For six years, the advertising industry planned a funeral. The guest of honor declined to attend. What follows is a practitioner’s map of where personalization actually stands now that the cookie survived but the law that made cookie-based targeting easy did not.
The Cookie That Refused to Die
For the better part of six years, the digital advertising industry planned a funeral. The deceased was to be the third-party cookie. Chrome, which carries roughly two-thirds of the world’s web traffic, had announced the cause of death and even circulated a rough date. The rest of us dressed in black, commissioned think pieces on the “cookieless future,” booked conference panels with appropriately grave titles, and rearranged entire measurement stacks around the premise that the humble text file was, at last, mortal.
Then the guest of honor declined to attend its own funeral.
In July 2024, Google reversed course and announced it would not phase out third-party cookies in Chrome after all. In April 2025, it confirmed there would not even be a standalone prompt asking users to choose.[1] And in October 2025, Google quietly dismantled most of the Privacy Sandbox, the elaborate replacement apparatus it had spent six years and untold engineering hours constructing.[2] The cookie, like a certain Russian mystic, had been poisoned, shot, and thrown into the river, and it climbed back out to ask what was for dinner.
If you sell leads or broker data for a living, resist the urge to celebrate. The cookie survived, but the world that made cookie-based targeting easy did not. What changed was not the technology. What changed was the law, and the law is now considerably less forgiving than a browser setting. This article walks through what Google actually did, why it barely matters, and what a durable, defensible personalization posture looks like for the lead generation and data brokerage businesses that will feel the enforcement first.
What Google Actually Did (and Did Not Do)
The reversal is worth stating precisely, because the industry summary of it tends to be wrong in both directions. Google did not kill the cookie, and Google did not save it. Google walked away from being the party responsible for its fate.
On April 22, 2025, Google confirmed it would maintain the existing approach to third-party cookie choice in Chrome and would not roll out a new standalone prompt.[3] Chrome keeps third-party cookies enabled by default, with the same buried user toggles that were always there. Then, on October 17, 2025, Google retired most of the Privacy Sandbox APIs, including Topics, Protected Audience, Attribution Reporting, IP Protection, and Related Website Sets. Only three narrow features survived: CHIPS for cookie partitioning, FedCM for privacy-preserving sign-in, and Private State Tokens for fraud signals.[4][5] The stated reasons were unremarkable and honest enough: adoption of the new tools had been anemic, publishers feared revenue loss, and regulators in the United Kingdom and elsewhere had spent years scrutinizing whether the whole project would simply entrench Google’s own advertising dominance.
Here is the judgment call worth flagging early. The three surviving Sandbox features are plumbing, not targeting. They handle partitioning, authentication, and anti-fraud. None of them restores audience-level behavioral targeting or cross-site attribution. So the practical situation is that the replacement never arrived, and the thing it was meant to replace was never removed. That is a reprieve for cookie-dependent workflows, but it is a technical reprieve, not a legal one. Nothing about Google’s decision changed a single obligation under any privacy statute.[6]
The Cookieless Present Was Already Here
There is a second reason the reversal matters less than the headlines suggested. A meaningful slice of the web was already cookieless before Google blinked and remains so regardless of anything Chrome decides.
Safari has blocked third-party cookies by default since 2020 through Intelligent Tracking Prevention. Firefox partitions them through Total Cookie Protection. Brave blocks essentially everything. Taken together, that is roughly a fifth of global traffic that arrives without a usable third-party cookie, independent of Chrome’s policy.[7] For a lead generation operation, that means roughly a fifth of your addressable audience has been invisible to cookie-based identity graphs for years. The “cookieless future” was never a future. It was a present that a large fraction of your traffic was already living in, quietly degrading match rates while everyone waited for Chrome to make it official.
