is based. A website with California traffic at scale may be in scope regardless of where it operates.

### CPRA exemptions

Outside the scope:

HIPAA-covered information, when treated in accordance with that federal law.

Gramm-Leach-Bliley Act regulated data, when treated accordingly.

Credit data regulated by the Fair Credit Reporting Act.

Health information under California's Confidentiality of Medical Information Act.

Research data, under specific conditions.

Employee and job applicant information, when used exclusively in that capacity.

Government entity data.

## CCPA vs. CPRA: the key differences

This is the section that matters for anyone already CCPA-compliant who needs to understand what changed.

### 1. New regulatory agency

The CCPA was enforced by the California Attorney General. The CPRA created the California Privacy Protection Agency (CPPA), an independent agency with an exclusive mission to protect consumer privacy. The CPPA has authority to investigate, fine, and issue regulations. The AG retains concurrent authority for certain violations.

### 2. New consumer rights

The CCPA had four main rights: access, deletion, opt-out of sale, and non-discrimination. The CPRA added:

Right to correct inaccurate personal information (new).

Right to limit use and disclosure of sensitive personal information (new).

The opt-out right was expanded to include sharing of data for cross-context behavioral advertising, in addition to selling.

### 3. Sensitive personal information category

The CCPA had no formal category of sensitive data with differentiated treatment. The CPRA created the "sensitive personal information" (SPI) category with its own rules: precise geolocation, financial account data, private communications, genetic data, biometric data, health data, sexual orientation, racial or ethnic origin, religious beliefs, and immigration status. Consumers have the right to limit use of this information to essential purposes.

### 4. Consumer threshold doubled

CCPA: 50,000 consumers or households. CPRA: 100,000 consumers or households. This may have taken some smaller businesses out of scope, but the new concept of "sharing" partially offset that effect.

### 5. "Sharing" as a separate category

The CCPA focused on "sale" of data. The CPRA added "sharing," which includes disclosing data for cross-context behavioral advertising even without direct payment. This closed a significant gap: businesses that argued they did not "sell" data but shared it with advertising networks.

### 6. Prohibition on retaining data beyond what is necessary

The CCPA had no data retention rule. The CPRA explicitly prohibits businesses from retaining personal information beyond what is necessary for the disclosed purpose. Businesses must specify retention periods and comply with them.

### 7. Tripled penalties for violations involving minors

The CCPA provided penalties of up to US$ 7,500 per intentional violation. The CPRA kept that amount for general violations but tripled the automatic penalties for violations involving personal information of consumers under 16: up to US$ 7,500 per violation, now applied automatically without needing to prove intent.

### 8. Enhanced protection for teens aged 13 to 15

The CCPA required opt-in for data of consumers under 16. The CPRA kept that and added: if a consumer under 16 declines consent, the business must wait **12 months** before requesting consent again.

### 9. Elimination of the cure period

The original CCPA had a 30-day cure period: the AG had to notify the business and give 30 days to correct before initiating formal action. The CPRA eliminated that cure period for CPPA enforcement. The CPPA can act directly.

### 10. Data Protection Assessments and Audit

The CPRA requires businesses to conduct periodic privacy risk assessments for high-risk activities, and to submit to regular privacy audits when required by the CPPA.

## What is personal information under the CPRA?

Any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.

This includes identifiers (name, address, email, IP), legally protected characteristics, commercial information, biometric data, geolocation data, internet activity data, audio and visual data, professional information, education information, and inferences used to create profiles.

Publicly available information from government sources is excluded.

## What is sensitive personal information (SPI) under the CPRA?

This is the CPRA's major innovation. The law created a subcategory called "sensitive personal information" with specific controls. SPI includes:

Social Security number, driver's license, passport or government ID number.

Financial account, debit or credit card information combined with access credentials.

Precise geolocation.

Contents of private communications (emails, texts), unless the business is the intended recipient.

Genetic data.

Biometric data for unique identification.

Health data.

Information about sex life or sexual orientation.

Racial or ethnic origin, religious or philosophical beliefs, or union membership.

Consumers have the right to limit use and disclosure of SPI to essential purposes.

## What are consumer rights under the CPRA?

The CPRA guarantees California residents:

**Right to know:** categories of personal information collected, sources, purposes, and third parties.

**Right to access:** a copy of specific personal information collected in the past 12 months.

**Right to deletion:** request deletion, with some exceptions.

**Right to correct:** request correction of inaccurate personal information (new under CPRA).

**Right to portability:** data in a portable, usable format.

**Right to opt-out of sale and sharing:** refuse sale and sharing for cross-context behavioral advertising.

**Right to limit SPI use:** limit use and disclosure of sensitive personal information to essential purposes (new under CPRA).

**Right to non-discrimination:** no penalties for exercising rights.

The response deadline is **45 days**, extendable by another 45 days when necessary, with consumer notification within the initial period.

Response is **free up to twice per year** per consumer.

## Protection for minors

The CPRA has specific protections for consumers under 16 that deserve attention.

For consumers under 16: the business cannot sell or share personal information without active opt-in. The default is opt-in, not opt-out.

For consumers under 13: consent must be given by parents or legal guardians.

If a consumer under 16 declines consent, the business must wait **12 months** before making a new consent request.

Penalties for violations involving data of consumers under 16 are tripled automatically, reaching **US$ 7,500 per violation**.

## Mandatory links on the site

The CPRA requires two links that must be visible on the homepage and on any page where personal information is collected:

**"Do Not Sell or Share My Personal Information"**: for opt-out of selling and sharing data for cross-context behavioral advertising.

**"Limit the Use of My Sensitive Personal Information"**: for limiting use of sensitive personal information to essential purposes.

These links may be combined into a single link if both opt-out options are available on the same destination page.

## Cookies and the CPRA

Cookies that collect personal information, especially for behavioral advertising, fall directly within the CPRA's scope.

The site must display a clear [cookie notice](https://goadopt.io/en/blog/operation-of-cookie-banner/), provide the opt-out links for sale/sharing and SPI limitation, and block non-necessary trackers before the consumer decides.

[Correct tag categorization](https://goadopt.io/en/blog/best-practices-tag-categorization/) is what makes it possible to identify which cookies constitute selling or sharing of personal information.

The Global Privacy Control (GPC) is recognized in California: the CPPA confirmed that the GPC is a valid form of opt-out under the CPRA. If a visitor accesses the site with the GPC enabled, that is equivalent to clicking "Do Not Sell or Share My Personal Information."

## Enforcement and penalties

The CPPA has primary enforcement authority for the CPRA for data collected from January 2022 forward. The AG retains concurrent authority for data breach violations.

There is no guaranteed cure period from the CPPA. The agency can initiate action directly.

Penalties are:

Up to **US$ 2,500 per unintentional violation**.

Up to **US$ 7,500 per intentional violation**.

Up to **US$ 7,500 per violation involving information of consumers under 16** (automatic, no need to prove intent).

The CPRA also preserves the **private right of action** for data security violations: consumers can sue the business directly for damages caused by unauthorized data breaches involving specified categories of personal information.

## How AdOpt helps with the CPRA

AdOpt records every consent and opt-out interaction, blocks trackers before acceptance, honors the GPC automatically, and generates the auditable log needed in a CPPA investigation.

The automatic scan identifies all active [trackers](https://goadopt.io/en/blog/gdpr-cookies-explained/) on the site, feeding the data inventory required for the privacy policy and risk assessments. And when the law changes, the platform updates automatically.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Ready to bring your website into compliance with the California CPRA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## CCPA vs. CPRA: comparison table

| Point | CCPA (2020) | CPRA (2023) |
|---|---|---|
| Effective date | Jan 2020 | Jan 2023 |
| Consumer threshold | 50,000 | 100,000 |
| Data sale | Opt-out | Opt-out |
| Sharing for advertising | Not explicitly covered | Opt-out (new) |
| Sensitive data | No separate category | SPI with specific limitation right |
| Right to correct | Not provided | Provided (new) |
| Limit SPI use | Not provided | Provided (new) |
| Regulatory agency | Attorney General | CPPA (new) |
| Cure period | 30 days guaranteed | Eliminated by CPPA |
| Penalties for minors | Up to US$ 7.5K with intent | Up to US$ 7.5K automatic |
| Data retention | No specific rule | Prohibited beyond necessity |
| Private right of action | Data breaches only | Maintained and expanded |

## Comparing CPRA with other privacy laws

| Law | State | Threshold | Agency | Cure Period | Effective Date |
|---|---|---|---|---|---|
| CPRA | California | US$ 25M or 100K or 50% revenue | CPPA | Eliminated | Jan 2023 |
| OCPA | Oregon | 100K (excl. payments) or 25K + 25% | AG Oregon | Eliminated (Jan 2026) | Jul 2024 |
| CTDPA | Connecticut | 100K (excl. payments) or 25K + 25% | AG Connecticut | Discretionary | Jul 2023 |
| VCDPA | Virginia | 100K or 25K + 50% | AG Virginia | 30 days guaranteed | Jan 2023 |
| NHDPA | New Hampshire | 35K or 10K + 25% | AG NH | Discretionary | Jan 2025 |

## Continue learning about privacy in California

Compliance in California is built from three documents that need to agree with each other: the [cookie policy](https://goadopt.io/en/blog/california-cpra-cookies-policy/), which declares every tracker and its purpose; the [privacy policy](https://goadopt.io/en/blog/california-cpra-privacy-policy/), reviewed at least every 12 months; and the [privacy portal](https://goadopt.io/en/blog/california-cpra-dsar-privacy-portal/), where the consumer exercises their rights and you keep the record of it.

## The CPRA in practice: the three documents

Compliance with the CPRA rests on three documents that have to agree with each other: the [cookies policy](https://goadopt.io/en/blog/california-cpra-cookies-policy/), which declares every tracker and its purpose; the [privacy policy](https://goadopt.io/en/blog/california-cpra-privacy-policy/), which explains what you do with the data; and the [privacy portal](https://goadopt.io/en/blog/california-cpra-dsar-privacy-portal/), where the consumer exercises their rights and you keep the record of it.

## FAQ: California CPRA

**1. What is the difference between the CCPA and the CPRA? Does the CCPA still exist?**
The CCPA still exists as the base law, but the CPRA substantially amended and expanded it. In practice, the current framework is CCPA/CPRA combined, with the CPRA adding new rights (correction, SPI limitation), a new data category (sensitive personal information), a new regulatory body (CPPA), a data retention prohibition, and enforcement changes. The CPRA took effect on January 1, 2023 and applies to data collected on or after January 1, 2022.

**2. What is the California Privacy Protection Agency (CPPA) and how does it differ from the Attorney General?**
The CPPA is an independent agency created by the CPRA itself, with an exclusive mission to protect consumer privacy in California. It took over CPRA enforcement for data collected from January 2022 forward, replacing the AG in that role. The AG retains concurrent authority for certain data breach violations. The CPPA also has rulemaking authority, which makes California's privacy law more dynamic than other state laws: rules can be updated without going through the legislature.

**3. What is sensitive personal information (SPI) and what new rights does it generate?**
The CPRA created the sensitive personal information (SPI) category, which includes: precise geolocation, financial account data combined with credentials, private communications, genetic data, biometric data, health data, sex life or sexual orientation, racial or ethnic origin, religious beliefs, and union membership. Consumers have the right to limit use of this information to essential purposes (providing the requested service, security, legal compliance). Businesses must provide a separate "Limit the Use of My Sensitive Personal Information" link on the homepage.

**4. What changes for cookies and digital advertising under the CPRA?**
The CPRA expanded the concept of "sale" to include "sharing," which covers disclosure of personal information for cross-context behavioral advertising even without direct payment. This means advertising pixels like the Meta Pixel and Google Ads that send behavioral data to external advertising networks may constitute "sharing" under the CPRA, even if the business receives no money directly for that specific sharing. The GPC is recognized as a valid form of opt-out from selling and sharing.

**5. What is the penalty for CPRA non-compliance and is there a private right of action?**
The CPPA can seek penalties of up to US$ 2,500 per unintentional violation and up to US$ 7,500 per intentional violation. Violations involving data of consumers under 16 generate automatic penalties of up to US$ 7,500 per violation without needing to prove intent. The CPRA preserves the private right of action for data security breaches resulting in unauthorized access to specified categories of personal information. Consumers can sue directly for damages of US$ 100 to US$ 750 per consumer per incident, or actual damages, whichever is greater. Class actions are permitted.

[Ready to bring your website into compliance with the California CPRA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


California CPRA and Cookies: All you need to know

Iowa has the longest response deadline for consumer requests of all US state privacy laws.

The Iowa Consumer Data Protection Act (ICDPA), Iowa Code § 715D, took effect on **January 1, 2025**. It was signed by Governor Kim Reynolds in March 2023, giving businesses nearly two years to prepare.

The most distinctive feature: **90 days** to respond to a consumer request, with a possible 45-day extension. And a **90-day cure period** guaranteed before any Attorney General action, the longest among current state laws.

## What is the ICDPA?

The ICDPA is Iowa's state personal data protection law. It grants rights to state residents and creates obligations for businesses that process their data.

The law follows the model of other US state privacy laws, with a structure close to Virginia's VCDPA and Utah's UCPA. But it has considerably longer deadlines for businesses to respond.

Enforcement is the exclusive responsibility of the **Iowa Attorney General**. There is no private right of action (§ 715D.8(4)).

## When did the ICDPA take effect?

On **January 1, 2025**.

The law was signed in March 2023, giving businesses nearly two years to prepare.

## Who must comply with the ICDPA?

Under Iowa Code § 715D.2(1), the law applies to persons that conduct business in Iowa or produce products or services targeted to state residents and that, during a calendar year:

Control or process personal data of at least **100,000 consumers**; or

Control or process personal data of at least **25,000 consumers** and derive more than **50% of gross revenue** from the sale of personal data.

**Key difference from Utah's UCPA:** the ICDPA does not require a minimum revenue of US$ 25 million as an additional criterion. If a business controls or processes data of 100,000 Iowa consumers, it is in scope regardless of revenue. This may bring smaller businesses into scope under the ICDPA that would be outside the UCPA's scope.

Understanding the distinction between [controller and processor](https://goadopt.io/en/blog/responsibilities-of-a-data-protection-officer/) is fundamental to defining each party's responsibilities.

### ICDPA Exemptions

Under § 715D.2(2) and (3), the following are exempt:

The State of Iowa and its political subdivisions.

Financial institutions, affiliates, and data subject to the Gramm-Leach-Bliley Act.

Entities subject to and compliant with HIPAA.

Nonprofit organizations.

Institutions of higher education.

HIPAA-protected health information and health records.

Regulated clinical research data.

Consumer credit data regulated by the Fair Credit Reporting Act.

Data regulated by the Driver's Privacy Protection Act.

Data regulated by FERPA.

Data regulated by the Farm Credit Act.

Employee, job applicant, and agent data in an employment context.

Data processed in accordance with COPPA.

## What is personal data under the ICDPA?

Under § 715D.1(18), personal data is any information linked or reasonably linkable to an identified or identifiable natural person.

Not personal data: de-identified data, aggregate data, and publicly available information.

## What is sensitive data under the ICDPA?

Under § 715D.1(26), sensitive data includes:

Racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status (except when used to avoid discrimination under anti-discrimination law).

Genetic or biometric data processed for the purpose of uniquely identifying a natural person.

Personal data collected from a known child (under 13).

Precise geolocation data.

**Sensitive data model:** like the UCPA, the ICDPA uses an **opt-out** model for sensitive data. The controller cannot process sensitive data without first presenting a clear notice and offering an opt-out opportunity (§ 715D.4(2)). Prior consent is not required.

## What is precise geolocation data?

Under § 715D.1(19), precise geolocation data is information derived from technology, including GPS coordinates, that identifies the specific location of a natural person with precision within a radius of **1,750 feet**.

## What are consumer rights under the ICDPA?

Under § 715D.3(1), Iowa residents have four rights:

**Confirm and access:** confirm whether the controller processes personal data and access that data (§ 715D.3(1)(a)).

**Deletion:** request deletion of personal data the consumer provided to the controller (§ 715D.3(1)(b)). Like the UCPA, the scope is limited to data provided by the consumer.

**Portability:** obtain a copy of the data in a portable and, where technically practicable, readily usable format for transmission to another controller without impediment (§ 715D.3(1)(c)).

**Opt-out from data sales:** refuse the sale of personal data (§ 715D.3(1)(d)).

**Note on targeted advertising:** the ICDPA lists only opt-out from data sales as a formal right in § 715D.3(1)(d). However, § 715D.4(6) requires that if the controller engages in targeted advertising, it must clearly disclose this and describe how the consumer can exercise an opt-out. In practice, the controller must offer an opt-out from targeted advertising in the privacy notice, even though it is technically a transparency obligation rather than a formally listed right.

### What the ICDPA does not have

No right to correct inaccurate data (same as UCPA).

No formal opt-out of profiling.

Deletion limited to data provided by the consumer.

## Response deadlines: the longest of all state privacy laws

This is the ICDPA's most distinctive feature. Under § 715D.3(2)(a):

**90 days** to respond from receipt of the request.

Extension of **+45 days** when reasonably necessary due to complexity or volume, with notification within the initial period.

Comparison of response deadlines:

| Law | Base deadline | Extension |
|---|---|---|
| ICDPA (Iowa) | 90 days | +45 days |
| VCDPA (Virginia) | 45 days | +45 days |
| UCPA (Utah) | 45 days | +45 days |
| OCPA (Oregon) | 45 days | +45 days |
| CTDPA (Connecticut) | 45 days | +45 days |

**Free service:** up to **2 times per year** per consumer (§ 715D.3(2)(c)). From the third request in the same 12-month period, the controller may charge a reasonable fee or refuse if the request is manifestly unfounded, excessive, repetitive, technically infeasible, or if the primary purpose is not to exercise a right.

## Right to appeal: 60 days

Under § 715D.3(3), the controller must establish an appeal process. It must be conspicuously available and similar to the original submission method. Within **60 days** of receiving an appeal, the controller must inform the consumer in writing of any action taken or not taken, with explanation of the reasons.

If the appeal is denied, the controller must provide the consumer with an online mechanism to contact the Attorney General to submit a complaint.

## Controller obligations under the ICDPA

Under § 715D.4, the controller must:

Adopt and implement reasonable administrative, technical, and physical data security practices, proportionate to the volume and nature of the data.

Not process sensitive data without presenting a clear notice and offering an opt-out opportunity first.

Not discriminate against consumers who exercise their rights.

Provide a reasonably accessible, clear, and meaningful privacy notice with the five required elements.

Clearly and conspicuously disclose if it sells data or engages in targeted advertising, with opt-out method for each activity.

Establish secure and reliable means for request submissions, described in the privacy notice.

Not require the consumer to create a new account to exercise rights.

## Cookies and the ICDPA

Cookies that collect personal data or allow user identification fall within the ICDPA's scope.

The site must display a clear [cookie notice](https://goadopt.io/en/blog/operation-of-cookie-banner/), offer opt-out from data sales and targeted advertising, and describe in the privacy notice how consumers can exercise their rights.

[Correct tag categorization](https://goadopt.io/en/blog/best-practices-tag-categorization/) is what makes it possible to identify which cookies constitute targeted advertising or data sales.

The ICDPA defines targeted advertising in § 715D.1(28) as ads selected based on data obtained from the consumer's activities over time and across non-affiliated websites or applications. Ads based on activities within the controller's own site or affiliated sites do not qualify.

The ICDPA uses "sale" as monetary consideration (§ 715D.1(25)), without including the concept of "sharing" for behavioral advertising without payment, as the CPRA does.

## Enforcement and penalties

Under § 715D.8, the Iowa Attorney General has exclusive enforcement authority.

**Cure period: 90 days guaranteed.** Before initiating any action, the AG must notify the controller in writing identifying violations and granting **90 days to cure** (§ 715D.8(2)). This is the longest cure period of all current US state privacy laws.

If the controller cures the violation within 90 days and provides an express written statement that violations have been cured and will not recur, no action is initiated.

If the violation continues or the controller breaches the provided statement, the AG may initiate action and seek:

Injunction to stop the violations.

Civil penalties of up to **US$ 7,500 per violation** (§ 715D.8(3)).

## How AdOpt helps with the ICDPA

AdOpt records every consent and opt-out interaction, blocks trackers before acceptance, and generates the auditable log needed in an Iowa Attorney General investigation.

The automatic scan identifies all active [trackers](https://goadopt.io/en/blog/gdpr-cookies-explained/) on the site, feeding the data inventory required for the privacy notice. And when the law changes, the platform updates automatically.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Ready to bring your website into compliance with the Iowa ICDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Comparing ICDPA with other privacy laws

| Law | State | Threshold | Response Deadline | Appeal | Cure Period | Free/Year |
|---|---|---|---|---|---|---|
| ICDPA | Iowa | 100K or 25K + 50% | 90 days | 60 days | 90 days | 2x |
| UCPA | Utah | US$ 25M + 100K or 25K + 50% | 45 days | Not structured | 30 days | 1x |
| VCDPA | Virginia | 100K or 25K + 50% | 45 days | 60 days | 30 days | 2x |
| OCPA | Oregon | 100K or 25K + 25% | 45 days | 45 days | Eliminated | 1x |
| CTDPA | Connecticut | 100K or 25K + 25% | 45 days | 60 days | Discretionary | 1x |

## The ICDPA in practice: the three documents

Compliance with the ICDPA rests on three documents that have to agree with each other: the [cookies policy](https://goadopt.io/en/blog/iowa-icdpa-cookies-policy/), which declares every tracker and its purpose; the [privacy policy](https://goadopt.io/en/blog/iowa-icdpa-privacy-policy/), which explains what you do with the data; and the [privacy portal](https://goadopt.io/en/blog/iowa-icdpa-dsar-privacy-portal/), where the consumer exercises their rights and you keep the record of it.

## FAQ: Iowa ICDPA

**1. What is the ICDPA and what is its key differentiator?**
The Iowa Consumer Data Protection Act (Iowa Code § 715D) is Iowa's state personal data protection law. It took effect on January 1, 2025. Its key differentiator is the response deadline for consumer requests: 90 days, with a possible extension of 45 more. This is the longest deadline of all current US state privacy laws, compared to 45 days in Virginia, Oregon, Utah, Connecticut, and other states. The 90-day cure period guaranteed before any AG action is also the longest among state laws.

**2. Why does the ICDPA have a 90-day deadline instead of 45 days like other laws?**
The ICDPA was designed with longer deadlines to reduce operational burden on businesses. § 715D.3(2)(a) explicitly establishes 90 days, which is double the 45-day standard adopted by most US state laws. This means businesses have more time to organize their DSAR processes, authenticate requests, and prepare responses. But the longer deadline for businesses also means consumers wait longer to receive a response.

**3. What distinguishes the ICDPA threshold from Utah's UCPA?**
The UCPA requires businesses to satisfy both the US$ 25 million revenue requirement AND at least one volume threshold (dual requirement). The ICDPA has no minimum revenue requirement. If a business controls or processes data of 100,000 Iowa consumers, it is in scope regardless of revenue. This may bring smaller businesses into ICDPA scope that would be outside UCPA scope. The 25,000 consumer + 50% revenue from data sales threshold is identical in both laws.

**4. Does the ICDPA have a formal opt-out right for targeted advertising?**
The ICDPA lists opt-out from data sales as a formal right in § 715D.3(1)(d), but does not list opt-out from targeted advertising as a formal right in the same way. However, § 715D.4(6) requires that if the controller engages in targeted advertising, it must clearly disclose this and describe the opt-out method. In practice, the controller must offer and accept opt-out requests for targeted advertising in the privacy notice, even though the legal basis is a transparency obligation rather than a formally listed right.

**5. What is the penalty for ICDPA non-compliance?**
The Attorney General may seek an injunction and civil penalties of up to US$ 7,500 per violation (§ 715D.8(3)). Before initiating any action, the AG must notify the controller and grant 90 days to cure. If the controller cures the violation and provides a written statement, no action is initiated. If not cured or if the statement is breached, the AG may proceed. There is no private right of action for consumers (§ 715D.8(4)).

[Ready to bring your website into compliance with the Iowa ICDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


IOWA ICDPA and Cookies: All you need to Know

## **DSAR: What It Means and Why It Matters Under the TDPSA**

The Texas Data Privacy and Security Act (TDPSA) brings several new consumer rights to the forefront and one of the most important is the **Data Subject Access Request** (**DSAR**).

This page covers one piece of the picture. For the full scope of the TDPSA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the TDPSA and cookies](https://goadopt.io/en/blog/texas-tdpsa-and-cookies-all-you-need-to-know/).

If your company processes personal data from Texas residents, you need to understand how DSARs work and what your responsibilities are.

## What is a DSAR?
A **DSAR** is a formal request from a consumer asking a business to **disclose the personal data** it has collected about them.

Under the **TDPSA**, consumers have the right to know what personal information is collected, how it’s used, with whom it’s shared, and why.

Businesses are required to respond to **DSARs** within a reasonable timeframe typically within 45 days.

## **What Information Must Be Provided?**

When a **Data Subject Access Request (DSAR)** is submitted, businesses are legally required to provide a clear and comprehensive summary of the personal data they have collected about the individual.

This includes not only **basic identifiers** like names and contact details but also any sensitive data categories processed, such as health, financial, or biometric data.

Organizations must outline the purpose of the **[data processing](https://goadopt.io/en/blog/best-practices-tag-categorization/)**, where the data was sourced from, and whether it has been shared with third parties. If data has been disclosed, the organization must also identify the recipients or categories of recipients.

All this information must be delivered in a **concise, transparent, intelligible, and easily** accessible formatusually free of charge and within a legally defined timeframe.

Beyond the data itself, organizations must explain the individual's rights under applicable data protection laws, such as the right to rectify inaccurate information, request deletion, or object to certain types of data processing.

Companies must also provide information about **how long personal data will be retained and the logic involved** in any automated decision-making or profiling that affects the individual.

If the data was transferred internationally, especially outside of jurisdictions with strong data protection laws, the response must include the safeguards in place—like Standard Contractual Clauses (**SCCs**) or Binding Corporate Rules (BCRs)—to protect the data during cross-border transfers.

To ensure **compliance**, many businesses rely on privacy management tools or external partners that help automate the **DSAR** response process.

These tools can pull together information from multiple systems, standardize the formatting, and track deadlines, reducing the risk of non-compliance penalties. It's crucial for organizations to have an internal protocol in place to verify the identity of the requester, **especially when dealing with sensitive personal data.**

Failing to fulfill a **DSAR** accurately or on time can lead to reputational damage and fines under laws like the **GDPR**, **CCPA**, or the **TDPSA**. For help in setting up a compliant **DSAR** process, book a meeting with a data privacy expert from **AdOpt.**

## **How Do Users Submit a DSAR?**

Submitting a **Data Subject Access Request (DSAR)** should be a simple and accessible process for users. Most privacy laws, including the **GDPR**, **CCPA**, and **TDPSA**, require businesses to provide at least one easy-to-use method for submitting these requests.

Common channels include web forms, email addresses, privacy portals, or even physical mail. Some companies also integrate **DSAR** options within cookie banners or consent preference centers.

Whatever the method, it must be clearly visible and not require users to jump through unnecessary hoops.

Transparency is key users should know exactly where to go and what to do when they want to exercise their [**privacy rights**](https://goadopt.io/en/blog/how-to-choose-cmp-consent-management-platform/).

Once a user initiates a **DSAR**, the business must verify the identity of the requester to protect against fraud or unauthorized access to personal data.

This verification process might involve confirming account details, sending a confirmation email, or requesting additional information especially for **sensitive data categories**.

However, the business must strike a balance: while **protecting data**, it should not make the verification process intentionally difficult or discourage users from completing their request.

Under most laws, once identity is verified, the organization must respond to the **DSAR** within a specified timeframe **usually 30 to 45 days**, depending on the jurisdiction.

To streamline the process and avoid delays, many businesses use automated **DSAR** workflows or third-party solutions that centralize requests, track deadlines, and ensure consistent responses.

These tools often include templates for standard communication and dashboards to manage compliance risks. In addition to responding within the legal timeframe, businesses must also keep detailed records of each request and how it was resolved.

This documentation is crucial in case of regulatory audits or disputes. If you’re unsure whether your **DSAR** submission process meets compliance requirements, speak with an expert at AdOpt to get guidance tailored to your region and business model.

**DSAR** and Other Consumer Rights

A **Data Subject Access Request (DSAR)** is a powerful tool under the **Texas Data Privacy and Security Act (TDPSA)**, but it’s just one of several rights available to consumers.

The TDPSA is designed to give Texans greater control over their personal data, and understanding these rights helps both individuals and businesses stay **compliant**. Alongside the right to access data through a **DSAR**, Texas residents can also correct inaccurate information, delete personal data, and opt out of specific uses like targeted advertising and data sales.

These rights reflect a growing trend among U.S. states toward broader, more user-centric **data privacy laws.**

The right to correct data means consumers can request a business to fix or update any incorrect personal information it holds. This is crucial for maintaining data **accuracy, especially in sectors like finance, healthcare, or education.**

The **TDPSA** requires businesses to respond to such correction requests within a set timeframe and to clearly communicate any actions taken.

Similarly, the right to deletion allows users to request the removal of their data from a company’s systems.

While some exceptions apply such as for legal obligations or security purposes businesses must honor these requests when possible and explain any denials clearly.

One of the most critical rights under the **TDPSA** is the ability to opt out of the sale of personal data and targeted advertising. This means consumers can say “no” to companies sharing their data with third parties for profit or using it to display behavior-based ads.

To stay compliant, businesses should implement clear and accessible opt-out mechanisms usually via cookie banners or privacy preference centers. If you want to ensure your site offers users the tools they need to opt out and manage consent, learn more about consent management with AdOpt.

These rights work together with DSARs to form a comprehensive, user-first approach to **[data privacy](https://goadopt.io/en/blog/difference-cookies-local-storage-session-storage/)**.

## **How to Handle a DSAR**

Handling a Data Subject Access Request (**DSAR**) properly is a key requirement of the** Texas Data Privacy** and Security Act (**TDPSA**).

