Toolkit · Technology

The Data Privacy and Consumer Rights Toolkit

15 U.S.C. §§ 6501

Type
Toolkit
Jurisdiction
National
Date
2025-09-19
Topic
Technology

A research and resource map for United States consumer data privacy practice, built for privacy counsel, in-house lawyers, litigators, and compliance leaders. Ten pillars organize the field: applicability and the exemptions that decide coverage, the definitions that determine most compliance questions, consumer rights and the response machinery they require, the opt-out stack and the dark pattern rules governing choice architecture, sensitive data and consent, the substantive minimization and retention duties that no disclosure satisfies, the controller and processor contract as the perimeter between an ordinary vendor relationship and a statutory sale, risk assessments and automated decisionmaking, the biometric and consumer health statutes that carry private rights of action, and the sectoral overlays, private litigation theories, and cross-border transfer rules that generate the largest exposures. Each pillar states the doctrine, names the controlling authorities, flags the trap and its second-order consequence, and points deeper. An authority shelf collects the statutes, regulations, leading cases, and secondary sources. Two appendices supply a fact-pattern-to-obligation decision matrix and a state comparison table covering the provisions on which the regimes actually diverge.

The Data Privacy and Consumer Rights Toolkit

Technology > Data Privacy | Published 19 September 2025 - Updated 28 July 2026 | UpLaw - uplaw.us

In brief. Ask three questions in order. Are you covered, and by which statutes? What is the data, and does a special statute reach it? Where does it go, and under what contract? The third question converts an ordinary vendor relationship into a statutory sale, and it is the one most companies cannot answer without reading their own tag container.

Keywords: CCPA/CPRA, applicability, sale and sharing, sensitive data, universal opt-out, dark patterns, minimization, processor contracts, assessments, ADMT, BIPA, MHMD, COPPA, VPPA, CIPA, FTC § 5, cross-border

How This Toolkit Is Organized

Ten pillars, each giving the doctrine, the anchors, the trap and its second order consequence, and where to go deeper. Then the authority shelf, then two appendices: a fact-pattern decision matrix and a state divergence table.

The narrative entry point is Notice and Choice Is Dead: What the State Privacy Laws Actually Require. The doctrinal treatment is Data Privacy Compliance: A Comprehensive Guide to State Privacy Laws and Consumer Rights. The operational sequence is Building a Privacy Compliance Program: A Practical Checklist.

Our running matters. Meridian Larder, Inc. (fictional), a national direct-to-consumer grocery retailer; Vantage Reach, LLC (fictional), its advertising measurement vendor; Northbeam Nutrition (fictional), its coaching subsidiary; Calder Financial (fictional), its card issuer; Tessellate (fictional), its analytics and session-replay vendor.

Pillar 1 — Applicability and Exemptions

Doctrine. Roughly twenty states have comprehensive consumer privacy statutes, each with its own thresholds and exemptions, none preempting the others and none preempted by federal law. Coverage is determined per state, per entity, and in California per data type.

Anchors. Cal. Civ. Code §§ 1798.100–1798.199.100; Va. Code §§ 59.1-575 to 59.1-585; Colo. Rev. Stat. §§ 6-1-1301 to 6-1-1313; Conn. Gen. Stat. §§ 42-515 to 42-525; Tex. Bus. & Com. Code ch. 541 (no numeric threshold; SBA small-business carve-out); Md. Code, Com. Law §§ 14-4601 to 14-4614.

Trap. Assuming a GLBA or HIPAA exemption is entity-level everywhere. In California it is data-level: a bank's marketing lists, web analytics, and HR data are in scope, and a wellness company that is not a covered entity gets nothing from the HIPAA carve-out at all.

Trap, second order. Counting customers instead of state residents processed, which omits prospects, site visitors, purchased lists, and people whose data the company merely handles for someone else. The low-threshold states — Delaware, Montana, New Hampshire, Rhode Island — catch companies that correctly concluded they were under the standard 100,000 line.

Go deeper: Guide Part II · Checklist Phase 1

Pillar 2 — The Definitions That Decide Cases

Doctrine. Compliance outcomes are driven by four definitions — personal data, sale, sharing or targeted advertising, and sensitive data — and each differs materially across states.