Consent Stopped Being a Banner and Became a Signal
While the industry watched the cookie, the genuinely consequential shift happened in state legislatures. As of early 2026, twenty states operated comprehensive consumer privacy laws, with Indiana, Kentucky, and Rhode Island joining on January 1, 2026. By April 2026, Oklahoma and Alabama had pushed the total past twenty-one, and the count continues to climb.[8][9] The federal bill that would have preempted all of this, the American Privacy Rights Act, expired without a vote, so the patchwork is still the permanent operating environment rather than a temporary inconvenience.
The variety is the headache, not the count. Thresholds swing from Rhode Island’s low bar of thirty-five thousand consumers to six-figure floors elsewhere, while Texas and Nebraska impose no volume threshold at all. Most states run an opt-out model; several demand opt-in consent for sensitive data. Maryland’s Online Data Privacy Act carries the strictest data-minimization language in the country and flatly prohibits the sale of sensitive personal information. Only California grants a private right of action under its comprehensive privacy statute, and even there it is confined to data-breach claims rather than the opt-out rules. Separately, California’s Invasion of Privacy Act, a decades-old wiretapping statute, supplies a considerably broader private right of action for tracking-technology claims and does not require a data breach at all.[10]
The single most important structural change for anyone in this readership is quieter than any of that. Opt-out is no longer something a consumer clicks on your banner. It is something the browser transmits automatically. At least twelve states now require businesses to honor the Global Privacy Control as a universal opt-out mechanism, among them California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, and Texas.[11][12] The Global Privacy Control is a header the browser or an extension sends on its own. The consumer visits your site, the signal arrives with the request, and the law expects you to recognize it and suppress the relevant data flows before anything fires.[13]
This is where implementations fail quietly, and where the enforcement is going. A site can display a polished “Your Privacy Choices” link and still stream identifiers to advertising partners for a visitor whose browser is broadcasting an opt-out, because the banner and the signal were never wired together. The California Attorney General’s 2022 settlement with Sephora put down the marker that a failure to process the Global Privacy Control is itself a violation.[14] Looking ahead, California’s AB 566, the “Opt Me Out” Act, will require browsers themselves to offer built-in universal opt-out signals beginning January 1, 2027, which will only increase the share of your traffic that arrives pre-opted-out.[15]
The Enforcement Turn: From Policies on Paper to Plumbing on the Wire
Regulators have noticed the gap between what privacy policies promise and what pages actually transmit, and they have restructured their enforcement to test the plumbing rather than read the prose.
On September 9, 2025, the California Privacy Protection Agency, the Colorado Attorney General, and the Connecticut Attorney General announced a coordinated investigative sweep aimed specifically at businesses that fail to honor opt-out preference signals.[16] That is the first cross-state, coordinated action targeting a single technical compliance issue, and it signals that universal opt-out compliance is now a multi-state priority rather than a state-by-state gamble. Enforcement has followed the theme. The Walt Disney Company settled California Attorney General claims for $2.75 million (announced February 11, 2026) tied in part to honoring rights requests across its services, and New York’s Attorney General sent Instacart a formal demand letter in January 2026 under the state’s new Algorithmic Pricing Disclosure Act, testing whether personal data used to shape prices is adequately disclosed.[17] The common thread is that regulators are now examining whether opt-out mechanisms function in practice, not merely whether they exist on paper.
Two operational implications follow directly. First, the same tracking technology that creates a state opt-out obligation can independently support a wiretapping claim under statutes like the California Invasion of Privacy Act, so a single misconfigured pixel can generate liability on two separate theories at once. Second, vendor contracts are now an enforcement finding, not a back-office formality. Recent settlements have specifically cited deficient advertising-technology contracts, which means a stale data-processing addendum with an ad partner is not paperwork risk. It is exposure.
The Data Broker Reckoning: DROP and the August Cliff
For the data brokerage side of this readership, the calendar has a hard edge on it, and it is close. California’s Delete Act created a centralized Delete Request and Opt-out Platform, known as DROP. Consumers have been able to file deletion requests through it since January 1, 2026. Registered data brokers must begin retrieving and processing those requests on August 1, 2026.[18][19] As of this writing, that is a matter of days away.