Once a request is submitted, businesses are responsible for verifying the identity of the requester to avoid unauthorized data disclosure. This step is **especially important when dealing with sensitive personal data.**

Verification methods can vary, but common options include two-step authentication or confirming details the company already has.

If a request comes through a web form or email, businesses should be sure those channels are **secure and trustworthy.**

After verifying identity, the business must respond to the **DSAR** within 45 days. An additional 45-day extension is allowed if the request is particularly complex or if there’s a high volume of requests but the consumer must be notified about the extension within the initial time frame.

The response should include all relevant data, often in a portable and machine-readable format like CSV or JSON. This ensures the consumer can understand and potentially transfer their data to another service.

If you’re unsure how to structure your **DSAR** response, our guide on how to build a privacy-first UX **[can help](https://goadopt.io/en/blog/what-is-privacy-by-design/)**.

Providing a convenient submission method is also part of compliance.

The **TDPSA** encourages businesses to offer easy-to-access web forms or a dedicated privacy email address. Clear instructions should be included in your privacy policy, along with links to your cookie preferences or consent banner, if relevant.

Failure to fulfill a **DSAR** on time or correctly can lead to investigations or fines from the Texas Attorney General. To avoid enforcement actions, businesses should regularly test their **DSAR** process and ensure every team involved from legal to IT understands their **role.**

**Tools like AdOpt can help simplify this process with built-in DSAR support and consent recordkeeping.**

---

## **Make DSAR Management Easier**
Managing **DSARs** efficiently goes beyond just avoiding legal penalties it’s a powerful way to build **consumer trust.**

By demonstrating that your business takes privacy seriously and handles requests transparently, you foster stronger relationships with customers. One of the most effective ways to streamline **DSAR** management is through automation.

By leveraging tools like AdOpt, you can automatically collect, organize, and respond to requests, saving your team time while ensuring compliance with the Texas Data Privacy and Security Act (**TDPSA**).

Another essential step is maintaining a centralized data inventory. Having a clear understanding of where all customer data resides within your organization makes it easier to respond to **DSARs** **[accurately and promptly](https://goadopt.io/en/blog/best-practices-tag-categorization/)**.

It also helps you avoid unnecessary delays or mistakes that could lead to legal repercussions.

To do this, establish a data governance strategy that categorizes and tracks consumer data from collection to deletion. Integrating this process with your **privacy management** software ensures that all data is organized and easily accessible when needed.

Finally, training internal teams is critical for effective **DSAR** management. All employees, especially those in customer service, IT, and legal, should be familiar with the procedures for handling these requests.

Regular workshops and ongoing education will ensure that your team is well-prepared to respond quickly and accurately to **DSARs**, ensuring continuous **TDPSA** **compliance**.

The smoother your **DSAR** process is, the more confident your customers will be in the **security of their personal data.**



Texas TDPSA: Under the DSAR

MTCDPA Montana and Cookies: All you need to know

## New Hampshire NHDPA: Everything You Need to Know

One more US state has entered the data privacy map.

The New Hampshire Data Privacy Act (NHDPA), codified under RSA 507-H, came into effect on January 1, 2025. It guarantees rights for consumers in the state and creates clear obligations for businesses that process the personal data of those individuals.

If your website serves users from New Hampshire, this guide is for you.

## What is the NHDPA?

The New Hampshire Data Privacy Act (RSA 507-H) is New Hampshire's state-level personal data protection law. It follows the same logic as the major modern privacy regulations: giving people back control over the data companies collect about them.

If you are already familiar with the [LGPD](https://goadopt.io/en/blog/lgpd-general-data-protection-law/), the GDPR, or the CCPA, the NHDPA framework will feel familiar. The differences are in the details, and some of those details matter quite a bit.

Enforcement falls under the Data Privacy Unit within the Consumer Protection and Antitrust Bureau of the New Hampshire Department of Justice. The state's Attorney General holds exclusive authority to enforce the law.

## When did the NHDPA come into effect?

On **January 1, 2025**.

There is no grace period. There are no friendly warnings from regulators. Any business that meets the criteria should already be in compliance.

## Who needs to comply with the NHDPA?

Under RSA 507-H:2, the law applies to persons that conduct business in New Hampshire or produce products or services targeted to state residents and that, during a calendar year:

Control or process personal data of at least **35,000 unique consumers**, excluding data processed solely to complete a payment transaction, or

Control or process personal data of at least **10,000 unique consumers** and derive more than **25% of gross revenue** from the sale of personal data.

The law does not focus on where the business is headquartered. It focuses on who the users are. If you have traffic from New Hampshire and process data from those people at scale, the law may reach you.

Understanding the difference between [controller and processor](https://goadopt.io/en/blog/responsibilities-of-a-data-protection-officer/) is the first step in defining which role your business plays and what your responsibilities are.

### NHDPA Exemptions

Under RSA 507-H:3, the following are exempt:

State and local government bodies and their subdivisions.

Nonprofit organizations.

Higher education institutions.

Financial institutions regulated by the Gramm-Leach-Bliley Act.

Entities regulated by HIPAA.

National securities associations registered with the SEC.

## What is personal data under the NHDPA?

Under RSA 507-H:1, XIX, personal data is any information linked or reasonably linkable to an identified or identifiable individual. This includes name, email, IP address, browsing history, location data, device identifiers, and any information that allows a person to be tracked.

De-identified data and publicly available information are excluded.

A well-executed [data mapping](https://goadopt.io/en/blog/what-is-privacy-by-design/) exercise reveals where this data is being generated and processed in your digital environment.

## What is sensitive data under the NHDPA?

Under RSA 507-H:1, XXVIII, sensitive data includes:

Data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life, sexual orientation, citizenship or immigration status.

Genetic or biometric data processed to identify an individual.

Personal data collected from known children (under 13 as defined by COPPA).

Precise geolocation data (within a radius of 1,750 feet).

Sensitive data cannot be processed without the consumer's explicit prior consent, as required by RSA 507-H:6, I, d.

## Special protection for teenagers between 13 and 15 years old

The NHDPA goes beyond protections for children under 13. RSA 507-H:6, I, g expressly prohibits controllers from processing data of consumers for targeted advertising or data sale purposes without consent when the controller has actual knowledge and deliberately ignores that the consumer is between 13 and 15 years old.

This additional protection for teenagers is a distinguishing feature of the NHDPA compared to other US state laws.

## What are consumer rights under the NHDPA?

Under RSA 507-H:4, the law guarantees residents of New Hampshire the following rights:

**Right to access and confirmation:** knowing whether the business processes their data and obtaining a readable copy.

**Right to correction:** correcting inaccuracies in personal data.

**Right to deletion:** requesting the deletion of data they provided or that was collected about them.

**Right to portability:** obtaining data in a portable, usable format, when processing is carried out by automated means.

**Right to opt-out:** refusing processing for targeted advertising, personal data sale, and profiling with legal or similarly significant effects.

**Right to appeal:** challenging any request denied by the controller.

The controller has **45 days** to respond. The deadline can be extended by another 45 days in complex cases, as long as the consumer is notified within the initial timeframe (RSA 507-H:4, III, a).

Service is **free once per year** per consumer. For requests that are manifestly unfounded, excessive, or repetitive, the business may charge a reasonable fee or refuse, but the burden of proving the excessive nature of the request lies with the business (RSA 507-H:4, III, c).

## Consent: the foundation of the NHDPA

Under RSA 507-H:1, VII, consent is a clear affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreement.

What is not valid consent: accepting general terms of use that contain data processing descriptions alongside unrelated information, hovering over or closing a piece of content, and any agreement obtained through dark patterns.

Dark patterns, defined in RSA 507-H:1, XII, are interfaces designed with the substantial effect of subverting or impairing the autonomy, decision-making, or choice of the user.

### The 15-day deadline to cease processing after revocation

A specific and important point of the NHDPA is in RSA 507-H:6, I, f: after a consumer revokes consent, the business must cease processing the data as soon as practicable, but **no later than 15 days** after receiving the request.

This is a shorter deadline than the DSAR response period and directly impacts how marketing and tracking systems are configured.

## Controller obligations under the NHDPA

Under RSA 507-H:6, the controller must:

Limit data collection to what is adequate, relevant, and reasonably necessary for the stated purposes.

Not process data for purposes incompatible with those disclosed, except with consent.

Implement reasonable technical, administrative, and physical security practices proportionate to the volume and nature of the data.

Not process sensitive data without prior consent.

Not discriminate against consumers who exercise their rights.

Offer a consent revocation mechanism that is as easy to use as the consent mechanism itself.

Provide a clear and meaningful privacy notice covering all elements required by law.

Conduct Data Protection Assessments for high-risk activities.

A [Records of Processing Activities (ROPA)](https://goadopt.io/en/blog/ropa-for-lgpd/) document that is kept up to date records all of these activities and serves as evidence of compliance in the event of an investigation.

## Cookies and the NHDPA

Cookies that collect personal data or allow user identification fall directly within the scope of the NHDPA.

Before firing any non-essential cookie, the website must display a clear [cookie notice](https://goadopt.io/en/blog/operation-of-cookie-banner/), obtain affirmative consent, block trackers until acceptance, and offer real opt-out options without dark patterns.

[Correct tag categorization](https://goadopt.io/en/blog/difference-cookies-local-storage-session-storage/) is what makes it possible to identify which cookies are necessary and which require consent.

The law also requires respect for the opt-out preference signal, such as the Global Privacy Control (GPC), under RSA 507-H:6, V, a, 1, B. But with an important nuance: the signal is only valid when the consumer configured it in an affirmative and voluntary manner, not as an automatic device default.

## Enforcement and penalties

Under RSA 507-H:11, the Attorney General holds exclusive authority to enforce the NHDPA. There is no private right of action.

**In 2025** (RSA 507-H:11, II): the Attorney General was required to issue a notice of violation and give the controller **60 days** to cure before filing a lawsuit.

**From 2026 onward** (RSA 507-H:11, III): the cure period became **discretionary**. The Attorney General may or may not grant the cure period, considering factors such as the number of violations, the size and complexity of the business, the nature of the processing, the risk to the population, and whether the violation was caused by human or technical error. There is no longer an automatic right to an opportunity to correct.

Violations are treated as unfair trade practices under RSA 358-A:2 (New Hampshire Consumer Protection Act), which provides for significant civil [penalties](https://goadopt.io/en/blog/fines-in-LGPD/). The market reference value is up to **US$ 10,000 per violation**.

## How to comply with the NHDPA in practice

### 1. Data mapping
Understand what you collect, where it lives, how it is used, and with whom it is shared. [Data mapping](https://goadopt.io/en/blog/what-is-privacy-by-design/) is the foundation of everything.

### 2. Update your privacy policy
The document must cover all requirements of RSA 507-H:6, III, with the date of the last update clearly visible.

### 3. Implement a functional cookie notice
A [cookie banner](https://goadopt.io/en/blog/how-to-choose-a-cookie-banner-for-your-website/) that blocks, records, respects the GPC as an affirmative choice, and offers real control options.

### 4. Create channels for DSARs
At least one secure and reliable mechanism to receive requests. No requirement for the consumer to create a new account.

### 5. Configure the 15-day deadline
Ensure your systems can cease processing within 15 days of a consent revocation.

### 6. Document everything
ROPA, data protection assessments, processor agreements. This documentation is your defense.

Applying [privacy by design](https://goadopt.io/en/blog/what-is-privacy-by-design/) from the conception of products is what makes compliance sustainable.

## How AdOpt helps with the NHDPA

AdOpt records every consent interaction, blocks trackers before acceptance, automatically respects the GPC when configured by the user, and generates the auditable log you would need to present in an investigation.

The automatic scan identifies all active [trackers](https://goadopt.io/en/blog/gdpr-cookies-explained/) on the site, feeding the data inventory. And when the law changes, the platform updates automatically.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Ready to bring your website into compliance with the NHDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Comparing the NHDPA with other privacy laws

| Law | State | Consumer Volume | Penalty | Effective Date |
|---|---|---|---|---|
| NHDPA | New Hampshire | 35K or 10K + 25% revenue | Up to US$ 10K/violation | Jan 2025 |
| TIPA | Tennessee | 175K or 25K + 50% revenue | US$ 7,500/violation | Jul 2025 |
| TDPSA | Texas | 25K residents | US$ 7,500/violation | Jul 2024 |
| MTCDPA | Montana | 25K residents | US$ 7,500/violation | Oct 2025 |
| CPA | Colorado | 100K residents | US$ 20,000/violation | Jul 2023 |

To understand how these [privacy laws](https://goadopt.io/en/blog/gdpr-lgpd-and-ccpa-what-are-these-laws-similarities-and-differences/) compare in terms of structure, our comparative guide goes deeper on the subject.

## The NHDPA in practice: the three documents

Compliance with the NHDPA rests on three documents that have to agree with each other: the [cookies policy](https://goadopt.io/en/blog/new-hampshire-nhdpa-cookies-policy/), which declares every tracker and its purpose; the [privacy policy](https://goadopt.io/en/blog/new-hampshire-nhdpa-privacy-policy/), which explains what you do with the data; and the [privacy portal](https://goadopt.io/en/blog/new-hampshire-nhdpa-dsar-privacy-portal/), where the consumer exercises their rights and you keep the record of it.

## FAQ: New Hampshire NHDPA

**1. What is the NHDPA and when did it come into effect?**
The New Hampshire Data Privacy Act (RSA 507-H) is New Hampshire's state-level data protection law. It came into effect on January 1, 2025. It guarantees rights to consumers in the state and imposes compliance obligations on businesses that process the personal data of those individuals.

**2. Who needs to comply with the NHDPA?**
Businesses that conduct operations in New Hampshire or target products and services to its residents, and that process data from at least 35,000 unique consumers per year, or from at least 10,000 consumers while deriving more than 25% of revenue from the sale of personal data (RSA 507-H:2).

**3. What is the penalty for non-compliance?**
Violations are treated as unfair trade practices under RSA 358-A:2. The reference value is up to US$ 10,000 per violation. In 2025, there was a guaranteed 60-day cure period. From 2026 onward, the cure period is discretionary and may not be granted (RSA 507-H:11).

**4. How long does a business have to respond to a consumer request?**
45 days from the receipt of an authenticated request. The deadline can be extended by another 45 days in complex cases, with notification within the initial period. For appeals, 60 days. Free once per year per consumer (RSA 507-H:4, III).

**5. What is the deadline to cease processing after consent is revoked?**
15 days from the receipt of the revocation request, under RSA 507-H:6, I, f. This deadline is separate from the DSAR response period and must be factored into the configuration of marketing and tracking systems.

[Want to bring your website into compliance with the NHDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)



New Hampshire NHDPA and Cookies: All you need to know

The Virginia Consumer Data Protection Act (VCDPA), codified at Va. Code § 59.1-575 et seq., came into effect on **January 1, 2023**. It establishes clear rights for state consumers and specific obligations for businesses that process personal data of those individuals.

If your website serves users from Virginia, this guide explains what changes for you.

## What is the VCDPA?

The VCDPA is Virginia's state-level personal data protection law. It follows the logic of the major modern privacy regulations around the world: giving people back control over their own data.

If you are already familiar with the [LGPD](https://goadopt.io/en/blog/lgpd-general-data-protection-law/), the GDPR, or the California CCPA, the VCDPA framework will feel familiar. The law is organized around three pillars: consumer rights, controller obligations, and enforcement by the Attorney General.

Enforcement is the exclusive responsibility of the Virginia Attorney General. There is no private right of action for consumers.

## When did the VCDPA come into effect?

On **January 1, 2023**.

Virginia was a pioneer among US states, passing the law in 2021 and giving businesses nearly two years to comply. That does not mean enforcement is lenient, only that the runway was generous.

## Who needs to comply with the VCDPA?

Under Va. Code § 59.1-576, the law applies to persons that conduct business in Virginia or produce products or services targeted to state residents and that, during a calendar year:

Control or process personal data of at least **100,000 consumers**, or

Control or process personal data of at least **25,000 consumers** and derive more than **50% of gross revenue** from the sale of personal data.

The focus is not on where the business is headquartered. It is on who the users are. If your site has Virginia traffic at scale, the law may reach you regardless of where your business operates.

Understanding the difference between [controller and processor](https://goadopt.io/en/blog/responsibilities-of-a-data-protection-officer/) is the first step in defining which role your business plays in the processing relationship.

### VCDPA Exemptions

Under Va. Code § 59.1-576 B, the following are exempt:

State and local government bodies and their political subdivisions.

Financial institutions regulated by the Gramm-Leach-Bliley Act (Title V).

Covered entities and business associates regulated by HIPAA.

Nonprofit organizations.

Institutions of higher education.

Also exempt are specific categories of data, including protected health information under HIPAA, data regulated by FERPA, consumer credit information regulated by the FCRA, and employee and job applicant data when used in that capacity.

## What is personal data under the VCDPA?

Under Va. Code § 59.1-575, personal data is any information linked or reasonably linkable to an identified or identifiable natural person. This includes name, email address, IP address, browsing history, location data, device identifiers, and any information that allows a person to be tracked.

De-identified data and publicly available information are excluded.

A thorough [data mapping](https://goadopt.io/en/blog/what-is-privacy-by-design/) exercise reveals where this data is being generated and processed in your digital environment.

## What is sensitive data under the VCDPA?

Under Va. Code § 59.1-575, sensitive data includes:

Personal data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status.

Genetic or biometric data processed to uniquely identify an individual.

Personal data collected from known children (under 13 years of age).

Precise geolocation data (within a radius of 1,750 feet).

Sensitive data cannot be processed without the consumer's explicit consent, under Va. Code § 59.1-578 A, 5.

## Special protection for minors on social media platforms

Starting **January 1, 2026**, the VCDPA includes a specific section for operators of social media platforms (Va. Code § 59.1-577.1).

"Minor," for purposes of this section, is any person under **16 years of age** (not 13, but 16).

Social media platform operators must:

Use commercially reasonable methods, such as a neutral age screen mechanism, to determine whether a user is a minor.

Limit minors' use to **1 hour per day** per service or application.

Allow parents or legal guardians to give verifiable parental consent to increase or decrease the daily time limit.

Use data collected for age determination solely for that purpose, without applying it to other processing operations.

This is one of the most concrete protections for teenagers among US state privacy laws, with direct impact on platforms such as social networks, entertainment apps, and any service that enables social online interaction.

## What are consumer rights under the VCDPA?

Under Va. Code § 59.1-577, the law guarantees Virginia residents five main rights:

**Right to access and confirmation:** knowing whether the business processes their data and obtaining a copy in an accessible format.

**Right to correction:** correcting inaccuracies in personal data, considering the nature of the data and the purposes of processing.

**Right to deletion:** requesting the deletion of data the consumer provided or that was obtained about them.

**Right to portability:** obtaining data in a portable and, where technically feasible, readily usable format, when processing is carried out by automated means.

**Right to opt-out:** refusing the processing of personal data for targeted advertising, sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.

The controller has **45 days** to respond. The deadline can be extended by another 45 days when reasonably necessary, considering complexity and volume of requests, as long as the consumer is notified within the initial period with the justification (Va. Code § 59.1-577 B, 1).

Service is **free up to twice per year** per consumer. For requests that are manifestly unfounded, excessive, or repetitive, the business may charge a reasonable fee or decline, but the burden of demonstrating the excessive nature lies with the business (Va. Code § 59.1-577 B, 3).

### Right to appeal

Under Va. Code § 59.1-577 C, the controller must establish a process for the consumer to appeal denial decisions. The process must be conspicuously available and similar to the original request submission mechanism.

The business has **60 days** to respond to the appeal in writing, including the decision and the reasoning. If the appeal is denied, the consumer must be informed about how to contact the Attorney General to submit a complaint.

## Consent: what the VCDPA requires

Under Va. Code § 59.1-575, consent is a clear affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreement. It may include a written statement, including by electronic means, or any other unambiguous affirmative action.

The correct standard for cookies: non-essential technologies off by default, with the user choosing what to enable, not what to disable.

## Controller obligations under the VCDPA

Under Va. Code § 59.1-578, the controller must:

Limit collection to what is adequate, relevant, and reasonably necessary for the disclosed purposes.

Not process data for purposes incompatible with those disclosed, except with consumer consent.

Implement reasonable technical, administrative, and physical data security practices proportionate to the volume and nature of the data.

Not process data in violation of anti-discrimination laws. Not discriminate against consumers who exercise their rights.

Not process sensitive data without prior consent.

For known children: compliance with COPPA's verifiable parental consent requirements constitutes compliance with the VCDPA's parental consent obligations.

Provide a reasonably accessible, clear, and meaningful privacy notice covering all elements required by law.

Establish at least one secure and reliable means for consumers to submit rights requests, without requiring the creation of a new account.

Conduct and document Data Protection Assessments for high-risk activities.

## Cookies and the VCDPA

Cookies that collect personal data or allow user identification fall directly within the scope of the VCDPA.

Before firing any non-essential cookie, the site must display a clear [cookie notice](https://goadopt.io/en/blog/operation-of-cookie-banner/), obtain affirmative consent, block trackers until acceptance, and offer real opt-out options.

[Correct tag categorization](https://goadopt.io/en/blog/difference-cookies-local-storage-session-storage/) is what makes it possible to identify which cookies are necessary and which require consent.

If the site uses advertising pixels or any targeted advertising tool (Va. Code § 59.1-575 defines targeted advertising as ads based on consumer activities across non-affiliated websites over time), the law requires clear and conspicuous disclosure of this practice, along with an accessible opt-out mechanism (Va. Code § 59.1-578 D).

## Data Protection Assessments

Under Va. Code § 59.1-580, the controller must conduct and document Data Protection Assessments for:

Processing personal data for targeted advertising.

Sale of personal data.

Processing for profiling where there is a reasonably foreseeable risk of harm to consumers.

Processing sensitive data.

Any processing presenting a heightened risk of harm.

Since 2024, the assessment requirement has been expanded to include online services directed at children (Va. Code § 59.1-580 B).

Assessments are confidential and exempt from public disclosure. The Attorney General may request access via civil investigative demand, and disclosure in response to such a request does not constitute waiver of attorney-client privilege.

## Enforcement and penalties

Under Va. Code § 59.1-584, the Virginia Attorney General has exclusive authority to enforce the VCDPA. There is no private right of action.

Before initiating any action, the Attorney General must send **written notice** identifying the specific violations and granting **30 days to cure**. If the controller cures the violation within the period and provides a written statement that the violations have been cured and will not recur, no action is initiated.

If the violation continues after the cure period or the controller breaches the written statement provided, the Attorney General may seek:

Injunctive relief to stop the violations.

Civil penalties of up to **US$ 7,500 per violation**.

Recovery of reasonable investigation and case preparation expenses, including attorney fees.

## How to comply with the VCDPA in practice

### 1. Data mapping
Understand what you collect, where it lives, how it is used, and with whom it is shared. [Data mapping](https://goadopt.io/en/blog/what-is-privacy-by-design/) is the foundation of any compliance program.

### 2. Update your privacy policy
The document must cover all five required information categories under Va. Code § 59.1-578 C.

### 3. Implement a functional cookie notice
A [cookie banner](https://goadopt.io/en/blog/how-to-choose-a-cookie-banner-for-your-website/) that blocks non-essential trackers before acceptance, records consent, and offers real control options.

### 4. Create channels for DSARs
At least one secure and reliable mechanism to receive requests. No new account creation required.

### 5. Document Data Protection Assessments
For each high-risk activity, conduct and document the assessment as required by Va. Code § 59.1-580.

### 6. Prepare for the cure period
The 30-day cure period is guaranteed by law, but it is not a compliance strategy. Having processes structured from the start is what makes correction within the deadline viable.

Applying [privacy by design](https://goadopt.io/en/blog/what-is-privacy-by-design/) from product conception is what makes compliance sustainable over time.

## How AdOpt helps with the VCDPA

AdOpt records every consent interaction, blocks trackers before acceptance, and generates the auditable log you would need to present in an Attorney General investigation.

The automatic scan identifies all active [trackers](https://goadopt.io/en/blog/gdpr-cookies-explained/) on the site, feeding the data inventory required for the privacy notice and the Data Protection Assessments. And when the law changes, the platform updates automatically.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Ready to bring your website into compliance with the VCDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Comparing the VCDPA with other privacy laws

| Law | State | Consumer Volume | Penalty | Cure Period | Effective Date |
|---|---|---|---|---|---|
| VCDPA | Virginia | 100K or 25K + 50% revenue | Up to US$ 7,500/violation | 30 days guaranteed | Jan 2023 |
| NHDPA | New Hampshire | 35K or 10K + 25% revenue | Up to US$ 10K/violation | Discretionary (2026) | Jan 2025 |
| TDPSA | Texas | 25K residents | Up to US$ 7,500/violation | 30 days (2024) | Jul 2024 |
| MTCDPA | Montana | 25K residents | Up to US$ 7,500/violation | 60 days | Oct 2024 |
| CPA | Colorado | 100K or 25K + 50% revenue | Up to US$ 20K/violation | Discretionary (2025) | Jul 2023 |

To understand how these [privacy laws](https://goadopt.io/en/blog/gdpr-lgpd-and-ccpa-what-are-these-laws-similarities-and-differences/) compare in terms of structure and practical impact, our comparative guide goes deeper on the subject.

## The VCDPA in practice: the three documents

Compliance with the VCDPA rests on three documents that have to agree with each other: the [cookies policy](https://goadopt.io/en/blog/virginia-vcdpa-cookies-policy/), which declares every tracker and its purpose; the [privacy policy](https://goadopt.io/en/blog/virginia-vcdpa-privacy-policy/), which explains what you do with the data; and the [privacy portal](https://goadopt.io/en/blog/virginia-vcdpa-dsar-privacy-portal/), where the consumer exercises their rights and you keep the record of it.

## FAQ: Virginia VCDPA

**1. What is the VCDPA and when did it come into effect?**
The Virginia Consumer Data Protection Act (Va. Code § 59.1-575 et seq.) is Virginia's state-level personal data protection law. It came into effect on January 1, 2023. It establishes rights for consumers residing in the state and compliance obligations for businesses that process the personal data of those individuals.

**2. Who needs to comply with the VCDPA?**
Businesses that conduct operations in Virginia or produce products and services targeted to its residents, and that control or process personal data of at least 100,000 consumers per year, or of at least 25,000 consumers while deriving more than 50% of gross revenue from the sale of personal data (Va. Code § 59.1-576 A).

**3. What is the penalty for non-compliance?**
The Attorney General may seek civil penalties of up to US$ 7,500 per violation, plus recovery of investigation costs and attorney fees. Before initiating any action, written notice with a 30-day cure period is mandatory. There is no private right of action (Va. Code § 59.1-584).

**4. How long does a business have to respond to a consumer request?**
45 days from receipt of an authenticated request. The deadline can be extended by another 45 days when reasonably necessary, with notification within the initial period. Service is free up to twice per year per consumer. For appeals, 60 days (Va. Code § 59.1-577 B and C).

**5. What are the consumer rights under the VCDPA?**
Consumers have five rights: access and confirmation, correction, deletion, portability, and opt-out of processing for targeted advertising, data sale, and profiling with legal or similarly significant effects. They also have the right to appeal any denial decision by the controller (Va. Code § 59.1-577).

[Ready to bring your website into compliance with the VCDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


Virginia VCDPA and Cookies: All you need to know

The California Privacy Rights Act (CPRA) has a set of requirements for the privacy policy that goes further than any other US state law.

This page covers one piece of the picture. For the full scope of the CPRA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the CPRA and cookies](https://goadopt.io/en/blog/california-cpra-and-cookies-all-you-need-to-know/).

It is not just about what the document must contain. It is about two specific links that must be visible on every page of the site. It is about specifying data retention periods. It is about an entirely new category of sensitive data with its own rules.

This article focuses exclusively on what the CPRA requires from the Privacy Policy, based on the official text of the law.

## What the CPRA calls a Privacy Policy

The law uses the term "privacy policy." In California, legal tradition requires this document to be accessible on the homepage and on any page where personal information is collected.

The CPRA significantly expands what the original CCPA required. If your privacy policy was written for the 2020 CCPA, it is likely outdated on several critical points.

## What must be in the Privacy Policy under the CPRA

### 1. Categories of personal information collected

The document must list the categories of personal information the business collects (Civil Code § 1798.100).

This includes: identifiers (name, email, IP), legally protected characteristics, commercial information, biometric data, geolocation data, internet activity data, audio or visual data, professional information, education information, and inferences used to create consumer profiles.

### 2. Categories of sensitive personal information (SPI) collected

This is the CPRA's major innovation. The document must specifically identify whether the business collects sensitive personal information (Civil Code § 1798.121).

SPI includes: precise geolocation, financial account data with credentials, private communications, genetic data, biometric data, health data, sex life or sexual orientation, racial or ethnic origin, religious beliefs, and union membership.

If the business collects SPI, the policy must:

List the categories of SPI collected.

Describe the purposes for which SPI is used.

State whether use is limited to essential purposes or exceeds that.

Explain how the consumer can exercise the right to limit SPI use.

### 3. The purposes of processing

The document must describe the purposes for which categories of personal information are collected and used (Civil Code § 1798.100).

Purposes must be specific. "Improve our services" is not adequate. "Browsing behavior data collected via analytics cookies to identify pages with high abandonment rates and prioritize usability improvements" is the correct level of specificity.

### 4. Data retention periods

This is a new requirement that the original CCPA did not have and that the CPRA explicitly introduced.

The document must inform how long each category of personal information is retained, or the criteria used to determine that period (Civil Code § 1798.130 a(5)(A)).

The CPRA prohibits retaining personal information beyond what is necessary for the disclosed purposes. This has direct impact on businesses that were simply accumulating data without a cleanup schedule.

### 5. Consumer rights and how to exercise them

The document must describe all rights guaranteed by the CPRA and how consumers can exercise them (Civil Code § 1798.130).

Rights under the CPRA include:

Right to know: categories and specific information collected, sources, purposes, and third parties.

Right to access: a copy of information collected in the past 12 months.

Right to deletion: request deletion, with exceptions.

Right to correct: correction of inaccurate personal information (new under CPRA).

Right to portability: data in a usable format.

Right to opt-out of sale and sharing: refuse sale and sharing for cross-context behavioral advertising.

Right to limit SPI use: limit use of sensitive information to essential purposes (new under CPRA).

