Data Protection Monitor
Global Privacy & Data Protection Intelligence

United States (US) · Module Detail

United States: AdTech & Commercial Privacy

← Full United States overview Build report with United States Request deeper dive

#

Obligations are substantively developed at state level with active, escalating enforcement, but remain absent as a matter of general federal law.

Primary frameworkCCPA regulations (Cal. Code Regs. tit. 11); FTC Act Section 5 (unfair/deceptive data-broker practices)
Supervisory authorityCalifornia Privacy Protection Agency (CalPrivacy)
Traffic-light rationale — AmberObligations are substantively developed at state level with active, escalating enforcement, but remain absent as a matter of general federal law.

Sub-modules (6)

Cookies And TrackersAmber

CCPA enforcement (Tractor Supply, Todd Snyder) has repeatedly cited continuous monitoring failures over cookies, tags, and trackers as a compliance deficiency.

Claims (1):

  • CalPrivacy's $1.35 million fine against Tractor Supply cited failures including routing Do-Not-Sell requests to a webform that did not block tracking and ignoring Global Privacy Control signals.

Dark PatternsAmber

California's 2026 CCPA regulations expressly prohibit consent interfaces using double negatives, misleading statements, false urgency (e.g., countdown clocks), or asymmetrical choice paths.

Claims (1):

  • California's 2026 CCPA regulations prohibit consent interfaces that use double negatives, misleading statements, affirmative misstatements, or deceptive language, and specifically flag false-urgency countdown clocks as prohibited dark patterns.

Opt Out SignalsAmber

The California AG's largest-ever CCPA settlement (Disney, $2.75M) centered on failure to honor Global Privacy Control signals across devices and services.

Claims (1):

  • California's Attorney General secured a $2.75 million CCPA settlement with Disney over failures to honor consumer opt-out requests consistently across devices, webforms, and Global Privacy Control signals.

Clean Rooms And DcrAmber

The FTC has flagged Data Clean Rooms as a technology whose branding can obscure actual data-sharing risk, signaling regulatory attention to this commercial-data-collaboration model.

Claims (1):

  • The FTC has publicly noted that Data Clean Rooms are not literal 'clean' rooms and do not inherently eliminate data-sharing privacy risk, signaling scrutiny of the model.

Cross Context AdvertisingAmber

GM's $12.75M CCPA settlement over OnStar geolocation/driving-behavior sales to data brokers (Verisk, LexisNexis) without consent illustrates enforcement of purpose-limitation/data-minimization rules against cross-context data monetization.

Claims (1):

  • General Motors agreed to pay $12.75 million to resolve allegations it unlawfully sold driving and location data collected via OnStar to data brokers Verisk Analytics and LexisNexis Risk Solutions without consumer consent, in violation of CCPA purpose-limitation and data-minimization provisions.

Direct MarketingAmber

The FTC's Kochava enforcement action addressed the sale of sensitive location data without consumers' affirmative express consent for tracking/marketing-adjacent purposes.

Claims (1):

  • The FTC will prohibit data broker Kochava and its subsidiary from selling, sharing, or disclosing sensitive location data without consumers' affirmative express consent, settling allegations it sold location data from hundreds of millions of mobile devices.
Category narrative63 words

Cookie/tracker, dark-pattern, and opt-out-signal obligations are driven almost entirely by state comprehensive privacy law (principally CCPA) rather than a federal ePrivacy analogue. California's 2026 regulations codify Global Privacy Control-style opt-out-signal recognition and anti-dark-pattern design rules, and enforcement (Disney, Tractor Supply, Honda, Todd Snyder, GM/OnStar) has focused heavily on failures to honor opt-out signals and on location-data monetization by data brokers such as Kochava.

no periodic updates on record for this sub-brief

Sources and claims (6)
  1. ProbableIAPP — CalPrivacy's $1.35 million fine against Tractor Supply cited failures including routing Do-Not-Sell requests to a webform that did not block tracking and ignoring Global Privacy Control signals.observed
  2. ProbableCPPA — California's 2026 CCPA regulations prohibit consent interfaces that use double negatives, misleading statements, affirmative misstatements, or deceptive language, and specifically flag false-urgency countdown clocks as prohibited dark patterns.observed
  3. ProbableIAPP — California's Attorney General secured a $2.75 million CCPA settlement with Disney over failures to honor consumer opt-out requests consistently across devices, webforms, and Global Privacy Control signals.observed
  4. ProbableFTC — The FTC has publicly noted that Data Clean Rooms are not literal 'clean' rooms and do not inherently eliminate data-sharing privacy risk, signaling scrutiny of the model.observed
  5. ProbableIAPP — General Motors agreed to pay $12.75 million to resolve allegations it unlawfully sold driving and location data collected via OnStar to data brokers Verisk Analytics and LexisNexis Risk Solutions without consumer consent, in violation of CCPA purpose-limitation and data-minimization provisions.observed
  6. ProbableFTC — The FTC will prohibit data broker Kochava and its subsidiary from selling, sharing, or disclosing sensitive location data without consumers' affirmative express consent, settling allegations it sold location data from hundreds of millions of mobile devices.observed