diff --git a/Sections/Section Information.md b/Sections/Section Information.md index 1f22546..267655a 100644 --- a/Sections/Section Information.md +++ b/Sections/Section Information.md @@ -58,32 +58,32 @@ Each section represents a unique privacy signal, usually a unique jurisdiction. 7 usnat - US - national section + US - national section 8 usca - US - California section + US - California section 9 usva - US - Virginia section + US - Virginia section 10 usco - US - Colorado section + US - Colorado section 11 usut - US - Utah section + US - Utah section 12 usct - US - Connecticut section + US - Connecticut section diff --git "a/Sections/US-National/IAB Privacy\342\200\231s National Privacy Technical Specification.md" "b/Sections/US-National/IAB Privacy\342\200\231s National Privacy Technical Specification.md" index 843f3de..b8d2ffd 100644 --- "a/Sections/US-National/IAB Privacy\342\200\231s National Privacy Technical Specification.md" +++ "b/Sections/US-National/IAB Privacy\342\200\231s National Privacy Technical Specification.md" @@ -24,7 +24,11 @@

US National Privacy Section

-

The US National Privacy Section is a string that consists of the components described below. Users should employ the US National Privacy Section only if they will adhere to the National Approach for their processing of a consumer’s personal data.

+

The US National Privacy Section is a string that consists of the components described below. The US National Privacy Section is intended to be used for MSPA Covered Transactions. The requirements for using the US National Privacy Section for MSPA Covered Transactions are defined by the MSPA “US National Approach” as a way to comply with the highest common denominator of all different state privacy law requirements in circumstances where the First Party setting the values for the string: (1) does not know the state residency of the Consumer; or (2) otherwise does not wish to use the Consumer’s specific state residency to differentiate how they will treat the Consumer for purposes of compliance with applicable state privacy laws. Requirements for using the components of the US National Privacy Section relating to sensitive data and childrens’ data are not currently defined by the MSPA, but may be defined by a future amendment or addendum to the MSPA.

+ +

Notwithstanding that the US National Privacy Section is intended to be used in conjunction with the MSPA, those who use it for non-MSPA Covered Transactions are representing to recipients of the string whether they have complied with the specific state law requirements referenced in the description of each string component.

+ +

The US National Privacy Section does not reflect any requirements of US federal law (for example, it does not reflect any COPPA consent requirements) and instead is intended only for use as a tool for compliance with applicable US state privacy law requirements.

Summary

@@ -254,12 +258,17 @@ -
KnownChildSensitiveDataConsents N-Bitfield(2,2)Two bits for each Data Activity:0 Not Applicable. The Business does not have actual knowledge that it Processes Personal Data or Sensitive Data of a Consumer who is a known child.

1 No Consent

2 Consent 

(1) Consent to Process the Consumer’s Personal Data or Sensitive Data for Consumers from Age 13 to 16.

References: -

    -
  • Cal. Civ. Code Cal. Civ. Code 1798.120(c)
    • -
  • Conn. PA 22-15, Sec. 6(a)(4)
    • -
-(2) Consent to Process the Consumer’s Personal Data or Sensitive Data for Consumers Younger Than 13 Years of Age.

References: +

Two bits for each Data Activity: +

0 Not Applicable. The Business does not have actual knowledge that it Processes Personal Data or Sensitive Data of a Consumer who is under 17 years old.

1 No Consent

2 Consent  +

Data Activities:

+

(1) Consumer Consent to Process the Consumer’s Personal Data or Sensitive Data for selling, sharing, or targeted advertising for a Consumer between the age of 13 and 16. +

References: +

    +
  • Cal. Civ. Code Cal. Civ. Code 1798.120(c)
    • +
  • Conn. PA 22-15, Sec. 6(a)(4)
    • +
+

(2) Verifiable consent obtained from the Consumer’s parent or lawful guardian to Process the Personal Data or Sensitive Data of a Consumer Younger Than 13 Years of Age. +

References:

  • Cal. Civ. Code Cal. Civ. Code 1798.120(c)
  • Virginia Code 59.1-578(A)(5)
    • diff --git "a/Sections/US-States/CA/GPP Extension: IAB Privacy\342\200\231s California Privacy Technical Specification.md" "b/Sections/US-States/CA/GPP Extension: IAB Privacy\342\200\231s California Privacy Technical Specification.md" index 9a6c407..ffa0114 100644 --- "a/Sections/US-States/CA/GPP Extension: IAB Privacy\342\200\231s California Privacy Technical Specification.md" +++ "b/Sections/US-States/CA/GPP Extension: IAB Privacy\342\200\231s California Privacy Technical Specification.md" @@ -24,7 +24,7 @@

    California Privacy Section

    -

    The California Privacy Section consists of the components described below. Users should employ the California Privacy String only if they have determined the CPRA applies to their processing of a consumer's personal information.

    +

    The California Privacy Section consists of the components described below. Users of the spec should employ the California Privacy String only if they have determined the CPRA applies to their processing of a consumer's personal information.

    Summary

    @@ -98,7 +98,7 @@ - + diff --git "a/Sections/US-States/CO/GPP Extension: IAB Privacy\342\200\231s Colorado Privacy Technical Specification.md" "b/Sections/US-States/CO/GPP Extension: IAB Privacy\342\200\231s Colorado Privacy Technical Specification.md" index 4515914..feeeb07 100644 --- "a/Sections/US-States/CO/GPP Extension: IAB Privacy\342\200\231s Colorado Privacy Technical Specification.md" +++ "b/Sections/US-States/CO/GPP Extension: IAB Privacy\342\200\231s Colorado Privacy Technical Specification.md" @@ -22,7 +22,7 @@

    Colorado Privacy Section

    -

    The Colorado Privacy Section consists of the components described below. Users should employ the Colorado Privacy Section only if they have determined the CPA applies to their processing of a consumer's personal data.

    +

    The Colorado Privacy Section consists of the components described below. Users of the spec should employ the Colorado Privacy Section only if they have determined the CPA applies to their processing of a consumer's personal data.

    Summary

    KnownChildSensitiveDataConsents N-Bitfield(2,2)Two bits for each Data Activity:

    0 Not Applicable. The Business does not have actual knowledge that it Processes Personal Information of Consumers Less Than 16 years of Age.

    1 No Consent

    2 Consent

    Data Activities:

    (1) Consent to Sell the Personal Information of Consumers Less Than 16 years of Age

    (2) Consent to Share the Personal Information of Consumers Less Than 16 years of Age

    		Two bits for each Data Activity:

    0 Not Applicable. The Business does not have actual knowledge that this transaction involves Processing the Personal Information of a Consumer who is Less Than 16 years of Age.

    1 No Consent

    2 Consent

    Data Activities:

    (1) Consent to Sell the Personal Information of Consumers Less Than 16 years of Age. For a Consumer the Business has actual knowledge is under 13 years of age, this must be consent given by the Consumer’s parent or guardian. For a Consumer the Business has actual knowledge is between the ages of 13 and 16, this must be Consumer consent.

    (2) Consent to Share the Personal Information of Consumers Less Than 16 years of Age. For a Consumer the Business has actual knowledge is under 13 years of age, this must be consent given by the Consumer’s parent of guardian. For a Consumer the Business has actual knowledge is between the ages of 13 and 16, this must be Consumer consent.
    PersonalDataConsents
    @@ -95,7 +95,7 @@ - + diff --git "a/Sections/US-States/CT/GPP Extension: IAB Privacy\342\200\231s Connecticut Privacy Technical Specification.md" "b/Sections/US-States/CT/GPP Extension: IAB Privacy\342\200\231s Connecticut Privacy Technical Specification.md" index c9dcd90..5451c72 100644 --- "a/Sections/US-States/CT/GPP Extension: IAB Privacy\342\200\231s Connecticut Privacy Technical Specification.md" +++ "b/Sections/US-States/CT/GPP Extension: IAB Privacy\342\200\231s Connecticut Privacy Technical Specification.md" @@ -22,7 +22,7 @@

    Connecticut Privacy Section

    -

    The Connecticut Privacy Section consists of the components described below. Users should employ the Connecticut Privacy Section only if they have determined the CAPDP applies to their processing of a consumer's personal data.