Anchors. Cal. Civ. Code § 1798.140 (definitions of sale, share, sensitive personal information, service provider, contractor, third party, dark pattern). Majority-state definitions of "sale" reaching monetary or other valuable consideration; minority states (Virginia, Utah, Iowa, Tennessee, Indiana) limited to monetary consideration. Deidentification standards requiring technical safeguards, a public commitment, and contractual flow-down.

Trap. "We do not sell data" as a statement about money rather than about consideration. Transmitting identifiers to an ad platform in exchange for measurement and audience matching is a sale in the majority of states and a share in California, with no money moving. A published California resolution rested on exactly this: participation in a marketing cooperative in which members contributed customer data and received pool access.

Trap, second order. Treating hashed or pseudonymous identifiers as outside scope. Hashing is a security control, not deidentification, and pseudonymous data remains personal data. A hashed email transmitted to an identity graph is the most common single flow in the field and the one most frequently misclassified.

Go deeper: Guide Part III · Article Part V

Pillar 3 — Consumer Rights and Response Machinery

Doctrine. Access, deletion, correction, portability, and opt-out rights, with a 45-day response clock, verification requirements, non-discrimination, and — in every state except California — a mandatory appeal process that must hand the consumer the attorney general's contact information.

Anchors. Cal. Civ. Code §§ 1798.100, 1798.105, 1798.106, 1798.110, 1798.115, 1798.120, 1798.125; 11 C.C.R. §§ 7020–7027 (request handling, verification, opt-out preference signals); Va. Code § 59.1-577 (appeal); Oregon's right to a list of specific third parties; Minnesota's right to question a profiling result.

Trap. Over-verification. Demanding identity documents to process an opt-out — which requires no verification — has produced published penalties standing alone. The instinct to protect against fraudulent requests produces a barrier that is itself the violation.

Trap, second order. Deletion that stops at the system of record. The obligation runs to derived data, segments, models, backups on their restoration cycle, service providers who must be directed to delete, and third parties who must be notified. A company that cannot enumerate where the data went cannot comply, which is why the inventory is prerequisite to the rights program rather than parallel to it.

Go deeper: Guide Part V · Checklist Phase 7

Pillar 4 — Opt-Outs, Universal Signals, and Dark Patterns

Doctrine. Controllers must honor a machine-readable universal opt-out signal without further consumer action, must propagate the opt-out downstream, and must design choice interfaces that satisfy symmetry and the other anti-dark-pattern criteria. Consent obtained through a dark pattern is not consent.

Anchors. 11 C.C.R. § 7025 (opt-out preference signals) and § 7004 (symmetry, plain language, no manipulative framing, minimal steps, no excess information); 4 C.C.R. 904-3 Rules 5 and 7 (Colorado universal opt-out list and consent); Cal. Civ. Code § 1798.140(l) (dark pattern definition). Federal Trade Commission staff report, Bringing Dark Patterns to Light (2022).

Trap. Building the banner and not the plumbing. The consent platform records the signal; the tag manager never reads the flag, or reads it after tags fire, or applies it only to cookie-based tags. This is the most tested control in the field because anyone can test it from a browser in ninety seconds.

Trap, second order. Server-side and offline paths. Conversion APIs, offline event uploads, CRM syncs, clean rooms, and partner batch files move the same identifiers without touching a browser, are configured in different consoles by different teams, and are almost never wired to the opt-out flag. A company that remediates only the browser layer has fixed the part a regulator can see and left the part a plaintiff's expert will find.

Go deeper: Guide Part VI · Checklist Phases 5–6

Pillar 5 — Sensitive Data, Consent, and Minors

Doctrine. Sensitive data requires opt-in consent in most states, a limit-use right in California, and notice plus opt-out in Utah and Iowa. Consent must be a clear affirmative act, freely given, specific, informed, unambiguous, and as easy to refuse and withdraw as to give. Minors' data carries additional consent and, in some states, outright prohibitions.

