USA Law and Practice Contributed by: Aly Dossa and Marcus Burnside, Chamberlain Hrdlicka
4. Sectoral Topics 4.1 Use of Cookies
Given this fragmented regulatory landscape, organi - sations should adopt the following practical approach: • identify what personal data they collect and pro - cess; • determine which state and federal laws apply to that data; and • implement a data governance programme that addresses all obligations under the identified laws Where applicable laws impose overlapping or conflict - ing requirements, best practice is to adopt the most stringent obligation across all relevant statutes. This “highest common denominator” approach ensures compliance while simplifying operational processes. 3.4 Regulators and Enforcement The Federal Trade Commission and state AGs serve as the primary enforcers of privacy laws in the United States. The FTC enforces privacy requirements under Section 5 of the FTC Act, which prohibits unfair or deceptive practices. This authority enables the agency to pursue companies that misrepresent their privacy practices or fail to implement reasonable data security measures. State AGs enforce privacy requirements under state- specific privacy laws, sector-specific federal laws and state consumer protection statutes. While there is some co-ordination between the FTC and state AGs, significantly more collaboration occurs among the states themselves. State AGs frequently form coalitions – such as the recent “Consortium of Privacy Regulators” comprising California, Colorado, Connecticut, Delaware, Indiana, New Jersey and Oregon – to conduct multi-state investigations, share technical expertise and address cross-border data issues. This collaborative approach creates a more unified enforcement front and ensures more consist - ent consumer protection across jurisdictions.
The US regulates online tracking technologies – including cookies, pixels, SDKs, mobile advertising IDs, device identifiers, fingerprinting and session replay tools – through a fragmented framework of federal and state laws. Federal Framework At the federal level, the regulation of tracking technol - ogies are primarily governed by the following statutes and regulatory bodies. • FTC Act Section 5 – the Federal Trade Commission prohibits unfair or deceptive practices related to tracking technologies. • COPPA (Children’s Online Privacy Protection Act) – requires verifiable parental consent (opt-in) before collecting personal information, including persis - tent identifiers used for tracking, from children under 13 years of age. Enhanced data-retention requirements became effective in June 2025. State Comprehensive Privacy Laws (State Laws Impose Varying Consent Models) • California (CCPA/CPRA) – requires businesses to provide opt-out mechanisms for the sale or sharing of personal information, including browsing history and online activity. Enhanced protections apply to minors under 16, requiring affirmative opt-in consent from the consumer (ages 13–15) or par - ent/guardian (under 13). Businesses must honour Global Privacy Control (GPC) signals as valid opt- out requests. • Virginia (VCDPA) – requires opt-out mechanisms for targeted advertising and data sales, and mandates opt-in consent for processing sensitive data and data from identified children. • Colorado (CPA) – defines consent as a “clear, affirmative act” and prohibits dark patterns. Pro - vides detailed technical specifications for universal opt-out mechanisms. • Connecticut (CTDPA) – permits technology-based opt-out mechanisms and prohibits geofencing for tracking purposes within 1,750 feet of mental health or reproductive health facilities. Opt-in con -
553 CHAMBERS.COM
Powered by FlippingBook