STATE DATA PRIVACY RIGHTS

Several U.S. states have passed privacy laws that give their residents specific rights over their personal information. These laws also place responsibilities on businesses like Boundless Media. Below, we explain your rights based on where you live and the laws that apply in your state.

California

If you are a resident of California, California Civil Code Section 1798.83 permits you to request information regarding the disclosure of your personal information.  We may make your personal information available to third parties for their marketing purposes, as described in this Privacy Policy. We maintain the policy of only disclosing such personal information to third parties with your affirmative consent.

The California Consumer Privacy Act (CCPA), along with its amendments through Proposition 24, the California Privacy Rights Act (CPRA), empowers consumers by granting them rights to control their personal information held by businesses. These rights include knowing what information is collected, deleting it, opting out of its sale, and protection against discrimination for exercising these rights. The CPRA introduces additional rights, such as correcting inaccurate information and limiting the use of sensitive data. 

Businesses under CCPA have responsibilities like responding to consumer requests and providing privacy notices. Penalties range from fines to potential damages for breaches, potentially reaching significant amounts for actions affecting consumers. It is important to add that the CPRA amends the CCPA; it is not a different law.

What are your rights? To access, delete, correct your data, obtain a copy of your information, and to opt-out of the sale/share of your information.

Colorado

The Colorado Privacy Act grants rights to residents over their data and imposes responsibilities on data controllers. Businesses must comply with notice requirements, obtain consent for certain data processing, conduct data protection assessments, and fulfill data subject access requests (DSARs). The CPA provides five main consumer rights: opt-out, access, correction, deletion, and data portability. It applies to businesses collecting data from a certain number of Colorado residents. Small businesses have exemptions, but penalties for violations under the CPA can be up to $20,000 per offense, capped at $500,000, enforced by the Colorado Attorney General without a private right of action.

What are your rights? To access, delete, correct your data, obtain a copy of your information, to opt-out of the sale/share of your information and targeted advertising.

Connecticut

The Connecticut Data Privacy Act (CTDPA), which came into effect on July 1, 2023, gives consumers control of their data and provides them with rights such as access to, correction of, and deletion of personal data, as well as the ability to opt out of data sale and processing. 

The CTDPA applies to companies operating in the state as well as those targeting Connecticut residents, with specified data volume and revenue requirements. It imposes obligations on data controllers, including the requirement to limit data acquisition, maintain security procedures, and acquire consent. Sensitive data, such as racial, health, and genetic information, requires express opt-in consent.  The Connecticut Attorney General is in charge of enforcing the CTDPA, which carries fines of up to $5,000 per infraction.

The law is being implemented in stages, with companies given a grace period until January 1, 2025, after which more challenging compliance is required. Additionally, beginning in 2025, companies must provide consumers with a uniform opt-out method for targeted advertising and data sale.

What are your rights? To access, delete, correct your data, obtain a copy of your information, to opt-out of the sale/share of your information and targeted advertising.

Iowa

Iowa’s data privacy law, which became effective on January 1, 2025, gives consumers greater control over their personal information held by companies. Businesses must inform consumers about how their data is collected, used, and shared. The law also limits the sale of personal data without consent. However, certain entities like nonprofits and smaller businesses may be exempt from some provisions. Does not grant private right of action.

What are your rights? To access, delete, correct your data, obtain a copy of your information, to opt-out of the sale/share of your information and targeted advertising.

Minnesota

The Minnesota Consumer Data Privacy Act (MCDPA) is designed to strengthen consumer privacy rights and data protection practices. It applies to businesses that operate in Minnesota or target its residents and meet certain data thresholds. The MCDPA requires businesses to be transparent about data use, conduct data protection assessments, and implement safeguards for handling personal and sensitive information. Certain organizations, including those governed by HIPAA and GLBA, are exempt. The Minnesota Attorney General enforces the law, with potential penalties for non-compliance.

What are your rights? To access, delete, and correct your personal data; obtain a portable copy of your information; and opt out of the sale of data, targeted advertising, and certain types of profiling. You also have the right to question decisions made through automated profiling, including requesting an explanation of how the decision was made, the data used, and how you can influence the outcome.

Montana 

The Montana Consumer Data Privacy Act is a law that makes sure companies are honest about how they use people’s personal information in Montana. If a company does business in Montana or sells products or services to people in Montana, and they handle a lot of personal information from Montana residents, this law applies to them. However, it doesn’t apply to government agencies, schools, or certain types of personal information like health records or research data.