Anchors. Cal. Civ. Code § 1798.121 (right to limit); COPPA, 15 U.S.C. §§ 6501–6506 and the amended COPPA Rule, 16 C.F.R. Part 312 (separate consent for third-party disclosure; written security program; published retention periods); Maryland's prohibition on sale and targeted advertising for consumers under 18; NetChoice, LLC v. Bonta, 113 F.4th 1101 (9th Cir. 2024); Moody v. NetChoice, LLC, 603 U.S. 707 (2024); Free Speech Coalition, Inc. v. Paxton, No. 23-1122 (U.S. June 27, 2025).

Trap. Missing inferred sensitive data. A propensity score derived from purchase history that predicts a health condition is health data in most states and consumer health data in Washington, regardless of whether any consumer disclosed anything. Precise geolocation collected by default by a mobile SDK is sensitive data nobody decided to collect.

Trap, second order. Assuming one consent satisfies every statute. Sensitive-data consent under a comprehensive law does not satisfy the Illinois biometric statute's prior written release, or Washington's separate consents to collect and to share, or COPPA's separate consent for third-party disclosure. Four statutes, four consent records, four retention obligations, one interface — and the interface must show each of them was actually obtained.

Go deeper: Guide Parts VII, XII

Pillar 6 — Minimization, Purpose Limitation, and Retention

Doctrine. Collection, use, and retention must be reasonably necessary and proportionate to a disclosed purpose; secondary uses must be compatible with the context of collection; and data must not be retained longer than necessary, with retention periods disclosed in California.

Anchors. Cal. Civ. Code § 1798.100(a)(3), (c); Md. Code, Com. Law § 14-4607 (necessary and proportionate to a product or service the consumer requested, and a flat ban on selling sensitive data); majority formulation tying necessity to the purposes as disclosed.

Trap. Believing disclosure cures over-collection. Under the majority formulation it partly does; under Maryland's it does not, because the standard is tied to what the consumer requested rather than to what the notice said. A national controller building to a single standard must build to Maryland's or accept a state-branched data flow it will maintain forever.

Trap, second order. Derived data. Scores, segments, model features, and embeddings are personal data if reasonably linkable, which means they are subject to deletion, correction, minimization, and retention limits. Programs that map raw fields and ignore derived artifacts fail the first deletion audit, and they fail it in the system that is hardest to fix.

Go deeper: Guide Part VIII · Checklist Phase 9

Pillar 7 — The Contract Perimeter

Doctrine. A disclosure of personal information to another company is a sale or share unless the recipient is a service provider, contractor, or processor — and under the CCPA the recipient holds that status only because a written contract containing specified terms exists.

Anchors. Cal. Civ. Code § 1798.140(ag), (j), (ai); 11 C.C.R. § 7051 (required service provider and contractor terms); Va. Code § 59.1-579(B) (processor contract terms: confidentiality, deletion or return, information to demonstrate compliance, assessments, subcontractor flow-down).

Trap. Treating the contract as evidence rather than as the operative fact. Missing contract, sale. Non-conforming contract, sale. The legacy vendor onboarded before the statute and never repapered is transmitting data under no agreement at all, and every transmission is a separate disclosure.

Trap, second order. The processor acting as a controller. A vendor that enriches, resells, trains on, or builds an identity graph from client data has left the processor role by conduct, and regulators look at conduct. Now there are two problems: the disclosure was a sale, and the privacy notice saying otherwise was a misrepresentation actionable under state law and FTC Act § 5.

Go deeper: Guide Part IX · Checklist Phase 8

Pillar 8 — Assessments, Profiling, and Automated Decisionmaking

Doctrine. Data protection assessments are mandatory for targeted advertising, sale, sensitive data, heightened-risk profiling, and any heightened risk of harm; several states may demand them. Consumers may opt out of profiling in furtherance of decisions with legal or similarly significant effects, and California's ADMT rules add pre-use notice, opt-out, and an explanation right.

Anchors. Colo. Rev. Stat. § 6-1-1309 and 4 C.C.R. 904-3 Rules 8–9 (assessment content; human involved, human reviewed, and solely automated processing); Va. Code § 59.1-580; California ADMT regulations adopted in 2025 (significant decisions limited to financial or lending services, housing, education, employment, and healthcare; behavioral advertising excluded from the final rules); Minnesota's right to question a profiling result.

