US State Privacy Best Practices: CMP & Privacy Rights

US Privacy 2024 Implementation Approach

Given the amount of overlap and shared requirements of each law, most organizations are taking a unified approach to US state law requirements, then working in specific nuances or state-specific strategies as it makes sense for their business. Additionally, given the fact that there are now many more compliance requirements than when US companies just had to focus on CCPA, organizations are taking a maturity-based approach to compliance. For most organizations, this means focusing on the external consumer and employee facing requirements first, then addressing the “behind the scenes” program management and governance requirements.  

This guide will take you through best practices when implementing OneTrust solutions to address each of these US state privacy law requirements.

Consumer Rights

As we focus on the Consumer Rights in-scope for US Privacy laws by the end of 2024, we first acknowledge that the way in which we solve for each may differ. In this guide, we will cover how to solve these requirements using that comprehensive approach across a set of OneTrust solutions with key callouts for state variances and how to manage accordingly.  

The first area that many organizations focus their compliance efforts is around Consumer Rights. Consumer Rights to access, deletion, and opt-out were established under the CCPA in 2020 and have been extended to include additional rights, as well as more covered individuals as more states have passed rights-driven privacy laws that are already or will be going into effect throughout 2024.  

As consumer rights continues to expand, we continue to see some of the nuanced requirements for specific rights like the right to opt-out or sale and the right to correction / rectification, organizations must consider the consumer journey and what typical consumer touchpoints look like within their organization and across their digital properties.  

As we dive into our best practices, we will focus first on a comprehensive US Privacy solution for Opt-Out of Sale and then shift to address the Broader Consumer Rights.

Website Scans

As one of the major themes of US Privacy Regulations, Opt-out is centered on the right to opt-out of the sale and/or sharing of a consumer’s personal information to third-parties through California Consumer Privacy Act (CCPA). This has since expanded through additional state regulations that create some level of complexity in solving for opt-out of sale, share, profiling, and targeted advertisements.  

The OneTrust Consent Management Platform (CMP) allows our customers to facilitate opt-out requests and comply with these US state laws across all digital properties.

6 key implementation areas to focus on:

• Website Scanning

• Categorizing Trackers

• CMP Templates

• Geolocation Rule Groups

• Respecting the Opt-out

• Integrating the Scripts

Website Scans

The first step in preparing for US Privacy laws is to audit your site to identify all tracking technologies. The OneTrust web scanner can be used to assist in this activity by helping identify cookies, tags and other tracking technologies being dropped on a user's browser when browsing your site.

Best practices for Configuring Scans

We recommend our customers think through how their sites are built when configuring their scans to manage any unique site designs. 

First, we see customers face challenges in defining the proper scope of their scans. To address this, our product allows you to define a sitemap and/or target specific sites and pages. From there, you can set parameters to limit the number of scannable pages. This helps ensure a successful scan and reduce potential errors.  We recognize many of our customer sites may have additional hurdles to address, like antibot tools or pages that require authentication to access. So, defining query parameters and/or login credentials are also recommended to ensure a successful scan.

For more best practices on cookie scans, see Website Scanning Best Practices.

Additional Scan Considerations

OneTrust recommends scanning a subset of pages within the domain, the standard recommendation for scanning is to scan anywhere between 2000-5000 pages maximum. The OneTrust scanner identifies cookies and other tracking technologies on a site by identifying network calls made while crawling the domain so typically, most of the tracking technologies on a site can be identified within the first 5000 pages.

How to Perform Website Scans

For guidance on how to perform website scans and then review scan results, visit these knowledgebase articles:

• Scanning a Website

• Viewing Scan Results

• Configuring a Website Scan

Categorizing Trackers

All cookies and trackers found need to be categorized based on their function. OneTrust automatically categorizes millions of third-party cookies and trackers into one of 5 key categories: Strictly Necessary, Performance, Functional, Targeting and Social Media Cookies. If you have previously implemented Cookie or Mobile App Consent, then this step will be for reviewing/categorizing any new trackers as your previous categorizations are saved and will not be overwritten by new scans.

Best Practices

The category a tracker is put in will determine whether an individual can opt-out or turn off that tracker through the CMP. For compliance with the US state laws, we recommend organizations identify two main categories of trackers: those involved in targeting and those not involved in targeting.  