The first thing to understand is that the statutory definition of “data broker” is deliberately broad and may capture businesses that have never thought of themselves as brokers. It reaches any business that knowingly collects and sells the personal information of consumers with whom it has no direct relationship, and it carries no revenue threshold.[20] Lead providers who build audiences from third-party data, enrichment vendors, and firms that resell segments are squarely in the frame.[21] The 2026 regulations narrowed the “direct relationship” safe harbor further, clarifying that merely collecting information directly from a consumer is not enough; the consumer must have intended to interact with the business for its products or services.[22] Many organizations that assumed they were outside the regime will discover, on inspection, that they are inside it.
The mechanics are demanding. Beginning August 1, 2026, brokers must access DROP at least once every forty-five days, match requests against their records, and delete them within the statutory window, treating unverifiable requests as opt-outs rather than denying them.[23][24] Critically, the obligation is not merely to remove a name and address. It extends to the inferences derived from personal information, the algorithmically built profiles that tag a consumer as financially vulnerable, likely pregnant, or carrying a probable health condition. Those inferences are the industry’s most valuable product, and the deletion mandate targets that product directly.[25]
The penalty structure is what turns this from a compliance project into a board-level risk. A broker that fails to act on a deletion request faces fines of $200 per request, per day.[26][27] By early July 2026, more than six hundred brokers were registered and over a quarter of a million consumer requests were queued, which means a single missed compliance cycle carries a theoretical exposure that regulators have themselves described, based on a thirty-day calculation window, in the range of $1.5 billion.[28] That figure is the outer edge of what the statute permits rather than a forecast, but the arithmetic is not comforting, and the Delete Act includes no cure period. Enforcement can begin the moment a violation occurs.
None of this arrives in a vacuum. California stood up a Data Broker Enforcement Strike Force in late 2025 and has already imposed penalties, including a $42,000 fine against a data provider that resold the personal information of people with serious health conditions for targeted advertising without registering.[29] Separately, SB 361 expanded the annual disclosures brokers must make, now reaching whether they share data with foreign actors, government entities, or developers of generative artificial intelligence systems.[30] And at the federal level, the Federal Trade Commission has begun reminding brokers of their obligations under the Protecting Americans’ Data from Foreign Adversaries Act, warning that data on servicemembers is covered.[31]
The useful mental model for a lead business is the Do-Not-Call registry, with one important difference. The Do-Not-Call rules restrict outbound contact. DROP targets the resale layer itself, creating deletion and suppression obligations that govern whether a consumer’s data can continue circulating through enrichment and resale markets at all. The control pattern that operators already know from prior-express-written-consent workflows is exactly the one that fits: a reliable suppression check baked into ingestion and delivery pipelines, so that a deleted record does not quietly reappear the next time you buy an append.[32]
The Lead Generation Consent Whiplash
The telephone side of the lead generation world has spent the last eighteen months on a regulatory rollercoaster, and the ride has a lesson embedded in it that applies well beyond the phone.
The Federal Communications Commission’s one-to-one consent rule, adopted in December 2023, would have closed what the agency called the “lead generator loophole” by requiring a consumer to consent to each seller individually and to limit consent to communications logically and topically associated with the original interaction. On 24 January 2025, the Eleventh Circuit vacated the rule in Insurance Marketing Coalition Ltd. v. FCC, holding that the Commission had exceeded its statutory authority by reading additional restrictions into the phrase “prior express consent.”[33][34] The decision arrived in the wake of the Supreme Court’s abandonment of Chevron deference in Loper Bright Enterprises v. Raimondo, and the Commission ultimately declined to fight it, issuing a conforming rule on Aug. 29, 2025 that brought the printed regulation into line with the court’s mandate and formally removed the one-to-one requirement from the Code of Federal Regulations.[35]
It would be a mistake to read that as deregulation. As commentators including our own firm noted at the time, nothing that was illegal on the day before the ruling became legal the day after.[36] Prior express written consent is still required, and it still must be clear and conspicuous. Meanwhile the states have not waited. Florida, Oklahoma, Washington, and a growing roster of others maintain and expand their own mini-statutes, several of which impose requirements stricter than the federal floor, and carrier and messaging-platform rules frequently demand consent granularity that federal law does not.[37] The through-line is unmistakable. The single federal chokepoint failed on administrative-law grounds, but the direction of travel across every other authority is toward more granular, more individualized, better-documented consent, not less. Building a business model on the assumption that a vacated rule stays vacated is a poor hedge against a plainly stated trend.