Trap. The template assessment. A three-page document with every risk marked "low" and no residual-risk analysis reads as a compliance artifact rather than a decision record, and regulators recognize it immediately. The assessment is usually the first document requested; produce a real one or produce nothing.

Trap, second order. Describing the same model four ways. Companies subject to the California ADMT rules, a state algorithmic discrimination act, an employment AI statute, and a bias-audit ordinance produce four documents from four teams, and the inconsistencies among them become the finding. One model inventory, one explanation artifact, four mappings.

Go deeper: Guide Part X · Checklist Phase 10

Pillar 9 — Biometric, Health, and Genetic Statutes

Doctrine. A separate tier of state statutes regulates specific data types without regard to the comprehensive laws' thresholds, and two of them carry private rights of action with statutory damages.

Anchors. 740 ILCS 14 (BIPA: written release before collection, published retention and destruction schedule, no profit; $1,000 negligent / $5,000 intentional or reckless, plus fees). Rosenbach v. Six Flags Entertainment Corp., 129 N.E.3d 1197 (Ill. 2019); Cothron v. White Castle System, Inc., 216 N.E.3d 918 (Ill. 2023) (per-scan accrual, since limited by 2024 amendment); Bryant v. Compass Group USA, Inc., 958 F.3d 617 (7th Cir. 2020); Patel v. Facebook, Inc., 932 F.3d 1264 (9th Cir. 2019). Tex. Bus. & Com. Code § 503.001 (CUBI; AG only; up to $25,000 per violation). Wash. Rev. Code ch. 19.373 (My Health My Data: separate consents, signed authorization to sell, 750-foot geofencing ban, private right of action through the state consumer protection act). 410 ILCS 513 (Illinois genetic privacy, including family medical history).

Trap. Accepting a vendor's statement that a feature "does not store biometrics." Under BIPA, collection without a prior written release is the violation; discarding the template afterward is a retention practice, not a defense. Face-based age estimation, virtual try-on, voice authentication, and fingerprint timeclocks are the recurring fact patterns.

Trap, second order. Washington's statute is the least discussed and the most dangerous, because its definition of consumer health data reaches inferences, its consent architecture is separate from every other statute's, and it is privately enforceable. A retailer with no health business can hold consumer health data by operation of its recommendation engine and never know it.

Go deeper: Guide Part XI · Checklist Phase 3

Pillar 10 — Sectoral Overlays, Private Litigation, and Cross-Border

Doctrine. The largest privacy exposures in the United States arise from older, narrower statutes with private rights of action and from a national security rule that is not a privacy statute at all.

Anchors. GLBA, 15 U.S.C. §§ 6801–6809; Reg. P, 12 C.F.R. Part 1016; Safeguards Rule, 16 C.F.R. Part 314. HIPAA, 45 C.F.R. Parts 160, 164. FCRA, 15 U.S.C. §§ 1681–1681x. VPPA, 18 U.S.C. § 2710; Salazar v. National Basketball Ass'n, 118 F.4th 533 (2d Cir. 2024); Salazar v. Paramount Global, 133 F.4th 642 (6th Cir. 2025); In re Nickelodeon Consumer Privacy Litig., 827 F.3d 262 (3d Cir. 2016); Eichenberger v. ESPN, Inc., 876 F.3d 979 (9th Cir. 2017); Yershov v. Gannett Satellite Info. Network, Inc., 820 F.3d 482 (1st Cir. 2016). ECPA, 18 U.S.C. § 2511; Cal. Penal Code §§ 630–638.55; Popa v. Harriet Carter Gifts, Inc., 52 F.4th 121 (3d Cir. 2022). TransUnion LLC v. Ramirez, 594 U.S. 413 (2021). FTC Act § 5, 15 U.S.C. § 45; FTC v. Wyndham Worldwide Corp., 799 F.3d 236 (3d Cir. 2015); LabMD, Inc. v. FTC, 894 F.3d 1272 (11th Cir. 2018); AMG Capital Mgmt., LLC v. FTC, 593 U.S. 67 (2021). 28 C.F.R. Part 202 (Data Security Program under Executive Order 14117).