This approach is driven by the fact that the opt-outs are focused on the sale or sharing of information with third parties for targeting or re-targeting ads. So, when configuring the CMP templates, the template will enable the individual to opt-out of all the trackers in the targeting category.

How to Categorize Trackers

For more details on how to categorize trackers identified through a scan of your website, please reference these knowledgebase articles:

• Managing and Categorizing Cookies

• Viewing Scan Results

CMP Templates

The Templates tab is where you will configure the user interfaces for your websites, and optionally across your other digital properties like Connected TV services. There are preconfigured templates for designed to comply with the US Privacy laws and frameworks.

Once you have categorized the cookies on your site, you will need to select a Template and evaluate design across 3 elements:

Banner

allows you to customize the styling, content, and behavior of the Bannerallows you to customize the styling, content, and behavior of the Banner

Preference Center

used to customize the styling and content of the Preference Center. You can include a link to the Preference Center on your website, which is typically placed in the footer. Then, you can use the Advanced Settings to show groups of cookie categories that can be opted in or out of individually.used to customize the styling and content of the Preference Center. You can include a link to the Preference Center on your website, which is typically placed in the footer. Then, you can use the Advanced Settings to show groups of cookie categories that can be opted in or out of individually.

Cookie List

serving as your third layer of notice

Recommended Approach and Template

OneTrust has a seeded template to target the new US requirements: ‘United States’ or ‘Virginia’, depending on your environment. We recommend using this template when preparing for new US privacy laws as a proper starting point.

With this template, we are able leverage our preference center as the central hub for all Consumer Rights, by:

• Capturing opt-in / opt-out of targeted ads and other cookie preferences 

• Link to your Privacy Cookie, cookie Policy, and additional privacy policies 

• Link to your Privacy Rights Intake Form

Together, this creates a centralized location for site users to quickly view their options on how to best action their relevant privacy rights.

Best Practices for the Preference Center Templates

You can customize the layout, styling, content, and cookie category configuration of your preference center. This allows you to create a look and feel that matches your organization's branding style.  

The best practice is to have Performance, Social Media, and Targeting cookies under the Share/Sell data bundle group. Performance is included as an extra precaution - analytics tools often allow you to opt in (or may opt you in by default) to data sharing pools that may be covered under legislation.  

The preference center’s description should have a link to the Privacy Rights Request form.

Managing the Various Opt-out Rights

With these considerations, we have outlined two approaches in how to present these options to a user:

One universal toggle/selection

• This is the most restrictive approach as you will be shutting off all tracking when a user wants to opt-out  

• This requires less analyzation of tracking technology as you will not be distinguishing between selling, profiling, and targeting 

• This can be presented across jurisdictions as it encompasses all rights

A toggle/selection per opt-out right

• This is least restrictive and give the user more granular choices which will allow flexibility in how data can still be processed 

• This requires analyzation of tracking technology to segment processing across selling, targeting, and profiling 

• This can be presented across jurisdictions (due to the overlap of selling and sharing and targeting) or can be dynamically presented based on location

Guidance from regulators has also stipulated that a “global” opt-out toggle can be provided with more granular selections. Regardless of the approach taken, a key consideration is providing context, notice, and transparency to the user in order to clearly communicate their rights and how they can be exercised.   

Once you have determined the choices that will be presented to a user, you will need to determine how they will be presented. As mentioned above there are three primary approaches.   

For more information on how to customize the Preference Center to meet your needs, please see Customizing the Preference Center.

Enhance your Solution

The most common area, and the focus of this guide, is on the Web experience delivered to site visitors. The entire consumer experience and back-end orchestration of these rights can be managed by OneTrust’s CMP across all your digital properties, including:

Web

also referred to as “Cookie Consent” 

Mobile

also referred to as “Mobile App Consent” 

CTV / OTT

also referred to as “Connected TV” or “Over-the-Top” apps

Geolocation Rules

Geolocation Rules allow you to control what site visitors will see based on their location. This is especially important as more states begin to roll-out their own unique requirements for opt-out across your digital properties.  

You can also determine if consent records will be collected and the behaviors that will close the cookie banner. For example, if you are using IAB TCF, you will need to decide which IAB vendors you use by selecting a vendor list.