Right to non-discrimination: no penalties for exercising rights.

For each right, the policy must describe the submission channel and the response process within 45 days.

### 6. Categories of personal information shared with third parties

The document must identify the categories of personal information disclosed to third parties for business purposes, and the categories of third parties to whom that information was disclosed (Civil Code § 1798.130).

This covers analytics platforms, advertising tools, CRMs, payment processors, and any external service receiving user data.

### 7. Sale and sharing of data: required disclosure

If the business sells or shares personal information, the policy must identify:

The categories of personal information sold or shared.

The categories of third parties to which information was sold or shared.

Whether the business sells or shares personal information of consumers under 16 (with confirmation that opt-in was obtained, where applicable).

"Sharing" under the CPRA means disclosing personal information for cross-context behavioral advertising even without direct payment. This includes sharing data with advertising networks via pixels, even if the business receives no money for that specific sharing.

### 8. The two mandatory links on the site

Beyond the content of the policy, the CPRA requires two links that must be visible on the homepage and on any page where personal information is collected:

**"Do Not Sell or Share My Personal Information"**: for opt-out of selling and sharing data for cross-context behavioral advertising.

**"Limit the Use of My Sensitive Personal Information"**: for consumers to limit use of sensitive information to essential purposes.

These links may be combined into a single link if both opt-out options are available on the same destination page.

The privacy policy must describe these links and how they work.

## The sensitive personal information category: additional requirements

The CPRA created a new layer of control for sensitive personal information that did not exist in the CCPA.

The business may use SPI only for essential purposes, unless the consumer has not exercised the limitation right. Essential purposes include: providing the requested service or product, security and integrity, debugging, reasonable internal research, and legal compliance.

If the business uses SPI for purposes beyond those, the policy must make that explicit and the consumer must have the option to limit that additional use.

The retention period for SPI must be specified. And sensitive information cannot be retained beyond what is necessary for the declared purpose.

## Protection for minors: what the policy must cover

The CPRA has specific minor protections that must be reflected in the privacy policy.

For **consumers under 16**: the business cannot sell or share personal information without active opt-in. The policy must describe how this opt-in is obtained.

For **consumers under 13**: consent must be given by parents or legal guardians. The policy must describe the parental consent process.

If a consumer under 16 declines consent for sale or sharing, the business must wait 12 months before requesting consent again. The policy must mention this rule.

Penalties for violations involving data of consumers under 16 are tripled and automatic. This should motivate special attention to this segment in the policy.

## Cookies and advertising: what the policy must say

The CPRA expanded "selling" to include "sharing." This directly impacts how the privacy policy describes the use of advertising cookies.

If the site uses Meta Pixel, Google Ads, TikTok Pixel or any pixel that sends behavioral data to external advertising networks, this may constitute "sharing" of personal information under the CPRA, even if the business receives no direct payment for those specific data.

The policy must:

Identify the types of cookies and trackers used.

State whether data is shared with third parties for cross-context behavioral advertising.

Describe how the consumer can opt out of sharing (via the "Do Not Sell or Share" link or the GPC).

The site's [cookie notice](https://goadopt.io/en/blog/operation-of-cookie-banner/) must align with what is described in the privacy policy.

## Data Protection Assessments: what the policy needs to address

The CPRA requires businesses to conduct periodic privacy risk assessments for high-risk activities, including processing of SPI, selling and sharing of data, and processing presenting significant risk to consumer rights.

Assessments do not need to be published in the policy, but the policy should state that the business conducts privacy risk assessments for high-risk activities as part of its compliance program.

The CPPA may request these assessments during investigations.

## Non-discrimination and loyalty programs

The CPRA prohibits discrimination against consumers who exercise their rights, including denying goods or services, charging different prices, or offering lower quality.

The exception is loyalty, rewards, premium features, or discount programs where the price or quality difference is reasonably related to the value the business derives from the consumer's data, provided the consumer participates voluntarily.

The privacy policy must describe this non-discrimination policy and any applicable exceptions.

## How AdOpt supports CPRA compliance

AdOpt ensures that what is written in the policy has real correspondence with what actually happens on the site.

The automatic scan identifies all active technologies, feeding the list of data categories and third parties that must appear in the document. The [consent management platform](https://goadopt.io/en/blog/how-to-choose-cmp-consent-management-platform/) ensures that opt-out links work as described, the GPC is honored automatically, and opt-out records are available for audit.

Every interaction is logged. If the CPPA requests evidence, the record is available.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Privacy Policy for your site that complies with the CPRA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what the Privacy Policy must contain for the CPRA

**Visible and accessible link** on the homepage and on all pages where personal information is collected.

**"Do Not Sell or Share My Personal Information"** link visible on homepage (Civil Code § 1798.120).

**"Limit the Use of My Sensitive Personal Information"** link visible on homepage if SPI is collected (Civil Code § 1798.121).

**Categories of personal information collected**, with specific description of each category (Civil Code § 1798.100).

**Categories of sensitive personal information (SPI)** collected, if applicable (Civil Code § 1798.121).

**Purposes of processing** for each category, without vague descriptions.

**Retention periods** for each data category, or criteria used to determine retention (Civil Code § 1798.130 a(5)(A)).

**All consumer rights** listed with submission process and 45-day response deadline.

**Free service** for up to two requests per consumer per year (Civil Code § 1798.130 a(3)).

**Categories of personal information sold or shared** and categories of recipient third parties.

**Protection for consumers under 16**: mandatory opt-in for sale and sharing.

**Protection for consumers under 13**: parental consent.

**12-month waiting rule** after minors under 16 decline consent.

**Non-discrimination policy** for consumers exercising their rights.

**Reference to privacy risk assessments** for high-risk activities.

## FAQ: CPRA and Privacy Policy

**1. My privacy policy was written for the CCPA. What are the main updates needed for the CPRA?**
The main updates are: add the sensitive personal information (SPI) category with its specific rules; describe the new right to correct data; describe the right to limit SPI use; include retention periods for each data category; update the "selling" section to include "sharing" for cross-context behavioral advertising; add the two mandatory links ("Do Not Sell or Share" and "Limit Use of SPI"); and reference the CPPA as the regulatory agency instead of the Attorney General.

**2. What are the "Do Not Sell or Share" and "Limit the Use of My Sensitive Personal Information" links?**
These are two links the CPRA requires to be visible on the homepage and on any page where personal information is collected. The first ("Do Not Sell or Share My Personal Information") allows consumers to opt out of selling and sharing personal information for cross-context behavioral advertising. The second ("Limit the Use of My Sensitive Personal Information") allows consumers to restrict use of sensitive personal information to essential purposes. Both links may be combined into a single link if both options are on the same destination page.

**3. Why does the CPRA require specifying data retention periods in the privacy policy?**
The CPRA introduced an explicit prohibition on retaining personal information beyond what is necessary for the declared purposes. As a result, businesses must know how long they retain each data category and communicate that to consumers. Civil Code § 1798.130 a(5)(A) requires the policy to specify retention periods or criteria used to determine them. This rule closes a gap that existed under the CCPA, where businesses could accumulate data indefinitely.

**4. What changes for data of teenagers aged 13 to 15 under the CPRA?**
The CCPA already required opt-in for selling data of consumers under 16. The CPRA added a new rule: if a consumer under 16 declines consent for selling or sharing their data, the business must wait 12 months before making a new consent request. This prevents businesses from repeatedly re-presenting the consent request. Penalties for violations involving data of consumers under 16 are tripled and automatic.

**5. Does the CPRA have a private right of action? In what situations can consumers sue the business directly?**
Yes. The CPRA preserves and expands the private right of action introduced by the CCPA. Consumers can sue the business directly when there is an unauthorized data breach resulting in unauthorized access, theft, disclosure, use, modification, or destruction of unencrypted, unredacted personal information. Categories include Social Security numbers, financial account credentials, debit or credit card data with security codes, medical information, health insurance information, and other categories specified in the law. Minimum damages per consumer per incident are US$ 100 to US$ 750, or actual damages, whichever is greater. Class actions are permitted.

[Ready to build a Privacy Policy for your site that complies with the CPRA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


California CPRA: Privacy Policy

Utah is the most business-friendly state in the US privacy landscape.

The Utah Consumer Privacy Act (UCPA), Utah Code § 13-61-101 et seq., took effect on **December 31, 2023**. It is the leanest state privacy law among those approved so far in the US, with fewer obligations for businesses and stronger protection for the traditional business model.

But "lean" does not mean ignorable. The US$ 25 million revenue threshold creates a well-defined scope, and the Utah Attorney General has exclusive enforcement authority.

## What is the UCPA?

The Utah Consumer Privacy Act is Utah's state personal data protection law. It grants basic rights to state residents and creates obligations for businesses that process their data.

Enforcement follows a two-stage model: the Division of Consumer Protection receives and investigates consumer complaints. If it finds substantial evidence of a violation, it refers to the **Utah Attorney General**, who has exclusive authority to initiate enforcement actions.

There is no private right of action.

## When did the UCPA take effect?

On **December 31, 2023**.

## Who must comply with the UCPA?

Under Utah Code § 13-61-102(1), the law applies to controllers or processors that:

Conduct business in Utah or produce products or services targeted to state residents;

Have **annual revenue of US$ 25,000,000 or more**; and

Meet at least one of the following thresholds:

Control or process personal data of **100,000 or more consumers** during a calendar year; or

Derive more than **50% of gross revenue** from the sale of personal data and control or process personal data of **25,000 or more consumers**.

**The key differentiator from other laws:** the UCPA requires the business to satisfy the US$ 25 million revenue requirement AND at least one of the volume thresholds. Other state laws use one or the other. Here both are needed. This significantly reduces the number of businesses in scope.

Understanding the distinction between [controller and processor](https://goadopt.io/en/blog/responsibilities-of-a-data-protection-officer/) is fundamental to defining responsibilities in the processing chain.

### UCPA Exemptions

Under Utah Code § 13-61-102(2), the following are exempt:

Government entities and third parties contracted on their behalf.

Native American tribes.

Institutions of higher education.

Nonprofit corporations.

HIPAA covered entities and business associates.

HIPAA-protected health information and related health data in specific situations.

Regulated clinical research data.

Consumer credit data regulated by the Fair Credit Reporting Act.

Financial institutions and data regulated by the Gramm-Leach-Bliley Act.

Data regulated by the Driver's Privacy Protection Act.

Data regulated by FERPA.

Data regulated by the Farm Credit Act.

Employee, job applicant, and independent contractor data in an employment context.

Data processed for purely personal or household purposes.

Air carriers.

## What is personal data under the UCPA?

Under Utah Code § 13-61-101(24), personal data is any information linked or reasonably linkable to an identified individual or an identifiable individual.

Not personal data: de-identified data, aggregated data, and publicly available information.

The UCPA also defines pseudonymous data (§ 13-61-101(28)) as personal data that cannot be attributed to a specific individual without additional information kept separately and under appropriate technical and organizational measures. Pseudonymous data has limited protection under the UCPA.

## What is sensitive data under the UCPA?

Under Utah Code § 13-61-101(32), sensitive data includes:

Personal data revealing racial or ethnic origin, religious beliefs, sexual orientation, citizenship or immigration status, or information about medical history, physical or mental health condition, or medical treatment or diagnosis.

Processing of genetic personal data or biometric data, where the processing is for the purpose of identifying a specific individual.

Specific geolocation data.

**Note on the UCPA's sensitive data model:** unlike the CPRA and several other state laws, the UCPA does not require consent to process sensitive data. It only requires the business to present a clear notice and offer an opt-out opportunity before processing. This is one of the aspects that makes the UCPA more business-friendly than other state laws.

For data of known children (under 13), businesses must comply with COPPA requirements (§ 13-61-102(3)).

## What is specific geolocation data under the UCPA?

Under Utah Code § 13-61-101(33), specific geolocation data means information derived from technology, including GPS coordinates, that directly identifies an individual's specific location with a precision of **1,750 feet or less**.

## What are consumer rights under the UCPA?

Under Utah Code § 13-61-201, Utah residents have four rights:

**Right to confirm and access:** confirm whether the controller is processing personal data and access that data (§ 13-61-201(1)).

**Right to deletion:** request deletion of personal data the consumer provided to the controller. Note: the UCPA limits the deletion right to data the consumer provided. Data the controller obtained from other sources does not need to be deleted under the UCPA (§ 13-61-201(2)).

**Right to portability:** obtain a copy of the data in a portable format where technically feasible, for transmission to another controller without impediment (§ 13-61-201(3)).

**Right to opt-out:** refuse processing of personal data for targeted advertising or sale of personal data (§ 13-61-201(4)).

### What the UCPA does not include compared to other laws

No right to correct inaccurate data. The UCPA does not guarantee this right, unlike the CPRA, OCPA, VCDPA, and CTDPA.

No right to opt-out of profiling. The UCPA covers only targeted advertising and data sales.

No formal structured appeal process. The law does not define an appeal process for controller denials.

## Response deadlines for requests

Under Utah Code § 13-61-203:

**45 days** to respond from receipt of the request.

Extension of **+45 days** when reasonably necessary due to complexity or volume, with notification within the initial period.

**Free for the first request** from each consumer per 12-month period (§ 13-61-203(4)(a)).

From the second request in the same 12-month period, the business may charge a reasonable fee or refuse if the request is excessive, repetitive, technically infeasible, manifestly unfounded, or if the controller reasonably believes the primary purpose is not exercising a right.

## Sensitive data: opt-out, not consent

This is one of the most important points of the UCPA for businesses already compliant with other laws.

Under Utah Code § 13-61-302(3), the controller may not process sensitive data collected from a consumer without first:

Presenting the consumer with a clear notice; and

Offering the consumer the opportunity to opt out of the processing.

This opt-out model for sensitive data is substantially less restrictive than the opt-in (prior consent) model required by the CPRA, OCPA, CTDPA, and VCDPA. Businesses already compliant with the more restrictive laws will automatically be compliant with the UCPA on this point.

## Controller obligations under the UCPA

Under Utah Code § 13-61-302, the controller must:

**Privacy notice:** provide a reasonably accessible and clear privacy notice including: categories of personal data processed, purposes of processing, how consumers can exercise their rights, categories of data shared with third parties (if any), and categories of third parties with whom data is shared.

**Data security:** establish, implement, and maintain reasonable administrative, technical, and physical data security practices proportionate to the volume and nature of the data.

**Disclosure of sale and targeted advertising:** if the business sells data or uses data for targeted advertising, it must clearly and conspicuously inform the consumer and provide an opt-out mechanism.

**Non-discrimination:** may not discriminate against consumers who exercise their rights.

**Processor contracts:** before engaging processors, the controller must enter into contracts with specific requirements including processing instructions, confidentiality obligations, and subcontractor requirements.

## Cookies and the UCPA

Cookies that collect personal data or allow user identification fall within the UCPA's scope.

The site must display a clear [cookie notice](https://goadopt.io/en/blog/operation-of-cookie-banner/), provide an opt-out mechanism for targeted advertising and data sales, and describe in the privacy notice how consumers can exercise their rights.

[Correct tag categorization](https://goadopt.io/en/blog/best-practices-tag-categorization/) is what makes it possible to identify which cookies constitute targeted advertising or data sales.

The UCPA defines targeted advertising in § 13-61-101(34) as ads selected based on data obtained from the consumer's activities over time and across non-affiliated websites or applications. Ads based on activities within the controller's own site do not qualify.

**The UCPA does not require honoring the GPC.** Unlike the CPRA (California) and CTDPA (Connecticut), the UCPA does not mention the obligation to honor universal opt-out signals such as the Global Privacy Control. However, implementing the GPC is a best practice that covers requirements in other jurisdictions.

## Enforcement and penalties

Under Utah Code § 13-61-402, the Utah Attorney General has exclusive enforcement authority.

The process follows two stages:

**Stage 1:** the consumer files a complaint with the Division of Consumer Protection. The Division investigates and, if it finds substantial evidence of a violation, refers to the Attorney General.

**Stage 2:** the AG notifies the controller in writing, identifying violations and providing **30 guaranteed days to cure**.

If the controller cures the violation within 30 days and provides a written statement that the violation has been cured and will not recur, no action is initiated.

If the violation continues or the controller breaches the provided statement, the AG may initiate action and recover:

Actual damages to the consumer.

Up to **US$ 7,500 per violation**.

The 30-day cure period is **guaranteed permanently** by the UCPA, unlike other laws such as the OCPA and CPRA that have eliminated the cure period. This makes UCPA enforcement more predictable for businesses.

## How AdOpt helps with the UCPA

AdOpt records every consent and opt-out interaction, blocks trackers before acceptance, and generates the auditable log needed in an Attorney General investigation.

The automatic scan identifies all active [trackers](https://goadopt.io/en/blog/gdpr-cookies-explained/) on the site, feeding the data inventory required for the privacy notice. And when the law changes, the platform updates automatically.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Ready to bring your website into compliance with the Utah UCPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Comparing UCPA with other privacy laws

| Law | State | Threshold | Sensitive Data | Right to Correct | Cure Period | Effective Date |
|---|---|---|---|---|---|---|
| UCPA | Utah | US$ 25M + 100K or 25K + 50% | Opt-out (prior notice) | Not provided | 30 days guaranteed | Dec 2023 |
| OCPA | Oregon | 100K (excl. payments) or 25K + 25% | Opt-in (consent) | Provided | Eliminated (Jan 2026) | Jul 2024 |
| CTDPA | Connecticut | 100K (excl. payments) or 25K + 25% | Opt-in (consent) | Provided | Discretionary | Jul 2023 |
| VCDPA | Virginia | 100K or 25K + 50% | Opt-in (consent) | Provided | 30 days guaranteed | Jan 2023 |
| CPRA | California | US$ 25M or 100K or 50% | Opt-in + SPI limitation | Provided | Eliminated | Jan 2023 |

## The UCPA in practice: the three documents

Compliance with the UCPA rests on three documents that have to agree with each other: the [cookies policy](https://goadopt.io/en/blog/utah-ucpa-cookies-policy/), which declares every tracker and its purpose; the [privacy policy](https://goadopt.io/en/blog/utah-ucpa-privacy-policy/), which explains what you do with the data; and the [privacy portal](https://goadopt.io/en/blog/utah-ucpa-dsar-privacy-portal/), where the consumer exercises their rights and you keep the record of it.

## FAQ: Utah UCPA

**1. What makes the UCPA different from other US state privacy laws?**
The UCPA is the most business-friendly state privacy law among those approved in the US so far. Key differences: requires both US$ 25M revenue AND at least one volume threshold (dual requirement), while other laws use one or the other; uses opt-out for sensitive data, while most other laws require opt-in (consent); no right to correct data; no right to opt-out of profiling; and maintains a guaranteed 30-day cure period permanently, while other laws are eliminating that period.

**2. Why does the UCPA use opt-out for sensitive data instead of opt-in?**
The UCPA reflects the Utah legislature's philosophy of creating a law that protects consumers without creating excessive barriers for businesses. The opt-out model for sensitive data (Utah Code § 13-61-302(3)) requires the business to inform the consumer and give them the opportunity to refuse, but does not require active prior consent. This is significantly less restrictive than the consent standard required by the CPRA, OCPA, and other laws.

**3. Does the UCPA have a right to correct inaccurate data?**
No. This is one of the most notable absent rights in the UCPA. The law only guarantees four rights: confirm/access, deletion (limited to data provided by the consumer), portability, and opt-out from targeted advertising and data sales. Correction of inaccurate data is not among them, distinguishing the UCPA from the VCDPA, OCPA, CTDPA, and CPRA.

**4. What does the limited deletion right in the UCPA mean?**
The UCPA's deletion right (§ 13-61-201(2)) applies only to personal data the consumer provided to the controller. Data the controller obtained from other sources, such as data brokers, third-party lists, or inferences created from other data, do not need to be deleted under the UCPA. This is a significant difference from the OCPA and CTDPA, which require deletion of data from any source.

**5. What is the penalty for UCPA non-compliance?**
The Attorney General can recover actual consumer damages and up to US$ 7,500 per violation. Before initiating any action, the AG is required to notify the controller and grant 30 days to cure (§ 13-61-402(3)). This 30-day period is guaranteed permanently by the UCPA. If the controller cures the violation and provides a written statement, no action is initiated. There is no private right of action for consumers (§ 13-61-305).

[Ready to bring your website into compliance with the Utah UCPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


Utah UCPA and Cookies: All you need to know

Montana MTCDPA: DSAR Policy

## **Why Every Business Today Needs an Effective CMP**

In today’s digital landscape, **privacy** is paramount. With regulations such as **[GDPR](https://goadopt.io/en/blog/gdpr-legal-basis/)** and **[LGPD](https://goadopt.io/en/blog/gdpr-lgpd-and-ccpa-what-are-these-laws-similarities-and-differences/)**, businesses must prioritize **[consent management](https://goadopt.io/en/blog/operation-of-cookie-banner/)** to protect users and stay compliant, an effective **[Consent Management Platform (CMP)](https://goadopt.io/en/blog/what-is-a-cmp-consent-management-platform/)** like **AdOpt** turns privacy from a blocker into part of the **user experience**: clear choices, **[granular consent]**, and **[encrypted consent logs]** that prove compliance.

## **How to Choose a CMP (Consent Management Platform)**

Look for a CMP that balances **compliance** and **UX**:  

- **Ease of use & quick setup** (seamless with your design).  
- **[Granular consent controls]**.  
- **[Dashboards & reports]** for consent rates and banner performance.  
- **Multi-language** and **multi-legislation** support.  
- **Human support with SLAs by plan** (no blanket “24/7” promise).

## Navigating **GDPR**, **LGPD**, **CCPA** and Beyond

Different laws emphasize different rights, but the baseline is the same: **transparency**, **choice**, and **evidence of consent**, a robust CMP helps you implement **prior blocking** (non-essential tags wait for consent), offer **opt-in/opt-out** by category, and **log consents** securely.

## The Cost of Non-Compliance

Non-compliance can trigger **enforcement actions and significant fines**, a reliable CMP helps **[collect and manage consent correctly](https://goadopt.io/en/blog/company-fined-the-end/)**, reducing risk while **preserving user trust**.

## **Essential Features** of a Top-Notch CMP

- **Customizable [cookie banner](https://goadopt.io/en/blog/how-to-choose-a-cookie-banner-for-your-website/)** (brand-aligned, accessible).  
- **[Granular consent]** by **purpose/category**.  
- **Tag scanning & categorization** to keep your inventory mapped.  
- **[Encrypted consent logs]**, **audit trail**, and **versioning** of policies.  
- **[Reports & KPIs]()**.  
- **Integrations** with **[Google Tag Manager (GTM)]** and **[Google Consent Mode]**.  
- **Multi-language** and **multi-legislation** operation.

## Choose a CMP That Provides **Rich Information**

Beyond capturing consent, AdOpt offers **actionable analytics** to improve banner UX and **increase legitimate consent rates** without dark patterns.

## Prefer **Granular, One-by-One** Consent

Let users **opt-in or opt-out** of **specific categories**, that’s what we call **“real consent”** respecting preferences and complying with **[GDPR/LGPD](https://goadopt.io/en/blog/key-differences-LGPD-GDPR/)**.

## Think **Beyond Your Country**

Operate across regions with **multi-jurisdiction** support and standards such as **TCF 2.2**, **Global Privacy Control (GPC)** and, when relevant, **Global Privacy Platform (GPP)**.

## Know Your Platform’s **Data Security**

AdOpt uses **encrypted storage** for consent records and provides **auditability** to prove what was collected, when, and under which **legal basis**.

## **Customize** the Banner Experience

Your **[cookie banner](https://goadopt.io/en/blog/how-to-choose-a-cookie-banner-for-your-website/)** is a UX component not just a compliance checkbox, with AdOpt, tailor **layout, copy, and controls** to your brand while keeping choices **clear and symmetrical** (“Accept all” / “Reject all” / “Customize”).

## Discover How AdOpt Helps You Stay **Compliant** (and Keep Ads Eligible)

For publishers and advertisers, **Google-certified CMP** status and **TCF 2.2** support help keep **ad delivery compliant** in regulated regions, aligning signals with platform requirements.

## Advanced Capabilities that Matter in Practice

- **Tag scanning & categorization** for accurate grouping.  
- **Callbacks, webhooks and APIs** to orchestrate consent across systems.  
- **Reports & KPIs** to iterate on UX and compliance.

## Criteria for Evaluating CMP Providers

### Integrate Seamlessly with Your **Tech Stack**

Check **API compatibility**, implementation paths **GTM**, direct tag, and **customization** options.

### Assess Market **Reputation** and Reliability

Look for independent reviews (e.g., **G2** highlights on **ease of use**) and adoption at scale (e.g., **trusted by 40,000+ sites worldwide**).

## Best Practices for Deployment & Engagement

### A **Secure and Intuitive Cookie Banner**

Prior-block non-essential tags, ensure **symmetry** between **Accept** and **Reject**, and keep copy **clear**.

Use **reports & KPIs** to refine UX and improve consent quality over time.

## **Manage KPIs and Metrics**

Track **consent rates**, **banner interactions**, and **opt-out requests**, iterate continuously.

## **Google Tag Manager (GTM)** and **Google Consent Mode**

Integrate AdOpt with **GTM and Consent Mode** to respect consent state while keeping measurement and ads **compliant**.

## **Multilingual** and **Multi-Legislation**

Serve the right experience for **GDPR**, **LGPD**, and other regimes with localized copy and **standards-based** signaling **TCF 2.2**, **GPC**, **GPP** where applicable.

## **TCF (Transparency & Consent Framework)**

AdOpt CMP supports **TCF 2.2**, aligning vendor signaling and user choices in EEA/UK.

## **GPC (Global Privacy Control)**

Respect **GPC** signals automatically to honor user preferences at the browser/extension level.

## **Plugins for Tray and WordPress**

Install via **Tray** or **WordPress** plugins, or implement via **GTM** / direct tag / API.

## Your Cookie Compliance in **7 Steps**

1. **Assess** your current setup (what scripts run, which are essential).  
2. Choose a **brand-aligned design** for the **cookie banner**.  
3. Implement **granular consent** (category/purpose).  
4. Use callbacks/webhooks/APIs to propagate consent.  
5. **Test** flows (accept/reject/customize + logging).  
6. **Monitor** KPIs and iterate on copy/UX.  
7. **Stay updated** on standards and platform requirements TCF 2.2, GPC and GPP.

## Why Choose **AdOpt**?

A **secure**, **elegant** CMP that makes **privacy** part of your **user experience** not a roadblock.  
**[Install now](https://goadopt.io/en)**
**[Talk to our team](https://meetings.hubspot.com/murilo-andrade/adopt-meeting1-murilo)

## FAQ — Frequently Asked Questions

## 1) What is a **CMP** and why do I need one?
A **Consent Management Platform (CMP)** informs, collects, and records user choices before non-essential tags fire.

With **AdOpt CMP**, you get **prior blocking**, **granular consent**, and **encrypted consent logs** to prove compliance while keeping UX smooth.

## 2) Which regulations does AdOpt help with?
AdOpt supports **multi-legislation** scenarios (e.g., **GDPR**, **LGPD**) and industry standards like **TCF 2.2**, **GPC**, and where relevant **GPP**.

**The goal: consistent, standards-based consent across regions.**

## 3) Is AdOpt a Google-certified CMP and **TCF 2.2** compatible?
Yes. AdOpt is a **[Google-certified CMP]()** and supports **TCF 2.2**, aligning consent signaling for advertising in regulated regions (EEA/UK).

## 4) Does AdOpt work with **Google Consent Mode** and **GTM**?
Yes. We integrate with **Google Tag Manager** and **Google Consent Mode** so tags respond to the user’s consent state, non-essential tags wait; essentials keep working.

## 5) Will a CMP hurt my analytics or ads?
A proper setup **preserves eligibility** while keeping you compliant, with **Consent Mode** and **tag gating** measurement adapts to consent without dark patterns.

## 6) What does “**granular consent**” mean in practice?
Users can **opt in/out by category/purpose** (e.g., analytics, marketing), that’s “real consent”: clear options, symmetric **Accept**/**Reject**, and a **Customize** path.

## 7) How does AdOpt block tags before consent?
AdOpt implements **preventive blocking** of non-essential scripts until consent is given, via GTM, direct tag, or API.

## 8) How are consent decisions stored?
All consents are **encrypted** and **timestamped**, you have an **audit trail** and **versioning** for key documents, helping you demonstrate compliance over time.

## 9) Can I customize the **cookie banner** to match my brand?
Yes. Adjust layout, copy, and controls to your brand while keeping **clarity and symmetry** (Accept/Reject/Customize).

## 10) Does AdOpt support **multiple languages** and regions?
Yes. Serve localized copy and jurisdiction-appropriate flows across markets with standards-based signals (**TCF 2.2**, **GPC**, **GPP** where applicable).

## 11) Which platforms does AdOpt integrate with?
Setup paths include **GTM**, **direct tag**, **APIs/callbacks**, and plugins for **WordPress** and **Tray**.

## 12) What kind of **reports & KPIs** do I get?
Dashboards show **consent rates**, **banner interactions**, and **opt-outs**. Use them to iterate on copy/UX and improve consent quality.

## 13) Can I manage multiple **sites/teams**?
Yes. You can organize multiple properties and manage access permissions across teams.

## 14) Does AdOpt support **GPC** and **GPP**?
AdOpt **respects GPC signals** automatically and supports **GPP** where relevant to your stack and regions.

## 15) How fast can I implement AdOpt CMP?
Typical paths (GTM, plugin, or direct tag) are **quick to deploy**. Your team chooses the path that fits your stack.

## 16) What does support look like?
You get **human support with SLAs by plan**. Need more? Talk to us about extended coverage options for critical operations.

## 17) Is AdOpt suitable for both **publishers** and **brands**?
Yes. Standards compliance (**TCF 2.2**, [Consent Mode](https://goadopt.io/en/blog/google-consent-mode-beginner-to-advanced-guide/)) helps publishers keep delivery compliant and brands maintain trustworthy measurement.

## 18) How do I get started?
- **[Talk to our team](https://meetings.hubspot.com/murilo-andrade/adopt-meeting1-murilo)**

## More than a CMP: a trusted partner
Choosing a **Consent Management Platform (CMP)** is about far more than showing a cookie banner. It’s about building **transparency** with your users and securing **legal peace of mind** for your business without sacrificing experience.

