Recherche avancée

Sur d’autres sites (8814)

• Consent management platforms : Keys to compliance and user trust

  14 juin, par Joe

  Today’s marketing managers and data analysts face a tricky balancing act : gaining meaningful customer insights while respecting user privacy. Finding ways to navigate the maze of complex privacy regulations while managing consent at scale can be daunting. 

  Consent management platforms (CMPs) offer a solution. They allow companies to collect data ethically, manage user consent efficiently, and comply with privacy regulations like Europe’s General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

  This guide explains everything you need to know about CMPs : how they function, why they’re essential for data governance, and how they work hand-in-hand with analytics platforms to promote transparency and build trust with users.

  What is a consent management platform (CMP) and what is it for ?

  A consent management platform (CMP) helps organisations collect, organise, and store user consent for personal data processing purposes. In short, it’s a tool that ensures data collection respects user privacy and complies with regulations like the GDPR and CCPA.

  Without a CMP, businesses could face hefty fines and penalties for violating data privacy laws in different parts of the world. This shows how vital these tools are to all modern businesses.

  How do consent management platforms work ?

  CMPs give users a clear and straightforward way to provide explicit consent for data collection. These platforms manage both the technical aspects of consent storage and the user experience on your site or app.

  Here’s a simplified breakdown :

  • Cookie consent banners : The CMP displays a banner whenever a user visits your website. This banner explains the types of personal information collected and for what purpose.
  • User choice : The user can accept or reject cookies and trackers. They can often customise their preferences to choose which specific data types they’re willing to share.
  • Preference storage : The CMP stores the user’s choices. This information helps ensure that you only collect and process the permitted data.
  • Integration with other systems : CMPs integrate with other systems, such as analytics platforms and advertising networks, to ensure that data collection and processing comply with the user’s choices throughout the customer experience.

  

  A key feature of CMPs is their role in shaping privacy policy design. This design encompasses the layout, visual elements, and cues employed to seek user consent.

  A recent study by Karlstad University in Sweden showed that privacy policy design significantly influences user comprehension and willingness to disclose information. In other words, it affects consent rates considerably and is key to enhancing data collection.

  Importance of consent management for compliance

  As the world becomes increasingly interconnected, consent management is taking centre stage. Although it applies to all technologies and systems that gather or handle personal data, few instances are as relevant as smart homes.

  Smart home devices have unique access to our personal spaces and private lives. They represent a unique challenge to consent management since one person is potentially granting access to personal data from themselves and other people who may be inside or around the house.

  A 2023 study by the University College London and the University of Oxford pointed out that clear design principles and granular, contextual permission structures are essential in these situations.

  However, consent management isn’t just best practice. It’s a widespread legal requirement. Not meeting these requirements can result in hefty penalties and reputational damage to your organisation.

  Consent management under GDPR

  The European Union’s GDPR is a data protection law applicable to organisations that process the personal data of individuals residing in the European Economic Area (EEA). It’s based on the principle of opting in.

  The GDPR is one of the strongest data privacy laws globally. For non-compliance, fines can be up to €20 million or 4% of the company’s total global turnover (whichever is higher).

  It’s also one of the most heavily enforced privacy laws. According to enforcementtracker.com, Meta was fined €1.2 billion in 2023, with GDPR fines reaching over €2 billion that year alone. In the UK, the largest GDPR fine is €22.05 million, according to Statista. It pays to comply.

  The GDPR has specific rules around consent, including that it must be :

  • Freely given : Users must not be pressured or coerced.
  • Specific : Must be given for specific data processing purposes.
  • Informed : Users must be provided with clear and concise information.
  • Unambiguous : Permission must be granted through clear and affirmative action, such as checking a box or tapping a button.

  CMPs help you meet these requirements by providing a transparent and user-friendly way to obtain and manage consent.

  Consent management under CCPA

  The CCPA is another privacy protection law for businesses collecting personal information from California residents. It grants Californians the right to know what data is being collected about them, to prevent it from being sold, and to request its deletion.

  CMPs support CCPA compliance by enabling users to exercise their rights and ensuring transparent data collection practices.

  Managing consent under other regulatory frameworks

  In addition to the GDPR and CCPA, numerous other privacy regulations can impact your organisation. These regulations include :

  • The COPPA in the US
  • Brazil’s LGPD
  • Japan’s APPI
  • Canada’s PIPEDA.
  • Australia’s Privacy Act 1988 

  A CMP will help streamline the process by providing a clear, practical framework to ensure you meet all applicable requirements.