Best Practices

A geolocation rule should be created for the United States as a country. If there are more restrictive privacy laws in other geolocation rules, they should be prioritized as the rule to follow if an IP address is not obtained. Global Privacy Control and Do Not Track signals should be respected for the Opt Out of Sale of Sharing/Targeted Advertising bundle group. This is a requirement of several US Laws.  The consent model for all categories should be Opt-Out, unless otherwise specified by a state-specific requirement.  

For more information on how to manage your Geolocation Rules, please see Configuring Geolocation Rules.

Respecting the Opt-out

After the sites and apps have been scanned, trackers categorized, templates and geolocation rules created, then you will need to configure and test the blocking of trackers.

This is the most important aspect of the implementation as it will allow a site visitor's preferences to be respected. If you don’t do this properly, individuals will continue to be tracked by third parties and profiled to deliver targeted advertising. Blocking is done in many ways including client-side cookie management, integration with tag managers (such as Google Tag Manager), signaling into frameworks from organizations like the IAB, and OneTrust Auto-Blocking technology.

More specific guidance for the various blocking methods:

• Client-Side Cookie Management

• Cookie Consent Integration with Google Tag Manager 

• IAB TCF Detailed Overview 

• OneTrust Cookie Auto-Blocking™ 

• Testing Your Cookie Blocking Implementation

Integrating Scripts & SDKs

The Integration tab provides you with a tables of your cookie banner scripts and mobile scripts. You can select the individual domain or application to implement your solutions. The tab will provide step-by-step instructions to implement the script. To publish a script, click the Publish button. This will present you with the Test CDN and settings related to how language will be determined. When testing is complete, click next to download or copy the production script.  

The Test Script and Production Script are similar, but differ in a few key details. When a cookie is written, it is written to a specific domain, such as .example.com or www.staging-example.com. A cookie written in .example.com is sent in any requests for the root domain. However, if you were on a different domain, like www.staging-example.com, you would not be able to write a cookie on .example.com. Therefore, if you use a production script on the staging domain, the cookies used by OneTrust would not be written and the consent would not be stored. To resolve this issue, the Test Script writes cookies to the domain it is currently on and allowing it to behave like the Production Script.

Best Practices

An important aspect of maintaining your preference center over time is to ensure a process for whenever there is a change made to any domain in the Cookie Consent application. This includes adding or deleting cookies, modifying templates, or reconfiguring geolocation rules. The process should ensure the respective domain scripts are re-published to view the changes on the website where the scripts are hosted.

For guidance on how to generate scripts, please visit Publishing and Implementing Cookie Consent Scripts.

Configuring Privacy Rights Automation for US Privacy

In conjunction with the state-by-state breakdown, this guide will then highlight the key considerations your teams should be making when configuring the Privacy Rights Automation Module (PRA). The PRA module has 6 key implementation areas to focus on:

• Web Forms

• Fulfillment Workflows

• ID Verification

• Web Form Routing Rules

• Response Templates & Privacy Portal

• Deploy the Web Form

Each item is important to evaluate and determine if additional updates are required to align with your unique business needs and to prepare for upcoming US privacy laws.

Web Forms

Web forms are the vehicle through which data subjects may exercise their rights. Whether you choose to utilize a form hosted on a OneTrust site, embed it in an iFrame on your own site, or configure an API feed, it is vital that the mechanism you create is straightforward, easily accessible, and concise. Web forms can be configured with dynamic variables that can adjust available options based on the input of data subjects. As with all configurations, simplicity and ease of use are key to compliance.

Best Practices

Our recommendation is to use a single, centralized US Privacy Web Form with dynamic capabilities to show only the relevant request fields for that specific state / regulation. To make this even easier for our customers, we have built our ‘United States’ web form that is designed to solve for US Privacy Regulations out-of-the-box.

Key Benefits of our 'United States' web form template

This template has several useful features built-in that further streamlines the configuration experience and helps our customers establish working solutions faster with a comprehensive solution. These features include:

Auto-Detect State of Residency

The form will auto-detect and populate ‘State of Residency’ field via geolocation technologies.

Consumer & Employee Subject Types

Most states apply to consumers, but some states such as California also offer rights to Employees. This form has this logic available to only show subject types that are applicable for that specific state. 

