California
Calif. Bus. & Prof. Code § 22575
Requires the operator of a commercial web site or online service to disclose in its privacy policy how it responds to a web browser ‘Do Not Track’ signal or similar mechanisms providing consumers with the ability to exercise choice about online tracking of their personal information across sites or services and over time. It also requires the operator to disclose whether third parties are or may be conducting such tracking on the operator’s site or service.
Calif. Bus. & Prof. Code § 22575-22578 (CalOPPA)
California’s Online Privacy Protection Act requires an operator, defined as a person or entity that collects personally identifiable information from California residents through an Internet Web site or online service for commercial purposes, to post a conspicuous privacy policy on its Web site or online service (
which may include mobile apps
) and to comply with that policy. The law, among other things, requires that the privacy policy identify the categories of personally identifiable information that the operator collects about individual consumers who use or visit its Web site or online service and third parties with whom the operator may share the information.
California Ed. Code § 99122
Requires private nonprofit or for-profit postsecondary educational institutions to post a social media privacy policy on the institution’s Internet Web site.
Connecticut
Conn. Gen. Stat. §
42-471
Requires any person who collects Social Security numbers in the course of business to create a privacy protection policy. The policy must be ”publicly displayed” by posting on a web page and the policy must (1) protect the confidentiality of Social Security numbers, (2) prohibit unlawful disclosure of Social Security numbers, and (3) limit access to Social Security numbers.
Delaware
Del. Code Tit. 6 § 205C
Requires an operator of a commercial internet website, online or cloud computing service, online application, or mobile application that collects personally identifiable information through the Internet about individual users residing in Delaware who use or visit the operator’s commercial internet website, online or cloud computing service, online application, or mobile application to make its privacy policy conspicuously available on its internet website, online or cloud computing service, online application, or mobile application. An operator shall be in violation of this subsection only if the operator fails to make its privacy policy conspicuously available within 30 days after being notified of noncompliance. Specifies requirements for the policy.
Nevada
Nevada in 2017 enacted
S.B. 538
, which requires operators of Internet websites or online services that collect personally identifiable information from residents of the state to notify consumers about how that information is used.