Under this law, Montana residents have the right to know if a company is using their personal information and can ask for a copy of their data or have it corrected or deleted. They can also choose not to let a company use their data for things like targeted ads or selling it to others. Companies must also keep personal data safe and not discriminate against people who exercise these rights. They have to explain clearly in a privacy policy how they use personal data and give people an easy way to contact them about privacy concerns.

Companies must be careful with sensitive data like genetic information or precise location data, and they can’t sell sensitive personal information to third parties without permission. Companies must assess the risks of their data processing activities and make sure that data is de-identified if it’s shared. If a company uses another company to handle data for them, they must have a contract in place to ensure data is protected. Finally, if a company violates these rules, the Montana Attorney General can investigate and take action, but the company has a chance to fix the problem first.

What are your rights? To access, delete, correct your data, obtain a copy of your information, to opt-out of the sale/share of your information and targeted advertising.

Nebraska

The Nebraska Data Privacy Act (NEDPA), effective January 1, 2025, provides Nebraska residents with rights over their personal data. Businesses operating in Nebraska are required to provide clear privacy notices, secure consumer consent for processing sensitive data, and implement reasonable data security measures. The Act does not grant a private right of action, meaning individuals cannot sue businesses directly for violations; instead, enforcement is handled by the Nebraska Attorney General. 

What are your rights? To access, delete, correct your data, obtain a copy of your information, to opt-out of the sale/share of your information and targeted advertising.

Minnesota

Nevada’s privacy law, known as the Nevada Privacy of Information Collected on the Internet from Consumers Act (NPICICA), focuses on regulating how websites and online service providers collect and handle personal information of Nevada residents. Enacted in 2017, this law requires operators of commercial websites and online services to post a clear and conspicuous privacy notice. This notice must inform consumers about what personal information is being collected, how it will be used, and whether it will be sold or shared with third parties. Operators are also required to provide a designated request address for consumers to exercise their rights under the law, such as opting out of the sale of their information.

In summary, the Nevada privacy law gives consumers the right to opt-out of the sale of their personal information to third parties, which is a significant element of privacy protection. Operators must act on these requests and must not discriminate against consumers who choose to exercise their rights under the law.

What are your rights? To opt-out of the sale/share of your information. However, we do not sell personal information.

New Hampshire 

New Hampshire’s data privacy law became effective on January 1, 2025  and is designed to protect your personal information and ensure businesses handle it responsibly. Under this law, companies must safeguard sensitive data such as your name, address, Social Security number, and financial details by implementing reasonable security measures to prevent unauthorized access. If a data breach occurs and your information is exposed, businesses are required to notify you promptly, allowing you to take steps to protect yourself, such as monitoring your accounts or changing passwords. The law also requires businesses to provide transparency about how they collect, use, and share your personal data, typically through clear and accessible privacy policies. In certain cases, you have the right to opt out of having your personal information sold or shared with third parties, and businesses must provide a way for you to exercise this right. The law is enforced by the state, which can penalize companies that fail to comply, ensuring that businesses take their responsibilities seriously. 

What are your rights? To access, delete, correct your data, obtain a copy of your information, to opt-out of the sale/share of your information and targeted advertising.

New Jersey

The New Jersey Data Privacy Act (NJDPA), effective January 15, 2025, provides residents with control over their personal information and imposes requirements on businesses that handle it. The law requires businesses to get consent before processing sensitive data, such as financial or health details, and to provide transparent privacy notices explaining their data practices. By July 15, 2025, businesses must comply with universal opt-out systems. The New Jersey Attorney General enforces the law, and it does not grant a private right of action. 

What are your rights? To access, delete, correct your data, obtain a copy of your information, to opt-out of the sale/share of your information and targeted advertising.

Oregon

The Oregon Consumer Data Privacy Act (OCDPA) is about how companies can use and protect your personal information. It will become effective on July 1st, 2024. The OCDPA is similar to laws in other states and gives people in Oregon more control over their personal data.

The OCDPA applies to businesses that operate in Oregon or offer products or services to people in Oregon. The law requires businesses to be clear about what personal data they collect and why, and to only collect what they really need. Businesses must also protect personal data and reduce the risk of harm to consumers. 

Consumers in Oregon have rights under the OCDPA. They can ask businesses to show them the personal data collected, correct it if it’s wrong, delete it, or get a copy of it. Parents or guardians can also do this for their children. The law also protects sensitive data, like health information or information about a person’s race, and requires businesses to get permission before using it.