  Key features to look for in a CMP

  Choosing the right CMP is crucial for global business.

  Here are some key features to consider :

  Custom banners

  Consent banners are often among users’ first digital interactions with your brand. It should be clear, concise and visually appealing. Look for a CMP that allows you to :

  • Customise the banner’s design to match your website’s branding and aesthetics.
  • Control the banner’s positioning for optimal visibility.

  End-user management tools

  The CMP should also offer a user-friendly interface allowing visitors to grant, manage and withdraw consent.

  This includes customisable banners, granular permissions, and a preference centre. The latter is a dedicated space where users can manage their preferences anytime.

  Integration capabilities with existing systems

  The CMP should integrate with your existing technology stack, including your analytics platform, marketing automation tools and CRM. This integration ensures a smooth workflow and prevents data silos.

  How to select the right CMP for your organisation

  To find the perfect CMP, focus on your specific needs and priorities. Here’s a step-by-step guide to help you make an informed decision :

  Assessing organisational needs and goals

  Start by clearly defining your organisation’s requirements. Consider the following :

  • Types of data collected : What personal data do you collect (for example, cookies, IP addresses, location data) ?
  • Compliance requirements : Which privacy regulations must you comply with (GDPR, CCPA, COPPA) ?
  • Website or app complexity : How complex is your website or app in terms of user interactions and data collection points ?
  • Budget : How much are you willing to invest in a CMP ?

  Comparing features and pricing

  Once you thoroughly understand your needs, you can compare the features and pricing of various CMPs. Look for key features like :

  • Customisable banners
  • Granular options
  • Preference centre
  • Integration with existing systems
  • Analytics and reporting

  Once you’ve shortlisted a few options, compare the pricing and choose the best value for your budget. Take advantage of free trials before committing to a paid plan.

  Checking verified user reviews

  Read user reviews on platforms like G2 or Trustpilot to get an idea of the strengths and weaknesses of different CMPs. Look for reviews from similar organisations regarding size, industry and compliance requirements.

  Integration with a privacy-focused analytics platform

  A consent management platform acts as the bridge between your users and your analytics and marketing teams. It ensures user preferences are communicated to your analytics setup, so data collection and analysis align with their choices and comply with privacy regulations. 

  Finding a consent manager integration that works with your analytics setup is essential for businesses.

  Top five consent management platforms

  The CMP market is pretty competitive, with many players providing excellent solutions. According to Emergen Research, it was valued at $320.9 million in 2021 and is growing at 21.2%.

  Here are five of our top choices 

  1. usercentrics

  usercentrics is a comprehensive CMP with customisable banners, granular consent options and a preference centre.

  

  usercentrics geolocation rulesets page (Source : Usercentrics)

  This Google-certified CMP allows you to create global and regional consent rules to ensure compliance with local regulations like GDPR, CCPA and LGPD. For a smooth implementation, usercentrics provides access to a knowledgeable support team and a dedicated customer success executive.

  It’s worth noting that Usercentrics is the CMP we use here at Matomo. It helps us in our mission to collect and analyse data ethically and with a privacy-first mindset.

  • Key features : Customisable banners, granular permissions, cross-domain and cross-device capabilities, automatic website scans, reporting and analytics.
  • Pricing : Usercentrics offers a free plan and four paid subscription plans from €7 to €50 per month.

  2. Osano

  Osano is a user-friendly CMP focusing on transparency and ease of use.

  

  Osano’s main dashboard (Source : Osano)

  Osano can scan websites for tracking technologies without impacting the user experience.

  • Key features : Customisable banners, multi-language support, granular consent options, a preference centre and access to a knowledgeable team of compliance specialists.
  • Pricing : Osano offers a self-service free plan and a paid plan at $199 per month.

  3. Cookiebot

  Cookiebot is another popular CMP with numerous integration options, including Matomo and other analytics tools. 

  

  Cookiebot consent banner options (Source : Cookiebot)

  • Key features : A cookie scanner, a privacy trigger or button allowing users to change their consent settings, a consent management API and advanced analytics.
  • Pricing : Cookiebot offers a free plan and paid plans ranging from €7 to €50 per month.

  4. CookieYes

  CookieYes is well-suited for small businesses and websites with basic privacy needs. 

  

  CookieYes cookie banner options (Source : CookieYes)

  It offers various features, including multilingual support, geo-targeting, privacy policy generation, and a preference centre. CookieYes also integrates with analytics and CMS tools, making it easy to implement as part of your stack.

