Merge pull request #95 from w3c/update-legal-changes-Feb-2024

Update legal changes as of Feb 2025

Author: j-br0

explainer.md

@@ -125,7 +125,14 @@ The regulations also set up a "registry" of legally binding signals under the la
 
 #### 4.1.3 Other states that explicitly provide for universal opt-out mechanisms
 
-In addition to California and Colorado, at least nine other states have passed comprehensive privacy legislation that explicitly provides for the operation of global privacy signals that must be treated as legally binding opt-outs under the law. Most of these state laws are broadly similar to the text of the Colorado Privacy Act, in that they apply to both sales and cross-context targeted advertising, and have similar provisions requiring, for example, that the signals reflect the intent of the user and that they not unfairly disadvantage other controllers. However, they also differ in a number of key ways. As one example, states like Texas and Nebraska provide that specific global opt-out signals will be deemed valid if they are legally recognized in another state jurisdiction. Most of these states do not provide for rulemaking from the Attorney General to issue more clarity on the operation of the global opt-out provisions, though regulators may offer more informal guidance through FAQs (as California originally did) or may bring enforcement actions to clarify the boundaries of the law.
+In addition to California and Colorado, at least ten other states have passed comprehensive privacy legislation that explicitly provides for the operation of global privacy signals that must be treated as legally binding opt-outs under the law. Most of these state laws are broadly similar to the text of the Colorado Privacy Act, in that they apply to both sales and cross-context targeted advertising, and have similar provisions requiring, for example, that the signals reflect the intent of the user and that they not unfairly disadvantage other controllers.
+
+However, they also differ in a number of key ways. As one example, states like Texas and Nebraska provide that specific global opt-out signals will be deemed valid if they are legally recognized in another state jurisdiction. Most of these states do not provide for rulemaking from the Attorney General to issue more clarity on the operation of the global opt-out provisions, though regulators may offer more informal guidance through FAQs (as California originally did) or may bring enforcement actions to clarify the boundaries of the law.
+
+Two states --- [Connecticut](https://portal.ct.gov/ag/sections/privacy/the-connecticut-data-privacy-act) and
+[New Jersey](https://www.njconsumeraffairs.gov/ocp/Pages/NJ-Data-Privacy-Law-FAQ.aspx) --- have issued FAQs explicity stating
+that GPC should be treated as a univeral opt-out under their laws (New Jersey's universal opt-out provision goes into effect
+on July 15, 2025).
 
 #### 4.1.4 States that have privacy law that is silent on universal opt-out mechanisms
 

index.html

@@ -410,7 +410,7 @@ <h3>United States Privacy Law</h3>
         have passed privacy laws that give consumers the legal right to opt out of the sale or share of
         their data, or the use of their data for cross-context targeted advertising. Many of those state
         laws make explicit provision for the exercise of those rights through universal opt-out mechanisms
-        such as the GPC. At least two states have specifically identified GPC as a valid means to exercise
+        such as the GPC. At least four states have specifically identified GPC as a valid means to exercise
         legal opt-out rights. A minority of states provide for rulemaking procedures to allow regulators
         to expand on the specifics of how universal opt-out requests should be honored; other states may
         rely upon informal guidance or enforcement actions to provide clarity on the scope of legal
@@ -474,7 +474,7 @@ <h2>User Interface Language</h2>
           such as a browser or operating system” ([[?COLORADO-REGULATIONS]], Rule 5.04(a)).
         </p>
         <p>
-          Currently California and Colorado are the only jurisdictions in the United States that empower
+          Currently California, Colorado, and New Jersey are the only jurisdictions in the United States that empower
           regulators to issue detailed regulations on topics such as universal opt-outs. Other statutes
           state relatively high level legal requirements that may be augmented by informal guidance
           (such as an FAQ) or through enforcement.