Dynamic, State-specific Request Types

Once a state is identified, the form will dynamically show the applicable subject types and request types for their specific state. 

Authorized Agents

Our template also has considerations for Authorized Agent requests (requests on behalf of another). These are hidden behind visibility rules, allowing you to capture the details of the authorized agent at the time of the request for your team to perform additional verification as needed.

For more guidance on how to enable a web form from our seeded Web Form Template Gallery, please visit Creating a Web Form.

Configure Custom Template

Alternatively, you can choose to create a custom template based upon your existing form(s). This may require your team to make additional adjustments based on the existing design.  

At minimum, we recommend adding the ‘United States’ template to your own Web Form list. You can then adjust the configuration to meet your own unique business requirements and needs or simply utilize the template as a reference point in building your own custom form.

Additional Considerations for the Web Form

Subject Types

Your organization must determine whether you wish to open employee requests to all employees, or only to those who operate within the regulated state. Our recommendation is to establish a process for all employees to drive Trust within the organization. However, this may not be feasible and should be evaluated by the internal teams.

Request Types

Similarly to Consumer & Employees, your organization should also consider whether to enable all request types for all citizens, all request types for citizens of the regulated states, or have specific visibility logic to only show request types for that specific state’s citizens.

Best practice is to configure a holistic solution that allows all data subjects the ability to exercise all rights as part of your Privacy & Trust initiatives. This also simplifies your configuration and long-term management of the platform. The key consideration here is the same – to consider the feasibility and scale of your current fulfillment team, as well as any downstream impacts.  

For information on how to make further adjustments to your Web Form Templates, please visit Customizing a Web Form.

Fulfillment Workflows

Once the web form is configured, the next step is to determine if additional workflows are required or if updates to existing workflows are needed. Businesses should evaluate existing workflows to see if they are sufficient for fulfilling rights. New workflows are especially recommended for Employee rights due to the higher volume of systems in which employee data may reside.

Reference Seeded Workflows

The OneTrust platform comes pre-populated with State-specific and consolidated United States workflows. You can perform a search of these within the Workflow section of the Privacy Rights Automation module. These can be utilized as the working template to build your organization’s workflows or serve as a reference point for your own, bespoke, workflows.

Best Practice for Workflow Management

Best practice is to have a 1:1 relationship between Workflows and Subject + Request combinations. As an example, a business may have one workflow for Consumer + Access Personal Information and a separate workflow for Employee + Access Personal Information.  

Your organization may find opportunities to consolidate workflows together if you find that the fulfillment procedures are the same across multiple combinations. For instance, if an organization fulfills all Access Requests in the same manner, we recommend minimizing the number of Access Type requests into a single fulfillment workflow.  

Regardless of whether you utilize our Seeded Workflows or build your own, we recommend you apply your own unique naming convention to each of these workflows for better tracking over time.

For how-to guides on configuring a workflow, see Adding and Deleting Workflows and Customizing a Workflow.

Addressing Authorized Agents in Workflow Management

Additional considerations should be made for Authorized Agent requests as there is benefit in having separate workflows to manage these request types. Authorized Agent requests may require your organization to validate the authorized agent status before proceeding with fulfillment. These actions may not always be necessary, but key considerations should be placed on requests to protect your business or the data subject – such as with a Request to Access from an unauthorized third-party.

ID Verification

As indicated above, ID verification is key to minimize any potential risks associated with fulfillment of privacy rights. The OneTrust PRA module has built-in capabilities to support your organization, including:

Request Confirmation via Email Procedures

driven off email value captured on web form 

Phone Number Verification

initiated as a sms message to the requestor that can be used in isolation or in conjunction with the out-of-the-box email procedure

ID Verification Status

dedicated fields to capture status of ID Verification procedures, including email and phone verification

Workflow and Customizable User Subtasks

tools to help govern your team’s ID Verification process, by defining key stage(s) and user tasks to complete your own internal id verification procedures

OneTrust also offers additional methods to further enhance & streamline your ID Verification procedures:

Third-Party ID Verification

enable verification of a user’s identity with an external Identity Provider (LexisNexis or Experian). 

OIDC (OpenId Connect)

this will require users to authenticate with an existing account when accessing the web form. 