  • Key features : Customisable consent banners, granular consent options, preference centre, integration with Matomo, reporting and analytics.
  • Pricing : You can use CookieYes for free or subscribe to one of their three paid plans, which range from $10 to $55 per month.

  5. Tarte au Citron

  Tarte au Citron is an open-source, lightweight, and customisable CMP developed in France.

  

  (Source : Tarte au Citron)

  Its focus is on transparency and user experience. It provides many features free of charge, but many do require some technical knowledge to deploy. There’s also a paid subscription with ongoing support and faster implementation.

  Tarte au Citron integrates with Matomo, which is also open-source. If you’re building an open-source stack for your analytics, Matomo and Tarte au Citron make an excellent pair.

  • Key features : Open-source, customisable consent banners, integration with Matomo, works with over 220 services.
  • Pricing : You can deploy the open-source core for free, but Tarte au Citron offers three paid licenses starting at €190 for one year and reaching €690 for a lifetime license.

  How to implement cookie consent the right way

  Implementing cookie consent requires precision, time and effort. But doing it wrong can result in significant legal penalties and severe reputational damage, eroding user trust and impacting your brand’s standing. Here are the key dos and don’ts of consent :

  

  Provide clear and concise information

  Use plain language that is easy for anyone to understand. Avoid using technical terms or legal jargon that may confuse users.

  Prioritise transparency

  Be upfront about your data collection practices. Clearly state what data you collect, how you use it and who you share it with. Provide links to your privacy and cookie policies for users who want to learn more.

  Offer granular control

  Give users detailed control over as many of their cookie preferences as possible. Allow them to choose which categories of tracking cookies they consent to, such as strictly necessary, performance and marketing cookies.

  Implement user-friendly banners

  Ensure banners are prominently displayed, easy to understand, and use clear and concise language. Also, make sure they’re accessible to all users, including those with disabilities.

  Respect “do not track” settings

  It’s essential to honour users’ choices when they enable their “do not track” browser setting.

  Document consent

  Maintain a record of user consent. This will help you demonstrate compliance with data privacy regulations and provide evidence of user consent in case of an audit or investigation.

  Regularly review and update consent policies

  Review and update your customer consent policies regularly to ensure they comply with evolving data privacy regulations and reflect your current data collection practices.

  Cookie consent pitfalls to avoid

  Here are some common pitfalls to avoid that may lead to legal penalties, loss of user trust or inaccurate analytics :

  • Avoid lengthy and complicated explanations. Overwhelming users with dense legal jargon or overly technical details can lead to consent fatigue and reduce the likelihood of informed consent.
  • Don’t force users to accept all cookies or none. Blanket consent options violate user autonomy and fail to comply with regulations like the GDPR.
  • Don’t make information about your data collection practices hard to find. Hidden or buried privacy policies breed suspicion and erode trust.
  • Avoid pre-checking all cookie consents. Pre-checked boxes imply consent without explicit user action, which is not compliant with GDPR and similar regulations. Users must actively opt in, not out.

  Emerging consent management trends 

  Consent management is constantly evolving and driven by new technologies, regulations, and user expectations. Here are some emerging trends to watch out for in the short term :

  • Increased automation : AI and machine learning are helping automate consent management processes, making them more efficient and effective.
  • Enhanced user experience : CMPs are becoming more user-friendly, focusing on providing an intuitive experience.
  • Privacy-preserving analytics : CMPs are being integrated with privacy-preserving analytics platforms, such as Matomo, to enable organisations to gain insights into user behaviour without compromising privacy.
  • Google Consent Mode : In 2024, Google rolled out Consent Mode v2 to align with the Digital Markets Act. Due to upcoming privacy regulations, more versions may be coming soon.

  The Privacy Governance Report 2024 also highlights the increasing complexity of managing data privacy, with more than four in five privacy professionals taking on additional responsibilities in their existing roles. This trend will likely continue in the coming years as more privacy laws are enacted.

  Addressing upcoming privacy regulations

  Data privacy and user consent requirements continue to emerge and evolve. Businesses must stay informed and adapt their practices accordingly.

  

  In 2025, several new privacy regulations are going into effect, including :

  • New state-level privacy laws in eight US states :
    • Delaware (1 January 2025)
    • Iowa (1 January 2025)
    • Nebraska (1 January 2025)
    • New Hampshire (1 January 2025)
    • New Jersey (15 January 2025)
    • Tennessee (1 July 2025)
    • Minnesota (31 July 2025)
    • Maryland (1 October 2025)
  • The EU’s Artificial Intelligence Act (which will be implemented from 1 August 2024 through 2 August 2026) and other AI-focused regulations.
  • The UK Adequacy Decision Review has a deadline of 27 December 2025.