What Durable Targeting Actually Looks Like Now
Strip away the noise and the surviving strategies share a single property: the legal basis travels with the data. Each of the fashionable alternatives is genuinely useful, and each carries a caveat that the vendor pitch tends to omit.
First-party and zero-party data, collected directly from a consumer who intended to interact with you, is the durable asset. Every product decision that raises authentication rates pays dividends downstream in both measurement and compliance, because a logged-in relationship is the cleanest possible basis for personalization. Authenticated identity is the same insight expressed as infrastructure.
Hashed-email identifiers, such as the UID2 framework, are the most common bridge across the open web. The caveat is legal, not technical: hashing is not anonymization.[38] A hashed email that resolves to an individual remains personal information under state law and transmitting it to a partner can still constitute a “sale” or “share” that a universal opt-out signal is entitled to stop. The hash changes the format of the identifier, not its legal character.
Contextual targeting, which reads the page rather than the person, is the quiet winner. It does not depend on cookie behavior and does not implicate consent in the same way, which makes it the one durable signal that survives every browser policy and every state statute. Data clean rooms are a legitimate way to combine datasets under controlled conditions, but they do not launder a missing legal basis; if you had no right to use the data, matching it inside a clean room does not create one. And server-side tracking, often sold as an escape hatch, is nothing of the sort. Moving the tag to your server does not exempt the transfer from consent obligations, and both European ePrivacy rules and the California “sale or share” framework reach server-to-server transfers directly.[39] The consistent theme across all five is that the technology has stopped being the constraint. The legal basis is the constraint, and the only approaches that scale are the ones where that basis is attached to the record itself.
A Compliance Posture for the Next Eighteen Months
The following is a conservative posture rather than a minimum, and it is offered as general guidance rather than advice on any specific operation. Where a judgment call exists, I have attempted to flag it.
- Wire the banner to the signal. Detect the Global Privacy Control, at both the HTTP header and the browser-property level and confirm that recognizing it actually suppresses downstream identifier transmissions. Load your own site with the signal active and watch the request waterfall. That is precisely the test a regulator can run without ever reading your policy.[40]
- Assume you are a data broker until you have proven otherwise. Run the direct-relationship analysis against the narrowed 2026 definition, register if you qualify, and build DROP retrieval and suppression into your pipelines before August 1st. The seven-month backlog of queued requests hits the workflow of anyone who waited, all at once.[41][42]
- Make opt-outs propagate downstream, by contract and in code. Your advertising-technology addenda must require partners to honor and pass through universal opt-out signals, and your systems must actually transmit the suppression. A deleted or opted-out record that reappears through an append is a live exposure, not a cosmetic defect.[43]
- Track consent at the individual level and keep the proof. Retain the certification, the exact disclosure text, the URL, and the timestamp for every consent, and audit each vendor’s consent flow at least annually. This is inexpensive relative to a single class-action defense, and it is the record that decides those cases.[44]
- Treat hashing and server-side deployment as engineering choices, not legal ones. Neither converts personal information into anonymous data, and neither escapes the sale-or-share analysis. Document the legal basis independently of the transport mechanism.
- Refresh your data map and your assessments. Inventory every advertising and tracking flow, complete the targeted-advertising and profiling assessments that most state laws now require, and document how your minimization practices satisfy the stricter standards emerging in states like Maryland.[45]
Conclusion: The Efficiency Frontier Moved
The survival of the cookie was the least important advertising development of the last two years. It preserved a familiar workflow for a while longer, and it lulled a portion of the industry into believing the reckoning had been cancelled. It was not cancelled. It moved.