Note:

Concerning Employee Requests: We commonly see customers use this option when solving for Employee Rights by allowing the user to log into their Identity Provider (i.e. Azure or Okta) and allowing for further evidence of their ID.

Targeted Data Discovery

OneTrust also allows organizations to establish connections with existing systems for their own internal ID Verification procedures.

For more information on these enhancements, see ID Verification Methods and Targeted Data Discovery.

Best Practices for ID Verification

Accurately verifying a data subject’s identity is a crucial first step to fulfilling their request. There is a balance to be found between a tedious and time intensive verification process and the speed and efficiency of fully automated fulfillment. The identifying element to be verified should be dependent on your organization’s process for fulfillment. For example, if email address is to be used as the unique identifier for a DSAR as well as any searches in your organization’s data sources, email address verification should be required. If, on the other hand, an account number or customer number is being utilized for searches of data sources, verifying the ownership of that account / customer number should be the core concern. 

When in doubt, a more intensive verification process is always better than a less intensive verification process. Options to consider include the uploading of a billing statement to the privacy portal, a combination of email and SMS verification, and the use of third-party verification partners. Leverage automated reminder emails for email verification where possible. Consult your legal counsel to ensure you are providing an adequate level of verification to lessen any potential liability. Also note that verification methodologies may differ depending on the data subject and request type. 

Once a verification strategy (or strategies) has been finalized, individual actions should be documented into user subtasks within the appropriate workflows.  

Regarding requests made on behalf of a data subject by an “Authorized Agent,” additional verification steps are necessary. While our standard best practice is to disable the ability to upload attachments at the time of submission (to reduce the collection of unnecessary PII), for Authorized Agent scenarios we recommend requiring the attachment of documentation such as an avadavat proving the relationship between agent and data subject. Consider using visibility rules to hide the attachment option in all cases other than Authorized Agent submissions.

Web Form Routing Rules

Once you have configured your web form(s) and workflows, the next step is to map each workflow to the applicable web form(s).  Routing rules allow you to:

• Ensure specific requests follow the appropriate workflows 

• Track the initial fulfillment timeline based on the specific state requirements for that request type (i.e. 45 days). 

  Note:

  All US Privacy Laws provide an initial fulfillment timeline of 45 days for all requests and commonly allow for extensions of an additional 45 days. A key exception is the CCPA Opt-out of Sale that has a deadline of 15 days with no extension.

• Assign specific approvers and informed parties to a new request Establish any auto-rejection logic

We recommend customers configure based on grouping of states, as these details are likely to not change year-over-year and can be treated as a “set-and-forget” configuration step. Take into consideration the many state regulations that may pass in the future and have a plan of action to edit your routing rules accordingly. If there are any saved changes to an active web form, you must republish for those changes to go into effect. This republishing will not change the web form’s URL.

For guidance on how to configure specific routing rules, please visit Creating Web Form Rules.

Response Templates & Privacy Portal

Another action item for configuration related to US Privacy laws going into effect for 2024 will be to evaluate how your organization will communicate with your data subject. This is broken out into:

• Response Templates

• Privacy Portal

Response Templates

OneTrust Privacy Rights Automation seeds response templates that can be sent through our secure messaging portal. These templates are designed to ensure communications sent to the individual match your organization's legal messaging and reduce the lift of crafting messages for each interaction. The list of available templates can be seen and further customized via the Response Templates screen. 

For more information on how to edit these templates, see  Lesson 3: Using Response Templates  and  Using Response Templates.

Privacy Portal

Finally, you will want to make sure that your secure messaging Privacy Portal is branded appropriately. This portal will adopt the branding configuration  established in the main application settings. You'll also need to ensure emails sent from the OneTrust application are branded accordingly as well.

For more information, see  Emails: Branding and Templates. In the scenario of multiple webforms with separate branding being utilized, a common “parent” branding is recommended to be applied to the main application (and therefore the portal).

Deploy the Web Form

Once you have configured and tested the different components of your Privacy Rights Automation module, you can publish and host your live web form to begin intake. Ensure that your most up-to-date workflows are all in an Active state, then route each web form to its respective workflow in the Web Form Customization settings.

For more guidance on how to generate a web form link, please visit Generating a Web Form Link.