  Organisations that collect, process or otherwise handle data from Europe and the above-named US states should proactively prepare for these changes by :

  • Conducting regular privacy impact assessments
  • Reviewing consent mechanisms regularly
  • Implementing data minimisation strategies
  • Providing user-friendly privacy controls

  Future-proofing your consent management strategy

  CMPs are essential for managing consent preferences, protecting user privacy, and earning customers’ trust through transparency and ethical data practices.

  When choosing a CMP, you should consider key features such as integration capabilities, customisation options and user-friendly interfaces.

  Integrating a CMP with a privacy-first analytics solution like Matomo allows you to collect and analyse data in a way that’s compliant and respectful of user preferences. This combination helps maintain data integrity while demonstrating a strong commitment to privacy. 

  Start your 21-day free trial today.

• (C_UDP Socket Programming) How can I convert binary file to video format ?

  30 avril 2024, par user24723398

  I am practicing UDP socket programming. My code's functions are below.

  


  

  1. Connect Server-Client and send "hello" message each other (it is working).

  


  2. Then Server is sending video file to client (problem).

  


  


  Transfer video file to client is working. But it is written in binary so I can't open the video.

  


  So I try to use ffmpeg to convert the video, but it doesn't work.

  


  Is there something wrong in my code ? How can I transfer a received file to a video file ?

  


  My environment is MacOs.

  


  Server.c (Server Code) :

  


  #include &#xA;#include &#xA;#include &#xA;#include <arpa></arpa>inet.h>&#xA;#include &#xA;#include <sys></sys>socket.h>&#xA;&#xA;#define PORT 8888&#xA;#define BUF_SIZE 256&#xA;&#xA;int main(){&#xA;    int serv_sock;&#xA;    char message[BUF_SIZE];&#xA;    char buf[BUF_SIZE];&#xA;    int str_len;&#xA;    socklen_t clnt_adr_sz;&#xA;&#xA;    struct sockaddr_in serv_adr, clnt_adr;&#xA;    &#xA;    //create socket&#xA;    serv_sock=socket(PF_INET, SOCK_DGRAM, 0);&#xA;    if(serv_sock == -1){&#xA;        perror("socket() error");&#xA;        exit(1);&#xA;    }&#xA;    &#xA;    //socket address&#xA;    memset(&amp;serv_adr, 0, sizeof(serv_adr));&#xA;    serv_adr.sin_family=AF_INET;&#xA;    serv_adr.sin_addr.s_addr=htonl(INADDR_ANY);&#xA;    serv_adr.sin_port=htons(PORT);&#xA;    //binding socket&#xA;    if(bind(serv_sock, (struct sockaddr*)&amp;serv_adr, sizeof(serv_adr)) == -1){&#xA;        perror("bind() error");&#xA;        exit(1);&#xA;    }&#xA;    &#xA;    while(1){&#xA;        clnt_adr_sz=sizeof(clnt_adr);&#xA;        str_len=recvfrom(serv_sock, message, BUF_SIZE, 0, (struct sockaddr *)&amp;clnt_adr, &amp;clnt_adr_sz);&#xA;         if (str_len &lt; 0) {&#xA;            perror("recvfrom error");&#xA;            exit(1);&#xA;        }&#xA;    &#xA;        char hello_message[] = "hello i am server";&#xA;        if (sendto(serv_sock, hello_message, strlen(hello_message), 0, (struct sockaddr *)&amp;clnt_adr, clnt_adr_sz) &lt; 0) {&#xA;            perror("sendto error");&#xA;            exit(1);&#xA;        }&#xA;        &#xA;        //print message&#xA;        message[str_len] = &#x27;\0&#x27;;&#xA;        printf("client say: %s\n", message);&#xA;        &#xA;        char buf[BUF_SIZE];&#xA;        ssize_t bytes_read;&#xA;        // sending viedo file&#xA;        printf("sending video file...\n");&#xA;        size_t fsize;&#xA;    &#xA;        //video file&#xA;        FILE *file;&#xA;        char *filename = "video.mp4";&#xA;        // open video file&#xA;        file = fopen(filename, "rb");&#xA;        if (file == NULL) {&#xA;            perror("File opening failed");&#xA;            exit(EXIT_FAILURE);&#xA;        }&#xA;        //calculate video file memory&#xA;        fseek(file, 0, SEEK_END);&#xA;        fsize = ftell(file);&#xA;        fseek(file,0,SEEK_SET);&#xA;    &#xA;        size_t size = htonl(fsize);&#xA;        int nsize =0;&#xA;        &#xA;        while(nsize!=fsize){&#xA;            int fpsize = fread(buf,1, BUF_SIZE, file);&#xA;            nsize &#x2B;= fpsize;&#xA;            if (sendto(serv_sock, &amp;size, sizeof(size), 0, (struct sockaddr *)&amp;clnt_adr, clnt_adr_sz) &lt; 0) {&#xA;                perror("sendto");&#xA;                exit(EXIT_FAILURE);    &#xA;            }&#xA;            fclose(file);&#xA;            /*&#xA;            while ((bytes_read = fread(buf, 1, BUF_SIZE, file)) > 0) {&#xA;                if (sendto(serv_sock, buf, bytes_read, 0,&#xA;                       (struct sockaddr *)&amp;clnt_adr, clnt_adr_sz) &lt; 0) {&#xA;                    perror("sendto");&#xA;                    exit(EXIT_FAILURE);&#xA;                }       &#xA;            }&#xA;            */&#xA;        }        &#xA;    }&#xA;    close(serv_sock);&#xA;    return 0;&#xA;}&#xA;