**AdOpt** is built to handle the technical and regulatory complexity for you **prior blocking**, **granular consent**, **encrypted consent logs**, and native integrations like **GTM** and **Google Consent Mode** so your team can focus on what truly matters: **growth**.

Trusted by **40,000+ sites** worldwide, **Google-certified as a CMP**, and **recognized on G2** for ease of use, your path to **real compliance** is one click away.

**Start free** and join the companies turning privacy into great experience.

*[Talk to a specialist](https://meetings.hubspot.com/murilo-andrade/adopt-meeting1-murilo)**


AdOpt CMP

Tenesse TIPA: Privacy Policy

Montana MTCDPA: Privacy Policy

## **Privacy Policy & TDPSA: Understanding the Key Changes**

 

This page covers one piece of the picture. For the full scope of the TDPSA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the TDPSA and cookies](https://goadopt.io/en/blog/texas-tdpsa-and-cookies-all-you-need-to-know/).

The **TDPSA Privacy Policy** marks a significant shift in how businesses operating in Texas must handle personal data.

The **Texas Data Privacy and Security Act (TDPSA)** brings the state in line with broader U.S. data protection trends, setting clear standards for **transparency**, consumer rights, and organizational responsibilities.

If your company targets consumers in Texas, adapting to this new framework is no longer optional it’s essential.

One of the most critical updates is the emphasis on **consumer consent and data transparency**.

Under the **TDPSA**, businesses must clearly disclose what personal data they collect, how it’s used, and with whom it’s shared. Privacy policies can no longer be buried in legal jargon.

 

Instead, they must be **clear, accessible, and easy to understand**, empowering users to make informed decisions about their data.

The act also introduces strict requirements for **privacy policy content and availability**.

Organizations are required to maintain an up-to-date privacy notice, easily accessible on their websites and digital services. These policies must reflect current data practices and outline consumer rights under the TDPSA.

Failure to comply can lead to regulatory action by the Texas Attorney General, making proactive compliance a business priority.

 

## **Overview of TDPSA and Privacy Policy Requirements**

 

**The Texas Data Privacy and Security Act (TDPSA)** introduces a comprehensive set of rules that reshape how businesses must craft and maintain their **privacy policies**.

If you process the personal data of Texas residents and meet the applicability thresholds, the TDPSA applies to you regardless of whether your business is physically located in Texas.

This means that your **privacy policy** must be compliant, clear, and up-to-date.

According to the **TDPSA Privacy Policy** requirements, companies must disclose specific information to consumers.

This includes what categories of personal data are collected, the purpose for each category, the types of third parties with whom data is shared, and whether the data is sold.

 
 

You must also explain how users can exercise their privacy rights, such as opting out of data sales or targeted advertising.

These details must be presented in a way that is **easily accessible and understandable** for the average consumer.

Importantly, the TDPSA sets expectations for **regular policy reviews** and updates. Businesses are expected to **revise their privacy policies** as their data practices change.

This includes updates to third-party vendors, data processing purposes, or user rights mechanisms. In other words, a one-time policy is no longer enough you need an active, evolving document that reflects your real-time data operations.

 

---

## What is the TDPSA?

 

The **Texas Data Privacy and Security Act (TDPSA)** is a state-level law that establishes consumer **privacy rights** and sets clear obligations for businesses that process personal data in Texas.

Enacted to strengthen **data privacy** in one of the largest U.S. states, the TDPSA follows a growing national trend of state-specific **privacy laws**, similar to California's CCPA and Virginia's VCDPA.

It reflects a shift toward giving individuals more control over how their personal information is collected, shared, and used.

 
 

The **TDPSA Privacy Policy** requirements are part of a larger framework that includes rules on data minimization, consent, and consumer access rights.

For example, the law gives Texas residents the right to know what data is collected about them, to request corrections or deletions, and to opt out of data sales and targeted advertising.

These rights must be clearly communicated through your company’s privacy policy, which serves as a key **compliance** tool.

Unlike some federal regulations that apply broadly, the **TDPSA** specifically targets companies that process the data of over 100,000 Texas consumers or derive a certain percentage of revenue from selling personal data.

This scope means that even mid-sized businesses must pay close attention to **compliance**.

Whether you're a tech startup or an e-commerce brand, understanding what the **TDPSA** requires and reflecting that in your **privacy policy** is critical to building trust and avoiding legal risk.

 

---

 

## **Key Privacy Policy Requirements Under TDPSA**

 

The **TDPSA Privacy Policy** mandates that businesses provide** detailed, transparent, and user-friendly** information about their data practices.

This includes clearly stating what categories of personal data are collected, such as names, email addresses, geolocation data, or online behavior.

In addition, the **policy** must describe the purposes for which each category of data is used whether for personalization, analytics, advertising, or operational needs.

Another requirement under the **Texas Data Privacy and Security** Act is disclosing whether personal data is shared with third parties and, if so, the categories of those parties.

 

 

If your business sells personal data or uses it for targeted advertising, the privacy policy must explicitly state this.

Consumers also need to be informed about their rights, including the ability to opt out of data sales, request data deletion, or access their personal data.

The **TDPSA** emphasizes that these options must be easy to locate and understand within the privacy notice.

Finally, your **privacy policy** must include a description of the process for submitting consumer requests.

This includes specifying how users can verify their identity and how long the business has to respond.

You’re also required to include a contact method, such as an email address or web form, dedicated to **privacy inquiries**.

Ignoring these requirements may lead to enforcement actions by the Texas Attorney General, so it’s critical to keep your policy both **compliant** and consumer-friendly.

 

----

## **Consent and Sensitive Data Handling Under TDPSA**

 

Under the **TDPSA** **Privacy Policy**, one of the most critical components is the handling of consumer consent, particularly when it comes to sensitive data.

The law explicitly requires that businesses obtain informed consent from consumers before collecting or processing sensitive information.

Sensitive data can include financial details, medical records, and biometric data information that requires a higher level of protection due to its private nature.

The **TDPSA** mandates that consent must be freely given, specific, informed, and unambiguous.

 

 

This means that your **privacy policy** should outline clear and straightforward methods for obtaining consent, whether it's through opt-in checkboxes, consent banners, or explicit agreement forms.

It’s not enough to have pre-checked boxes or vague consent clauses. Businesses must make it easy for users to choose which data they agree to share and for what purposes.

Additionally, the **TDPSA** places extra responsibility on companies that process sensitive data. They must provide users with a clear explanation of why sensitive data is needed and how it will be protected.

Any processing of such data without proper consent or without meeting the law's stringent requirements could lead to significant penalties.

Companies are also required to implement extra safeguards to protect sensitive data, **such as encryption or access restrictions,** ensuring it’s only accessible to authorized personnel.

 

## **Consent Necessary to Process Sensitive Data Under TDPSA**

 

Under the **TDPSA Privacy Policy**, obtaining explicit consent is a key requirement when handling sensitive data.

Sensitive data includes categories such as health information, financial details, biometric data, and social security numbers, which require a higher level of protection due to their sensitive nature.

The law makes it clear that businesses must obtain clear, informed consent from consumers before collecting or processing any sensitive data.

 

 

To comply with the **TDPSA**, businesses must not only inform users about what sensitive data they are collecting, but also why it is being collected and how it will be used.

For instance, if you're collecting health data for a health-related service or biometric data for security purposes, this must be transparently stated in your **privacy policy**.

Furthermore, consent must be given freely it cannot be coerced or tied to other unrelated services.

Users should have the option to withdraw consent at any time, with no consequences to their access to services.

The **TDPSA** also requires businesses to maintain clear documentation of when and how consent was obtained.

This can include tracking opt-in dates or saving logs of consent forms. Without this documentation, businesses may face challenges proving **compliance** in case of an audit or legal dispute.

Additionally, if sensitive data is being **shared with third parties,** businesses must provide consumers with the ability to opt-out or manage these third-party data sharing preferences easily.

 

## **Consumer Rights and Business Obligations with TDPSA**

 

The **TDPSA** **Privacy Policy** grants Texas residents several important consumer rights over their personal data. These rights include the ability to access, correct, and delete personal information collected by businesses.

The **Texas Data Privacy and Security Act (TDPSA)** mandates that businesses provide clear, easy-to-follow processes for consumers to exercise these rights.

As part of their obligations, companies must not only inform users about these rights but also make it easy for them to submit requests.

 

 

One key right under the **TDPSA** is the right to access. Consumers have the ability to request copies of the personal data that businesses hold about them. This request must be honored within a reasonable time frame typically within **45 days**.

Another **important right** is the right to delete. If a consumer requests the deletion of their data, and it is no longer necessary for the purposes for which it was collected, businesses must comply.

However, businesses are allowed to retain certain data for legal or operational purposes, such as complying with a legal obligation or fulfilling contractual agreements.

In addition to consumer rights, the **TDPSA** imposes strict business obligations. Companies must ensure that their **privacy policies** reflect all consumer rights under the act and clearly explain how these rights can be exercised.

Additionally, businesses must establish secure processes for handling consumer requests, such as verifying the identity of individuals making requests to ensure data is not inadvertently shared with unauthorized parties.

Failure to comply with consumer rights can result in significant penalties and damage to a company's reputation.

 

 

## **What Are the Rights of Consumers Under TDPSA?**

 

The Texas Data Privacy and Security Act (**TDPSA**) grants consumers in **Texas several key data privacy** rights to ensure greater control over their personal information.

Understanding these rights is essential for both businesses and consumers, as it helps establish transparency and trust.

Here’s a breakdown of the key consumer rights:

 

### TDPSA Privacy Policy

 

### 1. Right to Access

**Consumers have the right to access their personal data.**

This means they can request businesses to disclose what personal data they hold about them, how it was collected, and the purposes for which it is being used.

This right ensures transparency and helps consumers understand exactly what information businesses are using.

 

### 2. Right to Correction

**The right to correction allows consumers to request corrections to inaccurate or outdated personal data.**

If the data a company holds about a consumer is wrong or incomplete, the consumer can ask for it to be updated.

This ensures that consumers' personal information remains accurate and up to date.

 

### 3. Right to Deletion

**Consumers also have the right to request the deletion of their personal data.**

If the information is no longer necessary for the purpose it was collected, or if the consumer withdraws consent, businesses must delete the data unless it’s required for legal or contractual reasons.

This gives consumers control over their data and how long it remains in company databases.

 

### 4. Right to Opt-Out of Sales and Targeted Advertising

**Under the TDPSA Privacy Policy, consumers can opt-out of the sale of their personal data or the use of their data for targeted advertising**.

This means that businesses must offer a clear and accessible way for consumers to opt-out, preventing their data from being used for purposes they don’t consent to.

 

### 5. Right to Non-Discrimination

**Consumers are protected from discrimination if they exercise their privacy rights.**

The TDPSA ensures that businesses cannot discriminate against consumers by offering them less favorable terms or denying them services for exercising their rights, such as opting out of data collection or deleting their data.

 

### Privacy Notice Requirements

Under the **TDPSA Privacy Policy**, businesses are required to maintain a clear and accessible privacy notice that informs consumers about their data collection and usage practices.

This notice serves as a transparency tool, ensuring that consumers understand how their personal data is handled.

The **TDPSA** outlines specific requirements for what must be included in the privacy notice:

 

### 1. Clear Description of Data Collection Practices

The **privacy notice** must provide a detailed explanation of the categories of personal data being collected. This includes information such as names, addresses, email addresses, and any other data collected through websites, apps, or services.

Businesses must also clearly state the purposes for which this data is being used, whether it’s for improving services, personalization, marketing, or other operational needs.

 

### 2. Third-Party Data Sharing

**Another critical requirement under the** TDPSA Privacy Policy is the disclosure of any third-party data sharing. Businesses must list the types of third parties with whom data may be shared, including advertisers, service providers, or data processors.

This gives consumers a clear understanding of who has access to their data and why. If the business sells personal data or shares it for targeted advertising purposes, this must be explicitly stated.

 

### 3. Consumer Rights and Mechanisms

**The privacy notice must outline the consumer’s rights under the TDPSA**, such as the right to access, correct, delete, and opt-out of data sales.

It must also explain how consumers can exercise these rights.

Businesses are required to provide an easily accessible method for submitting data requests, such as an email address or a web form.

 

### 4. Data Retention Periods

**Businesses must inform consumers of the data retention periods for personal data**.

This includes how long data will be kept and the criteria used to determine retention periods.

If the data is no longer needed, businesses must outline the procedures for data deletion, ensuring compliance with consumer rights.

 

### 5. Security Measures
The **privacy notice** must include information on the security measures in place to protect consumers’ personal data.

This includes details on encryption, access controls, and any other safeguards to prevent unauthorized access or data breaches.

 

### 6. Regular Updates

**Finally,** businesses are required to regularly update their privacy notice to reflect any changes in data practices or legal obligations. It should be easy for consumers to access the most recent version, ensuring ongoing compliance with the TDPSA.

 

**How Will the TDPSA Be Enforced?**

The **TDPSA Privacy Policy** comes with clear enforcement mechanisms to ensure compliance with its privacy requirements.

Businesses that fail to adhere to the law’s provisions face significant penalties, and non-compliance can lead to both legal and reputational damage.

 

Let’s explore the key aspects of **TDPSA** enforcement:

 

### 1. Role of the Texas Attorney General

The Texas Attorney General (AG) is responsible for enforcing the **TDPSA**.

If a business is found to be in violation of the law, the AG can take legal action. This can include issuing warnings, seeking corrective measures, and even pursuing civil penalties. Businesses are given a **30-day** cure period to address any violations before formal enforcement actions are taken.

This allows companies to fix any issues without facing immediate legal consequences, but failure to resolve the matter could lead to further legal action.

 

### 2. Civil Penalties for Non-Compliance

**Businesses found to be in violation of the** TDPSA Privacy Policy** can face civil penalties.

The penalties can range from $7,500 per violation, with each instance of non-compliance potentially being considered a separate violation.

For example, if a company fails to update its privacy notice or fails to offer a consumer their rights under the TDPSA, each failure could incur a penalty.

In cases of knowing violations, where a business intentionally ignores the law or acts with disregard for consumer rights, the penalties can be even higher.

 

### 3. Consumer-Led Enforcement

In addition to enforcement by the Attorney General, the **TDPSA** also allows consumers to seek remedies for violations.

While the law primarily gives enforcement power to the AG, consumers have the ability to file complaints directly with the Attorney General’s office.

This provides consumers with a way to hold businesses accountable, especially if they believe their privacy rights under the TDPSA have been violated.

 

### 4. Corrective Actions and Compliance Plans

**If a company is found to be non-compliant**, the Texas Attorney General may require the business to take corrective actions.

This can include updating the privacy policy, improving consumer consent mechanisms, or implementing stricter data security measures.

Businesses may also be required to submit a compliance plan outlining how they intend to meet the law's requirements moving forward.

 

### 5. Reputational Damage

**While the TDPSA** penalties are financially significant, the reputational damage caused by non-compliance can be just as costly.

Consumers are becoming increasingly aware of their privacy rights, and businesses that fail to protect personal data or comply with the law may face loss of consumer trust.

**This can lead to a loss of customers, reduced brand loyalty, and negative media attention.**

Texas TDPSA: Privacy Policy

Tenesse TIPA: DSAR Privacy Portal

## New Hampshire NHDPA: Privacy Policy

Every business that collects data from New Hampshire residents needs a public document that clearly and specifically explains what it does with that information.

This page covers one piece of the picture. For the full scope of the NHDPA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the NHDPA and cookies](https://goadopt.io/en/blog/new-hampshire-nhdpa-and-cookies-all-you-need-to-know/).

That document is the Privacy Policy.

The New Hampshire Data Privacy Act (NHDPA, RSA 507-H), in effect since January 1, 2025, defines what must be in that document, how it must be published, and what happens when it is incomplete or outdated.

This article focuses exclusively on that: what the NHDPA requires from your Privacy Policy, point by point, verified against the full text of the law.

## What the NHDPA calls a Privacy Notice

The law uses the term Privacy Notice. In practice, it is the Privacy Policy that most websites already have.

RSA 507-H:6, III requires the controller to provide consumers with a privacy notice that is "clear and meaningful in a reasonably accessible format." The document can be published online, in mobile apps, or on devices through which consumers interact with the controller.

Two specific requirements from RSA 507-H:6, III deserve attention:

The document must be **reasonably accessible to consumers with disabilities**, including through digital accessibility tools.

The document must include the **date it was last updated**.

## What must be in the Privacy Policy under the NHDPA

RSA 507-H:6, III lists the mandatory elements of the privacy notice. Let's go through each one.

### 1. Categories of personal data processed

The document must list the categories of personal data the business processes (RSA 507-H:6, III, a).

Personal data under the NHDPA is any information linked or reasonably linkable to an identified or identifiable individual, as defined in RSA 507-H:1, XIX. This includes name, email, IP address, browsing history, location data, and any identifier that allows a person to be tracked.

### 2. The purpose of processing

The document must explain what the data is used for (RSA 507-H:6, III, b).

And the purposes must be specific. RSA 507-H:6, I, b determines that the business cannot process data for purposes that are not reasonably necessary or compatible with those disclosed, without new consent.

Vague purposes such as "improve your experience" do not meet the requirement. "Browsing data collected via analytics: used to analyze site usage behavior and identify pages with high abandonment rates" is a specific purpose.

### 3. How consumers exercise their rights

The document must describe how consumers can exercise the rights guaranteed by the NHDPA, including how to appeal a controller's decision (RSA 507-H:6, III, c).

It is not enough to list that the rights exist. The process must be described: which channel to use, how identity verification works, what the 45-day response deadline is, and how to appeal if a request is denied.

The [data protection officer](https://goadopt.io/en/blog/responsibilities-of-a-data-protection-officer/) or compliance lead must have this process mapped out and functioning before publishing the Policy.

### 4. Categories of data shared with third parties

If the business shares data with third parties, the document must inform which categories of data are shared (RSA 507-H:6, III, d).

This includes email marketing tools, CRMs, analytics platforms, advertising networks, payment processors, and any other service that receives data from your users.

This point is critical for digital marketing agencies that manage client websites. The client's website is the controller. The agency is typically the processor. The Policy must reflect this structure.

### 5. Categories of third parties that receive data

In addition to the types of data, the Policy must inform which categories of third parties receive them (RSA 507-H:6, III, e).

Categories such as "digital advertising platforms," "analytics tools," and "CRM systems" are valid examples. It is not necessary to list the name of every product, but the categories must be identifiable.

### 6. An active contact channel

RSA 507-H:6, III, f requires an active email address or other online mechanism through which the consumer can contact the controller.

It cannot be a form that does not work, an email that no one monitors, or a broken link. The channel must be operational.

### 7. Date of last update

RSA 507-H:6, III, g makes it mandatory to include the date the privacy notice was last updated.

Every time there is a material change in data processing practices, the document must be updated and this date must be reflected.

### 8. Disclosure of targeted advertising and data sale

If the business sells personal data to third parties or processes it for targeted advertising, RSA 507-H:6, IV requires this practice to be clearly stated, along with the mechanism through which the consumer can exercise the opt-out.

### 9. Mechanisms for submitting requests

RSA 507-H:6, V, a requires the Policy to describe at least one secure and reliable means for the consumer to submit requests. This means must include a clear and conspicuous link to a page where the consumer can exercise the opt-out of targeted advertising or data sale.

The business cannot require the consumer to create a new account to exercise their rights.

## Sensitive data: additional requirements in the Policy

Sensitive data receives special treatment under the NHDPA and must be identified in the Privacy Policy.

Under RSA 507-H:1, XXVIII, sensitive data includes: racial or ethnic origin, religious beliefs, physical or mental health, sex life, sexual orientation, citizenship, genetic or biometric data used for identification, data of known children under 13, and precise geolocation data.

If the business collects any data in this category, the Policy must:

Explicitly identify that sensitive data is collected.

State the specific purpose for which each category is used.

Describe how explicit prior consent is obtained, as required by RSA 507-H:6, I, d.

Explain how that consent can be revoked.

And on revocation: after receiving a consent revocation request, the business has a maximum of **15 days** to cease processing, under RSA 507-H:6, I, f. This deadline must be reflected in the Policy.

## The additional protection for teenagers between 13 and 15 years old

RSA 507-H:6, I, g prohibits processing consumer data for targeted advertising or selling it without consent when the controller has actual knowledge that the consumer is between 13 and 15 years old.

This protection goes beyond the protection of children under 13. If the site may have teenage users in that age range, the Privacy Policy must mention how this protection is implemented.

## Data Protection Assessments: when they are required

RSA 507-H:8 requires controllers to conduct and document Data Protection Assessments for activities that present elevated risk to the consumer, including targeted advertising, data sale, profiling with foreseeable risk of harm, and processing of sensitive data.

The assessments do not need to be published in the Policy, but must be documented and made available to the Attorney General upon request. They are confidential and exempt from public disclosure (RSA 507-H:8, III).

A [Records of Processing Activities (ROPA)](https://goadopt.io/en/blog/gdpr-legal-basis/) document is what organizes the record of these activities internally.

## Enforcement changed in 2026

One point that affects the urgency of compliance: in 2025, the Attorney General was required to give the business 60 days to cure before filing a lawsuit (RSA 507-H:11, II). From 2026 onward, this cure period became discretionary (RSA 507-H:11, III).

This means that an inadequate Privacy Policy in 2026 can result in direct enforcement action, with no guaranteed deadline to correct.

Violations are treated under RSA 358-A:2, with reference [penalties](https://goadopt.io/en/blog/fines-in-LGPD/) of up to US$ 10,000 per violation.

## How AdOpt supports compliance with the NHDPA

AdOpt ensures that what is written in the Policy has a real correspondence with what actually happens on the site.

The automatic scan identifies all active technologies, feeding the list of data categories and third parties that must appear in the document. The [consent management platform](https://goadopt.io/en/blog/how-to-choose-cmp-consent-management-platform/) ensures the consent and revocation mechanism works exactly as described.

Every consent and revocation is logged. If the Attorney General requests evidence, the record is available.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Privacy Policy for your site that complies with the NHDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what the Privacy Policy must contain for the NHDPA

**Visible and accessible link** on all pages of the site.

**Accessible to people with disabilities**, including via digital tools (RSA 507-H:6, III).

**Categories of personal data processed**, with specific descriptions (RSA 507-H:6, III, a).

**Purpose of processing** for each category, without vague descriptions (RSA 507-H:6, III, b).

**How to exercise each right** guaranteed by the NHDPA, with process, channel, and 45-day response deadline (RSA 507-H:6, III, c).

**Categories of data shared with third parties** (RSA 507-H:6, III, d).

**Categories of third parties** that receive data (RSA 507-H:6, III, e).

**Active contact channel**, functional email or online mechanism (RSA 507-H:6, III, f).

**Date of last update** visible (RSA 507-H:6, III, g).

**Disclosure of targeted advertising or data sale** with accessible opt-out (RSA 507-H:6, IV).

**Identification of sensitive data** and how prior consent is obtained (RSA 507-H:6, I, d).

**15-day deadline to cease processing after revocation** (RSA 507-H:6, I, f).

**Protection for teenagers between 13 and 15 years old** (RSA 507-H:6, I, g).

**Appeal process** described with a 60-day deadline.

**Non-discrimination policy** for consumers who exercise their rights.

**Free service once per year** per consumer.

## FAQ: NHDPA and Privacy Policy

**1. Does the NHDPA require a document specifically called a "Privacy Policy"?**
The law requires a clear and meaningful Privacy Notice in a reasonably accessible format, under RSA 507-H:6, III. In practice, it is the Privacy Policy. What the law specifies is the minimum required content, with seven elements listed directly in the text of the law.

**2. How many DSAR requests per year are free of charge?**
Once per year per consumer, under RSA 507-H:4, III, c. From the second request within the same 12-month period, the business may charge a reasonable fee or refuse if it considers the request excessive, but must prove the excessive nature of the request.

**3. How often should the Privacy Policy be reviewed?**
Whenever there is a material change in processing practices. The law requires the date of last update to be visible in the document (RSA 507-H:6, III, g). The [data protection officer](https://goadopt.io/en/blog/responsibilities-of-a-data-protection-officer/) should monitor changes in the tools used on the site and trigger an update when necessary.

**4. What changed in enforcement from 2026?**
In 2025, the Attorney General was required to give 60 days to cure before filing a lawsuit (RSA 507-H:11, II). From 2026, the cure period is discretionary (RSA 507-H:11, III). The Attorney General may or may not grant the period, considering factors such as the number of violations, company size, and probability of harm to the public.

**5. Does the Privacy Policy need to cover the protection of teenagers?**
Yes. RSA 507-H:6, I, g prohibits targeted advertising and data sale for consumers between 13 and 15 without consent, when the business has knowledge of this age range. If the site may have teenage users, the Policy must mention this protection.

With AdOpt, you're covered.

[Ready to build a Privacy Policy for your site that complies with the NHDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)



New Hampshire NHDPA: Privacy Policy

## Virginia VCDPA: Privacy Policy

Every business that collects data from Virginia residents needs a public document that clearly and specifically explains what it does with that information.

This page covers one piece of the picture. For the full scope of the VCDPA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the VCDPA and cookies](https://goadopt.io/en/blog/virginia-vcdpa-and-cookies-all-you-need-to-know/).

That document is the Privacy Policy.

The Virginia Consumer Data Protection Act (VCDPA, Va. Code § 59.1-575 et seq.), in effect since January 1, 2023, defines what must be in that document, how it should be presented, and what happens when it is incomplete or outdated.

This article focuses exclusively on that: what the VCDPA requires from your Privacy Policy, point by point, based on the official text of the law.

## What the VCDPA calls a Privacy Notice

The law uses the term privacy notice. In practice, it is the Privacy Policy that most websites already have.

Va. Code § 59.1-578 C requires the controller to provide consumers with a privacy notice that is "reasonably accessible, clear, and meaningful." The document must be easy to find and easy to understand.

Unlike the NHDPA, the VCDPA does not explicitly require accessibility accommodations for people with disabilities or mandate inclusion of the date of last update in the text of the law. However, the standard of reasonable accessibility and clarity requires the document to be navigable and comprehensible by any user.

## What must be in the Privacy Policy under the VCDPA

Va. Code § 59.1-578 C lists five categories of information the Privacy Policy must contain. Let's go through each one.

### 1. Categories of personal data processed

The document must list the categories of personal data the business processes (Va. Code § 59.1-578 C, 1).

Personal data under the VCDPA is any information linked or reasonably linkable to an identified or identifiable natural person, as defined in Va. Code § 59.1-575. This includes name, email address, IP address, browsing history, location data, and any identifier that allows a person to be tracked.

De-identified data and publicly available information are excluded.

### 2. The purpose of processing

The document must explain what the data is used for (Va. Code § 59.1-578 C, 2).

The purposes must be specific. Va. Code § 59.1-578 A, 2 prohibits processing data for purposes that are not reasonably necessary or compatible with the disclosed purposes, without the consumer's consent.

Vague descriptions such as "improve your experience" or "personalize your journey" do not meet the requirement. "Behavioral data collected via analytics to identify pages with high abandonment rates and prioritize usability improvements" is the correct level of specificity.

### 3. How consumers exercise their rights

The document must describe how consumers can exercise the five rights guaranteed by the VCDPA and how to appeal a denial decision (Va. Code § 59.1-578 C, 3).

It is not enough to list that rights exist. The process must be described: which channel to use, how identity authentication works, what the 45-day response deadline is, and how the appeal process works with a 60-day response period.

The [data protection officer](https://goadopt.io/en/blog/responsibilities-of-a-data-protection-officer/) or compliance lead must have this workflow mapped and operationally functional before publishing the Policy.

### 4. Categories of data shared with third parties

If the business shares data with third parties, the document must disclose which categories of data are shared (Va. Code § 59.1-578 C, 4).

This covers email marketing tools, CRMs, analytics platforms, advertising networks, payment processors, and any other service that receives user data.

It is important to distinguish what constitutes data sharing under the VCDPA. Transfers to processors that process data exclusively on behalf of the controller do not constitute "sale of data." But any transfer for monetary consideration to independent third parties may constitute a sale and require specific disclosure.

### 5. Categories of third parties that receive data

In addition to the types of data, the Policy must disclose which categories of third parties receive them (Va. Code § 59.1-578 C, 5).

Categories such as "digital advertising platforms," "analytics tools," "CRM systems," and "payment processors" are valid examples. It is not necessary to list the name of every product, but the categories must be identifiable and descriptive enough for the consumer to understand who has access to their data.

## Disclosure of targeted advertising and data sale

If the business sells personal data to third parties or processes it for targeted advertising, Va. Code § 59.1-578 D requires clear and conspicuous disclosure of this practice in the Privacy Policy, along with the manner in which the consumer can exercise the opt-out.

Targeted advertising, as defined by the VCDPA, consists of ads based on data collected from the consumer's activities over time and across non-affiliated websites or applications. Contextual ads based on the current session are not included in this definition.

If your site uses a Meta Pixel, Google Ads, TikTok Pixel, or any programmatic advertising tool that collects data in other environments, you are operating targeted advertising and must disclose this explicitly.

## The request submission mechanism

Va. Code § 59.1-578 E requires the controller to establish and describe in the Privacy Policy at least one secure and reliable means for consumers to submit rights requests.

This means must:

Consider how consumers normally interact with the controller.

Ensure secure and reliable communication.

Allow the controller to authenticate the consumer's identity.

Not require the consumer to create a new account. The business may require use of an existing account, but cannot force the user to register a new one just to exercise a right guaranteed by law.

## Sensitive data: additional requirements

Sensitive data receives special treatment under the VCDPA and must be identified in the Privacy Policy.

Under Va. Code § 59.1-575, sensitive data includes: racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data for identification, known children's personal data, and precise geolocation data.

If the business collects any data in this category, the Policy must:

Explicitly identify that sensitive data is collected.

Describe the specific purpose for which each category is processed.

Explain how the consumer's consent is obtained prior to processing.

Detail how that consent can be revoked.

