By Janelle M. Lewis, Attorney and Business Strategist

It is essential that business owners who process personal data from certain states in the U.S. have an understanding of what constitutes consent under the respective privacy law. By understanding the unique features of what constitutes consent under the various privacy laws throughout certain states in the U.S., consumers can benefit from the protection it provides, while business owners can be strategic how they collect personal data in certain states in the U.S. In other words, understanding the what constitutes consent under the various data privacy law in the U.S. can bridge the gap between law and business strategy.

Colorado Privacy Act (Effective July 1st, 2023)

Are you an organization whose activities include the need for consent to process personal data from the consumers of Colorado?

What Constitutes Consumer Consent?

According to the Colorado Privacy Act (CPA), consent must be given through a clear, affirmative act freely given by an informed consumer.

What Does Not Constitute Consumer “Consent”?

Consent cannot be obtained through general or broad terms of use, “hovering over, muting, pausing, or closing a given piece of content,” or “Dark Patterns.” Additionally, if a material change rises to the level of a secondary use, and the consumer does not opt back in using the Universal Opt-Out Mechanism, then this also does not constitute consent under the CPA.

Check out this video below on Consent and a link to the CPA for more information on what constitutes consent under the CPA. For more information on the CPA, click https://buff.ly/3n3ERch

Virginia Consumer Data Privacy Act (Effective January 1st, 2023)

As a business, it’s important to be aware of the rules and regulations surrounding data privacy in Virginia, otherwise known as VCDPA.

What Constitutes Consumer Consent under VCDPA?

Under the VCDPA, “consent” is defined as an affirmative act that expresses an individual’s freely given, informed, and unambiguous agreement to have their personal data processed. It can be given in writing or any other form of unambiguous action. Companies that comply with the Children’s Online Privacy Protection Act (COPPA) are considered to have met any consent obligations under the law.

What Does Not Constitute Consumer Consent under VCDPA?

Moreover, companies must not process personal data for purposes that are not necessary or compatible with the purposes that were initially disclosed to the consumer, unless they have received the individual’s consent.

Check out this video on Consent and the link to the VCDPA .

California Consumer Privacy Act (Effective with Amendments January 1st, 2023)

Unlock the key to understanding what constitutes consent under the CCPA Amended, including the recent amendment, CPRA.

What Constitutes Consumer Consent under CCPA Amended?

Companies that use the personal data of California consumers must know how to ensure compliance and receive valid consent. Under the CCPA Amended, consent must be informed, specific, voluntary, and an unambiguous indication of the consumer desires. Consent signifies agreement to the process of personal information relating to the consumer for by “a statement or by a clear affirmative action for a narrowly defined particular purpose.

What Does Not Constitute Consumer Consent under CCPA Amended?

Acceptance of a general or broad terms of use, or similar document, that contains descriptions of personal information processing along with other, unrelated information does not constitute consumer consent to process their personal information. Nor do the following actions constitute consent under the CCPA Amended “Hovering over, muting, pausing, or closing a given piece of content does not constitute consent. Additionally, agreement obtained through use of dark patterns does not constitute consent. Dark Patterns is a practice where ” a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision-making, or choice, as further defined” by CCPA.

Check out this video on brief overview of Consent under CCPA Amended and the link to the CCPA Amended

Iowa Consumer Data Protection Act (Effective January 1st, 2025)

There is another patch to the U.S. data privacy landscape – this time it’s the Iowa Consumer Data Protection Act (ICDPA)! Organizations who process Iowa residents personal data have a little over 20 months to get their data privacy consumer personal data processing in compliance with the ICDPA

What Constitutes Consumer Consent under ICDPA?

Under the ICDPA “a clear affirmative act signifying” constitutes consent if it is specific, informed and unambiguous; and was freely given by the consumer to process their personal data. A written statement, including a statement written by electronic means, or any other unambiguous affirmative action constitute manners in which consent may be expressed.

What Does Not Constitute Consumer Consent under ICDPA?

In Iowa, the ICDPA does not consider agreement that was not specific, informed and unambiguously given consent. Ambiguous actions expressing the Consumer’s agreement do not constitute consumer consent.

For the full list of consumer rights, visit the Iowa Legislature website.

To learn more about the key consumer rights under ICDPA, watch this video below:

Connecticut Data Privacy Act (Effective July 1st, 2023)

As legal teams dealing with personal data of U.S. residents of various states, it’s important to keep abreast of the rules and regulations of the ever evolving and developing data-privacy legal landscape in the U.S. Now it is the Connecticut Data Privacy Act (CTDPA). It is essential to undertand the nuances of essential elements of the act, such as what does and does not constitute consent. 

What Constitutes Consumer Consent under CTDPA?

Under the CTDPA, consent constitutes an affirmative act that expresses an individual’s freely given, informed, and unambiguous agreement to have their personal data processed. It can be given in writing or any other form of unambiguous action. Companies that comply with the Children’s Online Privacy Protection Act (COPPA) are considered to have met any consent obligations under the law.

What Does Not Constitute Consumer Consent under CTDPA?

Acceptance of a general or broad terms of use, or similar document, that contains descriptions of personal information processing along with other, unrelated information does not constitute consumer consent to process their personal information. Nor do the following actions constitute consent under the CTDPA “Hovering over, muting, pausing, or closing a given piece of content does not constitute consent”. Additionally, agreement obtained through use of dark patterns does not constitute consent.

For more information, check out the video below, follow the link to the Substitute Senate No. 6 Bill, and Go to the on the Connecticut Data Privacy Act portal.

Utah Consumer Privacy Act (Effective December 31st, 2023)

It’s essential to stay informed about the rapidly evolving privacy landscape, especially the nuances of the Utah Consumer Privacy Act (UCPA).

What Constitutes Consumer Consent under the UCPA?

A consumer’s voluntary and informed agreement to allow the processing of their personal data constitutes consent under the UCPA if the consent is unambiguous, voluntary and informed. Additionally, parental consent is accepted on behalf of a minor when data controllers comply with COPPA means an affirmative act by a consumer that unambiguously indicates

What Does Not Constitute Consumer Consent under the UCPA?

In Utah, the UCPA does not consider agreement that was not specific, informed and unambiguously given consent. Ambiguous actions expressing the Consumer’s agreement do not constitute consumer consent.

For more on the UCPA, visit the Utah’s Legislature website.

To learn more about what constitutes consumer consent under the UCPA, watch this video below:

Given the various privacy and data protection laws that are being passed by more and more states, the data privacy legal patchwork quilt is becoming more complex. Additionally, organizations who process personal data are becoming obligated to comply with new law and regulations and a rapid rate. This is another example of how understanding what constitutes consumer consent in the U.S. can bridge the gap between law and the business strategic objectives of the company who business activities include the collection of personal consumer data.