  


  Client.c (Client code)

  


  #include &#xA;#include &#xA;#include &#xA;#include <arpa></arpa>inet.h>&#xA;#include &#xA;#include <sys></sys>socket.h>&#xA;&#xA;#define BUFSIZE 256&#xA;#define PORT 8888&#xA;&#xA;int main(){&#xA;    int sock;&#xA;    char message[BUFSIZE];&#xA;    int str_len;&#xA;    socklen_t adr_sz;&#xA;&#xA;    struct sockaddr_in serv_addr, client_addr;   &#xA;    &#xA;    sock = socket(PF_INET, SOCK_DGRAM, 0);&#xA;    if(sock == -1){&#xA;        printf("socket() error\n");&#xA;        exit(1);&#xA;    }&#xA;&#xA;    memset(&amp;serv_addr, 0, sizeof(serv_addr));&#xA;    serv_addr.sin_family = AF_INET;&#xA;    serv_addr.sin_addr.s_addr = inet_addr("127.0.0.1");&#xA;    serv_addr.sin_port = htons(PORT);&#xA;&#xA;    char hello_message[] = "hello i am client";&#xA;    sendto(sock, hello_message, strlen(hello_message), 0, (struct sockaddr*)&amp;serv_addr, sizeof(serv_addr));&#xA;    adr_sz = sizeof(client_addr);&#xA;    str_len=recvfrom(sock,message,BUFSIZE,0,(struct sockaddr*)&amp;client_addr,&amp;adr_sz);&#xA;   &#xA;    message[str_len] = &#x27;\0&#x27;;&#xA;    printf("client say: %s\n", message);&#xA;    &#xA;    /*&#xA;    char buf[BUFSIZE];&#xA;    ssize_t bytes_received;&#xA;    socklen_t serv_len = sizeof(serv_addr);&#xA;    while ((bytes_received = recvfrom(sock, buf, BUFSIZE, 0,&#xA;                                      (struct sockaddr *)&amp;serv_addr, &amp;serv_len)) > 0) {&#xA;        fwrite(buf, 1, bytes_received, file);&#xA;    }&#xA;    */&#xA;     &#xA;    FILE *file = fopen("received_test.mp4", "wb");&#xA;&#xA;    int nbyte = BUFSIZE;&#xA;    while(nbyte>= BUFSIZE){&#xA;        nbyte = recvfrom(sock, message, BUFSIZE, 0, (struct sockaddr*)&amp;serv_addr, &amp;adr_sz);&#xA;        fwrite(message, sizeof(char), nbyte, file);&#xA;    }&#xA;&#xA;    if (file == NULL) {&#xA;        perror("File opening failed");&#xA;        exit(EXIT_FAILURE);&#xA;    }&#xA;&#xA;    fclose(file);&#xA;    close(sock);&#xA;    printf("File received successfully\n");&#xA;    &#xA;    return 0;&#xA;}&#xA;

  


  I try to convert the binary file to an .mp4 file using ffmpeg
but it doesn't work :