The efficiency frontier for personalization no longer runs along the axis of how much you can collect. It runs along the axis of how much you can collect with a legal basis that travels with the data, through every enrichment, every resale, and every server-to-server hop, and that answers correctly when a browser quietly says no. The operators who win the next several years will be the ones who stopped treating consent as a banner to be dismissed and started treating it as infrastructure to be engineered, tested, and maintained. Everyone else will keep planning the cookie’s funeral, and keep being surprised when the regulators, rather than the browser, turn out to be the ones holding the shovel.
This article is provided for general informational purposes only, reflects developments as of July 2026, and does not constitute legal advice or create an attorney-client relationship. The regulatory landscape described here is changing rapidly. Consult qualified counsel regarding any specific situation.
Citations
[1] Chavez, Anthony. “Next Steps for Privacy Sandbox and Tracking Protections in Chrome.” Privacy Sandbox, Google, 22 Apr. 2025, https://privacysandbox.google.com/blog/privacy-sandbox-next-steps.
[2] “Third-Party Cookies in 2026: What Actually Happened After Google’s Reversal.” Consenteo, 3 Apr. 2026, https://www.consenteo.com/knowledge-hub/cookies/third_party_cookies_2026_after_google_reversal.
[3] Chavez, “Next Steps for Privacy Sandbox and Tracking Protections in Chrome,” https://privacysandbox.google.com/blog/privacy-sandbox-next-steps.
[4] “Third-Party Cookies in 2026,” Consenteo, https://www.consenteo.com/knowledge-hub/cookies/third_party_cookies_2026_after_google_reversal.
[5] “Google Privacy Sandbox Officially Shuts Down: What It Means and What’s Next.” Usercentrics, 12 Feb. 2026, https://usercentrics.com/knowledge-hub/what-is-google-privacy-sandbox/. See also Chavez, Anthony. “Update on the Plan for Privacy Sandbox Technologies.” Privacy Sandbox, Google, https://privacysandbox.google.com/blog/update-on-plans-for-privacy-sandbox-technologies (Google’s own confirmation of the retirement, cited here in preference to a third-party summary).
[6] “Google Privacy Sandbox Officially Shuts Down,” Usercentrics, https://usercentrics.com/knowledge-hub/what-is-google-privacy-sandbox/.
[7] “Third-Party Cookies in 2026,” Consenteo, https://www.consenteo.com/knowledge-hub/cookies/third_party_cookies_2026_after_google_reversal.
[8] “The US State Privacy Law Tracker for 2026: Twenty Laws, One Compliance Baseline.” Consenteo, 10 Apr. 2026, https://www.consenteo.com/knowledge-hub/legal/us_state_privacy_law_tracker_2026.
[9] “20 State Privacy Laws in Effect in 2026: Key Dates and Changes.” MultiState, 1 May 2026, https://www.multistate.us/insider/2026/2/4/all-of-the-comprehensive-privacy-laws-that-take-effect-in-2026.
[10] “The US State Privacy Law Tracker for 2026,” Consenteo, https://www.consenteo.com/knowledge-hub/legal/us_state_privacy_law_tracker_2026.
[11] “The US State Privacy Law Tracker for 2026,” Consenteo, https://www.consenteo.com/knowledge-hub/legal/us_state_privacy_law_tracker_2026.
[12] “Global Privacy Controls: Preparing for the Next Wave of Enforcement.” Foster Garvey PC, 30 Apr. 2026, https://www.foster.com/newsroom/legal-alerts/global-privacy-controls-preparing-for-the-next-wave-of-enforcement/.
[13] “The State Privacy Patchwork in 2026: Opt-Out Rights, Global Privacy Control, and Where Website Enforcement Landed.” LawsuitGuard, 2026, https://lawsuitguard.com/insights/state-privacy-gpc-and-opt-out-signals.
[14] “The State Privacy Patchwork in 2026,” LawsuitGuard, https://lawsuitguard.com/insights/state-privacy-gpc-and-opt-out-signals.
