Usercentrics blog

California’s SB 690, signed September 30, 2026, ends private pen register lawsuits under CIPA over website and app tracking from January 1, 2027, and applies to many pending cases. CIPA’s wiretapping and eavesdropping provisions are unchanged, so trackers that fire before consent still carry risk. This article explains what changed, what did not, and how to reduce exposure.

The CCPA, as amended by the CPRA, applies to for-profit businesses that meet certain revenue or data thresholds and collect personal information from California residents. This checklist covers eight steps for websites, from privacy policies and opt-out links to consumer requests, and notes the rule changes taking effect in 2026 and 2027. Then take the quiz to test your knowledge.

The Tennessee Information Protection Act (TIPA), signed on May 11, 2023, is the eighth comprehensive U.S. state privacy law. It has applied since July 1, 2025, and covers only businesses with more than USD 25 million in annual revenue that also meet a consumer-count test. This overview covers who must comply, consumer rights, requirements, and enforcement.

The New Jersey Data Privacy Act (NJDPA), signed on January 16, 2024, is the thirteenth comprehensive U.S. state privacy law. It has applied since January 15, 2025, and a June 2026 amendment bans the sale of sensitive data. This overview covers who must comply, consumer rights, opt-out signals, and enforcement, including the end of the cure period.

If your website has visitors in Florida or Pennsylvania, two old wiretapping laws, FSCA and WESCA, which are similar to California’s CIPA, may already apply to the tracking pixels, chat tools, and analytics scripts running on your site. This guide breaks down what each law covers, what’s driving the current wave of lawsuits, and the practical steps that reduce your risk.

The Nebraska Data Privacy Act (NDPA), signed on April 17, 2024, has applied since January 1, 2025. It covers most businesses that are not small businesses, sets no revenue or consumer-count threshold, and keeps a permanent 30-day cure period. This overview explains who must comply, consumer rights, controller duties, and enforcement.

The Florida Digital Bill of Rights (FDBR) has applied since July 1, 2024. Its full duties reach only companies with more than USD 1 billion in global revenue that meet a business-model test, but its sensitive data sale rule reaches any for-profit business operating in Florida. This guide covers who must comply, consumer rights, children’s data, and enforcement.

The Colorado Privacy Act (CPA) has applied since July 1, 2023, and it now carries added duties for minors’ data, biometric identifiers, and precise geolocation. Colorado’s general cure period ended on January 1, 2025, so enforcement can begin without a warning. This guide helps businesses understand who must comply, what consumers can request, and how penalties work.

The Texas Data Privacy and Security Act (TDPSA), signed on June 18, 2023, is the tenth comprehensive U.S. state privacy law. It has applied since July 1, 2024, covers most businesses that are not small businesses, and has no consumer-count threshold. This overview covers who must comply, consumer rights, requirements, and enforcement.

An enterprise buyer’s guide to consent management platforms, built around one question: can your consent record hold up when a regulator or plaintiff’s attorney asks? It compares Usercentrics, Ketch, Didomi/Sourcepoint, OneTrust, Osano, and Transcend on seven criteria, including U.S. state law depth, litigation-ready audit trails, AI governance, TCF v2.4, app and CTV consent, and DSR handling.

The Virginia Consumer Data Protection Act (VCDPA), signed on March 2, 2021, was the second comprehensive U.S. state privacy law. It has applied since January 1, 2023, and amendments have since added protections for children’s data and, from July 1, 2026, a ban on selling precise geolocation data. This overview covers who the law applies to, consumer rights, sensitive data, and enforcement.

The Delaware Personal Data Privacy Act (DPDPA), signed on September 11, 2023, is the twelfth comprehensive U.S. state privacy law. It took effect on January 1, 2025, and House Bill 380 expands its scope from January 1, 2027. This overview covers who the law applies to, consumer rights, sensitive data, opt-out signals, and enforcement.