For children's data, the VCDPA takes a specific approach: businesses that comply with the verifiable parental consent requirements of COPPA (Children's Online Privacy Protection Act) are deemed compliant with the VCDPA's parental consent obligations (Va. Code § 59.1-576 D).

## Protection of minors on social media platforms

Starting January 1, 2026, Va. Code § 59.1-577.1 imposes specific obligations on social media platform operators related to users under **16 years of age**.

If the business operates a social media platform, the Privacy Policy must describe:

How the business determines whether a user is a minor under 16.

The 1-hour daily usage limit for minors.

How parents or legal guardians can provide verifiable parental consent to adjust the limit.

That data collected for age determination is used solely for that purpose.

## Data Protection Assessments: what the Policy needs to address

Va. Code § 59.1-580 requires controllers to conduct and document Data Protection Assessments for high-risk activities, including targeted advertising, data sale, profiling with foreseeable risk of harm, sensitive data processing, and online services directed at children.

Assessments do not need to be published in the Policy, but must be documented and available to the Attorney General upon request. They are confidential and exempt from public disclosure under the Virginia Freedom of Information Act (Va. Code § 59.1-580 D).

The Privacy Policy should, however, make clear that the business conducts impact assessments for high-risk activities as part of its compliance program.

## Non-discrimination policy

Va. Code § 59.1-578 A, 4 expressly prohibits businesses from discriminating against consumers who exercise their rights. This includes denying products or services, charging different prices, or offering lower quality as a consequence of a consumer exercising a right.

The Privacy Policy must state that consumers will not be discriminated against for exercising their rights.

The exception: voluntary loyalty, rewards, premium features, discount, or club card programs that offer benefits in exchange for data use are permitted, provided the consumer participates voluntarily.

## The cure period and its relationship to the Policy

Before initiating any action, the Attorney General must notify the business and provide **30 days to cure** the violation (Va. Code § 59.1-584 B). This period is guaranteed by law.

If the business cures the violation within the period and provides a written statement that the violations have been remedied and will not recur, no action is initiated.

However, if the business continues in violation after the cure period or breaches the written statement provided, the Attorney General may seek penalties of up to **US$ 7,500 per violation**, plus recovery of costs and [attorney fees](https://goadopt.io/en/blog/fines-in-LGPD/).

An incomplete Privacy Policy is one of the easiest violations to identify. Updating the document before receiving a notice is significantly more efficient than scrambling to adjust within 30 days.

## How AdOpt supports compliance with the VCDPA

AdOpt ensures that what is written in the Policy has real correspondence with what actually happens on the site.

The automatic scan identifies all active technologies, feeding the list of data categories and third parties that must appear in the document. The [consent management platform](https://goadopt.io/en/blog/how-to-choose-cmp-consent-management-platform/) ensures the consent and opt-out mechanism works exactly as described.

Every consent interaction is logged. If the Attorney General requests evidence, the record is available.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Privacy Policy for your site that complies with the VCDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what the Privacy Policy must contain for the VCDPA

**Visible and accessible link** on all pages of the site.

**Categories of personal data processed**, with specific descriptions (Va. Code § 59.1-578 C, 1).

**Purpose of processing** for each category, without vague descriptions (Va. Code § 59.1-578 C, 2).

**How to exercise each right** guaranteed by the VCDPA, with process, channel, and 45-day response deadline (Va. Code § 59.1-578 C, 3).

**Appeal process** described with a 60-day deadline and information about contacting the Attorney General (Va. Code § 59.1-577 C).

**Categories of data shared with third parties** (Va. Code § 59.1-578 C, 4).

**Categories of third parties** that receive data (Va. Code § 59.1-578 C, 5).

**Disclosure of targeted advertising or data sale** with accessible opt-out (Va. Code § 59.1-578 D).

**Request submission mechanism** described, without requiring a new account (Va. Code § 59.1-578 E).

**Identification of sensitive data** and how prior consent is obtained (Va. Code § 59.1-578 A, 5).

**Protection of minors on social media platforms** for businesses operating those services (Va. Code § 59.1-577.1, effective Jan 2026).

**Non-discrimination policy** for consumers who exercise their rights (Va. Code § 59.1-578 A, 4).

**Free service up to twice per year** per consumer (Va. Code § 59.1-577 B, 3).

## FAQ: VCDPA and Privacy Policy

**1. Does the VCDPA require a document specifically called a "Privacy Policy"?**
The law requires a privacy notice that is reasonably accessible, clear, and meaningful, under Va. Code § 59.1-578 C. In practice, it is the Privacy Policy. What the law defines are the five mandatory content categories the document must cover.

**2. Does the Privacy Policy need to mention Data Protection Assessments?**
It does not need to publish the content of assessments, which are confidential. But it is advisable for the Policy to mention that the business conducts Data Protection Assessments for high-risk activities as part of its compliance commitment. The Attorney General may request the assessments via civil investigative demand (Va. Code § 59.1-580 D).

**3. How many times per year is DSAR processing free of charge?**
Twice per year per consumer, under Va. Code § 59.1-577 B, 3. This differs from the NHDPA, which provides free service only once per year. From the third request within the same 12-month period, the business may charge a reasonable fee or decline if the request is manifestly unfounded, excessive, or repetitive, provided the business demonstrates the excessive nature.

**4. What happens if the business does not have a compliant Privacy Policy when it receives an Attorney General notice?**
The Attorney General sends notice with 30 days to cure (Va. Code § 59.1-584 B). If the business fails to implement the required elements within the deadline or breaches the written correction statement provided, the AG may seek penalties of up to US$ 7,500 per violation. Each consumer affected can be counted as a separate violation, which escalates the financial exposure quickly.

**5. How does the VCDPA treat teenager protection for ages 13 to 15?**
The VCDPA does not have a specific protection for this age range in the general law framework, unlike the NHDPA. For children under 13, COPPA applies. Protection for teenagers aged 13 to 15 appears only in the specific section for social media platforms (Va. Code § 59.1-577.1), where "minor" is defined as any person under 16, with a 1-hour daily usage limit and verifiable parental consent requirements.

[Ready to build a Privacy Policy for your site that complies with the VCDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


Virginia VCDPA: Privacy Policy

If the Florida Digital Bill of Rights (FDBR) applies to your business, you have specific obligations about what must be in the Privacy Policy, how it should be presented, and how often it must be updated.

This page covers one piece of the picture. For the full scope of the FDBR — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the FDBR and cookies](https://goadopt.io/en/blog/florida-fdbr-and-cookies-all-you-need-to-know/).

The FDBR (§§ 501.701 to 501.721), in effect since July 1, 2024, has one requirement that sets it apart from other US state privacy laws: the privacy notice must be updated **at least annually**, not only when there are material changes to processing practices.

This article focuses exclusively on what the FDBR requires from your Privacy Policy, point by point, based on the official text of the law.

## What the FDBR calls a Privacy Notice

The law uses the term "privacy notice." In practice, it is the Privacy Policy that most websites already have, but with specific content requirements and an annual update obligation.

§ 501.711 requires the controller to provide consumers with a privacy notice that is "reasonably accessible and clear, updated at least annually," containing six mandatory categories of information.

## What must be in the Privacy Policy under the FDBR

### 1. Categories of personal data processed

The document must list the categories of personal data the business processes, including, if applicable, any sensitive data processed (§ 501.711(1)(a)).

The FDBR is explicit in requiring specific mention of sensitive data when it is processed. This creates an additional layer of clarity compared to other state laws.

Personal data under the FDBR (§ 501.702(19)) includes any information linkable to an identified or identifiable individual, including pseudonymous data when used in conjunction with information that links the individual. Geolocation data, device identifiers, browsing history, and biometric data fall within this scope.

### 2. The purpose of processing

The document must explain what the data is used for (§ 501.711(1)(b)).

The purposes must be specific and correspond to what actually happens. § 501.71(2)(a) prohibits processing for purposes incompatible with those disclosed, except with consumer consent.

§ 501.711(5) goes further: the controller cannot collect additional categories of data or use collected data for additional purposes without providing prior notice to the consumer. Any expansion of the collection or use scope must be communicated.

### 3. How consumers exercise all seven rights

The document must describe how consumers can exercise all rights guaranteed by the FDBR (§ 501.711(1)(c)), including the appeal process.

Unlike most other state laws that guarantee five rights, the FDBR guarantees **seven**. The Privacy Policy must describe how the consumer can exercise each of them:

The right to access and confirmation.

The right to correction.

The right to deletion.

The right to portability.

The right to opt out of targeted advertising, data sale, and profiling with significant effects.

The right to opt out of collection of sensitive data, including precise geolocation.

The right to opt out of collection via voice or facial recognition features.

And how the appeal process works when a request is denied.

The [data protection officer](https://goadopt.io/en/blog/responsibilities-of-a-data-protection-officer/) must have these workflows mapped and operationally functional before publishing the document.

### 4. Categories of data shared with third parties

If the business shares data with third parties, the document must disclose which categories of data are shared (§ 501.711(1)(d)).

This covers analytics platforms, CRMs, email marketing tools, advertising networks, payment processors, and any other service that receives user data.

In the FDBR, the concept of "sale" is broader than in other laws. § 501.702(29) includes sharing for non-monetary valuable consideration in addition to monetary. A company that exchanges data with partners to receive services or other benefits may be conducting a "sale" under the FDBR definition.

### 5. Categories of third parties that receive data

In addition to the types of data, the Policy must disclose which categories of third parties receive them (§ 501.711(1)(e)).

Categories such as "digital advertising platforms," "analytics tools," "CRM systems," and "payment processors" are valid examples. Categories must be identifiable enough for the consumer to understand who accesses their data.

### 6. Description of the request submission methods

§ 501.711(1)(f) requires the Policy to describe the methods specified in § 501.709 for consumers to submit requests.

Here is a requirement specific to the FDBR: the controller must have **two or more methods** for submitting requests (§ 501.709). These methods must be secure, reliable, and clearly and conspicuously accessible. The Privacy Policy must describe all of them.

The business must also maintain a mechanism on its own website for request submission. Businesses that operate exclusively online and have a direct consumer relationship may additionally accept requests by email.

## Specific mandatory notices for sales of sensitive and biometric data

The FDBR has two specific notices that do not exist in other US state privacy laws.

If the controller engages in the sale of personal data that is sensitive data, it must display: **"NOTICE: This website may sell your sensitive personal data."** (§ 501.711(2))

If the controller engages in the sale of personal data that is biometric data, it must display: **"NOTICE: This website may sell your biometric personal data."** (§ 501.711(3))

These notices must be posted in accordance with the accessibility requirements of § 501.711(1) and are mandatory whenever these practices occur.

## Disclosure of targeted advertising and data sale

If the business sells personal data to third parties or processes it for targeted advertising, § 501.711(4) requires clear and conspicuous disclosure of this practice, along with the manner in which the consumer can opt out.

The FDBR defines targeted advertising (§ 501.702(33)) more broadly than other laws: it includes ads based on consumer activity data across **affiliated or unaffiliated** websites over time. This broadens the scope compared to laws like the VCDPA, which covers only non-affiliated websites.

## The mandatory annual update

§ 501.711(1) is explicit: the privacy notice must be updated **at least annually**. It is not enough to update only when there are material changes, as is common practice under other laws.

In practice, this means every company within the FDBR's scope needs an internal annual review process for the Privacy Policy, even if nothing has substantially changed in processing practices.

Situations that require immediate updates (in addition to the annual review):

Adding a new category of data collected.

Using existing data for new purposes.

New partners receiving consumer data.

Changes in data sale practices.

Introduction of new voice or facial recognition features.

## Protection of sensitive data: additional requirements

Sensitive data receives special treatment under the FDBR. The Privacy Policy must explicitly identify whether sensitive data is collected and which categories.

Under § 501.702(31), sensitive data includes: racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data for identification, known children's personal data, and precise geolocation data.

For each category of sensitive data collected, the Policy must explain how the consumer's consent is obtained and how it can be revoked.

For known children between 13 and 18, the FDBR requires their affirmative authorization (§ 501.71(2)(d)). For children under 13, COPPA applies.

## The device surveillance prohibition

§ 501.705(3) prohibits devices with voice recognition, facial recognition, video recording, audio recording, or other data collection features from being used for surveillance when not in active use by the consumer, without express authorization.

The Privacy Policy must mention this prohibition and describe how the business's devices are configured to comply with it.

## Children's data: "child" means under 18 years of age

The FDBR uses a broader definition. "Known child" (§ 501.702(17)) is any individual under **18 years of age** of whose age the controller has actual knowledge or willfully disregards.

This differs from most US laws that use 13 years as the threshold. If the site may have users under 18 whose age is known to the controller, the FDBR's special protections apply.

The Privacy Policy must describe how data of known users under 18 is treated differently.

## Data Protection Assessments

§ 501.713 requires controllers to conduct and document Data Protection Assessments for:

Processing data for targeted advertising.

Sale of personal data.

Processing for profiling with a reasonably foreseeable risk of harm.

Processing sensitive data.

Any processing presenting a heightened risk of harm.

Assessments are confidential. The Department of Legal Affairs may request access, and disclosure in response to that request does not constitute waiver of attorney-client privilege.

The Privacy Policy does not need to publish the assessments, but should communicate that the business conducts impact assessments for high-risk activities.

## Data retention: the 2-year limit

§ 501.719(3) requires adoption of a retention schedule that prohibits use or retention of personal data after:

The fulfillment of the initial collection purpose.

The expiration or termination of the contract.

**2 years after the consumer's last interaction with the controller.**

The Privacy Policy must mention the retention periods adopted for each data category and the existence of this 2-year limit.

## Enforcement and penalties

Violations of the FDBR are treated as unfair and deceptive trade practices by the Department of Legal Affairs, with penalties up to **US$ 50,000 per violation**.

Penalties are triplicable for violations involving known Florida children, failure to delete or correct data after an authenticated request, and continuation of data sale or sharing after consumer opt-out.

The 45-day cure period is discretionary. There is no guarantee it will be granted, and for violations involving children, it is not available.

## How AdOpt supports compliance with the FDBR

AdOpt ensures that what is written in the Policy has real correspondence with what actually happens on the site.

The automatic scan identifies all active technologies, feeding the list of data categories and third parties that must appear in the document. The [consent management platform](https://goadopt.io/en/blog/how-to-choose-cmp-consent-management-platform/) ensures the consent and opt-out mechanism works as described, including the additional rights specific to the FDBR.

Every consent interaction is logged. If the Department requests evidence, the record is available.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Privacy Policy for your site that complies with the FDBR? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what the Privacy Policy must contain for the FDBR

**Visible and accessible link** on all pages of the site.

**Updated at least annually**, even without material changes (§ 501.711(1)).

**Categories of personal data processed**, including sensitive data if applicable (§ 501.711(1)(a)).

**Purpose of processing** for each category, without vague descriptions (§ 501.711(1)(b)).

**How to exercise all 7 rights** guaranteed by the FDBR, with processes, channels, and deadlines (§ 501.711(1)(c)).

**Appeal process** described with a 60-day deadline.

**Categories of data shared with third parties** (§ 501.711(1)(d)).

**Categories of third parties** that receive data (§ 501.711(1)(e)).

**Description of the two or more submission methods** for consumer requests (§ 501.711(1)(f)).

**Notice of sensitive data sale** when applicable (§ 501.711(2)).

**Notice of biometric data sale** when applicable (§ 501.711(3)).

**Disclosure of targeted advertising or data sale** with accessible opt-out (§ 501.711(4)).

**Differentiated treatment for known children** under 18 years of age (§ 501.702(17)).

**Device surveillance prohibition** and how it is implemented (§ 501.705(3)).

**Retention periods** for each data category, including the 2-year limit (§ 501.719(3)).

**Non-discrimination policy** for consumers exercising their rights.

**Free service at least twice per year** per consumer.

## FAQ: FDBR and Privacy Policy

**1. Does the FDBR require the Privacy Policy to be updated annually even without changes?**
Yes. § 501.711(1) explicitly requires the privacy notice to be "updated at least annually." This differs from other US state privacy laws that require updates only when there are material changes. Companies within the FDBR's scope need a mandatory annual review process.

**2. What specific notices does the FDBR require that do not exist in other laws?**
The FDBR requires two specific notices. If the controller sells sensitive data, it must display: "NOTICE: This website may sell your sensitive personal data." If it sells biometric data: "NOTICE: This website may sell your biometric personal data." These notices are exclusive to the FDBR among US state privacy laws (§ 501.711(2) and (3)).

**3. How does the FDBR define "child" differently from other laws?**
The FDBR defines "known child" as any individual under 18 years of age of whose age the controller has actual knowledge or willfully disregards (§ 501.702(17)). Most other state laws use 13 years. This means businesses within the FDBR's scope need specific protections for users up to 17 years old, not just those under 13.

**4. Does the Privacy Policy need to mention the device surveillance prohibition?**
Yes. § 501.705(3) prohibits devices with voice, video, facial recognition, or other sensor features from being used for surveillance when not in active use by the consumer, without express authorization. For businesses that operate devices with these features, the Privacy Policy must describe how the prohibition is respected in practice.

**5. What happens if the Privacy Policy is not updated annually?**
The absence of an annual update constitutes a violation of § 501.711(1). The Department of Legal Affairs may grant a 45-day cure period for correction, but that period is discretionary. If not corrected, penalties reach up to US$ 50,000 per violation, potentially triplicable in specific circumstances (§ 501.72).

[Ready to build a Privacy Policy for your site that complies with the FDBR? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


Florida FDBR: Privacy Policy

California has one of the most detailed privacy policy requirements among all US state privacy laws.

This page covers one piece of the picture. For the full scope of the CCPA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the CCPA and cookies](https://goadopt.io/en/blog/california-ccpa-and-cookies-all-you-need-to-know/).

The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA) and codified at Cal. Civ. Code § 1798.100 et seq., requires the privacy notice to be updated every 12 months and to contain specific lists of what was collected, sold, shared, and disclosed in the preceding year.

This article focuses exclusively on what the CCPA/CPRA requires from your Privacy Policy, based on the official text of the law.

## Did the CPRA change what the CCPA requires from the Privacy Policy?

Yes, significantly. The CPRA (Proposition 24, operative since January 2023) expanded the transparency obligations of the privacy notice in three main areas:

Added the obligation to disclose the category of **sensitive personal information** when collected.

Added the **two new mandatory links** on the site: "Do Not Sell or Share My Personal Information" and "Limit the Use of My Sensitive Personal Information."

Reinforced **data minimization** and **proportionate retention** requirements, requiring the Policy to include the period the business intends to retain each category of data.

For more on what the CPRA specifically changed, we have a dedicated guide on the [California CPRA](https://goadopt.io/en/blog/california-cpra-and-cookies-all-you-need-to-know/). This article covers the current consolidated law.

## What must be in the Privacy Policy under the CCPA/CPRA

### 1. Categories of personal information collected

The privacy notice must list the categories of personal information collected about consumers in the **preceding 12 months** (§ 1798.130(a)(5)(B)).

The CCPA/CPRA establishes specific categories that must be used for this description, under § 1798.140(v):

Identifiers (name, address, IP address, email, Social Security number, etc.).

Personal information described in Section 1798.80 of California law.

Characteristics of protected classifications under California or federal law.

Commercial information (records of property, purchase history).

Biometric information.

Internet or other electronic network activity (browsing history, search history, ad interactions).

Geolocation data.

Audio, electronic, visual, thermal, olfactory, or similar information.

Professional or employment-related information.

Education information.

Inferences drawn to create profiles about preferences, characteristics, behavior, and aptitudes.

Sensitive personal information.

### 2. Categories of sources of personal information

The privacy notice must identify the categories of sources from which consumers' personal information is collected (§ 1798.130(a)(5)(B)(ii)).

Typical sources include: the consumer directly through forms, analytics systems, advertising networks, data partners, social media, and publicly available sources.

### 3. The business or commercial purpose for collecting, selling, or sharing

The notice must explain what the data is used for (§ 1798.130(a)(5)(B)(iii)).

The CCPA/CPRA defines "business purpose" (§ 1798.140(e)) with specific categories: auditing ad impression counts, ensuring security and integrity, debugging errors, short-term transient use, performing services on behalf of the business, advertising and marketing (except cross-context behavioral advertising), internal research, and quality verification activities.

### 4. Categories of third parties with whom data is shared

The notice must identify the categories of third parties with whom the business shares consumers' personal information (§ 1798.130(a)(5)(B)(iv)).

### 5. List of categories sold or shared in the preceding 12 months

§ 1798.130(a)(5)(C) requires the privacy notice to include:

A list of categories of personal information **sold or shared** about consumers in the preceding 12 months, by category; or a statement that the business has not sold or shared personal information.

A list of categories **disclosed for business purposes** in the preceding 12 months; or a statement that no such disclosure occurred.

These two lists must be kept separate in the privacy notice.

### 6. Consumer rights and how to exercise them

The notice must describe the rights guaranteed by the CCPA/CPRA and the designated methods for submitting requests (§ 1798.130(a)(5)(A)):

Right to know and access (§ 1798.100, 1798.110, 1798.115).

Right to deletion (§ 1798.105).

Right to correction of inaccurate data (§ 1798.106).

Right to opt-out of sale and sharing (§ 1798.120).

Right to limit use of sensitive personal information (§ 1798.121).

Right of non-discrimination (§ 1798.125).

And the two or more designated methods for submitting requests, including at minimum a toll-free telephone number.

### 7. Retention period for each category

§ 1798.100(a)(3) requires that, at or before the point of collection, the business inform consumers of the length of time it intends to retain each category of personal information, including sensitive personal information, or the criteria used to determine that period.

The business shall not retain a consumer's personal information for longer than is reasonably necessary for the disclosed purpose.

## The two mandatory links on the homepage

§ 1798.135 requires the Privacy Policy to mention and the site to provide, clearly and conspicuously:

**"Do Not Sell or Share My Personal Information":** a link to a page where the consumer can opt out of the sale and sharing of their data. Sharing, defined as transfer for cross-context behavioral advertising, is included even without monetary consideration.

**"Limit the Use of My Sensitive Personal Information":** a link that allows the consumer to limit the use of sensitive personal information to what is necessary to provide the products or services reasonably expected.

The business may use a single combined link that clearly allows exercising both options.

Alternatively, the business may honor the opt-out preference signal of the **Global Privacy Control (GPC)** when sent by the consumer, instead of maintaining the links. In that case, the Policy must state that the site respects the GPC.

## Disclosure of sensitive personal information

If the business collects sensitive personal information, the privacy notice must expressly disclose this (§ 1798.100(a)(2)).

Sensitive personal information under the CCPA/CPRA (§ 1798.140(ae)) includes: Social Security number, driver's license, or passport number; login credentials and financial account access codes; precise geolocation; racial or ethnic origin, citizenship status, religious beliefs, union membership; contents of private communications; genetic data; neural data; biometric data for identification; health information; sex life or sexual orientation.

For each category of sensitive information collected, the Policy must explain:

For what specific purpose it is collected.

Whether it is sold or shared, and with whom.

How the consumer can limit its use (via "Limit the Use of My Sensitive Personal Information" link or via GPC).

## The 12-month lookback

A specific feature of the CCPA/CPRA is the 12-month lookback in access requests.

When a consumer makes an access request, the response must cover the period of 12 months preceding receipt of the request (§ 1798.130(a)(2)(B)).

After adoption of specific regulations, the consumer may request information beyond 12 months for data collected from January 1, 2022, if it is not impossible or would not involve disproportionate effort.

The Privacy Policy must mention this 12-month lookback so the consumer understands which time period is covered by their request.

## Request submission methods: the toll-free number is mandatory

§ 1798.130(a)(1) requires two or more designated methods for submitting requests, including at minimum a **toll-free telephone number**.

Businesses that operate exclusively online with a direct consumer relationship may limit themselves to an email address.

The business must make its website available for request submission if it maintains a website.

The business cannot require the consumer to create a new account to exercise their rights. It may require use of an existing account.

Data collected for identity verification may be used only for that purpose, not for other uses (§ 1798.130(a)(7)).

## Protection for consumers under 16 years of age

If the business may have consumers under 16 years of age, the Privacy Policy must describe the special protections applicable:

For consumers between 13 and 15: the business cannot sell or share data without affirmative authorization from the consumer themselves (§ 1798.120(c)).

For consumers under 13: parental or guardian authorization is required.

A business that willfully disregards the consumer's age is deemed to have actual knowledge of it.

The [data protection officer](https://goadopt.io/en/blog/responsibilities-of-a-data-protection-officer/) must ensure that the age verification process, where applicable, is operational and documented.

## The private right of action and the Privacy Policy

§ 1798.150 grants the consumer the private right of action for security breaches, with damages of US$ 100 to US$ 750 per consumer per incident.

Before initiating any action for statutory damages, the consumer must provide written notice to the business 30 days in advance. If the business cures the violation within the period and provides a written statement that no further violations will occur, no action may be initiated.

The Privacy Policy must mention this right and how the consumer can exercise it.

## The mandatory annual update

§ 1798.130(a)(5) requires the privacy notice to be updated **at least once every 12 months**.

This update must reflect what was collected, sold, shared, and disclosed for business purposes in the preceding 12 months. A generic, outdated notice is not sufficient: the business needs an internal mandatory annual review process.

Situations requiring immediate update, in addition to the annual review:

Adding a new category of data collected.

New third parties receiving data.

Changes in sale or sharing practices.

New purposes for data use.

Any change to opt-out links or submission methods.

## Enforcement and penalties

CCPA/CPRA violations are investigated and enforced by the **California Privacy Protection Agency (CPPA)** and the **California Attorney General**.

The CPPA can impose administrative fines of up to **US$ 2,500 per violation** and up to **US$ 7,500 for intentional violations** or violations involving minors. The Attorney General can seek civil penalties in the same amounts.

There is no guaranteed cure period before CPPA actions. The agency has discretion to investigate without any obligation to grant advance notice.

## How AdOpt supports CCPA/CPRA compliance

AdOpt ensures that what is written in the Policy has real correspondence with what actually happens on the site.

The automatic scan identifies all active technologies, feeding the list of data categories and third parties. The [consent management platform](https://goadopt.io/en/blog/how-to-choose-cmp-consent-management-platform/) ensures that the opt-out and sensitive information limitation mechanisms work as described.

The GPC is honored automatically when sent by the user. Every consent interaction is logged. If the CPPA or Attorney General requests evidence, the record is available.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Privacy Policy for your site that complies with the CCPA/CPRA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what the Privacy Policy must contain for the CCPA/CPRA

**Visible and accessible link** on all pages of the site.

**Updated at least once every 12 months** (§ 1798.130(a)(5)).

**Categories of personal information collected** in the preceding 12 months (§ 1798.130(a)(5)(B)(i)).

**Categories of sources** of personal information (§ 1798.130(a)(5)(B)(ii)).

**Business or commercial purpose** for collecting, selling, or sharing (§ 1798.130(a)(5)(B)(iii)).

**Categories of third parties** with whom data is shared (§ 1798.130(a)(5)(B)(iv)).

**List of categories sold or shared** in the preceding 12 months (§ 1798.130(a)(5)(C)(i)).

**List of categories disclosed for business purposes** in the preceding 12 months (§ 1798.130(a)(5)(C)(ii)).

**Consumer rights and how to exercise them**, with process and deadlines (§ 1798.130(a)(5)(A)).

**Two or more submission methods**, including a toll-free telephone number (§ 1798.130(a)(1)).

**"Do Not Sell or Share My Personal Information" link** or statement of honoring GPC (§ 1798.135).

**"Limit the Use of My Sensitive Personal Information" link** when applicable (§ 1798.121, 1798.135).

**Categories of sensitive personal information** collected, when applicable (§ 1798.100(a)(2)).

**Retention period** for each category of data (§ 1798.100(a)(3)).

**12-month lookback** for access requests mentioned (§ 1798.130(a)(2)(B)).

**Private right of action** for security breaches mentioned (§ 1798.150).

**Protection for minors** aged 13 to 15 and under 13 (§ 1798.120(c)).

**Non-discrimination policy** for consumers exercising their rights (§ 1798.125).

## FAQ: CCPA/CPRA and Privacy Policy

**1. How often does the Privacy Policy need to be updated under the CCPA/CPRA?**
At least once every 12 months, under § 1798.130(a)(5). This goes beyond updating only when there are material changes. The business needs a mandatory annual review process, and the lists of categories sold, shared, and disclosed in the preceding 12 months must be regularly updated.

**2. What is the "12-month lookback" and how does it affect the Privacy Policy?**
§ 1798.130(a)(2)(B) requires that the response to a consumer access request cover the 12 months preceding receipt of the request. The Privacy Policy must mention this period so the consumer understands which time window is covered by their request.

**3. Does the Privacy Policy need to mention the CCPA private right of action?**
Yes. § 1798.150 grants consumers the right to file civil lawsuits for security data breaches. The Policy must mention this right and the process: the consumer must provide written notice to the business 30 days in advance before initiating action for statutory damages.

**4. Is the toll-free telephone number really mandatory?**
Yes. § 1798.130(a)(1) requires the business to provide two or more designated methods for submitting requests, including at minimum a toll-free telephone number. The exception applies to businesses that operate exclusively online with a direct consumer relationship, which may limit themselves to an email address.

**5. What did the CPRA add that was not in the original CCPA?**
The CPRA added: the right to correct inaccurate data (§ 1798.106), the right to limit use of sensitive personal information (§ 1798.121), the mandatory "Limit the Use of My Sensitive Personal Information" link, the distinction between "sale" and "sharing" for behavioral advertising, the expanded definition of sensitive personal information (including neural data), and data minimization and proportionate retention requirements. All of this must be reflected in the Privacy Policy.

[Ready to build a Privacy Policy for your site that complies with the CCPA/CPRA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


California CCPA: Privacy Policy

The Colorado Privacy Act (CPA, C.R.S. § 6-1-1301 et seq.) has one of the most detailed sets of privacy notice requirements among all US state privacy laws.

This page covers one piece of the picture. For the full scope of the CPA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the CPA and cookies](https://goadopt.io/en/blog/colorado-cpa-and-cookies-all-you-need-to-know/).

This happens because Colorado went beyond the statute: the Attorney General promulgated the Colorado Privacy Act Rules (4 CCR 904-3), a complete set of regulations that precisely specify what each element of the privacy notice must contain, how it must be presented, in what languages, and which changes require immediate update.

