US Privacy

We have already helped more than 25,000 websites to comply with GDPR, TTDSG & ePrivacy

Our clients include some of the biggest websites and best known brands in the world.

… and many more.

NEED FOR US PRIVACY COMPLIANCE

… but I’m not processing any data at all!?

One response we hear a lot from US customers is that they don’t actually process any data and therefore data protection laws don’t apply to them.

• It is important to note here that website and app operators are responsible for the data that is processed on their website or in their app . Therefore, the data protection laws apply in particular to companies if they meet one of the following conditions:

• 1. If data is processed for our own purposes , for example via tracking tools such as Google Analytics, Matomo, Hotjar or similar

• 2. Sharing data with third parties is also a processing step. Data is shared, for example, by integrating a third-party plugin into the website or app. This applies to YouTube videos, Facebook plugins, Google Maps, chat programs or payment providers such as PayPal

• 3. Whenever advertising is integrated into the website or app, data is automatically transmitted to the advertiser . The transmission is understood as a step in data processing.

• While states differ a bit on when consent to data processing must be given, virtually all data protection laws require opt-out. In the case of CCPA/CPRA, this must be implemented explicitly by means of a link that says “Do not sell or share my personal information”.

The new standard AB GPP

Make websites secure with new standards: IAB GPP

In order to transparently signal the opt-in or opt-out within the website or app to all integrated tools, plugins and advertising providers, the so-called IAB GPP standard was developed by the IAB.

• GPP stands for Global Privacy Platform and defines various methods and interfaces such as a CMP (Consent Management Provider, also known as “Cookie Banner” or “Privacy Notice”) that record and communicate consent/opt-in or rejection/opt-out can. The standard is largely based on the IAB TCF standard, which has been used successfully in Europe for years and has become a must for publishers and advertisers.

• The consentmanager team was significantly involved in the development of the GPP standard, so it is not surprising that consentmanager is the first provider to offer the productive use of IAB GPP.
  You can also find more about GPP in our blog .

• Important: Most data protection laws also require that website operators and app operators can respond to “browser signals”. One of these signals is the GPC or “Global Privacy Control” required in California. With consentmanager, websites and apps don’t have to worry about happiness: The consentmanager solution automatically reacts to browser signals and implements the opt-out automatically.

• Use GPP and GPC now

Why become compliant for US privacy laws now?

Only pay for what you use

Our flexible pricing model

The consentmanager CMP is inexpensive and available with a flexible model: You only pay for what you use!

These are the important US privacy norms

What data protection laws are there in the US?

Companies that are based in the United States, do business or provide services there, or otherwise deal with US citizens are likely to be subject to one of a variety of privacy laws.

• Unlike in many other countries, data protection laws in the USA are regulated at the state level – until there is a national data protection law. Companies should therefore check whether or which federal laws apply to them. Specifically, these could be:

• CCPA / CPRA – California

  CCPA stands for California Consumer Privacy Act and was enacted in 2019. It applies especially in California or in relation to California residents. The “update” to CCPA is CPRA or California Privacy Rights Act. Under the CPRA, some regulations are specified and tightened.

• VCDPA—Virginia
  

  VCDPA stands for Virginia Consumer Data Protection Act and refers to companies doing business in the state of Virginia or serving residents of that state. VCDPA will be “effective” from January 1st, 2023 – ie it has to be implemented by companies since that date at the latest.

• CPA—Colorado

  CPA or Colorado Privacy Act is the privacy law of the state of Colorado. Like Virginia’s VCDPA, this law is effective as of January 1, 2023 and must be implemented by companies located in Colorado or processing data from residents of the state.

• UCPA-Utah
  

  The data protection law for the state of Utah in the western United States is called the UCPA or Utah Consumer Privacy Act. Unlike the two aforementioned laws, UCPA will not come into effect until December 31, 2023. This law also affects all companies that process a certain amount of data (here 100,000 per year) from the citizens of the state.

• CAPDP—Connecticut
  

  CAPDP (partly CTPDP) stands for Connecticut Act Concerning Personal Data Privacy is the federal data protection law in the state of Connecticut. The law will go into effect on July 1, 2023 and will affect companies located in, doing business in, or processing information about citizens of the state of Connecticut.

• U.S. National Privacy
  

  In addition to the aforementioned laws, various other states have their own laws in the works – some of which are expected as early as 2023. In addition, there are different approaches to country-level privacy regulations that apply across the United States.