    +

    The Connecticut Privacy Section consists of the components described below. Users of the spec should employ the Connecticut Privacy Section only if they have determined the CAPDP applies to their processing of a consumer's personal data.

    Summary

    KnownChildSensitiveDataConsents Int(2)Consent to Process Sensitive Data from a Known Child.

    0 Not Applicable. The Controller does not Process Sensitive Data of a known Child.

    1 No Consent

    2 Consent

    		Consent to Process Sensitive Data from a Known Child given by the Consumer’s parent or lawful guardian.

    0 Not Applicable. The Controller does not Process Sensitive Data of a Known Child.

    1 No Consent

    2 Consent
    MspaCoveredTransaction
    @@ -95,7 +95,7 @@ - + diff --git "a/Sections/US-States/UT/GPP Extension: IAB Privacy\342\200\231s Utah Privacy Technical Specification.md" "b/Sections/US-States/UT/GPP Extension: IAB Privacy\342\200\231s Utah Privacy Technical Specification.md" index 50c0f37..050dd97 100644 --- "a/Sections/US-States/UT/GPP Extension: IAB Privacy\342\200\231s Utah Privacy Technical Specification.md" +++ "b/Sections/US-States/UT/GPP Extension: IAB Privacy\342\200\231s Utah Privacy Technical Specification.md" @@ -23,7 +23,7 @@

    Utah Privacy Section

    -

    The Utah Privacy Section consists of the components described below. Users should employ the Utah Privacy Section only if they have determined the UCPA applies to their processing of a consumer's personal data.

    +

    The Utah Privacy Section consists of the components described below. Users of the spec should employ the Utah Privacy Section only if they have determined the UCPA applies to their processing of a consumer's personal data.

    Summary

    KnownChildSensitiveDataConsents N-Bitfield(2,3)Two bits for each Data Activity:

    0 Not Applicable. The Controller does not Process Sensitive Data of a known Child.

    1 No Consent

    2 Consent

    (1) Consent to Process Sensitive Data from a Known Child.

    (2) Consent to Sell the Personal Data of Consumers At Least 13 Years of Age but Younger Than 16 Years of Age.

    (3) Consent to Process the Personal Data of Consumers At Least 13 Years of Age but Younger Than 16 Years of Age for Purposes of Targeted Advertising.

    		Two bits for each Data Activity:

    0 Not Applicable. The Controller does not Process Sensitive Data of a Consumer the Business has actual knowledge is less than 16 years old.

    1 No Consent

    2 Consent

    (1) Verifiable parental consent to Process Sensitive Data from a Consumer the Business has actual knowledge is less than 13 years old.

    (2) Consumer Consent to Sell the Consumer’s Personal Data for a Consumer at Least 13 Years of Age but Younger Than 16 Years of Age.

    (3) Consumer Consent to Process the Consumer’s Personal Data for Purposes of Targeted Advertising for a Consumer At Least 13 Years of Age but Younger Than 16 Years of Age.
    MspaCoveredTransaction
    @@ -101,7 +101,7 @@ - +
    KnownChildSensitiveDataConsents Int(2)Consent to Process Sensitive Data from a Known Child

    0 Not Applicable. The Controller does not Process Sensitive Data of a known Child.

    1 No Consent

    2 Consent

    		Verifiable parental Consent to Process Sensitive Data of a Consumer the Business has actual knowledge is under 13 years old.

    0 Not Applicable. The Controller does not have actual knowledge that it Process Sensitive Data of a Consumer it has actual knowledge is under 13 years old.

    1 No Consent

    2 Consent
    MspaCoveredTransaction