Trap. Removing a privacy class action to federal court to win on standing. TransUnion frequently produces a remand rather than a dismissal, and the state forum is usually worse: no Article III requirement, different class certification law, and a jury pool that lives where the plaintiff shops.

Trap, second order. The Data Security Program. It is a national security rule with civil and criminal exposure, administered by the Department of Justice, that reaches ordinary commercial arrangements — an offshore support vendor, a cloud region, an investor with a covered nexus — whenever bulk sensitive personal data is accessible. Its thresholds are low: human genomic data at 100 U.S. persons, biometric identifiers and precise geolocation at 1,000, health and financial data at 10,000. It appears in almost no privacy risk register and belongs in all of them.

Go deeper: Guide Parts XIII–XIV

The Authority Shelf

Federal statutes

Federal regulations and executive action

State statutes and rules

Leading cases

  • TransUnion LLC v. Ramirez, 594 U.S. 413 (2021) · Spokeo, Inc. v. Robins, 578 U.S. 330 (2016) · AMG Capital Mgmt., LLC v. FTC, 593 U.S. 67 (2021) · FTC v. Wyndham Worldwide Corp., 799 F.3d 236 (3d Cir. 2015) · LabMD, Inc. v. FTC, 894 F.3d 1272 (11th Cir. 2018)
  • Rosenbach v. Six Flags Entm't Corp., 129 N.E.3d 1197 (Ill. 2019) · Cothron v. White Castle Sys., Inc., 216 N.E.3d 918 (Ill. 2023) · Bryant v. Compass Grp. USA, Inc., 958 F.3d 617 (7th Cir. 2020) · Patel v. Facebook, Inc., 932 F.3d 1264 (9th Cir. 2019)
  • Salazar v. Nat'l Basketball Ass'n, 118 F.4th 533 (2d Cir. 2024) · Salazar v. Paramount Global, 133 F.4th 642 (6th Cir. 2025) · In re Nickelodeon Consumer Privacy Litig., 827 F.3d 262 (3d Cir. 2016) · Eichenberger v. ESPN, Inc., 876 F.3d 979 (9th Cir. 2017) · Yershov v. Gannett Satellite Info. Network, Inc., 820 F.3d 482 (1st Cir. 2016)
  • Popa v. Harriet Carter Gifts, Inc., 52 F.4th 121 (3d Cir. 2022) · NetChoice, LLC v. Bonta, 113 F.4th 1101 (9th Cir. 2024) · Moody v. NetChoice, LLC, 603 U.S. 707 (2024) · Free Speech Coalition, Inc. v. Paxton, No. 23-1122 (U.S. June 27, 2025)

Secondary sources

  • Daniel J. Solove & Paul M. Schwartz, Information Privacy Law (casebook) and Privacy Law Fundamentals — the standard references
  • Daniel J. Solove, Understanding Privacy; The Digital Person
  • International Association of Privacy Professionals — US State Privacy Legislation Tracker, Westin Research Center charts, and the CIPP/US body of knowledge; the fastest reliable source on which states have what
  • Berkeley Technology Law Journal; Harvard Journal of Law & Technology; Journal of Law and the Biosciences; Privacy Law Scholars Conference papers
  • Federal Trade Commission, Bringing Dark Patterns to Light (2022); Privacy and Data Security Update (annual); business blog guidance on health data and location data
  • California Privacy Protection Agency enforcement decisions and rulemaking records; Colorado Attorney General universal opt-out list and rulemaking record; Connecticut Attorney General CTDPA enforcement report
  • Restatement of the Law, Consumer Contracts, and Restatement (Second) of Torts §§ 652A–652I (privacy torts) for the common-law overlay
  • National Institute of Standards and Technology, Privacy Framework — the affirmative-defense standard referenced by the Tennessee statute

Appendix A — Fact Pattern to Obligation Matrix

Find the fact; read the obligation and the exposure. Assume a national controller over the thresholds.