This article focuses exclusively on what the CPA and its regulations require from the Privacy Policy, based on the official text of both documents.

## What the CPA calls a Privacy Notice

The law uses the term "privacy notice." In practice, it is the Privacy Policy.

C.R.S. § 6-1-1308(1) requires the controller to provide consumers with a privacy notice that is "reasonably accessible, clear, and meaningful."

The regulations (4 CCR 904-3, Rule 6.02) expand this standard: the notice must give the consumer a meaningful understanding and accurate expectations of how their personal data will be processed. It must be clear, easily accessible, specific, and available in all languages the controller regularly uses to interact with consumers.

## What must be in the Privacy Policy under the CPA

### 1. Categories of personal data processed

The notice must list the categories of personal data collected or processed by the controller or a processor (C.R.S. § 6-1-1308(1)(a)(I)).

The regulations (4 CCR 904-3, Rule 6.03(A)(1)(a)) require categories to be described at a sufficient level of detail for the consumer to understand the type of data. Examples of categories with adequate granularity: "contact information," "government-issued identification numbers," "payment information," "data from cookies," "data revealing religious affiliation," "medical data."

The notice must also specifically indicate whether sensitive data or children's data is processed.

### 2. The purposes for which the data is processed

The notice must explain what the data of each category is used for (C.R.S. § 6-1-1308(1)(a)(II)).

The regulations (4 CCR 904-3, Rule 6.06) require the purpose to be described at a level of detail that gives the consumer a meaningful understanding of how the data is used. Vague purposes are not permitted. If data will be used for targeted advertising, profiling, or sale, this must be stated explicitly for each category.

### 3. How consumers exercise their rights and file appeals

The notice must describe how and where consumers can exercise the rights guaranteed by the CPA, including the controller's contact information and how to appeal a decision (C.R.S. § 6-1-1308(1)(a)(III)).

The regulations (4 CCR 904-3, Rule 6.03(A)(4)) detail what must be in the notice:

Instructions on how to use each available submission method.

Instructions on how an authorized agent may submit opt-outs on behalf of a consumer.

A clear and conspicuous method to exercise opt-out of targeted advertising and data sale.

The description of the commercially reasonable identity authentication process.

Effective July 2024: explanation of how requests via Universal Opt-Out Mechanism will be processed.

### 4. Categories of personal data shared with third parties

If the controller shares data with third parties, the notice must identify the categories of data shared (C.R.S. § 6-1-1308(1)(a)(IV)).

The regulations (4 CCR 904-3, Rule 6.03(A)(1)(d)) also require the notice to indicate whether each category of data will be sold, used for targeted advertising, or for profiling with significant effects on the consumer.

### 5. Categories of third parties with whom data is shared

In addition to the categories of data, the notice must identify the categories of third parties that receive them (C.R.S. § 6-1-1308(1)(a)(V)).

The regulations (4 CCR 904-3, Rule 6.03(A)(1)(e)) require categories of third parties to be described at a level of detail that gives the consumer a meaningful understanding of the type, business model of, or processing conducted by those third parties. Examples: "analytics companies," "data brokers," "third-party advertisers," "payment processors," "lenders," "government agencies."

### 6. The date of last update

The regulations (4 CCR 904-3, Rule 6.03(A)(8)) require the notice to include the date it was last updated.

## The opt-out mechanism must be in the notice

C.R.S. § 6-1-1308(1)(b) requires that if the controller sells personal data or processes for targeted advertising, it must disclose this clearly and conspicuously, along with the method to exercise the opt-out.

The regulations (4 CCR 904-3, Rule 4.03(B)) detail: the opt-out method must appear in the privacy notice AND in a clear, conspicuous, and readily accessible location outside the notice. A direct link to the opt-out method is required.

From July 2024, the notice must also describe how requests via Universal Opt-Out Mechanism (including the GPC) will be processed.

## Sensitive data: additional requirements

If the controller processes sensitive data, the notice must reflect this explicitly.

Sensitive data under the CPA (C.R.S. § 6-1-1303(24)) includes: racial or ethnic origin, religious beliefs, physical or mental health, sex life or sexual orientation, citizenship status, genetic or biometric data for identification, and known children's data.

The regulations (4 CCR 904-3, Rule 6.10) add an important nuance: inferences made by the controller that indicate these sensitive categories ("Sensitive Data Inferences") are also sensitive data and require consent to be processed, except in specific situations where they can be deleted within 24 hours.

If the controller uses this 24-hour inference exception, the notice must describe the inferences subject to this provision and the retention and deletion timeline.

## The duty of purpose specification

The CPA explicitly names the **duty of purpose specification** as an autonomous controller obligation (C.R.S. § 6-1-1308(2)): the controller must specify the express purposes for which personal data are collected and processed.

The regulations (4 CCR 904-3, Rule 6.06) detail what this means:

The purpose must be described at a level of detail that gives the consumer a meaningful understanding of how the data is used.

If data is collected for more than one purpose, each unrelated purpose must be specified separately.

It is not permitted to identify a broad purpose to justify numerous processing activities that are only remotely related.

It is not permitted to specify so many purposes that the purposes become unclear or uninformative.

## The duty to avoid secondary use

The CPA also names the **duty to avoid secondary use** (C.R.S. § 6-1-1308(4)): the controller must not process personal data for purposes not reasonably necessary or compatible with the specified purposes, except with consumer consent.

The regulations (4 CCR 904-3, Rule 6.08) detail: if the controller collected data before July 2023 and the processing purpose changes after that date in a way incompatible with the original, new consent must be obtained.

## The 24-month consent refresh requirement

This is a requirement exclusive to Colorado's regulations that does not exist in other US state privacy laws.

Under 4 CCR 904-3, Rule 7.08: when a consumer has not interacted with the controller in the **past 24 months**, the controller must **refresh consent** to:

Continue processing sensitive data.

Continue processing personal data for secondary purposes involving profiling with significant effects.

The exception is for cases where the consumer has permanent access and ability to update their opt-out preferences through a consumer-controlled interface.

The Privacy Policy must describe when and how this consent will be refreshed.

## Material changes: mandatory notification

The regulations (4 CCR 904-3, Rule 6.04) require the controller to notify consumers of material changes to the privacy notice, communicated in a manner by which the controller regularly interacts with consumers.

Material changes include: categories of personal data processed, processing purposes, the controller's identity, the act of sharing personal data with third parties, categories of third parties, and methods for exercising rights.

If a material change constitutes a secondary use, the controller must obtain consumer consent.

## Enforcement and penalties

CPA violations are treated as **deceptive trade practices** under the Colorado Consumer Protection Act (C.R.S. § 6-1-1311(1)(c)).

Enforcement is shared between the **Attorney General** and **District Attorneys** of Colorado. There is no private right of action (C.R.S. § 6-1-1310).

Before 2025, there was a guaranteed 60-day cure period. From 2025 onward, the cure period is discretionary.

## How AdOpt supports CPA compliance

AdOpt ensures that what is written in the Policy has real correspondence with what actually happens on the site.

The automatic scan identifies all active technologies, feeding the list of data categories and third parties. The [consent management platform](https://goadopt.io/en/blog/how-to-choose-cmp-consent-management-platform/) ensures that the Universal Opt-Out Mechanism is honored automatically and the consent mechanism works as described.

Every interaction is logged for 24 months as required by the regulations.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Privacy Policy for your site that complies with the Colorado CPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what the Privacy Policy must contain for the CPA

**Visible and accessible link** on all pages, using the word "privacy" (4 CCR 904-3, Rule 6.02(E)).

**Available in all languages** used by the controller to interact with consumers (4 CCR 904-3, Rule 3.02(A)(3)).

**Accessible for people with disabilities**, following WCAG 2.1 (4 CCR 904-3, Rule 3.02(A)(2)).

**Categories of personal data processed**, with sufficient granularity (C.R.S. § 6-1-1308(1)(a)(I)).

**Purpose for each category**, without vague descriptions (C.R.S. § 6-1-1308(1)(a)(II)).

**Whether data will be sold, used for targeted advertising, or profiling** (4 CCR 904-3, Rule 6.03(A)(1)(c)).

**How to exercise all rights** guaranteed by the CPA, with processes and timelines (C.R.S. § 6-1-1308(1)(a)(III)).

**Appeal process** described with 45+60 day deadlines.

**Categories of personal data shared with third parties** (C.R.S. § 6-1-1308(1)(a)(IV)).

**Categories of third parties** with detail on type/business model (C.R.S. § 6-1-1308(1)(a)(V)).

**Opt-out method** clearly within and outside the notice (C.R.S. § 6-1-1308(1)(b)).

**Universal Opt-Out Mechanism** processing explained (4 CCR 904-3, Rule 6.03(A)(4)(e)).

**Sensitive data and sensitive data inferences** identified with how consent is obtained.

**Consent refresh policy** after 24 months of consumer inactivity (4 CCR 904-3, Rule 7.08).

**Date of last update** (4 CCR 904-3, Rule 6.03(A)(8)).

**Controller contact information**.

**Authentication process** described.

## FAQ: CPA and Privacy Policy

**1. Does the CPA require a Colorado-specific privacy notice?**
No. The regulations (4 CCR 904-3, Rule 6.02(B)) confirm that the controller does not need a separate Colorado notice, as long as the existing notice meets all CPA requirements and makes clear that Colorado consumers have the rights provided by C.R.S. § 6-1-1306.

**2. In how many languages must the privacy notice be available?**
The notice must be available in all languages in which the controller ordinarily provides web pages, interfaces, contracts, and other information to consumers (4 CCR 904-3, Rule 3.02(A)(3)). Communications sent directly to the consumer must be in the language the consumer ordinarily uses to interact with the controller.

**3. What are "Sensitive Data Inferences" and how do they affect the Privacy Policy?**
They are inferences made by the controller based on personal data indicating racial or ethnic origin, religious beliefs, health condition, sex life or sexual orientation, or citizenship status (4 CCR 904-3, Rule 2.02). Like the underlying sensitive data, these inferences require consent to be processed. If the controller uses the 24-hour deletion exception, the Policy must describe the inferences subject to this provision and the retention timeline.

**4. What is the 24-month consent refresh requirement?**
The regulations (4 CCR 904-3, Rule 7.08) require that when a consumer has not interacted with the controller in the past 24 months, consent for processing sensitive data or for secondary purposes involving significant profiling effects must be refreshed. This requirement is exclusive to Colorado and does not exist in other US state privacy laws.

**5. What changed in CPA enforcement from 2025?**
Before 2025, C.R.S. § 6-1-1311(1)(d) guaranteed 60 days to cure before legal action. From January 1, 2025, this provision was repealed. The Attorney General and District Attorneys now have discretion to investigate and act without any obligation to grant a prior correction period.

[Ready to build a Privacy Policy for your site that complies with the Colorado CPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


Colorado CPA: Privacy Policy

The Colorado Privacy Act (CPA) has a set of rules for the Privacy Portal that goes beyond the statute. The Attorney General promulgated the Colorado Privacy Act Rules (4 CCR 904-3), which specify exactly how each aspect of the DSAR process must work, including the minimum content of each request record, the record-keeping deadline, and how to handle authorized agents.

This page covers one piece of the picture. For the full scope of the CPA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the CPA and cookies](https://goadopt.io/en/blog/colorado-cpa-and-cookies-all-you-need-to-know/).

This article covers all of it: what a DSAR is under the CPA, the five guaranteed rights, the law's specific deadlines, the Universal Opt-Out Mechanism, and what the regulations require from the process.

## What is a DSAR under the CPA?

DSAR stands for Data Subject Access Request, or Data Rights request in the language of the CPA. It is any formal request from a Colorado consumer to exercise the rights the law grants over their own data.

Under C.R.S. § 6-1-1306(1), the consumer may submit a request at any time using the methods specified by the controller in the privacy notice.

If you are already familiar with the [GDPR](https://goadopt.io/en/blog/gdpr-cookies-explained/) data subject rights framework, the structure is familiar. The CPA adds the Universal Opt-Out Mechanism as an alternative channel for exercising opt-out of targeted advertising and data sale.

## What are consumer rights under the CPA?

Under C.R.S. § 6-1-1306(1), Colorado residents have five rights:

### Right to opt-out

The consumer may refuse the processing of their personal data for three purposes (C.R.S. § 6-1-1306(1)(a)):

Targeted advertising.

Sale of personal data.

Profiling in furtherance of decisions with legal or similarly significant effects (access to financial or lending services, housing, insurance, education, criminal justice, employment, healthcare, or essential goods).

The consumer may also exercise the opt-out through an authorized agent, including via UOM (such as the GPC), when the controller can authenticate the consumer's identity and the agent's authority with commercially reasonable effort (C.R.S. § 6-1-1306(1)(a)(II)).

The regulations (4 CCR 904-3, Rule 4.03(A)(1)(b)) detail: if the opt-out is submitted online and the controller cannot identify the consumer to cease processing of connected offline data, it may request additional information. And if a consumer submitted multiple DSARs, the opt-out must be processed first.

### Right of access

The consumer may confirm whether the controller processes their data and access the personal data (C.R.S. § 6-1-1306(1)(b)).

The regulations (4 CCR 904-3, Rule 4.04(A)(1)) clarify that "specific pieces of personal data" include final profiling decisions, inferences, derivative data, marketing profiles, and any other personal data created by the controller linked to the consumer.

The response must be provided in a common, accessible electronic format, in the language the consumer uses to interact with the controller, without incomprehensible internal codes.

The controller does not need to disclose in response to an access request: government-issued identification numbers, financial account numbers, biometric data or biometric identifiers. But must inform the consumer that it holds these types of data (e.g., "We collect unique biometric data including fingerprint scan" without revealing the actual scan).

### Right to correction

The consumer may request correction of inaccuracies in personal data, taking into account the nature and purposes of processing (C.R.S. § 6-1-1306(1)(c)).

The regulations (4 CCR 904-3, Rule 4.05) detail:

The controller corrects in active systems but may delay for archive or backup systems until they are restored or accessed.

If the correction can be made by the consumer through account settings, the controller may provide instructions, provided the process is not unduly burdensome.

The controller may request documentation to verify data accuracy.

If the controller did not receive the data directly from the consumer and has no supporting documentation, the consumer's assertion of inaccuracy is sufficient to establish that the data is inaccurate.

### Right to deletion

The consumer may request deletion of personal data (C.R.S. § 6-1-1306(1)(d)).

The regulations (4 CCR 904-3, Rule 4.06) detail:

The controller permanently and completely erases from active systems, or de-identifies so it cannot reasonably be linked to the individual.

Also instructs processors to delete.

May delay for archive or backup systems until they are restored.

For data obtained from third parties (not directly from the consumer), may comply by retaining only the deletion request record and the minimum necessary to ensure the data remains deleted, or opting the consumer out of all processing.

If partial retention is justified by a legal exception, must inform the consumer of which categories were not deleted and which exception applies.

### Right to data portability

When exercising the right of access, the consumer may obtain data in a portable and, where technically feasible, readily usable format that allows transmission to another entity without hindrance (C.R.S. § 6-1-1306(1)(e)).

Portability may be exercised **no more than twice per calendar year**. This differs from other US state privacy laws that do not impose this limit on the right to portability.

The controller is not required to provide data in a manner that discloses trade secrets. But must provide as much data as possible in portable format without disclosing the secret.

## What are the response deadlines?

The CPA's deadlines have a specific structure.

**45 days** from receipt of the request to respond (C.R.S. § 6-1-1306(2)(a)).

The deadline may be extended by another **45 days** when reasonably necessary, considering complexity and number of requests, as long as the consumer is notified within the initial period with the reason.

For **appeals**: **45 days** to respond, extendable by another **60 days** in cases of complexity or large number of requests (C.R.S. § 6-1-1306(3)(b)).

The first request is free. For subsequent requests within the same 12-month period, the business may charge a fee calculated under C.R.S. § 24-72-205(5)(a).

## The appeal process with distinct deadlines

The CPA has a very specific appeal process (C.R.S. § 6-1-1306(3)):

The controller must establish an internal appeal process that is conspicuously available and as easy to use as the original request submission process.

The process must be actionable within a reasonable period after the consumer receives the denial notice.

The appeal response must include the decision and the written justification.

If the appeal is denied, the controller must **inform the consumer of the ability to contact the Attorney General** (C.R.S. § 6-1-1306(3)(c)).

## What should the request submission channel look like?

The regulations (4 CCR 904-3, Rule 4.02(B)) detail the requirements:

**Online-only businesses with a direct consumer relationship:** a single email address is sufficient.

**Other businesses:** two or more designated methods, and if the business maintains a website, application, or digital presence, one method must be through that digital presence (web form).

**Businesses that interact in person:** must consider an in-person method (printed form, tablet/computer portal, or telephone for a toll-free call).

The method must:

Consider how consumers normally interact with the controller.

Enable the consumer to submit the request at any time.

Use reasonable data security measures.

Be easy to execute, with a minimal number of steps.

Not require creating a new account (but may require using an existing password-protected account).

## Authentication: how to do it right

The regulations (4 CCR 904-3, Rule 4.08) are specific:

The controller must use a commercially reasonable method to authenticate each request. To determine what is reasonable, consider:

The right being exercised, the type, sensitivity, value, and volume of data involved.

The level of possible harm from improper access.

The cost of authentication to the controller.

The controller should avoid requesting additional personal data if it can authenticate using data it already has.

The controller cannot charge an authentication fee to the consumer (e.g., cannot require notarization without compensating the consumer for the cost).

If unable to authenticate with reasonable effort, the controller is not required to comply. But must inform the consumer that their identity could not be authenticated and how to remedy deficiencies.

## Mandatory documentation for 24 months

The regulations (4 CCR 904-3, Rule 6.11(A)) require records of all DSARs to be maintained for at least **24 months**. Each record must include at minimum:

The date of the request.

The type of request.

The date of the controller's response.

The nature of the response.

The basis for denial if the request was denied in whole or in part.

The existence and resolution of any appeal.

Records of DSARs already complied with must also be maintained for 24 months and made available to any new controller in a merger, acquisition, or other transaction where a third party assumes control of personal data.

## The Universal Opt-Out Mechanism in the Privacy Portal

The UOM (including the GPC) does not replace the Privacy Portal, but covers the opt-out for targeted advertising and data sale.

When the consumer sends a valid UOM signal, the controller must:

Cease processing for the indicated purposes as soon as feasibly possible, without undue delay (4 CCR 904-3, Rule 4.03(A)(1)).

Maintain a record of the opt-out (4 CCR 904-3, Rule 4.03(A)(2)).

Continue treating the browser, device, and consumer as having exercised opt-out until the consumer consents again (4 CCR 904-3, Rule 5.08(A)(2)).

If the consumer wants to opt out of profiling with significant effects, this still requires submission through the Privacy Portal, since the UOM covers only targeted advertising and data sale.

## Protection against discrimination

C.R.S. § 6-1-1308(1)(c)(II) prohibits the controller from, based solely on the exercise of a right and unrelated to feasibility or the value of a service, increasing the cost or decreasing the availability of the product or service.

The exception is loyalty programs, rewards, premium features, discounts, or club card programs (C.R.S. § 6-1-1308(1)(d)). The regulations (4 CCR 904-3, Rule 6.05) detail extensively the obligations related to loyalty programs.

## Enforcement: AG and District Attorneys

The CPA is enforced by the **Attorney General** and **District Attorneys** of Colorado (C.R.S. § 6-1-1311). There is no private right of action.

From January 1, 2025, the 60-day cure period was repealed. AG and DAs have discretion to act without a guaranteed prior correction period.

## How AdOpt helps with the Privacy Portal

AdOpt logs every consent and opt-out interaction with a timestamp and unique identifier, maintaining documentation for 24 months as required by the regulations.

The GPC and other UOMs are detected and honored automatically. When the consumer exercises opt-out via Portal or via UOM, the system updates the corresponding trackers. The auditable log serves as evidence for the AG or District Attorneys.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Privacy Portal for your site that complies with the Colorado CPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what the Privacy Portal needs for the CPA

**Two or more submission methods** for non-online-only businesses, including a digital channel if the business has digital presence (4 CCR 904-3, Rule 4.02(B)(1)(b)).

**Email only** for online-only businesses with a direct consumer relationship (4 CCR 904-3, Rule 4.02(B)(1)(a)).

**Coverage of 5 rights**: opt-out, access, correction, deletion, portability.

**Portability limited to 2x per calendar year** (C.R.S. § 6-1-1306(1)(e)).

**Universal Opt-Out Mechanism** honored automatically from July 2024 (C.R.S. § 6-1-1306(1)(a)(IV)(B)).

**Conspicuously available appeal process** as easy as the original submission process.

**Deadlines**: 45 days for response (+45 ext.); 45 days for appeals (+60 ext.).

**Information to consumer** on how to contact the AG in case of denied appeal.

**Authentication** with commercially reasonable effort, no fee charged, no unnecessary data requested.

**Records maintained for 24 months** with the 6 mandatory fields (4 CCR 904-3, Rule 6.11(A)).

**Free first request**; second may be charged under C.R.S. § 24-72-205(5)(a).

**Consent refresh** configured for 24 months of consumer inactivity.

**Notification to processors** when a deletion or correction is fulfilled.

## Comparison: Privacy Portal deadlines under the CPA

| Request type | Response deadline | Extension possible |
|---|---|---|
| Opt-out, access, correction, deletion | 45 days | +45 days with notification |
| Portability (max 2x/year) | 45 days | +45 days with notification |
| Appeal of a decision | 45 days | +60 days with notification |
| Cure period (general violations) | Discretionary (2025) | No guarantee |

## FAQ: CPA and Privacy Portal

**1. Does the CPA require a dedicated Privacy Portal or is an email address sufficient?**
It depends on the type of business. Online-only businesses with a direct consumer relationship only need an email address (4 CCR 904-3, Rule 4.02(B)(1)(a)). Others need two or more methods, and a business with a website must offer a digital option (web form). A dedicated Privacy Portal is the most organized approach, but it is not the name the law requires.

**2. How does the twice-per-year limit on portability work?**
The right to portability under the CPA may be exercised no more than twice per calendar year (C.R.S. § 6-1-1306(1)(e)). This is a limit exclusive to the CPA among US state privacy laws. The right of access (without portable format) does not have this explicit limit in the statute, although the first request is free and subsequent ones may be charged.

**3. What must the controller do when a consumer has not interacted for 24 months?**
The regulations (4 CCR 904-3, Rule 7.08) require the controller to refresh consent for processing sensitive data and for secondary purposes involving profiling with significant effects, when the consumer has not interacted in the past 24 months. This means the Privacy Portal and consent management systems need to track the consumer's last interaction and trigger consent refresh flows.

**4. What happens after a denied appeal under the CPA?**
C.R.S. § 6-1-1306(3)(c) requires the controller to inform the consumer of the ability to contact the Attorney General. This differs from other laws that require specific instructions on how to contact the authority. The CPA is more open: the controller must communicate that this option exists. The consumer can then file a complaint with the AG or the District Attorney of the relevant jurisdiction.

**5. Does the CPA have specific obligations about data found during an access request that the controller cannot disclose?**
Yes. The regulations (4 CCR 904-3, Rule 4.04(D)) list categories of data the controller does not need to disclose in the access response: government-issued identification numbers, financial account numbers, health insurance or medical identification numbers, passwords, security questions, biometric data, and biometric identifiers. But the controller must inform the consumer that it holds these types of data, with sufficient particularity (e.g., "We collect unique biometric data including a fingerprint scan") without revealing the actual data.

[Ready to build a Privacy Portal for your site that complies with the Colorado CPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


Colorado CPA: DSAR Privacy Portal

The Connecticut Data Privacy Act (CTDPA, Public Act No. 22-15) has a specific requirement for the privacy notice that does not appear as explicitly in other US state privacy laws: the notice must include an **active email address** or other online mechanism that the consumer may use to contact the controller.

This page covers one piece of the picture. For the full scope of the CTDPA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the CTDPA and cookies](https://goadopt.io/en/blog/connecticut-CTDPA-and-cookies-all-you-need-to-know/).

It sounds simple. But it is an explicit requirement that many businesses overlook when building privacy policies for compliance with other legislation.

This article focuses exclusively on what the CTDPA requires from the Privacy Policy, based on the official text of the law.

## What the CTDPA calls a Privacy Notice

The law uses the term "privacy notice." In practice, it is the Privacy Policy that most sites already have, but with CTDPA-specific content elements.

Section 6(c) requires the controller to provide consumers with a privacy notice that is "reasonably accessible, clear and meaningful."

## What must be in the Privacy Policy under the CTDPA

### 1. Categories of personal data processed

The notice must list the categories of personal data processed by the controller (Section 6(c)(1)).

Categories must be described clearly enough for consumers to understand what types of data are being collected. This includes identifiers, behavioral data, geolocation data, communication data, and specifically whether sensitive data is in the list.

Sensitive data under the CTDPA (Section 1(27)) includes: racial or ethnic origin, religious beliefs, physical or mental health, sex life, sexual orientation, citizenship or immigration status, genetic or biometric data for identification, known children's data, and precise geolocation. If any of these categories are collected, they must be explicitly listed.

### 2. The purpose for processing

The notice must explain what the data is used for (Section 6(c)(2)).

The purpose must be specific enough for the consumer to understand the actual intent. The CTDPA prohibits processing for purposes incompatible with those disclosed, except with consent (Section 6(a)(2)).

If data is used for targeted advertising or sale, Section 6(d) requires clear and conspicuous specific disclosure about that use, along with the opt-out method.

### 3. How consumers exercise their rights and file appeals

The notice must describe how consumers can exercise the five rights guaranteed by the CTDPA, including how to appeal a controller decision (Section 6(c)(3)).

The five rights covered are: access and confirmation, correction, deletion, portability, and opt-out of targeted advertising, data sale, and solely automated profiling.

For exercising rights, Section 6(e)(1) requires the controller to establish one or more secure and reliable means, described in the privacy notice, taking into account:

The ways in which consumers normally interact with the controller.

The need for secure and reliable communication.

The controller's ability to verify the consumer's identity.

The controller cannot require creation of a new account, but may require use of an existing account.

### 4. Categories of personal data shared with third parties

The notice must identify the categories of personal data the controller shares with third parties (Section 6(c)(4)).

This includes analytics platforms, advertising tools, CRMs, payment processors, and any external service receiving user data. "Third party" under the CTDPA (Section 1(29)) excludes the consumer, the controller, the processor, and affiliates of the controller or processor.

### 5. Categories of third parties with whom data is shared

Beyond the categories of data, the notice must identify the categories of third parties receiving them (Section 6(c)(5)).

Categories such as "digital advertising platforms," "analytics tools," "marketing CRMs," and "payment processors" are valid examples. Categories must be identifiable enough for the consumer to understand who accesses their data.

### 6. Active email address or online contact mechanism

The notice must include an active email address or other online mechanism the consumer may use to contact the controller (Section 6(c)(6)).

This requirement is explicit and specific to the CTDPA. The consumer needs a direct contact channel with the controller available within the privacy notice itself, not just abstract rights and processes.

## Disclosure of targeted advertising and data sale

If the controller sells personal data to third parties or processes it for targeted advertising, Section 6(d) requires clear and conspicuous disclosure of this, along with the opt-out method.

Targeted advertising under the CTDPA (Section 1(28)): ads based on data from consumer activities over time across **nonaffiliated** websites or online applications. Contextual ads, own-site-based ads, and ads in response to consumer requests do not constitute targeted advertising.

## The mandatory opt-out link on the site

Beyond the privacy notice, Section 6(e)(1)(A)(i) requires the controller to provide a clear and conspicuous link on its website to a page enabling the consumer to opt out of targeted advertising or sale of personal data.

This link must be visible on the page, not buried in obscure menus or footers.

## The opt-out preference signal from January 2025

Section 6(e)(1)(A)(ii) requires that from **January 1, 2025**, controllers processing for targeted advertising or selling data allow opt-out via signal sent with consumer consent.

The mechanism cannot be a default setting: must represent an affirmative, freely given, and unambiguous consumer choice. The Global Privacy Control (GPC) is the best-known mechanism meeting these criteria.

The Privacy Policy must state whether the site honors these signals and how they work.

## Protection for sensitive data

Sensitive data requires consent before processing. The Policy must identify:

Whether any sensitive data category is collected.

For what specific purpose sensitive data is used.

How consent is obtained and can be revoked.

The revocation mechanism must be at least as easy as the consent mechanism. After revocation, processing must cease within **15 days** (Section 6(a)(6)).

## Special protection for teens aged 13 to 15

If the site may have users aged 13 to 15, the Privacy Policy must describe how the business obtains consent before processing data for targeted advertising or sale (Section 6(a)(7)).

A controller with actual knowledge that willfully disregards that a user is in this age range is subject to the law's sanctions.

## The right to portability and trade secrets

The CTDPA has a specific clause for portability (Section 4(a)(4)): the controller is not required to reveal trade secrets when providing data in portable format. The Policy may mention this limitation to set consumer expectations.

## The appeal process: 60 days, not 45

The appeal response deadline under the CTDPA is **60 days** (Section 4(d)), not 45 like the initial request deadline. The Privacy Policy must describe the appeal process with the correct deadline.

If the appeal is denied, the controller must provide the consumer with an online mechanism or other method to contact the Attorney General to submit a complaint.

## The duty not to discriminate

Section 6(a) expressly prohibits discrimination against consumers who exercise their rights, including denying goods or services, charging different prices, or offering different quality.

The exception is voluntary loyalty programs, rewards, premium features, discounts, or club card programs.

## Enforcement and penalties

CTDPA violations are treated as unfair trade practices by the **Connecticut Attorney General**. There is no private right of action.

From January 2025, the cure period is discretionary. The AG may or may not grant a correction period before acting.

## How AdOpt supports CTDPA compliance

AdOpt ensures that what is written in the Policy has real correspondence with what actually happens on the site.

The automatic scan identifies all active technologies, feeding the list of data categories and third parties. The [consent management platform](https://goadopt.io/en/blog/how-to-choose-cmp-consent-management-platform/) ensures the consent and opt-out mechanism works as described, the GPC is honored from January 2025, and consent revocations are processed within 15 days.