[15] “Global Privacy Controls,” Foster Garvey PC, https://www.foster.com/newsroom/legal-alerts/global-privacy-controls-preparing-for-the-next-wave-of-enforcement/.
[16] “The US State Privacy Law Tracker for 2026,” Consenteo, https://www.consenteo.com/knowledge-hub/legal/us_state_privacy_law_tracker_2026.
[17] Compare “California Attorney General Announces Largest CCPA Settlement.” WilmerHale, 9 Mar. 2026, https://www.wilmerhale.com/en/insights/blogs/wilmerhale-privacy-and-cybersecurity-law/20260309-california-attorney-general-announces-largest-ccpa-settlement; and “Attorney General James Demands Answers from Instacart About Algorithmic Pricing.” Office of the New York Attorney General, 8 Jan. 2026, https://ag.ny.gov/press-release/2026/attorney-general-james-demands-answers-instacart-about-algorithmic-pricing.
[18] “Is Your Business a ‘Data Broker’?: California’s DROP Goes Live, and CalPrivacy Continues to Enforce Delete Act.” Clark Hill PLC, 14 Jan. 2026, https://www.clarkhill.com/news-events/news/is-your-business-a-data-broker-californias-drop-goes-live-and-calprivacy-continues-to-enforce-delete-act/.
[19] “DROP for Data Brokers.” California Privacy Protection Agency, accessed 16 July 2026, https://privacy.ca.gov/data-brokers/.
[20] “DROP for Data Brokers,” California Privacy Protection Agency, https://privacy.ca.gov/data-brokers/.
[21] “Is Your Business a ‘Data Broker’?,” Clark Hill PLC, https://www.clarkhill.com/news-events/news/is-your-business-a-data-broker-californias-drop-goes-live-and-calprivacy-continues-to-enforce-delete-act/.
[22] “Analyzing the California Delete Act Regulations.” Troutman Pepper Locke, 4 Dec. 2025, https://www.troutmanprivacy.com/2025/12/analyzing-the-california-delete-act-regulations/.
[23] “DROP for Data Brokers,” California Privacy Protection Agency, https://privacy.ca.gov/data-brokers/.
[24] “California Delete Act (SB 362) Compliance: DROP Platform Impact on Lead Sellers in 2026.” Lead Gen Economy, 17 Jan. 2026, https://www.leadgen-economy.com/blog/california-delete-act-drop-lead-sellers/.
[25] “California DROP Enforcement Hits Aug. 1: Data Brokers Face $200-Per-Day Fines.” Tech Times, 8 July 2026, https://www.techtimes.com/articles/319927/20260708/california-drop-enforcement-hits-aug-1-data-brokers-face-200-per-day-fines.htm. See also Cal. Civ. Code §1798.140(v)(1)(K), https://codes.findlaw.com/ca/civil-code/civ-sect-1798-140/ (defining “sale” to include inferences derived from personal information).
[26] “DROP for Data Brokers,” California Privacy Protection Agency, https://privacy.ca.gov/data-brokers/.
[27] “California Delete Act (SB 362) Compliance,” Lead Gen Economy, https://www.leadgen-economy.com/blog/california-delete-act-drop-lead-sellers/.
[28] “California DROP Enforcement Hits Aug. 1,” Tech Times, https://www.techtimes.com/articles/319927/20260708/california-drop-enforcement-hits-aug-1-data-brokers-face-200-per-day-fines.htm.
[29] “Is Your Business a ‘Data Broker’?,” Clark Hill PLC, https://www.clarkhill.com/news-events/news/is-your-business-a-data-broker-californias-drop-goes-live-and-calprivacy-continues-to-enforce-delete-act/.
[30] “20 State Privacy Laws in Effect in 2026,” MultiState, https://www.multistate.us/insider/2026/2/4/all-of-the-comprehensive-privacy-laws-that-take-effect-in-2026.