  


  ffmpeg -i received_test.mp4 output.mp4
ffmpeg version 7.0 Copyright (c) 2000-2024 the FFmpeg developers
  built with Apple clang version 15.0.0 (clang-1500.3.9.4)
  configuration: --prefix=/opt/homebrew/Cellar/ffmpeg/7.0 --enable-shared --enable-pthreads --enable-version3 --cc=clang --host-cflags= --host-ldflags='-Wl,-ld_classic' --enable-ffplay --enable-gnutls --enable-gpl --enable-libaom --enable-libaribb24 --enable-libbluray --enable-libdav1d --enable-libharfbuzz --enable-libjxl --enable-libmp3lame --enable-libopus --enable-librav1e --enable-librist --enable-librubberband --enable-libsnappy --enable-libsrt --enable-libssh --enable-libsvtav1 --enable-libtesseract --enable-libtheora --enable-libvidstab --enable-libvmaf --enable-libvorbis --enable-libvpx --enable-libwebp --enable-libx264 --enable-libx265 --enable-libxml2 --enable-libxvid --enable-lzma --enable-libfontconfig --enable-libfreetype --enable-frei0r --enable-libass --enable-libopencore-amrnb --enable-libopencore-amrwb --enable-libopenjpeg --enable-libopenvino --enable-libspeex --enable-libsoxr --enable-libzmq --enable-libzimg --disable-libjack --disable-indev=jack --enable-videotoolbox --enable-audiotoolbox --enable-neon
  libavutil      59.  8.100 / 59.  8.100
  libavcodec     61.  3.100 / 61.  3.100
  libavformat    61.  1.100 / 61.  1.100
  libavdevice    61.  1.100 / 61.  1.100
  libavfilter    10.  1.100 / 10.  1.100
  libswscale      8.  1.100 /  8.  1.100
  libswresample   5.  1.100 /  5.  1.100
  libpostproc    58.  1.100 / 58.  1.100
[mov,mp4,m4a,3gp,3g2,mj2 @ 0x12a62bdb0] Format mov,mp4,m4a,3gp,3g2,mj2 detected only with low score of 1, misdetection possible!
[mov,mp4,m4a,3gp,3g2,mj2 @ 0x12a62bdb0] moov atom not found
[in#0 @ 0x12b0043c0] Error opening input: Invalid data found when processing input
Error opening input file received_test.mp4.
Error opening input files: Invalid data found when processing input


  


• OCPA, FDBR and TDPSA – What you need to know about the US’s new privacy laws

  22 juillet 2024, par Daniel Crough

  On July 1, 2024, new privacy laws took effect in Florida, Oregon, and Texas. People in these states now have more control over their personal data, signaling a shift in privacy policy in the United States. Here’s what you need to know about these laws and how privacy-focused analytics can help your business stay compliant.

  Consumer rights are front and centre across all three laws

  The Florida Digital Bill of Rights (FDBR), Oregon Consumer Privacy Act (OCPA), and Texas Data Privacy and Security Act (TDPSA) grant consumers similar rights.

  Access : Consumers can access their personal data held by businesses.

  Correction : Consumers can correct inaccurate data.

  Deletion : Consumers may request data deletion.

  Opt-Out : Consumers can opt-out of the sale of their personal data and targeted advertising.

  Oregon Consumer Privacy Act (OCPA)

  The Oregon Consumer Privacy Act (OCPA), signed into law on June 23, 2023, and effective as of July 1, 2024, grants Oregonians new rights regarding their personal data and imposes obligations on businesses. Starting July 1, 2025, authorities will enforce provisions that require data protection assessments, and businesses must recognize universal opt-out mechanisms by January 1, 2026. In Oregon, the OCPA applies to business that :

  • Either conduct business in Oregon or offer products and services to Oregon residents

  • Control or process the personal data of 100,000 consumers or more, or

  • Control or process the data of 25,000 or more consumers while receiving over 25% of their gross revenues from selling personal data.

  Exemptions include public bodies like state and local governments, financial institutions, and insurers that operate under specific financial regulations. The law also excludes protected health information covered by HIPAA and other specific federal regulations.

  Business obligations

  Data Protection Assessments : Businesses must conduct data protection assessments for high-risk processing activities, such as those involving sensitive data or targeting children.

  Consent for Sensitive Data : Businesses must secure explicit consent before collecting, processing, or selling sensitive personal data, such as racial or ethnic origin, religious beliefs, health information, biometric data, and geolocation.

  Universal Opt-out : Starting January 1, 2025, businesses must acknowledge universal opt-out mechanisms, like the Global Privacy Control, that allow consumers to opt out of data collection and processing activities.

  Enforcement

  The Oregon Attorney General can issue fines up to $7,500 per violation. There is no private right of action.