Every interaction is logged. If the AG requests evidence, the record is available.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Privacy Policy for your site that complies with the CTDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what the Privacy Policy must contain for the CTDPA

**Visible and accessible link** on all pages of the site.

**Categories of personal data processed**, including sensitive data if collected (Section 6(c)(1)).

**Purpose for processing** each category (Section 6(c)(2)).

**How to exercise all 5 rights** guaranteed by the CTDPA, with processes and timelines (Section 6(c)(3)).

**Appeal process** with **60-day** deadline (not 45) (Section 4(d)).

**Categories of personal data shared with third parties** (Section 6(c)(4)).

**Categories of third parties** that receive data (Section 6(c)(5)).

**Active email address or online mechanism** for consumer contact with the controller (Section 6(c)(6)).

**Disclosure of targeted advertising or data sale** with accessible opt-out (Section 6(d)).

**Clear and conspicuous link** for opt-out on the site (Section 6(e)(1)(A)(i)).

**Opt-out preference signal**: statement of how GPC is processed from January 2025 (Section 6(e)(1)(A)(ii)).

**Treatment of sensitive data** with how consent is obtained and revoked.

**15-day deadline** for honoring consent revocation mentioned (Section 6(a)(6)).

**Protection for teens aged 13 to 15** described (Section 6(a)(7)).

**Non-discrimination policy** for consumers exercising rights (Section 6(a)).

## FAQ: CTDPA and Privacy Policy

**1. Why does the CTDPA require an active email or online mechanism in the Privacy Policy?**
Section 6(c)(6) specifically requires the privacy notice to include an active email address or other online mechanism the consumer may use to contact the controller. This ensures consumers have a direct communication channel available in the privacy document itself, not just abstract rights and processes.

**2. What is the difference between the response deadline for requests and for appeals in the CTDPA?**
For initial requests: 45 days, extendable by 45 more (Section 4(c)(1)). For appeals: 60 days, with no mentioned extension (Section 4(d)). The Privacy Policy must correctly describe both deadlines.

**3. Does the Privacy Policy need to mention the 15-day consent revocation deadline?**
Yes. Section 6(a)(6) requires the controller to cease processing within 15 days after receiving consent revocation. As this is unique among US state laws, it is important to explicitly mention this deadline in the Policy so consumers know what to expect.

**4. What is the opt-out preference signal and when does the CTDPA require it?**
It is a signal sent by a browser, extension, or device (like the GPC) communicating an opt-out preference. Section 6(e)(1)(A)(ii) makes it mandatory for controllers to honor these signals from January 1, 2025. The Privacy Policy must describe how these signals are processed.

**5. Does the Privacy Policy need to mention the protection for teens aged 13 to 15?**
Yes, if the site may have users in that age range. Section 6(a)(7) prohibits processing data for targeted advertising or sale of 13-to-15-year-old consumers without their consent when the controller has actual knowledge. The Policy must describe how consent is obtained for this specific group.

[Ready to build a Privacy Policy for your site that complies with the CTDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


Connecticut CTDPA: Privacy Policy

The Connecticut Data Privacy Act (CTDPA, Public Act No. 22-15) has a few DSAR process peculiarities that set it apart from other US state privacy laws.

This page covers one piece of the picture. For the full scope of the CTDPA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the CTDPA and cookies](https://goadopt.io/en/blog/connecticut-CTDPA-and-cookies-all-you-need-to-know/).

The most important: opt-out requests **do not require authentication**, but the controller may deny them if it has a documented belief of fraud. And the appeal response deadline is **60 days**, not 45 like the initial request deadline.

This article covers all of it: what a DSAR is under the CTDPA, the five guaranteed rights, the specific deadlines, the authentication rules, and how to build a Privacy Portal that works for Connecticut law.

## What is a DSAR under the CTDPA?

DSAR stands for Data Subject Access Request, or Data Rights request in the language of the CTDPA. It is any formal request from a Connecticut resident to exercise the rights the law grants over their own data.

Under Section 4(b), the consumer exercises their rights by a secure and reliable means established by the controller and described in the privacy notice.

If you are already familiar with the [GDPR](https://goadopt.io/en/blog/gdpr-cookies-explained/) data subject rights framework, the structure will feel familiar. The CTDPA adds specific rules on opt-out authentication and the role of authorized agents via technology.

## What are consumer rights under the CTDPA?

Under Section 4(a), Connecticut residents have five rights:

### 1. Right to confirm and access

The consumer may confirm whether the controller processes their data and access the personal data (Section 4(a)(1)).

A CTDPA-specific limitation: if confirmation or access would require the controller to **reveal a trade secret**, the controller is not obligated to do so. This differs from other state laws that do not mention trade secrets in the access right context.

### 2. Right to correction

The consumer may request correction of inaccuracies in personal data, taking into account the nature of the data and the purposes of processing (Section 4(a)(2)).

### 3. Right to deletion

The consumer may request deletion of personal data provided by or obtained about them (Section 4(a)(3)).

For data obtained from third parties (not from the consumer themselves), the controller may comply by retaining only the deletion request record and the minimum data necessary to ensure the data remains deleted (without using that data for any other purpose), or by opting the consumer out of processing that data (Section 4(c)(5)).

### 4. Right to portability

The consumer may obtain a copy of data in a portable and, where technically feasible, readily usable format that allows transmission to another controller without hindrance, where processing is by automated means (Section 4(a)(4)).

The controller is **not required to reveal trade secrets** to fulfill a portability request.

### 5. Right to opt-out

The consumer may refuse processing of personal data for three purposes (Section 4(a)(5)):

Targeted advertising.

Sale of personal data (except as provided in Section 6(b) on loyalty programs).

Profiling in furtherance of **solely automated** decisions that produce legal or similarly significant effects.

The third point is the most important CTDPA distinction: the profiling opt-out applies only to **solely** automated decisions. If there is any human review in the final decision, this opt-out may not apply.

## What are the response deadlines?

Under Section 4(c)(1):

**45 days** to respond from receipt of the request.

Extension of **+45 days** when reasonably necessary, considering complexity and number of requests, with notification within the initial period.

**Free** once per consumer during any 12-month period (Section 4(c)(3)).

For manifestly unfounded, excessive, or repetitive requests: may charge a reasonable fee or decline, with the burden of demonstrating the excessive nature on the controller.

## The appeal process: 60 days, not 45

The CTDPA has a distinctive feature: the appeal response deadline is **60 days**, not 45 like the initial request deadline (Section 4(d)).

The appeal process must be:

Conspicuously available and similar to the request submission process.

Actionable within a reasonable period after the consumer receives the decision.

The response must include any action taken or not taken, along with a written explanation of the reasons.

If the appeal is denied, the controller must provide the consumer with an online mechanism, if available, or other method through which the consumer may contact the **Attorney General** to submit a complaint.

## Authentication: the special rule for opt-outs

The CTDPA has a different authentication rule for opt-outs (Section 4(c)(4)):

For exercising access, correction, deletion, and portability rights: the controller may deny if it cannot authenticate using commercially reasonable efforts. Must notify the consumer that authentication failed and additional information is needed.

For **opt-out requests**: the controller is **not required to authenticate**, but **may deny** if it has a good faith, reasonable, and documented belief that the request is fraudulent. If denying, it must send a notice to the requestor disclosing that it believes the request is fraudulent, why it believes so, and that it will not comply.

This distinction matters for Portal design: the opt-out channel must function without requiring verification, but the controller may have a fraud monitoring process.

## Authorized agents and opt-out signals

Section 5 allows the consumer to designate another person as an authorized agent to exercise opt-out rights on their behalf. This includes via technology such as an Internet link, browser setting, browser extension, or global device setting.

The controller must comply with an opt-out from an authorized agent if it can verify, with commercially reasonable effort, the consumer's identity and the agent's authority.

From **January 1, 2025**, controllers processing for targeted advertising or selling data must accept opt-outs via signal sent with consumer consent (Section 6(e)(1)(A)(ii)). This includes the GPC.

## What should the request submission channel look like?

Section 6(e)(1) requires the controller to establish and describe in the privacy notice one or more secure and reliable means for submitting requests. The means must take into account:

The ways consumers normally interact with the controller.

The need for secure and reliable communication.

The controller's ability to verify the consumer's identity.

The controller cannot require creation of a new account. May require use of an existing account.

Additionally, Section 6(e)(1)(A)(i) specifically requires a clear and conspicuous link on the site to an opt-out page.

## How to process each type of DSAR in practice

### Access request

Receive and authenticate with commercially reasonable efforts.

Locate all personal data about this consumer in systems.

Check whether confirmation or access would reveal trade secrets: if so, may deny that specific part.

Prepare response in accessible format within 45 days.

### Correction request

Receive and authenticate.

Identify the inaccurate data.

Correct in primary systems.

Confirm to the consumer within 45 days.

### Deletion request

Receive and authenticate.

Check whether a legal exception allows retaining the data.

For data obtained from third parties: choose between deleting outright or opting the consumer out of all processing.

Confirm to the consumer what was done.

### Portability request

Receive and authenticate.

Generate a portable data file without revealing trade secrets.

Deliver securely within 45 days.

### Opt-out of targeted advertising and data sale

Receive the request (via Portal, site link, or opt-out signal like GPC).

No authentication required; however, monitor for fraud signals.

If there is reasonable, documented suspicion of fraud: notify the requestor.

Otherwise: cease processing for the indicated purposes.

If the opt-out signal conflicts with an existing controller-specific setting or loyalty program, comply with the opt-out but may notify the consumer of the conflict.

### Opt-out of solely automated profiling

Receive via Portal.

Assess whether the profiling in question is **solely automated** (no human review). If there is significant human review, the opt-out may not apply.

If solely automated: cease using the data for those decisions.

Inform the consumer of the outcome.

## What happens when the controller denies a request?

Under Section 4(c)(2), the controller must inform the consumer without undue delay, but not later than 45 days, with:

The justification for not taking action.

Instructions on how to appeal the decision.

## Consent revocation: 15 days

If the consumer had consented to processing of sensitive data or other consent-based processing and then revokes, Section 6(a)(6) requires:

A revocation mechanism at least as easy as the consent mechanism.

Cessation of processing not later than **15 days** after receiving the revocation.

This 15-day deadline must be factored into consent management systems and Privacy Portal operational processes.

## Special protection for children and teens

For known children (under 13 under COPPA): parents or legal guardians may exercise rights on the child's behalf (Section 4(b)).

For consumers under guardianship or conservatorship: the guardian or conservator may exercise rights on the consumer's behalf (Section 4(b)).

For teens aged 13 to 15: the controller cannot process data for targeted advertising or sale without their consent (Section 6(a)(7)).

## Protection against discrimination

Section 6(a) expressly prohibits discrimination against consumers who exercise their rights, including denying goods or services, charging different prices, or offering different quality.

The exception is voluntary loyalty programs, rewards, premium features, discounts, or club card programs.

## Enforcement: AG exclusively

Section 11(a) grants the Connecticut Attorney General **exclusive authority** to enforce the CTDPA. No District Attorneys are involved (unlike Colorado) and there is no private right of action.

From January 2025, the cure period is discretionary. The AG may consider multiple factors before acting or not.

## How AdOpt helps with the Privacy Portal

AdOpt logs every consent, opt-out, and revocation interaction with a timestamp and unique identifier. When the consumer exercises opt-out via Portal or via signal like the GPC, the system automatically updates the corresponding trackers.

The system processes consent revocations and ensures cessation within 15 days. AdOpt's auditable log serves as evidence of compliance for the Attorney General.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Privacy Portal for your site that complies with the CTDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what the Privacy Portal needs for the CTDPA

**One or more secure and reliable channels** described in the privacy notice (Section 6(e)(1)).

**Clear and conspicuous link** on the site for opt-out of targeted advertising/sale (Section 6(e)(1)(A)(i)).

**Opt-out preference signal** honored from January 2025 (Section 6(e)(1)(A)(ii)).

**Coverage of 5 rights**: access/confirmation, correction, deletion, portability, opt-out.

**Profiling: only solely automated decisions** covered by the opt-out (Section 4(a)(5)(C)).

**Opt-out without mandatory authentication**: process accepting opt-outs without requiring verification (Section 4(c)(4)).

**Documented fraud denial process** if opt-outs are denied based on fraud suspicion, including mandatory notification.

**Authorized agents** accepted for opt-out via technology (Section 5).

**Deadlines**: 45 days for initial response (+45 ext.); **60 days** for appeals (not 45).

**Conspicuously available appeal process** similar to the original submission process.

**Reference to AG** provided when appeal is denied (Section 4(d)).

**Free** first request per 12-month period (Section 4(c)(3)).

**Consent revocation honored within 15 days** (Section 6(a)(6)).

**Parents/guardians** may exercise rights for children (Section 4(b)).

**Guardians/conservators** may exercise rights for consumers under protection (Section 4(b)).

**Teen 13-15 protection**: process for obtaining consent before targeted advertising/data sale.

## Comparison: Privacy Portal deadlines under the CTDPA

| Request type | Response deadline | Extension possible |
|---|---|---|
| Access, correction, deletion, portability | 45 days | +45 days with notification |
| Opt-out (no authentication required) | No specific deadline | Immediate recommended |
| Appeal of a decision | **60 days** | Not specified |
| Consent revocation | **Max. 15 days** | No extension |
| Cure period (general violations) | Discretionary (2025) | No guarantee |

## FAQ: CTDPA and Privacy Portal

**1. Why do opt-outs not require authentication under the CTDPA?**
Section 4(c)(4) establishes that the controller is not required to authenticate opt-out requests. The rationale is that opt-out is a basic right that should not have unnecessary barriers. The controller may, however, deny if it has a documented good-faith belief of fraud and must notify the requestor with the justification. This balances ease of exercising the right with protection against abuse.

**2. Why does the appeal have a 60-day deadline instead of 45 like initial requests?**
Section 4(d) explicitly establishes 60 days for appeal responses, while initial requests have a 45-day deadline (Section 4(c)(1)). The longer deadline for appeals likely reflects the need for more careful review of an already-made decision. There is no mentioned extension for appeal deadlines.

**3. Is the CTDPA profiling opt-out more restrictive than in other laws?**
Yes. Section 4(a)(5)(C) limits the profiling opt-out to **solely automated** decisions with legal or significant effects. Virginia's VCDPA and Colorado's CPA cover such decisions without the sole-automation requirement. In practice, if the controller uses automated profiling but a human reviews and makes the final decision, the CTDPA profiling opt-out may not apply.

**4. Who can exercise rights on behalf of other consumers under the CTDPA?**
Section 4(b) allows parents or legal guardians to exercise rights on behalf of known children, and guardians or conservators to exercise rights on behalf of consumers under protective arrangements. Additionally, Section 5 allows any consumer to designate an authorized agent to exercise the opt-out, including via technology such as a browser extension or device setting.

**5. What happens if the controller denies an opt-out for fraud suspicion?**
Section 4(c)(4) allows denial if there is a good faith, reasonable, and documented belief that the opt-out is fraudulent. But it requires notification to the requestor with three elements: that the controller believes the request is fraudulent, why it believes so, and that it will not comply. Without this notification, the denial may itself constitute a violation of the law.

[Ready to build a Privacy Portal for your site that complies with the CTDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


Connecticut CTDPA: DSAR Privacy Portal

The Oregon Consumer Privacy Act (OCPA, ORS 646A.570 et seq.) has a specific requirement for the privacy notice that does not appear as explicitly in other US state privacy laws: the notice must include an **active email address or other online method** that the controller **actively monitors**.

This page covers one piece of the picture. For the full scope of the OCPA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the OCPA and cookies](https://goadopt.io/en/blog/oregon-ocpa-and-cookies-all-you-need-to-know/).

Publishing an email is not enough. It needs to be genuinely monitored. The first-year enforcement report (August 2025) identified non-functional contact channels as one of the most common problems found during investigations.

This article focuses exclusively on what the OCPA requires from the Privacy Policy, based on the official text of the law.

## What the OCPA calls a Privacy Notice

The law uses the term privacy notice. In practice, it is the Privacy Policy that most sites already have, but with OCPA-specific content elements.

Section 5(4) requires the controller to provide consumers with a privacy notice that is "reasonably accessible, clear, and meaningful."

## What must be in the Privacy Policy under the OCPA

### 1. Categories of personal data processed, including sensitive data

The notice must list the categories of personal data processed by the controller, including categories of sensitive data (Section 5(4)(a)).

Personal data under the OCPA includes derived data, an important differentiator from other laws. Marketing profiles and behavioral scores created from the consumer's data are personal data under the law.

Sensitive data, per Section 1(18), includes: racial or ethnic background, religious beliefs, mental or physical condition, sexual orientation, status as transgender or nonbinary, status as a crime victim, citizenship or immigration status, precise geolocation data (within 1,750 feet), genetic or biometric data, and personal data of children under 13. Any of these categories must be explicitly listed.

### 2. The purpose for processing

The notice must describe the controller's purposes for processing personal data (Section 5(4)(b)).

Section 5(2)(a) prohibits processing for purposes not reasonably necessary or compatible with those declared, except with consumer consent.

Vague descriptions like "improve your services" or "personalize your experience" do not meet the requirement. "Behavioral data collected via analytics to identify pages with high abandonment rates and prioritize usability improvements" is the correct level of specificity.

### 3. How consumers exercise their rights and file appeals

The notice must describe how consumers can exercise the rights guaranteed by the OCPA and how to appeal a denial decision (Section 5(4)(c)).

It is not enough to list that rights exist. The process must be described: which channel to use, how identity authentication works, the 45-day response deadline, and how the appeal process works with its 45-day response period.

The [data protection officer](https://goadopt.io/en/blog/responsibilities-of-a-data-protection-officer/) or compliance lead must have this workflow mapped and operationally functional.

### 4. Categories of data shared with third parties, including sensitive data

If the business shares data with third parties, the notice must disclose all categories of personal data shared, including categories of sensitive data (Section 5(4)(d)).

This covers email marketing tools, CRMs, analytics platforms, advertising networks, payment processors, and any external service that receives user data.

### 5. Categories of third parties and how each may process data

This is the OCPA's most specific requirement compared to other US state laws. Section 5(4)(e) requires that the notice describe all categories of third parties with whom data is shared at a level of detail that enables the consumer to understand what type of entity each third party is and, to the extent possible, how each third party may process personal data.

Generic categories like "business partners" are not sufficient. The correct level is something like: "audience analytics platforms that use browsing data to generate aggregated usage reports" or "digital advertising networks that use behavioral identifiers to display personalized ads on other sites the consumer visits."

### 6. Active email address or online contact mechanism, actively monitored

Section 5(4)(f) requires the notice to include an email address or other online method the consumer may use to contact the controller, and that channel must be **actively monitored** by the controller.

This is one of the OCPA's most specific requirements. Publishing an email address that nobody checks does not comply. The 2025 enforcement report confirmed that non-functional contact channels were among the most frequent problems found during investigations.

### 7. Complete identification of the controller

The notice must identify the controller, including the business name registered with the Oregon Secretary of State and any assumed business name used in the state (Section 5(4)(g)).

If the company operates under a brand different from its legal name, both must be identified.

### 8. Description of targeted advertising and profiling with opt-out

If the business processes data for targeted advertising or profiling for decisions with legal effects or effects of similar significance, the notice must describe this clearly and conspicuously, with the opt-out procedure accessible (Section 5(4)(h)).

Targeted advertising, per Section 1(19), consists of ads based on data collected from the consumer's activities over time and across non-affiliated websites or online applications. Contextual ads based on the current session are not included.

If your site uses a Meta Pixel, Google Ads, TikTok Pixel, or any programmatic advertising tool that collects data in other environments, you are operating targeted advertising and must disclose this explicitly.

### 9. Method for submitting rights requests, including GPC recognition

The notice must describe the method or methods the controller has established for consumers to submit rights requests (Section 5(4)(i)).

Per Section 5(5), this method must:

Consider how consumers normally interact with the controller.

Ensure security and reliability in communications.

Allow authentication of the consumer's identity.

Provide a clear and conspicuous link for opting out of targeted advertising.

As of **January 1, 2026**, it is also mandatory to honor universal opt-out signals, such as the Global Privacy Control (GPC), provided they meet specific technical requirements (Section 5(5)(c)).

Must not require the consumer to create a new account. The business may require use of an existing account, but cannot force new registration to exercise rights guaranteed by law (Section 4(2)).

## Disclosure of targeted advertising and data sale

If the business sells personal data or processes it for targeted advertising, Section 5(4)(h) requires clear and conspicuous disclosure in the Privacy Policy, along with the opt-out procedure.

The first-year enforcement report identified that many businesses were not offering consumers the right to list the specific third parties that received their data. This was the most frequently denied right in Oregon during the first year.

## Sensitive data: additional requirements

Sensitive data receives special treatment and must be specifically identified in the Policy.

If the business collects any data in this category, the Policy must:

Explicitly identify that sensitive data is collected.

Describe the specific purpose for processing each category.

Explain how consumer consent is obtained prior to processing.

Detail how that consent can be revoked, respecting the **15-day** cessation deadline after revocation (Section 5(1)(d)).

For children's data, the business must comply with COPPA requirements, per Section 5(2)(b) of the OCPA.

## Protection for teens aged 13 to 15

Section 5(2)(c) prohibits processing data of consumers aged 13 to 15 for targeted advertising, profiling for decisions with legal effects, or data sales without those consumers' consent, when the controller has actual knowledge of that age range.

As of **January 1, 2026**, protection was expanded: prohibition on selling data of minors under 16 and on using data of minors under 16 for targeted advertising and certain types of profiling.

The Privacy Policy must specifically reflect these protections if the business may reach this audience.

## Data Protection Assessments: what the Policy needs to address

Section 8 requires controllers to conduct and document Data Protection Assessments for high-risk activities, including targeted advertising, data sales, profiling with foreseeable risk of harm, and sensitive data processing.

Assessments do not need to be published in the Policy, but must be documented, retained for at least **five years** (Section 8(6)), and available to the Attorney General upon request. They are confidential and exempt from public disclosure (Section 8(7)).

The Policy should make clear that the business conducts impact assessments for high-risk activities as part of its compliance program.

## Non-discrimination policy

Section 5(2)(d) expressly prohibits businesses from discriminating against consumers who exercise their rights. This includes denying products or services, charging different prices, or offering lower quality as a consequence.

The exception is voluntary loyalty, rewards, premium features, discount, or club card programs that offer benefits in exchange for data use, provided the consumer participates voluntarily (Section 5(3)(b)).

## The elimination of the cure period and its impact on the Policy

Through December 31, 2025, the Attorney General was required to notify the business and grant 30 days to cure violations before initiating formal action.

**As of January 1, 2026, that cure period was eliminated.** The AG may initiate action directly, without prior notice (Section 11 of the OCPA).

An incomplete Privacy Policy is one of the easiest violations to identify. Updating the document before an investigation was efficient when the cure period existed. Now, it is the only way to protect the business.

## How AdOpt supports compliance with the OCPA

AdOpt ensures that what is written in the Policy has real correspondence with what actually happens on the site.

The automatic scan identifies all active technologies, feeding the list of data categories and third parties that must appear in the document. The [consent management platform](https://goadopt.io/en/blog/how-to-choose-cmp-consent-management-platform/) ensures the consent and opt-out mechanism works as described, including automatic recognition of the GPC from January 2026 and processing of revocations within 15 days.

Every interaction is logged. If the Attorney General requests evidence, the record is available.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Privacy Policy for your site that complies with the OCPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what the Privacy Policy must contain for the OCPA

**Visible and accessible link** on all pages of the site.

**Categories of personal data processed**, with explicit mention of sensitive data and derived data (Section 5(4)(a)).

**Purpose of processing** for each category, without vague descriptions (Section 5(4)(b)).

**How to exercise all L.O.C.K.E.D. rights** with process, channel, and 45-day response deadline (Section 5(4)(c)).

**Appeal process** with a 45-day deadline and information about the Attorney General (Section 4(6)).

**All categories of personal data shared with third parties**, including sensitive data (Section 5(4)(d)).

**Categories of third parties** with detail about entity type and how each may process data (Section 5(4)(e)).

**Active email or online contact method, actively monitored** by the controller (Section 5(4)(f)).

**Complete controller identification**, including assumed business name if applicable (Section 5(4)(g)).

**Description of targeted advertising or data sale** with accessible opt-out (Section 5(4)(h)).

**Request submission method** described, without requiring a new account (Section 5(4)(i) and 5(5)).

**GPC recognition** from January 2026 (Section 5(5)(c)).

**15-day deadline** for honoring consent revocation (Section 5(1)(d)).

**Protection for teens aged 13 to 15** with consent requirement (Section 5(2)(c)).

**Prohibition on data sales and targeted advertising for minors under 16** from January 2026.

**Non-discrimination policy** for consumers exercising their rights (Section 5(2)(d)).

**Reference to Data Protection Assessments** for high-risk activities (Section 8).

## FAQ: OCPA and Privacy Policy

**1. Why does the OCPA require the contact channel to be actively monitored?**
Section 5(4)(f) specifically requires the controller to specify an email or other online method that the controller "actively monitors." This distinguishes the OCPA from other state laws that simply require an available channel. The 2025 enforcement report identified non-functional rights request forms as one of the most frequent problems during investigations, confirming that the AG verifies whether channels actually work.

**2. What is derived data and why does the OCPA include it in personal data?**
Derived data is data created or inferred from other consumer data. Marketing profiles, propensity scores, audience segment classifications. The OCPA explicitly includes derived data in the personal data definition (Section 1(13)), meaning that when a consumer requests a copy or deletion of their data, derived data is also in scope. The enforcement report identified that businesses were not including back-end data in responses, which constitutes a direct violation.

**3. Why does the OCPA require more detail about third parties than other state laws?**
Section 5(4)(e) requires the description of third-party categories to be at a level of detail that enables the consumer to understand "what type of entity each third party is and, to the extent possible, how each third party may process personal data." This goes beyond what laws like the VCDPA require, which ask only for categories of third parties without the detail about how they process data. In practice, "business partners" is not sufficient.

**4. What happens to sensitive data if the consumer revokes consent?**
Section 5(1)(d) requires the controller to provide a revocation mechanism at least as easy as the consent mechanism. After revocation, the controller must cease processing as soon as practicable, but **not later than 15 days**. This 15-day deadline is a differentiator of the OCPA. The Privacy Policy must inform consumers of this deadline so they know what to expect.

**5. How does the elimination of the cure period affect the urgency of updating the Privacy Policy?**
Before January 2026, the AG was required to notify the business and grant 30 days to cure violations. With that period eliminated by Section 11 of the OCPA, the AG may initiate action directly. An incomplete Privacy Policy that previously could have been corrected after notification now represents immediate risk of penalties of up to US$ 7,500 per violation. Each affected consumer can be counted as a separate violation.

[Ready to build a Privacy Policy for your site that complies with the OCPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


Oregon OCPA: Privacy Policy

The Oregon Consumer Privacy Act (OCPA, ORS 646A.570 et seq.) has several particularities in the DSAR process that distinguish it from other US state laws.

This page covers one piece of the picture. For the full scope of the OCPA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the OCPA and cookies](https://goadopt.io/en/blog/oregon-ocpa-and-cookies-all-you-need-to-know/).

The most important: opt-out requests **do not require authentication**. And the right to list third parties that received personal data was the most frequently denied right in the first year of enforcement. The report from Attorney General Dan Rayfield (August 2025) showed businesses simply did not have that record structured.

This article covers everything: what a DSAR is under the OCPA, what rights are guaranteed under the L.O.C.K.E.D. system, specific deadlines, authentication rules, and how to build a Privacy Portal that works for Oregon law.

## What is a DSAR under the OCPA?

DSAR stands for Data Subject Access Request. It is any formal request made by an Oregon resident to exercise the rights the OCPA guarantees over their own data.

Under Section 4(1), consumers exercise their rights through means established by the controller and described in the privacy notice.

If you already know the [LGPD data subject portal](https://goadopt.io/en/blog/legal-bases-of-lgpd/), the structure is familiar. The OCPA adds specific rules about derived data, opt-out without authentication, and the role of universal opt-out signals via technology.

## What are consumer rights under the OCPA?

The **L.O.C.K.E.D.** system from the Oregon Department of Justice summarizes the rights of Section 3(1) of the OCPA:

### L: Right to list third parties

The consumer may request a list of the specific entities to which the controller has disclosed their personal data, or a list of any personal data disclosed (Section 3(1)(a)(B)).

The controller may choose to provide: (i) a list of specific third parties that received the individual consumer's data, or (ii) a list of any third party that received any personal data from the controller.

This was the most frequently denied right in the first year of enforcement. Businesses did not have the record of data sharing structured in a way that allowed them to respond to this request.

### K: Right to know and confirm

The consumer may obtain confirmation that the controller processes or has processed their personal data and which categories are involved (Section 3(1)(a)(A)).

### C: Right to copy

The consumer may obtain a copy of **all** personal data the controller has processed, in a portable format and readily usable where technically feasible (Section 3(1)(a)(C)).

This scope includes derived data. Marketing profiles, behavioral scores, and audience segment classifications created from the consumer's data are part of the copy that must be delivered.

The enforcement report identified that businesses were not including back-end data such as marketing profiles in responses to copy requests. This constitutes a direct violation of the law.

### E: Right to correction

The consumer may request correction of inaccuracies in personal data, taking into account the nature and purpose of processing (Section 3(1)(b)).

### D: Right to deletion

The consumer may request deletion of personal data, including (Section 3(1)(c)):

Data the consumer provided directly to the business.

Data the business obtained from other sources about the consumer.

Derived data created by the business from other data.

For data obtained from third parties, the OCPA provides an alternative. The controller may fulfill the deletion request by either deleting the data entirely, or opting the consumer out of processing their data for any purpose other than those exempt under Section 2(3) (Section 4(7)).

### O: Right to opt-out

The consumer may refuse processing of data for three specific purposes (Section 3(1)(d)):

Targeted advertising.

Sale of personal data.

Profiling in furtherance of decisions that produce legal effects or effects of similar significance (such as access to credit, housing, insurance, employment, or health care services).

## What are the response deadlines?

Under Section 4(5)(a):

**45 days** to respond from receipt of the request.

Extension of **+45 days** when reasonably necessary, considering complexity and volume of requests, with notification within the initial period.