[31] “Data Brokers and Their Partners Navigate New Compliance Regimes.” Venable LLP, 10 Mar. 2026, https://www.venable.com/insights/publications/2026/03/data-brokers-and-their-partners-navigate-new.
[32] “California Delete Act (SB 362) Compliance,” Lead Gen Economy, https://www.leadgen-economy.com/blog/california-delete-act-drop-lead-sellers/.
[33] Insurance Marketing Coalition Ltd. v. FCC, No. 24-10277 (11th Cir. 24 Jan. 2025).
[34] Troutman, Eric J. “Eleventh Circuit Overturns Major FCC TCPA Ruling: Here’s the Czar’s Definitive Take.” National Law Review, Troutman Amin, LLP, 27 Jan. 2025, https://natlawreview.com/article/eleventh-circuit-overturns-major-fcc-tcpa-ruling-heres-czars-definitive-take-ruling.
[35] “The FCC Issues Final Rule Formally Eliminating the One-to-One Consent Requirement.” Consumer Finance Insights, 15 Sept. 2025, https://www.consumerfinanceinsights.com/2025/09/15/the-fcc-issues-final-rule-formally-eliminating-the-one-to-one-consent-requirement/. See also Federal Communications Commission, Rules and Regulations Implementing the Telephone Consumer Protection Act of 1991, 90 Fed. Reg. 41,614 (29 Aug. 2025) (FR Doc. 2025-16641), https://www.govinfo.gov/content/pkg/FR-2025-08-29/html/2025-16641.htm (the primary source, which issued 29 Aug. 2025, not September 2025 as the secondary source’s headline states, and which implemented the court’s mandate rather than announcing an independent policy change).
[36] Troutman, “Eleventh Circuit Overturns Major FCC TCPA Ruling,” https://natlawreview.com/article/eleventh-circuit-overturns-major-fcc-tcpa-ruling-heres-czars-definitive-take-ruling.
[37] “FCC One-to-One Consent Rule Status Update 2026.” InsureLeads, 18 Mar. 2026, https://www.getinsureleads.com/blog/fcc-one-to-one-consent-rule-status-update-2026.
[38] “Third-Party Cookies in 2026,” Consenteo, https://www.consenteo.com/knowledge-hub/cookies/third_party_cookies_2026_after_google_reversal.
[39] “The State Privacy Patchwork in 2026,” LawsuitGuard, https://lawsuitguard.com/insights/state-privacy-gpc-and-opt-out-signals.
[40] “Analyzing the California Delete Act Regulations,” Troutman Pepper Locke, https://www.troutmanprivacy.com/2025/12/analyzing-the-california-delete-act-regulations/.
[41] “California Delete Act (SB 362) Compliance,” Lead Gen Economy, https://www.leadgen-economy.com/blog/california-delete-act-drop-lead-sellers/.
[42] “Global Privacy Controls,” Foster Garvey PC, https://www.foster.com/newsroom/legal-alerts/global-privacy-controls-preparing-for-the-next-wave-of-enforcement/.
[43] “FCC One-to-One Consent Rule Status Update 2026,” InsureLeads, https://www.getinsureleads.com/blog/fcc-one-to-one-consent-rule-status-update-2026.
[44] “U.S. Privacy Laws (and Key Provisions) That Take Effect or Become Enforceable in 2026.” Vault JS, 2026, https://vaultjs.com/resources/us-privacy-laws-and-key-provisions-that-take-effect-or-become-enforceable-in-2026/. See also “Differing Data Minimization Standards: Comparing California’s CCPA and Maryland’s MODPA.” California Lawyers Association, https://calawyers.org/privacy-law/differing-data-minimization-standards-comparing-californias-ccpa-and-marylands-modpa/ (direct treatment of Maryland’s minimization standard; the Vault JS source above does not address minimization).
[45] “No, Hashing Still Doesn’t Make Your Data Anonymous.” Federal Trade Commission, Tech@FTC, July 2024, https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/07/no-hashing-still-doesnt-make-your-data-anonymous.
Discover more from TCPAWorld
Subscribe to get the latest posts sent to your email.