their internet activity, at the present time, it is up to internet search engines to
voluntarily implement changes to their browsers to block annoying ad formats.
80
Many states, most notably California, have enacted online privacy protection legislation. Many of these identity-theft protection measures impose an obligation on
business entities to protect social security numbers and similar person data against
unauthorized use.
81 California’s Online Privacy Protection Act requires any person
or entity that collects personally identifiable information from California residents
through an internet Web site or online service for commercial purposes, to identify
the categories of information that it collects about individual consumers as well as to
post a conspicuous privacy policy on its Web site or online service.
82 At least four
states have enacted legislation that protects the personal information of users of
digital book services and technologies.
83
2.2 Electronic Communications for Marketing Purposes
The small number of laws that regulate electronic marketing target specific marketing channels.
84 At the federal level, the Controlling the Assault of Non-Solicited
Pornography and Marketing Act of 2003 (CAN-SPAM) regulates all commercial
email.
85 The Act applies to any business entity or individual that initiates or sends
commercial messages via email. Critically, it gives recipients of commercial emails
the right to prohibit marketers from continuing to email them.
86 It covers all
commercial messages, which the law defines as “any electronic mail message the
primary purpose of which is the commercial advertisement or promotion of a
commercial product or service”. This includes all email that promotes content on
commercial websites.
87 The law makes no exception for business-to-business email
as even messages to former customers announcing new products must comply with
80 Toner (2017).
81 See, e.g., “State Laws Related to Internet Privacy”, National Conference of State Legislatures.
Available online at: http://www.ncsl.org/research/telecommunications-and-information-technol
ogy/state-laws-related-to-internet-privacy.aspx.
82 Calif. Bus. & Prof. Code § 22575–22578 (CalOPPA).
83 These states include: Arizona, California, Delaware, and Missouri.
84 Sotto and Simpson (2014) (Gideon Roberton (2014)). P. 192. Pp. 191–198. Available online at:
https://www.hunton.com/files/Publication/1f767bed-fe08-42bf-94e0-0bd03bf8b74b/Presentation/
PublicationAttachment/b167028d-1065-4899-87a9-125700da0133/United_States_GTDT_Data_
Protection_and_Privacy_2014.pdf.
85 15 U.S.C. §§ 7701–7713.
86 “CAN-SPAM Act: A Compliance Guide for Business”, Federal Trade Commission Website.
Available at: https://www.ftc.gov/tips-advice/business-center/guidance/can-spam-act-complianceguide-business. Last accessed on 17 July 2017.
87 See 15 U.S.C. § 7702(2)(A).
Data Protection in the United States: U.S. National Report
419
voluntarily implement changes to their browsers to block annoying ad formats.
80
Many states, most notably California, have enacted online privacy protection legislation. Many of these identity-theft protection measures impose an obligation on
business entities to protect social security numbers and similar person data against
unauthorized use.
81 California’s Online Privacy Protection Act requires any person
or entity that collects personally identifiable information from California residents
through an internet Web site or online service for commercial purposes, to identify
the categories of information that it collects about individual consumers as well as to
post a conspicuous privacy policy on its Web site or online service.
82 At least four
states have enacted legislation that protects the personal information of users of
digital book services and technologies.
83
2.2 Electronic Communications for Marketing Purposes
The small number of laws that regulate electronic marketing target specific marketing channels.
84 At the federal level, the Controlling the Assault of Non-Solicited
Pornography and Marketing Act of 2003 (CAN-SPAM) regulates all commercial
email.
85 The Act applies to any business entity or individual that initiates or sends
commercial messages via email. Critically, it gives recipients of commercial emails
the right to prohibit marketers from continuing to email them.
86 It covers all
commercial messages, which the law defines as “any electronic mail message the
primary purpose of which is the commercial advertisement or promotion of a
commercial product or service”. This includes all email that promotes content on
commercial websites.
87 The law makes no exception for business-to-business email
as even messages to former customers announcing new products must comply with
80 Toner (2017).
81 See, e.g., “State Laws Related to Internet Privacy”, National Conference of State Legislatures.
Available online at: http://www.ncsl.org/research/telecommunications-and-information-technol
ogy/state-laws-related-to-internet-privacy.aspx.
82 Calif. Bus. & Prof. Code § 22575–22578 (CalOPPA).
83 These states include: Arizona, California, Delaware, and Missouri.
84 Sotto and Simpson (2014) (Gideon Roberton (2014)). P. 192. Pp. 191–198. Available online at:
https://www.hunton.com/files/Publication/1f767bed-fe08-42bf-94e0-0bd03bf8b74b/Presentation/
PublicationAttachment/b167028d-1065-4899-87a9-125700da0133/United_States_GTDT_Data_
Protection_and_Privacy_2014.pdf.
85 15 U.S.C. §§ 7701–7713.
86 “CAN-SPAM Act: A Compliance Guide for Business”, Federal Trade Commission Website.
Available at: https://www.ftc.gov/tips-advice/business-center/guidance/can-spam-act-complianceguide-business. Last accessed on 17 July 2017.
87 See 15 U.S.C. § 7702(2)(A).
Data Protection in the United States: U.S. National Report
419