Editor J

California treats a browser opt-out signal such as Global Privacy Control as a valid request to stop selling or sharing your data. What the 2026 CCPA regulations require, from the 15-business-day deadline to the new duty to show the opt-out was honored.

The National Do Not Call Registry does not stop every call. Here is what the FTC Telemarketing Sales Rule (16 CFR 310.4) says about company-specific requests, the 540-day and 90-day business relationship windows, calling hours and robocalls.

Federal law gives senders 10 business days to honor an unsubscribe request, bars opt-out fees and logins, and stops them from selling your address. Here is what 15 U.S.C. 7704 and the FTC CAN-SPAM Rule say.

Federal law makes a credit freeze free, requires bureaus to place it within 1 business day of an online request and lift it within 1 hour, and lets parents freeze a child’s file. A guide based on 15 U.S.C. 1681c-1.

HIPAA gives you a right to see and copy your medical and billing records. Providers must act within 30 days, may extend once by 30 days in writing, may charge only listed cost-based fees, and must explain any denial in writing.

iPhone lets you refuse tracking app by app, so apps get zeros instead of the IDFA. Android lets you reset or delete the advertising ID. Step-by-step paths from Apple and Google help pages, and what these settings do not cover.

The FTC’s amended COPPA Rule took effect June 23, 2025, with compliance due April 22, 2026. A section-by-section look at new personal information, third-party consent, consent methods, security and retention duties.

Who the FTC Health Breach Notification Rule covers, what counts as a breach after the 2024 amendments, and the deadlines for notifying people, the FTC and the media.

Who must be notified, by when, and when the clock starts under GDPR Articles 33 and 34, SEC Form 8-K Item 1.05 and the HIPAA Breach Notification Rule.

What remote content in an email can tell the sender, how Apple Mail Privacy Protection and Gmail image settings change that, and what they do not cover.

How browser fingerprinting differs from cookies, the four types described in the W3C Note, and the EFF steps that reduce it, with their trade-offs.

The FCC’s 2023 order (FCC 23-95) requires U.S. wireless carriers to authenticate customers securely before a SIM change or port-out. Notices, account locks and fraud remediation were delayed. Where each rule stands in the code and what you can do now.

A passkey keeps the private key on your device and is bound to the real domain; a password is sent to the site. How NIST SP 800-63B-4 treats each, what syncing changes, and the current password rules.

How the Delete Request and Opt-out Platform works under the Delete Act: residency check, identifiers you can add, the 45-day broker cycle, the four status codes and what DROP does not cover.

What Article 15 GDPR lets you ask a company for, the one-month answer deadline in Article 12, when it can be extended, fees, identity checks and where to complain.