CMP Recommendations: US Multi-State
The Multi-State Template can be used as a starting point for compliance with other US State privacy statutes, including (1) Virginia CDPA; (2) the Texas DPSA; (3) the Florida DBR; (4) the Oregon CPA; and (5) the Montana CDPA.
The Multi-State Template is based on Virginia’s CDPA. Virginia's CDPA has no consent requirement to process personal data generally, but a set of opt-outs (meaning that these categories are “on” automatically) corresponding to at least sale, targeted advertising, and profiling, and a set of opt-ins (meaning that these categories are “off” automatically) for certain other types of processing. This makes the Virginia an appropriate template from which to begin.
Review our overview and resource page of the US State Privacy Compliance areas here.
OneTrust recommends the following configurations for the CMP template to help align with these unique requirements: Categories | Banner | Preference Center | Geolocation Rules.
Categories
Add new bundled cookie categories for the following. Other categories besides the below opt-out and opt-in groups should provide information but can contain either greyed out toggles or no toggle option as they do not need to be consented to under any US State general privacy statute.
For instructions on how to add a new category, see Managing and Categorizing Cookies and SDKs.
For instructions on how to create a new bundle group, see Managing Categories with Bundle Groups.
|
Bundle Group Name |
Categories |
Consent Model |
Description |
|---|---|---|---|
|
Sale of Personal Data, Profiling, and Targeted Advertising
Note:
Leverage and rename the existing bundle group created automatically by the Virginia CDPA template. |
|
Opt-Out |
Third party trackers collect information to use for analytics and to personalize your experience with targeted ads. Under the Colorado CPA, the Virginia CDPA, the Texas DPSA, the Oregon CPA, the Montana CDPA, and the Florida DBR, you have the right to opt-out of the sale of your personal data to third parties, of targeted advertising related processing, and of some types of profiling. You may exercise your rights by using the toggles below. If you opt out, the ads and content that you see may not be as relevant to you. Under the Colorado CPA, you have the right to opt back in to these categories at any time should you initially choose to opt out, and you may do so using the same toggles provided below. For more details on the data we process and how to exercise your rights, and to view information related to required opt-in disclosures, see our Privacy Policy (link to privacy policy). |
|
Sensitive Data Processing, Sale of Sensitive Data, and Processing for Secondary Purposes
Note:
This bundle group is optional and should be used only if necessary based on your business practices. |
|
Opt-In |
Under the Colorado CPA, the Virginia CDPA, the Texas DPSA, the Oregon CPA, the Montana CDPA, and the Florida DBR, you have the right to opt-in to the sale of your sensitive personal data, the processing of your sensitive personal data, and processing of personal data for secondary purposes. Opting in will allow us to tailor your experience and the ads you see to be more relevant to you. You may view a description of secondary purposes you may wish to opt-in to below. Sensitive data may include things like genetic or biometric data, precise geolocation data, and data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status. For more details on the data we process and how to exercise your rights, and to view information related to required opt-in disclosures, see our Privacy Policy (link to privacy policy). |
|
Children’s Data
Note:
This bundle group is optional and should be used only if necessary based on your business practices. |
|
Opt-In |
Under the Colorado CPA, the Virginia CDPA, the Texas DPSA, the Oregon CPA, the Montana CDPA, and the Florida DBR, you must provide opt-in consent to the processing of personal data of children under 13 years of age, to targeted advertising to certain ages of children, and to the collection and processing of the sensitive data of certain ages of children. If the child is under 13 years of age, you must authenticate yourself as the child’s guardian in order to consent to processing the child’s personal data, including sensitive personal data, by clicking “Processing of Sensitive Data” below. If you are 13 to 18 years of age, under the Florida DBR you may opt-in to processing of sensitive data by clicking “Processing of Sensitive Data,” below. If you are 13 to 16 years of age, under the Montana DCPA and Oregon CPA, you may opt-in to the sale of your sensitive personal data and targeted advertising by clicking “Sale of Sensitive Data” and “Targeted Advertising,” below. If you are 13 to 15 years of age, under the Oregon CPA, you may opt-in to certain types of profiling by clicking “Profiling,” below. Opting in will allow us to tailor your experience and the ads you see to be more relevant to you. For more details on the data we process and how to exercise your rights, and to view information related to required opt-in disclosures, see our Privacy Policy (link to privacy policy). |
Banner Configuration
In order to configure your Banner, you must first create a new CMP template with the Virginia Consumer Data Protection Act (CDPA) framework. For more information, see Adding, Editing, and Managing Cookie Consent Templates.
