--- title: "United States — AdTech & Commercial Privacy | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/united-states/adtech-and-commercial-privacy/ source_html: /jurisdictions/united-states/adtech-and-commercial-privacy/index.html description: "United States — AdTech & Commercial Privacy: adtech_and_commercial_privacy AdTech & Commercial Privacy 6 sub-modules 6 claims Amber ▾ # Obligations are substantively developed at state level with active, escalating enforcemen" generated_at: 2026-10-25T04:46:50Z content_sha256: 5b79a195d8899197cd2bdee15ad41d590103af577bd2ba3c52e2a41e1008a968 generator: "fe-fleet/md-twin@1.0" --- # United States — AdTech & Commercial Privacy | Data Protection Monitor ### D7AdTech & Commercial Privacy6 sub-modules6 claimsAmber▾# Obligations are substantively developed at state level with active, escalating enforcement, but remain absent as a matter of general federal law. Primary framework CCPA regulations (Cal. Code Regs. tit. 11); FTC Act Section 5 (unfair/deceptive data-broker practices) Supervisory authority [California Privacy Protection Agency (CalPrivacy)](https://cppa.ca.gov) Traffic-light rationale — Amber Obligations are substantively developed at state level with active, escalating enforcement, but remain absent as a matter of general federal law. #### Sub-modules (6) #### Cookies And TrackersAmber CCPA enforcement (Tractor Supply, Todd Snyder) has repeatedly cited continuous monitoring failures over cookies, tags, and trackers as a compliance deficiency. Claims (1): - CalPrivacy's $1.35 million fine against Tractor Supply cited failures including routing Do-Not-Sell requests to a webform that did not block tracking and ignoring Global Privacy Control signals. #### Dark PatternsAmber California's 2026 CCPA regulations expressly prohibit consent interfaces using double negatives, misleading statements, false urgency (e.g., countdown clocks), or asymmetrical choice paths. Claims (1): - California's 2026 CCPA regulations prohibit consent interfaces that use double negatives, misleading statements, affirmative misstatements, or deceptive language, and specifically flag false-urgency countdown clocks as prohibited dark patterns. #### Opt Out SignalsAmber The California AG's largest-ever CCPA settlement (Disney, $2.75M) centered on failure to honor Global Privacy Control signals across devices and services. Claims (1): - California's Attorney General secured a $2.75 million CCPA settlement with Disney over failures to honor consumer opt-out requests consistently across devices, webforms, and Global Privacy Control signals. #### Clean Rooms And DcrAmber The FTC has flagged Data Clean Rooms as a technology whose branding can obscure actual data-sharing risk, signaling regulatory attention to this commercial-data-collaboration model. Claims (1): - The FTC has publicly noted that Data Clean Rooms are not literal 'clean' rooms and do not inherently eliminate data-sharing privacy risk, signaling scrutiny of the model. #### Cross Context AdvertisingAmber GM's $12.75M CCPA settlement over OnStar geolocation/driving-behavior sales to data brokers (Verisk, LexisNexis) without consent illustrates enforcement of purpose-limitation/data-minimization rules against cross-context data monetization. Claims (1): - General Motors agreed to pay $12.75 million to resolve allegations it unlawfully sold driving and location data collected via OnStar to data brokers Verisk Analytics and LexisNexis Risk Solutions without consumer consent, in violation of CCPA purpose-limitation and data-minimization provisions. #### Direct MarketingAmber The FTC's Kochava enforcement action addressed the sale of sensitive location data without consumers' affirmative express consent for tracking/marketing-adjacent purposes. Claims (1): - The FTC will prohibit data broker Kochava and its subsidiary from selling, sharing, or disclosing sensitive location data without consumers' affirmative express consent, settling allegations it sold location data from hundreds of millions of mobile devices. Category narrative 63 words Cookie/tracker, dark-pattern, and opt-out-signal obligations are driven almost entirely by state comprehensive privacy law (principally CCPA) rather than a federal ePrivacy analogue. California's 2026 regulations codify Global Privacy Control-style opt-out-signal recognition and anti-dark-pattern design rules, and enforcement (Disney, Tractor Supply, Honda, Todd Snyder, GM/OnStar) has focused heavily on failures to honor opt-out signals and on location-data monetization by data brokers such as Kochava. no periodic updates on record for this sub-brief Evidence 6 Sources and claims (6) - Probable[IAPP](https://iapp.org/news/a/retail-under-review-californias-new-era-of-privacy-enforcement) — CalPrivacy's $1.35 million fine against Tractor Supply cited failures including routing Do-Not-Sell requests to a webform that did not block tracking and ignoring Global Privacy Control signals.observed 2026-07-29 - Probable[CPPA](https://cppa.ca.gov/regulations/pdf/ccpa_statute_eff_20260101.pdf) — California's 2026 CCPA regulations prohibit consent interfaces that use double negatives, misleading statements, affirmative misstatements, or deceptive language, and specifically flag false-urgency countdown clocks as prohibited dark patterns.observed 2026-07-29 - Probable[IAPP](https://iapp.org/news/a/california-s-attorney-general-issues-largest-ccpa-fine-to-date) — California's Attorney General secured a $2.75 million CCPA settlement with Disney over failures to honor consumer opt-out requests consistently across devices, webforms, and Global Privacy Control signals.observed 2026-07-29 - Probable[FTC](https://www.ftc.gov/data-security) — The FTC has publicly noted that Data Clean Rooms are not literal 'clean' rooms and do not inherently eliminate data-sharing privacy risk, signaling scrutiny of the model.observed 2026-07-29 - Probable[IAPP](https://iapp.org/news/a/california-authorities-announce-largest-ccpa-fine-to-date) — General Motors agreed to pay $12.75 million to resolve allegations it unlawfully sold driving and location data collected via OnStar to data brokers Verisk Analytics and LexisNexis Risk Solutions without consumer consent, in violation of CCPA purpose-limitation and data-minimization provisions.observed 2026-07-29 - Probable[FTC](https://www.ftc.gov/news-events/news/press-releases/2026/05/ftc-ban-kochava-subsidiary-selling-sensitive-location-data-settle-charges-they-sold-location-data) — The FTC will prohibit data broker Kochava and its subsidiary from selling, sharing, or disclosing sensitive location data without consumers' affirmative express consent, settling allegations it sold location data from hundreds of millions of mobile devices.observed 2026-07-29