The OCDPA does not let businesses sell personal data without permission. Businesses must give consumers an easy way to say no to selling their data. The law also has rules for how businesses can use personal data for targeted advertising, making sure it’s done in a fair and transparent way.

What are your rights? To access, delete, correct your data, obtain a copy of your information, to opt-out of the sale/share of your information and targeted advertising. 

For Oregon consumers, you may submit your privacy requests via email, to the following address legal@boundlessmedia.com. Please include a valid government-issued ID, your full name, and your address. The information provided must match our records in order for us to process your request.

Tennessee

The Tennessee Information Protection Act (TIPA), effective July 1st, 2025, is the state’s comprehensive privacy law granting residents key rights over their personal data. It applies to businesses operating in or targeting Tennessee that meet specific data processing thresholds. The law requires businesses to maintain reasonable security measures, provide transparent privacy notices, conduct data protection assessments for high-risk processing, and have proper contracts with data processors. TIPA is enforced by the state Attorney General with a 60-day cure period and no private right of action. It gives businesses an affirmative defense if they align their privacy programs with the NIST Privacy Framework.

What are your rights? To access, correct, delete, and obtain a copy of your personal data, as well as opt out of targeted advertising, data sales, and profiling.

Texas

Texas passed a new law called the Texas Data Privacy and Security Act (TDPSA) which will become effective on July 1, 2024. This law affects how companies handle people’s personal information in Texas. It’s similar to laws in Virginia and California.

The TDPSA applies to almost any business in Texas or selling to Texans that handles personal data. Personal data now includes not just obvious information like names and addresses but also online usernames or other data that could identify a person.

Small businesses are mostly exempt, unless they sell sensitive data like health information, in which case they need permission first. Companies must be transparent about how they use personal data and must protect it from being misused. They must also limit the amount of data they collect to what’s really needed for their purposes.

Texans now have more control over their data. They can ask companies to show them what data is being collected, correct any mistakes, or even delete their data. They can also choose not to have their data used for targeted advertising or be sold to other companies.

The law also has rules for companies that process this data, making sure they follow the same guidelines as the companies collecting it. 

What are your rights? To access, delete, correct your data, obtain a copy of your information, to opt-out of the sale/share of your information and targeted advertising. 

Utah

The Utah Consumer Privacy Act (UCPA), effective from Dec. 31, 2023, marks Utah as the fourth state with comprehensive consumer privacy legislation. It resembles laws from Virginia, Colorado, and California but takes a more business-friendly approach. Its scope covers entities meeting specific revenue thresholds and processing data of a certain number of consumers. The Act provides fewer rights compared to other state laws, focusing on access, deletion, data portability, and opting out of specific processing. It excludes certain data types and grants exemptions to various entities, offering narrow enforcement and no private right of action. 

What are your rights? To access, delete, correct your data, obtain a copy of your information, to opt-out of the sale/share of your information and targeted advertising. 

Vermont

In the absence of a specific statewide privacy law, Vermont residents have to refer to the Health Insurance Portability and Accountability Act (HIPAA) for healthcare-related privacy and the Children’s Online Privacy Protection Act (COPPA) for the online privacy of children under 13. Also, Vermont has data breach notification laws that ask companies to notify individuals and the Vermont Attorney General’s office in the event of a data breach.

What are your rights? To opt-out of the sale/share of your information. However, we do not sell personal information.

Virginia

On January 1, 2023, the Virginia Consumer Data Protection Act (VCDPA) came into full effect in Virginia. Its main aim is to enhance consumer protection in the digital space. This act introduces broader privacy rights, defines personal information comprehensively, establishes protection for sensitive data, and sets data protection standards for those handling data. The VCDPA applies to businesses operating in Virginia or targeting its residents and handling personal data of a certain volume or deriving a significant portion of revenue from such data. However, certain entities like those under HIPAA, not-for-profits, and financial institutions are exempt. The act requires businesses falling under its scope to conduct and document data protection assessments, enforced by the Virginia Attorney General’s office with fines for violations reaching up to $7,500 each.

What are your rights? To access, delete, correct your data, obtain a copy of your information, to opt-out of the sale/share of your information and targeted advertising.

If you want to submit a request for privacy rights, please send it to the following email address:  

Attn: Legal Department
legal@boundlessmedia.com

or make an online request here << INSERT HYPERLINK TO PRIVACY RIGHTS REQUESTS SITE >>