  Unique characteristics of the OCPA

  The OCPA differs from other state privacy laws by requiring affirmative opt-in consent for processing sensitive and children’s data, and by including nonprofit organisations under its scope. It also requires global browser opt-out mechanisms starting in 2026.

  Florida Digital Bill of Rights (FDBR)

  The Florida Digital Bill of Rights (FDBR) became law on June 6, 2023, and it came into effect on July 1, 2024. This law targets businesses with substantial operations or revenues tied to digital activities and seeks to protect the personal data of Florida residents by granting them greater control over their information and imposing stricter obligations on businesses. It applies to entities that :

  • Conduct business in Florida or provide products or services targeting Florida residents,

  • Have annual global gross revenues exceeding $1 billion,

  • Receive 50% or more of their revenues from digital advertising or operate significant digital platforms such as app stores or smart speakers with virtual assistants.

  Exemptions include governmental entities, nonprofits, financial institutions covered by the Gramm-Leach-Bliley Act, and entities covered by HIPAA.

  Business obligations

  Data Security Measures : Companies are required to implement reasonable data security measures to protect personal data from unauthorised access and breaches.

  Handling Sensitive Data : Explicit consent is required for processing sensitive data, which includes information like racial or ethnic origin, religious beliefs, and biometric data.

  Non-Discrimination : Entities must ensure they do not discriminate against consumers who exercise their privacy rights.

  Data Minimisation : Businesses must collect only necessary data.

  Vendor Management : Businesses must ensure that their processors and vendors also comply with the FDBR, regarding the secure handling and processing of personal data.

  Enforcement

  The Florida Attorney General can impose fines of up to $50,000 per violation, with higher penalties for intentional breaches.

  Unique characteristics of the FDBR

  Unlike broader privacy laws such as the California Consumer Privacy Act (CCPA), which apply to a wider range of businesses based on lower revenue thresholds and the volume of data processed, the FDBR distinguishes itself by targeting large-scale businesses with substantial revenues from digital advertising. The FDBR also emphasises specific consumer rights related to modern digital interactions, reflecting the evolving landscape of online privacy concerns.

  Texas Data Privacy and Security Act (TDPSA)

  The Texas Data Privacy and Security Act (TDPSA), signed into law on June 16, 2023, and effective as of July 1, 2024, enhances data protection for Texas residents. The TDPSA applies to entities that :

  • Conduct business in Texas or offer products or services to Texas residents.

  • Engage in processing or selling personal data.

  • Do not fall under the classification of small businesses according to the U.S. Small Business Administration’s criteria, which usually involve employee numbers or average annual receipts. 

  The law excludes state agencies, political subdivisions, financial institutions compliant with the Gramm-Leach-Bliley Act, and entities compliant with HIPAA.

  Business obligations

  Data Protection Assessments : Businesses must conduct data protection assessments for processing activities that pose a heightened risk of harm to consumers, such as processing for targeted advertising, selling personal data, or profiling.

  Consent for Sensitive Data : Businesses must get explicit consent before collecting, processing, or selling sensitive personal data, such as racial or ethnic origin, religious beliefs, health information, biometric data, and geolocation.

  Companies must have adequate data security practices based on the personal information they handle.

  Data Subject Access Requests (DSARs) : Businesses must respond to consumer requests regarding their personal data (e.g., access, correction, deletion) without undue delay, but no later than 45 days after receipt of the request.

  Sale of Data : If businesses sell personal data, they must disclose these practices to consumers and provide them with an option to opt out.

  Universal Opt-Out Compliance : Starting January 1, 2025, businesses must recognise universal opt-out mechanisms like the Global Privacy Control, enabling consumers to opt out of data collection and processing activities.

  Enforcement

  The Texas Attorney General can impose fines up to $25,000 per violation. There is no private right of action.

  Unique characteristics of the TDPSA

  The TDPSA stands out for its small business carve-out, lack of specific thresholds based on revenue or data volume, and requirements for recognising universal opt-out mechanisms starting in 2025. It also mandates consent for processing sensitive data and includes specific measures for data protection assessments and privacy notices.

  Try Matomo for Free

  Get the web insights you need, without compromising data accuracy.

  Start for free

  No credit card required

  Privacy notices across Florida, Oregon, and Texas

  All three laws include a mandate for privacy notices, though there are subtle variations in their specific requirements. Here’s a breakdown of these differences :

  FDBR privacy notice requirements

  Clarity : Privacy notices must clearly explain the collection and use of personal data.

  Disclosure : Notices must inform consumers about their rights, including the right to access, correct, delete their data, and opt-out of data sales and targeted advertising.

