Cookies, Online Tracking and Direct Marketing
Jump to
Cookies, Online Tracking and Direct Marketing Start Comparison
Are there specific requirements for the use of cookies and other online tracking technologies?

Last review date: 31 December 2024

Yes. Under California privacy laws, a number of companies have been sued based on unfair competition and misrepresentation theories for failure to provide adequate disclosures regarding cookies in privacy policies, attempts to disable consumer attempts to block or delete certain types of cookies and placement of certain particularly intrusive tracking technologies without consent. Under CalOPPA, operators of websites and online services must disclose in privacy policies how they respond to "Do Not Track" signals and similar privacy protection measures selected by consumers and if and to what extent third parties collect personal data regarding consumers on websites or via online services. In addition, under the CCPA, CPA, the VCDPA, and other state privacy laws, the use of cookies and related data sharing for advertising purposes may be subject to opt-out rights depending on the circumstances. Private individuals have used CIPA and VPPA to bring claims against companies for unlawfully intercepting or disclosing personal information collected through cookies, web tracking technologies, or other online monitoring tools.

Are there specific requirements related to the use of personal data for direct marketing activities?

Last review date: 31 December 2024

Yes. At the federal level, the CAN SPAM Act, 15 U.S. Code § 7701 et seq., regulates commercial email marketing activities, and telemarketing practices are subject to regulation under the Telemarketing Sales Rule (TSR), 16 CFR PART 310, as well as the Telephone Consumer Protection Act (TCPA), 47 U.S. Code § 227 et seq. and its implementing rules. More broadly, given the current sector-, activity- and data type-specific framework of US privacy laws, the specific requirements vary based on industry marketing regulations and state-specific marketing laws.

☒   email marketing

   opt-out or implied consent

☒   telephone marketing

   prior opt-in consent. Tele-marketers using robocalls or auto-dialers must obtain prior express consent before using such methods in their marketing.

   opt-out or implied consent. The TCPA also requires that opt-out options be provided to persons who receive certain exempted telemarketing calls.

☒   SMS/text message marketing

   prior opt-in consent

   online behavioral advertising targeting/social media targeting/ad personalization marketing

☒   opt-out or implied consent