The following configurations are suggested for your CMP Banner. For instructions on how to set up or edit your Banner, see Customizing the Banner Template.
|
Banner Template Section |
Setting |
Recommended Configuration |
|---|---|---|
|
Content > Title & Description |
See Recommended Configuration |
Opt-Out Preference Signal Not Detected This website uses tracking technologies to enable our website functionalities, to enhance user experience or to analyze performance and traffic. We may also share or sell information about your use of our site with our social media, advertising, and analytics partners. This allows us to perform targeted advertising and to select ads and content that will be more relevant to you. Below you can Accept Default Settings, Reject All trackers, or exercise your right to opt -in or -out of the sale of personal data, targeted advertising, profiling, and the processing of sensitive data by clicking on “Manage Your Privacy Choices.” For more details on the data we process and how to exercise your rights, see our Privacy Policy [link to privacy policy]. Opt-Out Preference Signal Honored This website uses tracking technologies to enable our website functionalities, like enhancing user experience or analyzing performance and traffic. We have detected and honored your opt-out signal. Depending on your preferences, we may share or sell information about your use of our site with our social media, advertising, and analytics partners. This allows us to perform targeted advertising and to select ads and content that will be more relevant to you. Below you can Accept Default Settings, reject all trackers, or exercise your right to opt -in or -out of the sale of personal data, targeted advertising, profiling, and the processing of sensitive data by clicking on “Manage Your Privacy Choices”. For more details on the data we process and how to exercise your rights, see our Privacy Policy [link to privacy policy]. |
|
Content > Button Set |
Show Allow All Button |
Enabled Rename to Accept Default Settings. |
|
Show Cookies Settings Button |
Enabled Rename to Manage Your Privacy Choices. |
|
|
Show Reject All Button |
Enabled |
|
|
Show Close Button |
Enabled as Show Close Button (X). |
|
|
Content > Opt-Out Signal |
Enable Opt-Out Signal Notification |
Enabled |
Preference Center Configuration
In order to configure your Preference Center, you must first create a new CMP template with the Virginia Consumer Data Protection Act (CDPA) framework. For more information, see Adding, Editing, and Managing Cookie Consent Templates.
The following configurations are suggested for your CMP Preference Center. For instructions on how to set up or edit your Preference Center, see Customizing the Preference Center Template.
|
Preference Center Template Section |
Setting |
Recommended Configuration |
|---|---|---|
|
Content > Title & Description |
See Recommended Configuration |
Note:
You can tailor this description to fit your business needs and reflect your data collection processes. When you visit our website, we store trackers on your browser to collect information. The information collected might relate to you, your preferences, or your device, and is used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of tracking technologies, which may impact your experience of the site and the services we are able to offer. You can exercise your rights to opt-out by clicking on “Sale of Personal Data, Profiling, and Targeted Advertising,” below. You may also click on “Processing of Sensitive Data, Sale of Sensitive Data, and Processing for Secondary Purposes” to opt-in to further types of processing so that we may further tailor your experience to you. You cannot opt-out of First Party Strictly Necessary Trackers as they are deployed to ensure the proper functioning of our website (such as prompting the tracking technologies banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more details on the data we process and how to exercise your rights, and to view information related to required opt-in disclosures, see our Privacy Policy (link to privacy policy). |
|
Content > Button Set |
Enable Persistent Cookie Settings hover button |
Enabled |
|
Show Reject All Button |
Enabled |
|
|
Show Close Button |
Enabled |
|
|
Content > Opt-Out Signal |
Enable Opt-Out Signal Notification |
Enabled |
Geolocation Rule Configuration
The following configurations are suggested for your CMP Geolocation Rule. For instructions on how to set up or edit your Geolocation Rules, see Configuring Geolocation Rules.
You can either add a new rule to an existing Geolocation Rule Group or create a new Geolocation Rule Group and manually add a new rule for Washington and Nevada in addition to the default Global rule.
|
Setting |
Recommended Configuration |
|---|---|
|
Geolocation |
Select Virginia, Texas, Florida, Oregon, and Montana. |
|
Show Banner |
Enabled |
|
Cookie Categories Consent Model |
Select Custom. Configure the consent model for each bundle group as follows:
|