USA Law and Practice Contributed by: Aly Dossa and Marcus Burnside, Chamberlain Hrdlicka
sent is required before the sale of consumer health data. • Texas (TDPSA) – requires clear, affirmative consent for processing sensitive data and mandates that universal opt-out mechanisms enable consumers to make unambiguous choices to opt out. Summary of Consent Models • Opt-in consent required for children under 13 (fed - eral), minors under 16 (California), sensitive data processing (Virginia, Texas) and health data sales (Connecticut) • Opt-out models apply to targeted advertising and data sales under most state comprehensive pri - vacy statutes, including those in California, Virginia, Organisations must provide clear, conspicuous notice about tracking practices, implement effective opt-out mechanisms where required, honour universal opt-out signals like GPC in applicable states, ensure consent banners are properly configured and avoid misleading interfaces, establish vendor management processes with contractual protections for third-party tracking providers, and implement data minimisation practices aligned with state law requirements. Given the complexity of the regulatory landscape, organisations should determine which state and fed - eral laws govern their tracking practices and imple - ment compliance programmes that satisfy the most stringent requirements across all applicable jurisdic - tions. 4.2 Personalised Advertising and Other Online Marketing Practices Personalised and Targeted Advertising Regulation in the United States The United States regulates personalised and targeted advertising through a patchwork of federal and state laws. At the federal level, the FTC prohibits decep - tive advertising practices and has imposed significant penalties for misrepresenting data collection and use. COPPA essentially bans behavioural advertising to children under 13, requiring verifiable parental con - sent before collecting any personal information includ - ing cookies and device identifiers. HIPAA restricts Colorado, Connecticut and Texas. Practical Compliance Requirements
healthcare providers from using health information for marketing without authorisation, while GLBA limits financial institutions’ ability to share customer data for marketing purposes. Multiple states – including California, Colorado, Vir - ginia, Connecticut, Utah and Texas – have enacted comprehensive privacy laws governing targeted advertising. These laws generally require businesses to provide opt-out mechanisms for targeted advertis - ing and data sales, often through “Do Not Sell My Personal Information” links on websites. California’s law is the strictest, requiring opt-in consent for minors under 16 and mandating recognition of Global Privacy Control signals. All state laws impose heightened pro - tections for sensitive data (health information, precise location, biometric data, race, ethnicity, religion or sexual orientation), requiring affirmative opt-in con - sent before using such data for advertising. States also prohibit “dark patterns” – manipulative design tricks to obtain consent – and some require risk assessments for profiling activities that could cause unfair treatment or harm. To comply, companies must: • post clear privacy notices explaining data collec - tion for advertising; • provide easy opt-out options for targeted advertis - ing and data sales; • obtain affirmative opt-in consent for children’s data and sensitive information; • honour universal opt-out signals (like Global Pri - vacy Control) where required; • avoid manipulative consent interfaces (“dark pat - terns”); and • conduct risk assessments for high-risk profiling activities. Enforcement comes from the FTC and state AGs, with penalties ranging from thousands of dollars per viola - tion to billions for major violations. Given this frag - mented landscape, best practice is to identify appli - cable laws and implement the strictest requirements across all jurisdictions where the business operates.
554 CHAMBERS.COM
Powered by FlippingBook