Consent is where most privacy compliance actually fails, usually because the banner and the backend disagree about what the user chose. This hub covers opt-out signal requirements including Global Privacy Control, and the enforcement that follows when honoring them is only cosmetic.
Consent Management
November 2, 2026
Maine's chapter 94 of Title 35-A is one section long. Since July 1, 2020 it has barred broadband providers from using, selling or sharing customer personal information without express, affirmative consent, and from pricing that choice. Four industry groups sued in 2020; the federal court's published orders rejected their preemption claims and declined to strike the law on the pleadings.
Read more →
Data Security Rules
October 5, 2026
Customer proprietary network information is the record of whom a phone customer calls, when, for how long and on what plan. Section 222 of the Communications Act limits how carriers use it, and the FCC's rules in subpart U of part 64 add a two-tier customer approval system, password and ID checks before disclosure, and an officer-signed compliance certificate filed every March 1.
Read more →
Consent Management
October 5, 2026
An event data recorder keeps a few seconds of vehicle data around a crash. Federal law makes that data the property of the vehicle's owner or lessee and lists five situations in which someone else may access it, while NHTSA's Part 563 sets what an installed recorder must capture. Eight state statutes read for this post add their own consent rules, insurer limits and penalties.
Read more →
Dark Patterns
September 14, 2026
California, Colorado and Connecticut define a dark pattern in nearly the same words, and each treats agreement obtained through one as no consent at all. What differs is the material around that sentence: an example-driven regulation in California, design and withdrawal rules in Colorado, and in Connecticut a statute that points to the FTC.
Read more →
Adtech & Cookies
September 7, 2026
The banner that greets visitors to most American websites is not a creature of American statute. Neither the CCPA nor the Colorado Privacy Act requires one, and the California regulations mention banners chiefly to say when their design is unlawful. This sets out what each statute requires at the point of collection, and when each genuinely calls for consent.
Read more →
COPPA
September 1, 2026
The FTC published amendments to the Children's Online Privacy Protection Rule on April 22, 2025. They added a separate-consent requirement for third-party disclosure, a written retention policy and a prohibition on indefinite retention, two new categories of personal information, a written security program, and staggered obligations for safe harbor programs.
Read more →
TCPA
September 1, 2026
A February 2024 FCC order codified the right to revoke TCPA consent by any reasonable means, fixed seven per se opt-out words for reply texts, capped the processing window at ten business days, and permitted one confirmation message. The cross-message-type portion of that rule has been waived twice and is now scheduled to take effect January 31, 2027.
Read more →
Consent Management
August 24, 2026
A universal opt-out signal moves the choice from the website to the browser: one setting, broadcast to every site, instead of a banner per visit. Several state statutes now require controllers to honour one. This guide sets out what those statutes and the California regulations say, the conditions on the mechanism, and what two enforcement actions establish about broken opt-out plumbing.
Read more →