Cookie Policy

The above cookie policy and opt-out language provided are generally compliant with the privacy laws in California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and Utah (UCPA). Here’s how we align with these laws:

1. Opt-Out of Sale/Sharing of Personal Information

• CCPA/CPRA (California): Requires businesses to allow consumers to opt-out of the “sale” or “sharing” of personal information. CPRA expands this to include sharing for cross-context behavioral advertising. The opt-out language addresses this by explaining the “sale” and providing an easy method for users to opt-out.
• VCDPA (Virginia), CPA (Colorado), CTDPA (Connecticut): These laws also require businesses to offer consumers the right to opt-out of targeted advertising, the sale of personal data, and, in some cases, profiling. The language meets this requirement by allowing users to opt-out of cookie-based tracking and other personal information uses.
• UCPA (Utah): Requires an opt-out for sales, though Utah law specifically defines “sale” as an exchange of personal data for monetary consideration. The provided language mentions that cookies may be considered a sale under certain laws, thus providing a compliant option for Utah as well.

2. Transparency and Consent

• CCPA/CPRA: Requires clear and conspicuous notice about what personal information is collected, how it is used, and for what purposes (including third-party sharing). The language used in both the cookie policy and opt-out sections provides this transparency.
• VCDPA, CPA, CTDPA, UCPA: Similarly require businesses to disclose the types of personal data collected and the purposes for processing, as well as to obtain consent for processing sensitive data. The language provides a clear breakdown of the types of cookies, how they are used, and user rights, which aligns with these requirements.

3. Data Subject Rights

• Right to Know, Access, Delete: All of these laws require that consumers be able to request access to the data that a business holds about them, request its deletion, and in some cases, correct inaccuracies. The cookie policy includes a section on user rights, referencing the ability to request access, deletion, and more, which complies with these provisions.
• Right to Opt-Out of Targeted Advertising: The provided opt-out language explicitly mentions opting out of targeted ads via cookie settings, fulfilling this requirement under all the relevant laws.

4. Cookie Consent and Management

• CCPA/CPRA: The language allows users to manage cookies via the “Cookie Settings” button, which aligns with California’s requirement for clear cookie management options.
• VCDPA, CPA, CTDPA, UCPA: While these states don’t have explicit cookie consent requirements like the EU’s GDPR, providing a method to manage cookies ensures compliance with transparency and opt-out rights for targeted advertising and data sales.

Additional State-Specific Considerations

• CPRA (California): The CPRA adds the requirement to disclose data retention periods and adds rights for consumers regarding the correction of personal information. Including a data retention disclosure could further improve compliance, though it’s not strictly necessary for cookie policies.
• VCDPA, CPA, CTDPA, UCPA: These states have stronger protections for sensitive data, such as biometric or geolocation information, and typically require opt-in consent to process this data. While the cookie policy doesn’t deal with sensitive data, you might need to include language for opt-in consent if such data is collected in other contexts.