FTC Negative Option Rule, Click to Cancel (16 CFR Part 425)

The 2024 Click to Cancel rule was vacated, but ROSCA and state auto-renewal laws still govern how subscription websites disclose, charge, and cancel.

Indiana Consumer Data Protection Act (SB 5)

Indiana’s privacy law, effective January 1, 2026, requires notices, consumer rights, and opt-outs on the Virginia model.

Kentucky’s privacy law, effective January 1, 2026, follows the Virginia model with notices, consumer rights, and opt-out duties.

Rhode Island requires privacy policy disclosures from sites of any size, plus full controller duties for larger data processors.

Maryland’s MODPA imposes hard data minimization, bans sensitive data sales, and reaches smaller businesses than most state privacy laws.

Minnesota’s privacy law adds profiling appeal rights and requires a written privacy policy with a named compliance lead.

Tennessee’s privacy law covers larger businesses and offers a NIST Privacy Framework safe harbor as an affirmative defense.

New Jersey’s privacy law treats financial data as sensitive, covers nonprofits, and counts any sale revenue toward its threshold.

Delaware’s privacy law applies at low thresholds, covers many nonprofits, and requires universal opt-out signal recognition.

Iowa’s business-friendly privacy law requires notices and opt-outs but no correction right and no data protection assessments.