BFCM

5 privacy checks to run before Black Friday.

Privacy Compliance News

Clarity over chaos chaos

Practical privacy guidance for ecommerce teams, product updates, and the latest on changing laws.

Thank you! Your submission has been received!

Oops! Something went wrong while submitting the form.

customer shopping online

Practical guidance

SB 923: What California's new rules mean for ecommerce brands

Starting January 1, California's SB 923 requires online-only brands to offer a web form for privacy requests, and deletion requests now cover data brands got about a customer from outside sources like visitor-ID and enrichment tools.

October 6, 2026

More articles

Does the CCPA Have a Private Right of Action?

The CCPA grants consumers the right to sue businesses for damages resulting from violations of California’s data breach law. Learn what the change means.

Does the CCPA Apply to Businesses Outside of California?

The CCPA applies to businesses with users or customers in California, even if they have no physical presence in California and do business entirely online.

Does CCPA Apply to Nonprofits?

The reach of the California Consumer Privacy Act (CCPA) is broader than some companies realize. Understand the requirements and how to maintain compliance.

Does CCPA Apply to Government Agencies?

While the CCPA does not impose legal obligations on government agencies, they must be disclosed as third parties disclosing or receiving information.

Do You Need to Be GDPR Compliant?

Non-European organizations may assume the EU law doesn't apply to them, but it's not so simple. Find out when the GDPR might apply to your business.

Office environment with workers collaborating at desks and computers, representing organizational structures and privacy program management across teams

Practical guidance

Do You Need Multiple Privacy Programs?

Many companies have multiple subsidiaries with separate websites. Do they need to have multiple privacy compliance programs, too? Read the key takeaways.

No items found.

More articles

Digital communication concept showing email and online messaging interfaces with opt-out and unsubscribe options, representing user privacy choices in digital communication systems

Privacy concepts

Privacy Opt-Outs vs. Email Unsubscribes

Privacy opt-outs and email unsubscribes may appear similar on the surface, but mixing the two up can cost your business marketing opportunities. Read more.

Privacy concepts

Global Privacy Control: A New Requirement for Compliance

Global Privacy Control is making advertising opt-outs easier than ever for consumers, and failure to implement it on your website may lead to fines.

Privacy concepts

Data Brokers: What Are They and Why Does It Matter?

Lots of businesses have relationships with data brokers, but it may create some complications down the road for privacy compliance. Read the key takeaways.

Privacy concepts

Cookies & Privacy Compliance

Websites use cookies by the dozens, but most businesses don’t understand the privacy implications of this technology. Learn the key facts and requirements.

Person signing documents on a desk, representing agreements and data collection purposes between organizations and vendors in privacy compliance

Privacy concepts

Collection Purposes: How You & Your Vendors Work Together

Most data processing is now done by outside vendors, but businesses are still responsible for disclosing it. Learn how this fits into privacy compliance.

customer shopping online

Practical guidance

SB 923: What California's new rules mean for ecommerce brands

Starting January 1, California's SB 923 requires online-only brands to offer a web form for privacy requests, and deletion requests now cover data brands got about a customer from outside sources like visitor-ID and enrichment tools.

October 6, 2026

More articles

customer shopping online

Practical guidance

SB 923: What California's new rules mean for ecommerce brands

Starting January 1, California's SB 923 requires online-only brands to offer a web form for privacy requests, and deletion requests now cover data brands got about a customer from outside sources like visitor-ID and enrichment tools.

October 6, 2026

Practical guidance

California's DROP Is Now Enforceable. Here's What That Means for Your Business.

‍Enforcement of California's Delete Request and Opt-Out Platform (DROP) began August 1. Data brokers now face fines of $200 per request, per day. The first thing to figure out is whether California considers you one.

Practical guidance

Connecticut just updated its privacy law again. Here's what brands need to know.

Connecticut doesn't wait around. The state has already updated its privacy law twice since 2023 with another round of changes landing soon.