**Appeal: 45 days** for a written response with decision and reasoning (Section 4(6)(d)).

**Free** once per 12-month period per consumer (Section 4(5)(c)). For subsequent requests, may charge a reasonable fee, except when verifying compliance with a prior correction or deletion.

A key distinction from Connecticut's CTDPA: the OCPA sets a 45-day appeal deadline, while the CTDPA sets 60 days. The OCPA is faster on appeals.

## The appeal process

Section 4(6) requires the controller to establish an appeal process that is conspicuously available and similar to the original submission process.

The process must:

Allow a reasonable period after the consumer receives the denial for them to appeal.

Be comparable to the original request submission process.

Result in a written response within **45 days** with the decision and reasoning.

If the appeal is denied, the notice must provide or specify information enabling the consumer to contact the Attorney General to submit a complaint (Section 4(6)(d)).

## Authentication: the special rule for opt-outs

Section 4(5)(e) of the OCPA has a different authentication rule for opt-outs:

For exercising access, correction, deletion, and portability rights: the controller may request additional information reasonably necessary to authenticate. If unable to authenticate, it is not required to comply, but must notify the consumer (Section 4(5)(d)).

For **opt-out requests**: the controller **cannot require authentication**. It may ask only for information necessary to identify who is making the opt-out request. If it has a good faith, reasonable, and documented belief that a request is fraudulent, it may deny, but must notify the requestor explaining why and that it will not comply.

This distinction matters for the Privacy Portal: the opt-out mechanism must work without authentication barriers.

## Authorized agents and opt-out signals

Section 4(4) allows consumers to designate another person as an authorized agent to exercise the opt-out on their behalf. This includes via technology: an internet link, browser setting, browser extension, or global device setting.

The controller must honor the opt-out received from an authorized agent if it can verify, with commercially reasonable effort, the identity of the consumer and the authority of the agent.

As of **January 1, 2026**, controllers processing for targeted advertising or selling data must accept opt-outs via signal sent with consumer consent (Section 5(5)(c)). This includes the Global Privacy Control (GPC).

## How the request submission channel must work

Sections 5(4)(i) and 5(5) require the controller to establish and describe in the privacy notice the method for submitting requests. This method must:

Consider how consumers normally interact with the controller.

Ensure security and reliability in communications.

Allow authentication of the consumer's identity.

Provide a clear and conspicuous link for opting out of targeted advertising.

The controller cannot require creation of a new account (Section 4(2)). It may require use of an existing account.

Additionally, Section 5(5)(b) specifically requires a clear and conspicuous link on the site to an opt-out page for targeted advertising and data sale.

As of **January 1, 2026**, the channel must also recognize and honor universal opt-out signals such as the GPC, per Section 5(5)(c).

A well-structured Privacy Portal offers:

A submission form with clear categories (list of third parties, access/copy, correction, deletion, opt-out from advertising/sale/profiling).

A proportionate and non-discriminatory identity verification process.

Automatic receipt confirmation with a tracking number.

A record of each request, action taken, and response sent.

An appeal channel for denied requests.

The [site consent mechanism](https://goadopt.io/en/blog/operation-of-cookie-banner/) and the Privacy Portal must be integrated so that consumer preferences are reflected across the business's operational systems.

## How to process each type of DSAR in practice

### List of third parties request

Receive and authenticate the consumer's identity.

Consult the data sharing record.

Decide whether to provide: (i) a list of specific third parties that received the consumer's data, or (ii) a list of any third party that received any personal data.

Prepare response within 45 days.

Without a structured sharing record, compliance is impossible. Building a data sharing map is a prerequisite.

### Access and copy request

Receive and authenticate.

Locate all personal data in systems, including derived data such as marketing profiles and behavioral scores.

Prepare response in portable format within 45 days.

### Deletion request

Receive and authenticate.

Check for a legal exemption (Section 2(3)).

For data provided by the consumer: delete from all relevant systems.

For data obtained from third parties: delete entirely or opt the consumer out of processing for non-exempt purposes (Section 4(7)).

Confirm to the consumer within 45 days.

### Opt-out from targeted advertising and sale

Receive the request (via Portal, site link, or opt-out signal such as the GPC from 2026).

**Authentication is not required** to process.

Monitor for fraud indicators. If there is documented reasonable suspicion: notify the requestor.

Otherwise: cease processing for the indicated purposes.

### Opt-out from profiling

Receive via Portal.

Identify whether the profiling in question is for decisions with legal effects or effects of similar significance.

If yes: cease using the data for those decisions.

Inform the consumer of the result within 45 days.

## What happens when the controller denies a request?

Under Section 4(5)(b), the controller that does not take action must inform the consumer without undue delay, but no later than 45 days, with:

The justification for not taking action.

Instructions on how to appeal the decision.

## Consent revocation: 15 days

If the consumer had consented to processing of sensitive data or other consent-based processing and then decides to revoke, Section 5(1)(d) requires:

A revocation mechanism at least as easy as the consent mechanism.

Cessation of processing as soon as practicable, but **not later than 15 days** after receiving the revocation.

This deadline must be built into consent management systems and Privacy Portal operational processes.

## Special protection for children and teenagers

Section 4(3) allows parents or legal guardians to exercise rights on behalf of children under 13.

Section 4(3) also allows guardians or conservators to exercise rights on behalf of consumers under guardianship, conservatorship, or other protective arrangement.

For teens aged 13 to 15: the controller cannot process data for targeted advertising or sale without those consumers' consent (Section 5(2)(c)).

As of January 2026: prohibition on selling data of minors under 16 and on using data of minors under 16 for targeted advertising.

## Protection against discrimination

Section 5(2)(d) prohibits discriminating against consumers who exercise their rights, including denying goods or services, charging different prices, or offering different quality.

The exception is voluntary loyalty programs where the difference is reasonably related to the value the data provides (Section 5(3)(b)).

## The elimination of the cure period and DSARs

Through December 31, 2025, the AG was required to notify the business and grant 30 days to cure violations before initiating formal action.

**As of January 1, 2026, that period was eliminated.** The AG may act directly (Section 11 of the OCPA).

Businesses without a structured DSAR process cannot correct in 30 days what should have been implemented from the start. Without the cure period, the risk is even greater. Penalties can reach **US$ 7,500 per violation**, with each consumer whose right was violated potentially counting as a separate violation.

## How AdOpt helps with the Privacy Portal

AdOpt records every consent, opt-out, and revocation interaction with a timestamp and unique identifier. When the consumer exercises opt-out via the Portal or via a signal like the GPC from 2026, the system automatically updates the corresponding trackers.

The system processes consent revocations and ensures cessation within 15 days. AdOpt's auditable log serves as evidence of compliance for the Attorney General.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Privacy Portal for your site that complies with the OCPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what the Privacy Portal needs for the OCPA

**Request submission channel** without requiring creation of a new account (Section 4(2)).

**Clear and conspicuous link** on the site for opt-out from targeted advertising and sale (Section 5(5)(b)).

**Opt-out preference signal** honored from January 2026 (Section 5(5)(c)).

**Coverage of all L.O.C.K.E.D. rights**: list of third parties, access/confirmation, copy (including derived data), correction, deletion, opt-out.

**Derived data included** in the scope of copy and deletion (Sections 3(1)(a)(C) and 3(1)(c)).

**Opt-out without mandatory authentication** for targeted advertising, sale, and profiling (Section 4(5)(e)).

**Fraud denial process** documented for opt-outs denied on suspicion of fraud.

**Authorized agents** accepted for opt-out, including via technology (Section 4(4)).

**Deadlines**: 45 days to respond (+45 ext.); **45 days** for appeal.

**Appeal mechanism** conspicuously available and similar to original process (Section 4(6)).

**Reference to the AG** provided when appeal is denied (Section 4(6)(d)).

**Free service** once per 12-month period per consumer (Section 4(5)(c)).

**15-day consent revocation** honored (Section 5(1)(d)).

**Documented record** of each request, action taken, and response sent.

**Parents/legal guardians** may exercise rights for children under 13 (Section 4(3)).

**Guardians/conservators** may exercise rights for consumers under protective arrangements (Section 4(3)).

**Teen protection 13-15**: consent process before processing for advertising/sale.

## Comparative: Privacy Portal deadlines under the OCPA

| Request type | Response deadline | Extension possible |
|---|---|---|
| Access, list, copy, correction, deletion | 45 days | +45 days with notification |
| Opt-out (no authentication required) | No specific deadline | Immediate recommended |
| Appeal | 45 days | Not specified |
| Consent revocation | Max. 15 days | No extension |
| Cure period for violations | Eliminated (Jan 2026) | No guarantee |

## FAQ: OCPA and Privacy Portal

**1. Why does opt-out not require authentication under the OCPA?**
Section 4(5)(e) establishes that for opt-out requests from targeted advertising, sale, and profiling, the controller must comply without requiring authentication. The rationale is that opt-out is a basic right that should not have unnecessary barriers. The controller may deny only if it has a documented good-faith belief that the request is fraudulent, and must notify the requestor with the reason. Without that notification, the denial may be considered a violation.

**2. Why was the right to list third parties the most denied right in the first year?**
The report from AG Dan Rayfield (August 2025) identified that businesses simply did not have the structured record of who had received personal data. To comply with Section 3(1)(a)(B), the controller must know exactly which entities received data from a specific consumer, or which entities received any personal data from the controller. Without an updated data sharing map, it is impossible to respond to this request.

**3. What makes the deletion of derived data a key differentiator of the OCPA?**
The OCPA explicitly includes derived data in the personal data definition (Section 1(13)) and in the scope of the right to deletion (Section 3(1)(c)). When a consumer requests deletion, marketing profiles, propensity scores, and audience segment classifications created from their data must also be deleted. The enforcement report identified that businesses were not including this data in responses, which constituted a direct violation.

**4. Who may exercise rights on behalf of other consumers under the OCPA?**
Section 4(3) allows parents or legal guardians to exercise rights on behalf of children under 13, and guardians or conservators to exercise rights on behalf of consumers under protective arrangements. Section 4(4) allows any consumer to designate an authorized agent for opt-out, including via technology such as a browser extension or device setting.

**5. What happens if the controller does not have a DSAR process when the Attorney General investigates?**
As of January 2026, there is no longer a 30-day cure period. The AG may initiate action directly (Section 11 of the OCPA). If violations are identified, penalties of up to US$ 7,500 per violation may be sought. Each consumer whose right was violated can be counted as a separate violation, quickly escalating the financial exposure. The 2025 enforcement report showed that inaccessible or non-functional rights forms were among the most common problems found during investigations.

[Ready to build a Privacy Portal for your site that complies with the OCPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


Oregon OCPA: DSAR Privacy Portal

The Utah Consumer Privacy Act (UCPA, Utah Code § 13-61-101) is the most straightforward state privacy law in its Privacy Policy requirements.

This page covers one piece of the picture. For the full scope of the UCPA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the UCPA and cookies](https://goadopt.io/en/blog/utah-ucpa-and-cookies-all-you-need-to-know/).

No actively monitored contact channel like the OCPA requires. No mandatory retention periods like the CPRA. No detailed description of how each third party may process data like the OCPA requires. Five categories of information that must be in the document, and that is it.

But simple does not mean trivial. The law still requires real transparency about what is happening with Utah consumers' data.

This article focuses exclusively on what the UCPA requires from the Privacy Policy, based on the official text of the law.

## What the UCPA calls a Privacy Notice

The law uses the term "privacy notice." In practice, it is the Privacy Policy most sites already have.

Utah Code § 13-61-302(1)(a) requires the controller to provide consumers with a privacy notice that is "reasonably accessible and clear."

## What must be in the Privacy Policy under the UCPA

### 1. Categories of personal data processed

The notice must list the categories of personal data the controller processes (§ 13-61-302(1)(a)(i)).

Personal data under the UCPA is any information linked or reasonably linkable to an identified or identifiable individual. This includes identifiers such as name, email, IP address, browsing history, location data, and any data that allows tracking a person.

De-identified data, aggregated data, and publicly available information are excluded.

### 2. The purposes for processing

The notice must explain the purposes for which each category of data is processed (§ 13-61-302(1)(a)(ii)).

The UCPA does not explicitly list that purposes must be as specific as required by other laws like the VCDPA, but the requirement that the notice be "reasonably accessible and clear" implies that "improve services" is not sufficient. "Behavioral data to identify usability improvement opportunities" is the correct level.

### 3. How consumers exercise their rights

The notice must describe how consumers can exercise the rights guaranteed by the UCPA (§ 13-61-302(1)(a)(iii)).

The four rights under the UCPA are:

**Confirm and access:** know whether the controller processes data and access that data.

**Deletion:** request deletion of data the consumer provided to the controller.

**Portability:** obtain a copy of the data in a portable format for transmission to another controller.

**Opt-out:** refuse processing for targeted advertising or data sales.

For each right, the notice must describe the request submission channel and the 45-day response deadline.

**What the UCPA does not require to be described:** a formal appeal process (the law has no such structured mechanism), a right to correct (the UCPA does not provide this right), and a right to opt-out of profiling (not covered by the law).

### 4. Categories of personal data shared with third parties

If the business shares data with third parties, the notice must list which categories of data are shared (§ 13-61-302(1)(a)(iv)).

This covers analytics tools, advertising platforms, CRMs, payment processors, and any external service that receives user data.

The UCPA uses the concept of "sale" of data, defined in § 13-61-101(31) as the exchange of personal data for monetary consideration to third parties. Sharing without monetary consideration does not constitute "sale" under the UCPA, unlike the CPRA which includes the concept of "sharing" for behavioral advertising even without payment.

### 5. Categories of third parties with whom data is shared

Beyond the categories of data, the notice must identify the categories of third parties with whom data is shared (§ 13-61-302(1)(a)(v)).

Categories such as "audience analytics platforms," "marketing automation tools," and "payment processors" are valid examples.

The UCPA does not require the level of detail the OCPA demands (entity type and how each third party may process data). Identifiable categories are sufficient.

## Disclosure of targeted advertising and data sale

If the business sells data or uses data for targeted advertising, Utah Code § 13-61-302(1)(b) requires clear and conspicuous disclosure, along with the opt-out method.

Targeted advertising, per § 13-61-101(34), consists of ads selected based on data obtained from the consumer's activities over time and across non-affiliated websites or online applications. Ads based on activities within the controller's own site do not qualify.

If the site uses a Meta Pixel, Google Ads, or any pixel that sends data to external advertising networks, the business is operating targeted advertising and must disclose this explicitly.

## Sensitive data: notice and opt-out, not consent

This is the point that most differentiates the UCPA from other state laws. Utah Code § 13-61-302(3) requires that, before processing sensitive data, the controller:

Present the consumer with a clear notice; and

Offer the consumer the opportunity to **opt out**.

**Prior consent is not required.** The business may process sensitive data, provided it informs the consumer and gives them the option to refuse before starting.

Sensitive data under the UCPA includes: health and medical data, genetic and biometric data for identification, specific geolocation data, racial or ethnic origin, religious beliefs, sexual orientation, and citizenship or immigration status.

For data of known children (under 13), the business must comply with COPPA (§ 13-61-102(3)), which in practice requires verifiable parental consent.

The Privacy Policy must:

Identify whether the business processes sensitive data.

Describe how the sensitive data notice is presented to the consumer.

Explain how the consumer can exercise the opt-out from sensitive data processing.

## What the UCPA does not require in the Privacy Policy

For businesses that already have Privacy Policies written for other state laws, it is worth noting what the UCPA does not require:

**No mandatory retention periods.** The CPRA requires specifying how long each data category is retained. The UCPA has no such requirement.

**No actively monitored contact channel.** The OCPA requires an actively monitored email or online mechanism. The UCPA only requires the notice to describe how consumers can exercise their rights.

**No detail about third parties.** The OCPA requires describing how each third party may process data. The UCPA only requires categories.

**No right to correct to describe.** Since the UCPA does not provide this right, the policy does not need to describe it.

**No formal appeal process.** The UCPA has no structured appeal mechanism like the OCPA and CTDPA.

This makes the UCPA Privacy Policy the simplest to structure among current US state privacy laws.

## Data security: what the policy needs to mention

Utah Code § 13-61-302(2) requires the controller to establish, implement, and maintain reasonable administrative, technical, and physical data security practices, proportionate to the size, scope, type, and volume of data processed.

The Privacy Policy should mention that the business implements appropriate security measures to protect consumers' personal data, even without needing to detail each specific measure.

## Non-discrimination

Utah Code § 13-61-302(4) expressly prohibits the business from discriminating against consumers who exercise their rights. This includes denying goods or services, charging different prices, or offering different quality.

The exception is voluntary loyalty programs and situations where the consumer opted out of targeted advertising and the business adjusted the price accordingly, provided the price difference is reasonably related to the value the data provides the business.

The Privacy Policy must mention this non-discrimination policy.

## The cure period and its relationship to the Policy

Before initiating any action, the Utah Attorney General is required to notify the controller and grant **30 days to cure** (§ 13-61-402(3)). This deadline is guaranteed permanently by the UCPA, unlike other laws that have eliminated it.

An outdated or incomplete Privacy Policy is one of the easiest violations to identify. Correcting it within 30 days after a notification is achievable with the right processes. But structuring the policy correctly from the start is always more efficient.

## How AdOpt supports UCPA compliance

AdOpt ensures that what is written in the Policy has real correspondence with what actually happens on the site.

The automatic scan identifies all active technologies, feeding the list of data categories and third parties that must appear in the document. The [consent management platform](https://goadopt.io/en/blog/how-to-choose-cmp-consent-management-platform/) ensures the opt-out mechanism works as described.

Every interaction is logged. If the Attorney General requests evidence, the record is available.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Privacy Policy for your site that complies with the UCPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what the Privacy Policy must contain for the UCPA

**Visible and accessible link** on all pages of the site.

**Categories of personal data processed**, with sufficient description for the consumer to understand (§ 13-61-302(1)(a)(i)).

**Purposes of processing** for each category (§ 13-61-302(1)(a)(ii)).

**How to exercise the 4 rights** guaranteed by the UCPA: confirm/access, deletion, portability, opt-out, with channel and 45-day deadline (§ 13-61-302(1)(a)(iii)).

**Categories of personal data shared with third parties**, if any (§ 13-61-302(1)(a)(iv)).

**Categories of third parties** with whom data is shared (§ 13-61-302(1)(a)(v)).

**Disclosure of targeted advertising or data sale** with accessible opt-out (§ 13-61-302(1)(b)).

**Sensitive data treatment**: clear notice and opt-out opportunity before processing (§ 13-61-302(3)).

**Children's data treatment**: COPPA compliance for children under 13 (§ 13-61-102(3)).

**Non-discrimination policy** for consumers exercising rights (§ 13-61-302(4)).

**Free service** for the first request per 12-month period (§ 13-61-203(4)(a)).

## FAQ: UCPA and Privacy Policy

**1. Does the UCPA Privacy Policy need to specify data retention periods?**
No. The UCPA does not require the Privacy Policy to specify how long each data category is retained. This distinguishes the UCPA from the CPRA, which requires this information explicitly. The UCPA only requires the policy to describe the categories of data processed and the purposes, without detailing retention periods.

**2. Do I need to describe the right to correct in the UCPA Privacy Policy?**
No. The UCPA does not guarantee the right to correct inaccurate data, unlike the CPRA, OCPA, VCDPA, and CTDPA. The policy only needs to describe the four rights the law actually guarantees: confirm/access, deletion (limited to data provided by the consumer), portability, and opt-out from targeted advertising and data sales.

**3. How does the UCPA treat sensitive data differently from other state laws?**
Utah Code § 13-61-302(3) requires only a clear notice and an opt-out opportunity before processing sensitive data. Laws like the CPRA, OCPA, VCDPA, and CTDPA require active prior consent (opt-in) for sensitive data. This difference is fundamental: under the UCPA, the business can process sensitive data unless the consumer actively refuses. Under the other laws, the business can only process with the consumer's active consent.

**4. Does the UCPA Privacy Policy need to describe an appeal process?**
No. The UCPA does not define a formal appeal process for when the controller denies a consumer request. Unlike the OCPA (45 days for appeal), CTDPA (60 days), and VCDPA (60 days), the UCPA has no such structured mechanism. The Policy only needs to describe the four rights and the request submission channel.

**5. What happens if the Privacy Policy is incomplete when the Attorney General investigates?**
The AG sends notification identifying violations and gives 30 days to cure (§ 13-61-402(3)). This 30-day period is guaranteed permanently by the UCPA. If the business corrects the Policy and provides a written statement that the violation has been cured and will not recur, no formal action is initiated. If not corrected or if the statement is breached, the AG may seek penalties of up to US$ 7,500 per violation. An outdated Policy is one of the easiest violations to identify and to correct.

[Ready to build a Privacy Policy for your site that complies with the UCPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


Utah UCPA: Privacy Policy

The Iowa Consumer Data Protection Act (ICDPA, Iowa Code § 715D) has privacy notice requirements very similar to Utah's UCPA, with one important operational difference: the response deadline for consumer requests is **90 days**, not 45.

This page covers one piece of the picture. For the full scope of the ICDPA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the ICDPA and cookies](https://goadopt.io/en/blog/iowa-icdpa-and-cookies-all-you-need-to-know/).

For the Privacy Policy, this means the process described in the document for exercising rights must reflect this longer deadline. Iowa consumers will have to wait up to three months to receive a response, and the notice must be clear about this.

This article focuses exclusively on what the ICDPA requires from the Privacy Policy.

## What the ICDPA calls a Privacy Notice

The law uses the term "privacy notice." Under § 715D.4(5), the controller must provide a notice that is "reasonably accessible, clear, and meaningful."

## What must be in the Privacy Policy under the ICDPA

### 1. Categories of personal data processed

The notice must list the categories of personal data the controller processes (§ 715D.4(5)(a)).

Personal data under the ICDPA is any information linked or reasonably linkable to an identified or identifiable natural person (§ 715D.1(18)). This includes identifiers such as name, email, IP address, browsing history, and data that allows tracking a person.

De-identified data, aggregate data, and publicly available information are excluded.

### 2. The purpose for processing

The notice must explain the purpose for which data is processed (§ 715D.4(5)(b)).

The law does not specify that purposes must be highly detailed, but the requirement that the notice be "clear and meaningful" implies that generalities like "improve services" are insufficient.

### 3. How consumers exercise their rights and how to appeal

The notice must describe how consumers can exercise the rights guaranteed by the ICDPA, including how to appeal a controller decision (§ 715D.4(5)(c)).

The four rights under the ICDPA are:

**Confirm and access:** confirm whether the controller processes data and access that data (§ 715D.3(1)(a)).

**Deletion:** request deletion of data the consumer provided to the controller (§ 715D.3(1)(b)).

**Portability:** obtain a copy of the data in a portable format (§ 715D.3(1)(c)).

**Opt-out from data sales:** refuse the sale of personal data (§ 715D.3(1)(d)).

**The deadline that must be described: 90 days** to respond from receipt of the request, with a possible extension of 45 more days with notification within the initial period (§ 715D.3(2)(a)).

**The appeal process:** the notice must describe how the consumer can appeal a denial decision, with a 60-day response deadline for appeals (§ 715D.3(3)). If the appeal is denied, the consumer must be informed of how to contact the Attorney General online.

### 4. Categories of personal data shared with third parties

The notice must identify the categories of personal data the controller shares with third parties, if any (§ 715D.4(5)(d)).

### 5. Categories of third parties with whom data is shared

The notice must identify the categories of third parties with whom data is shared, if any (§ 715D.4(5)(e)).

The ICDPA does not require the level of detail about how each third party may process data that the OCPA demands. Identifiable categories are sufficient.

## Disclosure of targeted advertising and data sales

If the business sells data or engages in targeted advertising, § 715D.4(6) requires clear and conspicuous disclosure of that activity, with description of the method by which the consumer can exercise the opt-out for each activity.

Targeted advertising, per § 715D.1(28), consists of ads selected based on data obtained from the consumer's activities over time and across non-affiliated websites or applications.

Although opt-out from targeted advertising is not listed as a formal right in § 715D.3, the disclosure obligation in § 715D.4(6) creates the practical requirement to offer this opt-out in the privacy notice.

## The request submission channel

Under § 715D.4(7), the controller must establish secure and reliable means for consumers to submit rights requests, and describe those means in the privacy notice.

These means must:

Consider how consumers normally interact with the controller.

Ensure secure and reliable communication.

Allow authentication of the consumer's identity.

The controller may not require the consumer to create a new account to exercise their rights. It may require use of an existing account (§ 715D.4(7)).

## Sensitive data: notice and opt-out, not consent

Under § 715D.4(2), the controller may not process sensitive data without first presenting the consumer with a clear notice and offering an opt-out opportunity.

Sensitive data includes: racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data for unique identification, data of known children, and precise geolocation data.

This opt-out model for sensitive data is identical to the UCPA's. It is less restrictive than the opt-in required by the CPRA, OCPA, VCDPA, and CTDPA.

For data of known children, the business must comply with COPPA (§ 715D.2(2)(r) and 715D.4(2)).

The Privacy Policy must:

Identify whether the business processes sensitive data.

Describe how the sensitive data notice is presented to consumers.

Explain how the consumer can exercise the opt-out from sensitive data processing.

## What the ICDPA does not require in the Privacy Policy

Comparing with other laws:

**No mandatory retention periods.** The CPRA requires specifying how long each data category is retained. The ICDPA has no such requirement.

**No detail about third parties.** The OCPA requires describing how each third party may process data. The ICDPA requires only categories.

**No right to correct to describe.** Since the ICDPA does not provide this right, the policy does not need to describe it.

**The 90-day deadline must be clearly described.** Consumers familiar with VCDPA, OCPA, and CTDPA expect responses within 45 days. A notice that clearly states the ICDPA's 90-day deadline avoids unnecessary complaints.

## Non-discrimination

Under § 715D.4(3), the business may not discriminate against consumers who exercise their rights. This includes denying goods or services, charging different prices, or offering different quality.

The exception is voluntary loyalty programs and situations where the consumer opted out of targeted advertising and the business adjusted prices accordingly.

## The 90-day cure period and its relationship to the Policy

Before initiating any action, the Iowa Attorney General must notify the controller and grant **90 days to cure** (§ 715D.8(2)). This is the longest cure period of all US state privacy laws.

An outdated or incomplete Privacy Policy can be corrected within 90 days with the right processes. But structuring it correctly from the start is always more efficient.

## How AdOpt supports ICDPA compliance

AdOpt ensures that what is written in the Policy has real correspondence with what actually happens on the site.

The automatic scan identifies all active technologies, feeding the list of data categories and third parties. The [consent management platform](https://goadopt.io/en/blog/how-to-choose-cmp-consent-management-platform/) ensures the opt-out mechanism works as described.

Every interaction is logged. If the Attorney General requests evidence, the record is available.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Privacy Policy for your site that complies with the ICDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what the Privacy Policy must contain for the ICDPA

**Visible and accessible link** on all pages of the site.

**Categories of personal data processed** (§ 715D.4(5)(a)).

**Purpose for processing** each category (§ 715D.4(5)(b)).

**How to exercise the 4 rights** with channel and **90-day** deadline (§ 715D.4(5)(c)).

**Appeal process** with **60-day** response deadline (§ 715D.3(3)).

**How to contact the Attorney General** if appeal is denied (§ 715D.3(3)).

**Categories of personal data shared with third parties** (§ 715D.4(5)(d)).

**Categories of third parties** with whom data is shared (§ 715D.4(5)(e)).

**Disclosure of data sales or targeted advertising** with opt-out method (§ 715D.4(6)).

**Request submission channel** described, without requiring new account (§ 715D.4(7)).

**Sensitive data treatment**: clear notice and opt-out before processing (§ 715D.4(2)).

**COPPA compliance** for children's data (§ 715D.4(2)).

**Non-discrimination policy** (§ 715D.4(3)).

**Free service for 2 requests** per year per consumer (§ 715D.3(2)(c)).

## FAQ: ICDPA and Privacy Policy

**1. Why must the ICDPA Privacy Policy clearly state the 90-day deadline?**
Most consumers who have interacted with privacy notices from other jurisdictions expect responses within 45 days. The ICDPA establishes 90 days as the standard deadline (§ 715D.3(2)(a)), which is significantly different. A Policy that clearly describes this deadline helps manage expectations and avoids complaints from consumers expecting a faster response. Describing the correct deadline also demonstrates that the business knows its specific legal obligations.

**2. Does the privacy notice need to mention the ICDPA's appeal process?**
Yes. § 715D.4(5)(c) requires the notice to describe how consumers can exercise their rights "including how a consumer may appeal a controller's decision with regard to the consumer's request." This means the appeal process, with a 60-day response deadline (§ 715D.3(3)), must be described. If the appeal is denied, the notice should also indicate how the consumer can contact the Attorney General.

**3. Does the ICDPA have the same free-service policy as the UCPA?**
Not exactly. The ICDPA guarantees free service for **2 requests** per consumer per 12-month period (§ 715D.3(2)(c)). The UCPA guarantees free service for only **1 request** per 12-month period. The VCDPA also guarantees 2 free requests per year. The Privacy Policy must correctly reflect this number, as stating "free once per year" when the law guarantees 2 would be an inaccuracy that could generate complaints.

**4. Does the ICDPA use the same opt-out model for sensitive data as the UCPA?**
Yes. Both the ICDPA (§ 715D.4(2)) and the UCPA require only a clear notice and opt-out opportunity before processing sensitive data, without requiring active prior consent. This model differs from the opt-in required by the CPRA, OCPA, VCDPA, and CTDPA. A business already compliant with the UCPA on this point will be compliant with the ICDPA as well.

**5. Does the ICDPA require the same level of detail about third parties as the OCPA?**
No. The OCPA requires describing third parties at a level of detail that enables the consumer to understand what type of entity each third party is and how it may process data. The ICDPA (§ 715D.4(5)(d) and (e)) requires only the categories of data shared and the categories of third parties, without the additional detail the OCPA demands. Categories such as "digital advertising platforms" and "analytics tools" are sufficient under the ICDPA.

[Ready to build a Privacy Policy for your site that complies with the ICDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)


All posts