  Specificity : Businesses must disclose if they sell personal data or use it for targeted advertising.

  Security Practices : The notice should describe the data security measures in place.

  OCPA privacy notice requirements

  Comprehensive Information : Notices must provide information about the personal data collected, the purposes for processing, and any third parties that can access it.

  Consumer Rights : Must plainly outline consumers’ rights to access, correct, delete their data, and opt-out of data sales, targeted advertising, and profiling.

  Sensitive Data : To process sensitive data, businesses or entities must get explicit consent and communicate it.

  Universal Opt-Out : Starting January 1, 2026, businesses must recognise and honour universal opt-out mechanisms.

  TDPSA privacy notice requirements

  Detailed Notices : Must provide clear and detailed information about data collection practices, including the data collected and the purposes for its use.

  Consumer Rights : Must inform consumers of their rights to access, correct, delete their data, and opt-out of data sales and targeted advertising.

  High-Risk Processing : Notices should include information about any high-risk processing activities and the safeguards in place.

  Sensitive Data : To process sensitive data, entities and businesses must get explicit consent.

  What these laws mean for your businesses

  Businesses operating in Florida, Oregon, and Texas must now comply with these new data privacy laws. Here’s what you can do to avoid fines :

  1. Understand the Laws : Familiarise yourself with the specific requirements of the FDBR, OCPA, and TDPSA, including consumer rights and business obligations.

  2. Implement Data Protection Measures : Ensure you have robust data security measures in place. This includes conducting regular data protection assessments, especially for high-risk processing activities.

  3. Update Privacy Policies : Provide clear and comprehensive privacy notices that inform consumers about their rights and how their data is processed.

  4. Obtain Explicit Consent : For sensitive data, make sure you get explicit consent from consumers. This includes information like health, race, sexual orientation, and more.

  5. Manage Requests Efficiently : Be prepared to handle requests from consumers to access, correct, delete their data, and opt-out of data sales and targeted advertising within the stipulated timeframes.

  6. Recognise Opt-Out Mechanisms : For Oregon, businesses must be ready to implement and recognise universal opt-out mechanisms by January 1, 2026. In Texas, opt-out enforcement begins in 2026. In Florida, the specific opt-out provisions began on July 1, 2024.

  7. Stay Updated : Keep abreast of any changes or updates to these laws to ensure ongoing compliance. Keep an eye on the Matomo blog or sign up for our newsletter to stay in the know.

  Are we headed towards a more privacy-focused future in the United States ?

  Florida, Oregon, and Texas are joining states like California, Virginia, Colorado, Connecticut, Utah, Iowa, Indiana, Tennessee, and Montana in strengthening consumer privacy protections. This trend could signify a shift in US policy towards a more privacy-focused internet, underlining the importance of consumer data rights and transparent business practices. Even if these laws do not apply to your business, considering updates to your data and privacy policies is wise. Fortunately, there are tools and solutions designed for privacy and compliance to help you navigate these changes.

  Avoid fines and get better data with Matomo

  Most analytics tools don’t prioritize safeguarding user data. At Matomo, we believe everyone has the right to data sovereignty, privacy and amazing analytics. Matomo offers a solution that meets privacy regulations while delivering incredible insights. With Matomo, you get :

  100% Data Ownership : Keep full control over your data, ensuring it is used according to your privacy policies.

  Privacy Protection : Built with privacy in mind, Matomo helps businesses comply with privacy laws.

  Powerful Features : Gain insights with tools like heatmaps, session recordings, and A/B testing.

  Open Source : Matomo’s is open-source and committed to transparency and customisation.

  Flexibility : Choose to host Matomo on your servers or in the cloud for added security.

  No Data Sampling : Ensure accurate and complete insights without data sampling.

  Privacy Compliance : Easily meet GDPR and other requirements, with data stored securely and never sold or shared.

  Try Matomo for Free

  21 day free trial. No credit card required.

  
  

  Your email address
  

  Your website address
  

  Your Analytics subdomain will be .matomo.cloud (change)

  Choose your analytics subdomain
  

  .matomo.cloud

  I accept the terms and conditions and data processing agreement (DPA)

  
  Your information will be used to create an account on our cloud service. For more information please consult our privacy policy.
  
  
  

  Start improving your websites now

  

  Disclaimer : This content is provided for informational purposes only and is not intended as legal advice. While we strive to ensure the accuracy and timeliness of the information provided, the laws and regulations surrounding privacy are complex and subject to change. We recommend consulting with a qualified legal professional to address specific legal issues related to your circumstances.