Usercentrics blog

The Iowa Consumer Data Protection Act (ICDPA) has been in effect since January 1, 2025. It gives Iowa residents four data rights and relies on notice and opt-out, which makes it one of the lighter-touch U.S. state privacy laws. This guide covers who must comply, consumer rights, controller duties, and enforcement, including the 90-day cure period.

The Montana Consumer Data Privacy Act (MTCDPA) took effect on October 1, 2024, and SB 297 amended it effective October 1, 2025. The amendments lowered applicability thresholds, added duties for minors’ data, removed the cure period, and introduced civil penalties of up to USD 7,500 per violation.

The Oregon Consumer Privacy Act (OCPA), in effect since July 1, 2024, sets rules for how businesses collect, share, and protect Oregon residents’ personal data. Amendments that took effect on January 1, 2026 added a universal opt-out requirement, ended the mandatory cure period, and tightened protections for minors and precise geolocation data.

The Utah Consumer Privacy Act (UCPA) gives Utah residents the right to access, delete, correct, and obtain a copy of their personal data, and to opt out of its sale or use for targeted advertising. This overview covers who must comply, what controllers must do, how the law is enforced, and recent changes, including the right to correct that took effect July 1, 2026.

The California Consumer Privacy Act (CCPA), in effect since 2020 and expanded by the CPRA, governs how covered businesses collect, use, sell, and share Californians’ personal information. This guide explains who must comply, what rights consumers hold, and what businesses must do, including the 2026 rules on automated decision-making, risk assessments, and cybersecurity audits, and the SB 923 changes taking effect in 2027.

The California Privacy Rights Act (CPRA) amended the California Consumer Privacy Act (CCPA), and two regulators now enforce it with fines and settlements that reach into the millions of dollars. New rules on opt-out signals, automated decision-making, deletion requests, and website tracking lawsuits take effect in 2027.

The Connecticut Data Privacy Act (CTDPA) governs how businesses collect, process, and sell Connecticut residents’ personal data. This guide covers thresholds, consumer rights, consent, and enforcement, including the 2026 amendments (PA 25-113 and SB 4) on profiling, minors, geolocation, and surveillance pricing.

The U.S. privacy landscape is shifting. There are now over 20 state privacy laws, federal legislation remains stalled, and private litigation is ramping up. A Consortium of Privacy Regulators has grown to eleven states plus California’s privacy agency, coordinating enforcement across borders. They have publicly stated enforcement priorities. For businesses, check-the-box compliance is no longer enough. Here’s what you need to know.

This guide explains how Usercentrics geolocation rulesets let a single implementation serve the right consent experience to each U.S. visitor. It covers the opt-out model behind most state privacy laws, which states require Global Privacy Control recognition, why California needs a separate CIPA configuration, and how to structure a ruleset’s global and regional rules.

This guide explains how Google Tag Manager interacts with cookie consent requirements under U.S. privacy laws, including the CCPA/CPRA and a growing set of state and federal wiretapping and video-privacy statutes such as CIPA, FSCA, WESCA, ECPA, and VPPA. It covers how to configure GTM to respect visitor consent choices, what non-compliance can cost a U.S. business, and what to consider if you also operate in the EU or UK.

CIPA demand letters are targeting websites implementing tracking technologies that fire before visitors provide consent. The new Usercentrics CIPA Template applies a geotargeted, opt-in consent configuration for California visitors within the existing Web CMP, automatically blocking such technologies until affirmative consent is given.

This guide explains what a consent management platform (CMP) is and why it’s not the same as a cookie banner. It covers the U.S. privacy law and litigation landscape, why a CMP is needed, plus how to choose the right compliance framework for single state or multi-jurisdictional needs while maintaining audit-readiness over time.