Illustration of a connected vehicle and data privacy symbols related to GM’s CCPA fine.

Practical guidance

What GM's $12.75M CCPA Fine Tells Us About Where Privacy Enforcement Is Headed

Explore what GM's $12.75M CCPA fine reveals about California privacy enforcement priorities, regulator expectations, and compliance risks for businesses.

Illustration related to the European Wax Center privacy settlement and consumer data protection concerns.

Practical guidance

The real lessons of the European Wax Center settlement

A national consumer brand just paid $5 million because their website ran tracking pixels the way almost every website runs tracking pixels. Learn more.

Server room related to personal data storage and data retention policies

Practical guidance

How Long Can Businesses Keep Personal Data?

Learn how long businesses can retain personal data under privacy laws and how to set defensible retention periods based on purpose, risk, and legal duties.

November 5, 2024

No items found.

More articles

Online document management displayed on a laptop representing privacy laws that may apply to a business

Multi-jurisdictional compliance

Which Privacy Laws Apply to Your Business?

With the increasing number of privacy laws added every year, it can be difficult to know which apply to your business. Learn about each law's criteria.

Multi-jurisdictional compliance

When Do the New State Privacy Laws Go into Effect?

U.S. state legislatures have been busy passing privacy laws. Check the exact date when each of the new laws go into effect. See what companies should know.

Illustration of an hourglass symbolizing time limits for responding to privacy requests, with digital data particles flowing through the glass and a subtle cybersecurity background suggesting data protection and compliance deadlines

Multi-jurisdictional compliance

Time Limits for Responding to Privacy Requests

The amount of time allowed to respond to privacy requests varies by jurisdiction and request type. Use this reference chart to keep it all straight.

Decorative wooden-style map of the United States with state boundaries highlighted, representing privacy compliance management across multiple jurisdictions

Multi-jurisdictional compliance

Managing Privacy Compliance in Multiple Jurisdictions

Data privacy laws are multiplying rapidly in the United States and elsewhere. Complying with all of these laws at once will take some planning. Learn more.

No items found.

More articles

Hand flipping a wooden block showing the transition of the year from 2023 to 2024, symbolizing the end of a major year in data privacy

Privacy updates

A Big Year for Data Privacy Draws to a Close

2023 was slated to be an important year for data privacy, and it did not disappoint. Take a look back at the biggest developments over the last year.

No items found.

More articles

Detailed political map of the United States showing state boundaries representing a comparison of state privacy laws

Multi-jurisdictional privacy

State Privacy Law Comparison

Many U.S. states are enacting their own data privacy law, forming a complicated patchwork of rules. Compare the different laws' requirements. Learn more.

all Case studies

100,000+ privacy requests a year. Less than 30 minutes a week for Aerosoles.

100,000+ privacy requests a year. Less than 30 minutes a week for Aerosoles.

TrueVault automates more than 99% of Aerosoles' privacy requests, leaving one person to handle the remaining work in a single weekly block.

September 25, 2026

P.F. Candle Co. built a privacy workflow that their lean ecommerce team could actually maintain.

Practical guidance

P.F. Candle Co. built a privacy workflow that their lean ecommerce team could actually maintain.

TrueVault helped P.F. Candle Co identify hidden gaps, automate GPC opt-out requests, and keep workflows current as vendors, tracking tools, and privacy requirements continued changing.

Tommy John replaced scattered privacy request handling with a workflow the team could keep up with.

Tommy John replaced scattered privacy request handling with a workflow the team could keep up with.

TrueVault helped Tommy John centralize privacy requests, reduce manual coordination, and move beyond single-person dependency.

How [solidcore] scaled privacy operations and not costs

Privacy concepts

How [solidcore] scaled privacy operations and not costs

[solidcore] built its brand on customer trust. TrueVault helps the company maintain that trust through privacy operations that continue working as the business grows.

Get started

Still figuring out privacy for your store?

Our team has helped hundreds of ecommerce brands keep privacy current without adding more overhead.