Fact pattern Primary obligation Principal exposure
Advertising or measurement tag transmits a hashed email to a platform Sale/share; opt-out link; contract or third-party status State AG penalties; opt-out propagation findings
Global Privacy Control enabled and tags still fire Universal opt-out recognition The most-tested control; published penalties
"Accept All" prominent, decline buried in a submenu Symmetry in choice Consent void; every downstream use unlawful
Face-based age estimation at a kiosk Prior written release, published retention schedule BIPA private right of action; $1,000/$5,000 per person
Voice analytics in a call center Biometric analysis; two-party consent recording BIPA plus state wiretap claims
Purchase-derived health propensity score Sensitive data consent or limit-use; Washington consumer health data MHMD private right of action; sensitive-data findings
Mobile SDK collecting precise geolocation by default Sensitive data; minimization FTC unfairness; sensitive-data consent failures
Session-replay script on any page Prior consent; wiretap analysis CIPA and state wiretap class actions
Any video on a property plus an advertising pixel VPPA analysis $2,500 liquidated damages per person
Vendor "improves its services" using client data Vendor is a third party, not a processor Every transmission is a sale; notice is a misrepresentation
Vendor onboarded before the statute, never repapered Missing mandatory contract terms Disclosure is a sale by operation of law
Targeted advertising or sale of personal data Data protection assessment First document a regulator requests
Model denies credit, housing, employment, or care Profiling opt-out; ADMT notice, opt-out, explanation State privacy plus algorithmic discrimination statutes
Children's content, no age gate COPPA directed-to-children analysis; state knowledge standards Civil penalties per violation per child
Retaining five years of data with no stated purpose Minimization and retention Regulator inquiry; breach magnitude
Breach of unencrypted personal information Reasonable security Cal. Civ. Code § 1798.150: $100–$750 per consumer
Offshore support vendor with access to bulk sensitive data Data Security Program analysis DOJ civil and criminal exposure
Selling personal data of a Maryland consumer under 18 Flat prohibition Per-violation penalties; no consent cure
Company registers as a data broker in no state Registration statutes Easiest enforcement in the field

Appendix B — Where the State Regimes Actually Diverge

Comparison of the provisions that change program design. Verify current law; effective dates and amendments move.

Provision Broadest position Narrowest position Practical consequence
Applicability threshold Texas and Nebraska: no numeric threshold Florida: very large entities only Small companies are covered in Texas and nowhere else
GLBA/HIPAA exemption California: data-level Most states: entity-level Banks and providers have a California-only program
Employee and B2B data California: in scope All others: out HR privacy is a California question
Nonprofits California, Colorado, Delaware, New Jersey, Oregon, Minnesota: covered Most: exempt Nonprofit compliance is state-specific
"Sale" Monetary or other valuable consideration Monetary consideration only (Virginia, Utah, Iowa, Tennessee, Indiana) Ad-tech is a sale in the majority of states
Sensitive data Opt-in consent (most states) Notice and opt-out (Utah, Iowa); limit-use right (California) Build to consent, degrade gracefully
Minimization Maryland: tied to a requested product or service Most: tied to disclosed purposes Maryland is the design constraint
Minors Maryland: sale and targeted advertising prohibited under 18 COPPA: under 13, actual knowledge Knowledge standard drives the age-gate decision
Correction right All states Utah, Iowa: none Build it; the exception is not worth branching
Appeal right All states except California California: none (agency complaint instead) Appeal responses reach regulators by design
Specific third parties Oregon: on request Most: categories only Requires a recipient-level ledger
Data inventory Minnesota: expressly required Most: implicit Build it everywhere; it is prerequisite anyway
Profiling Minnesota: right to question and reevaluate Utah, Iowa: no profiling opt-out Explanation artifacts become mandatory
Cure period Texas, Virginia, Utah: permanent (30 days) California, Colorado, Connecticut: sunset or discretionary Cure rights only help if you can actually cure
Private right of action California breach claim; Washington MHMD; Illinois BIPA and GIPA None in the other comprehensive statutes The class action risk is in the narrow statutes

Related Documents

Articles

Guides

Checklists

Toolkits