From 7385fc6524bbb29ac0c372b6c36972a9a48844fd Mon Sep 17 00:00:00 2001 From: Justin Brookman Date: Tue, 4 Feb 2025 11:24:21 -0500 Subject: [PATCH 1/2] Update index.html Minor changes to update changes in law --- index.html | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/index.html b/index.html index 856144c..ebd4416 100644 --- a/index.html +++ b/index.html @@ -410,7 +410,7 @@

United States Privacy Law

have passed privacy laws that give consumers the legal right to opt out of the sale or share of their data, or the use of their data for cross-context targeted advertising. Many of those state laws make explicit provision for the exercise of those rights through universal opt-out mechanisms - such as the GPC. At least two states have specifically identified GPC as a valid means to exercise + such as the GPC. At least four states have specifically identified GPC as a valid means to exercise legal opt-out rights. A minority of states provide for rulemaking procedures to allow regulators to expand on the specifics of how universal opt-out requests should be honored; other states may rely upon informal guidance or enforcement actions to provide clarity on the scope of legal @@ -474,7 +474,7 @@

User Interface Language

such as a browser or operating system” ([[?COLORADO-REGULATIONS]], Rule 5.04(a)).

- Currently California and Colorado are the only jurisdictions in the United States that empower + Currently California, Colorado, and New Jersey are the only jurisdictions in the United States that empower regulators to issue detailed regulations on topics such as universal opt-outs. Other statutes state relatively high level legal requirements that may be augmented by informal guidance (such as an FAQ) or through enforcement. From a524a4752909c64645fc6416ae64fddd7e53c589 Mon Sep 17 00:00:00 2001 From: Justin Brookman Date: Tue, 4 Feb 2025 11:30:53 -0500 Subject: [PATCH 2/2] Update explainer.md Minor edits to reflect that CT and NJ have explicitly endorsed GPC as a universal opt-out. --- explainer.md | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/explainer.md b/explainer.md index 9938c47..dda9e86 100644 --- a/explainer.md +++ b/explainer.md @@ -125,7 +125,14 @@ The regulations also set up a "registry" of legally binding signals under the la #### 4.1.3 Other states that explicitly provide for universal opt-out mechanisms -In addition to California and Colorado, at least nine other states have passed comprehensive privacy legislation that explicitly provides for the operation of global privacy signals that must be treated as legally binding opt-outs under the law. Most of these state laws are broadly similar to the text of the Colorado Privacy Act, in that they apply to both sales and cross-context targeted advertising, and have similar provisions requiring, for example, that the signals reflect the intent of the user and that they not unfairly disadvantage other controllers. However, they also differ in a number of key ways. As one example, states like Texas and Nebraska provide that specific global opt-out signals will be deemed valid if they are legally recognized in another state jurisdiction. Most of these states do not provide for rulemaking from the Attorney General to issue more clarity on the operation of the global opt-out provisions, though regulators may offer more informal guidance through FAQs (as California originally did) or may bring enforcement actions to clarify the boundaries of the law. +In addition to California and Colorado, at least ten other states have passed comprehensive privacy legislation that explicitly provides for the operation of global privacy signals that must be treated as legally binding opt-outs under the law. Most of these state laws are broadly similar to the text of the Colorado Privacy Act, in that they apply to both sales and cross-context targeted advertising, and have similar provisions requiring, for example, that the signals reflect the intent of the user and that they not unfairly disadvantage other controllers. + +However, they also differ in a number of key ways. As one example, states like Texas and Nebraska provide that specific global opt-out signals will be deemed valid if they are legally recognized in another state jurisdiction. Most of these states do not provide for rulemaking from the Attorney General to issue more clarity on the operation of the global opt-out provisions, though regulators may offer more informal guidance through FAQs (as California originally did) or may bring enforcement actions to clarify the boundaries of the law. + +Two states --- [Connecticut](https://portal.ct.gov/ag/sections/privacy/the-connecticut-data-privacy-act) and +[New Jersey](https://www.njconsumeraffairs.gov/ocp/Pages/NJ-Data-Privacy-Law-FAQ.aspx) --- have issued FAQs explicity stating +that GPC should be treated as a univeral opt-out under their laws (New Jersey's universal opt-out provision goes into effect +on July 15, 2025). #### 4.1.4 States that have privacy law that is silent on universal opt-out mechanisms