{
  "trackers": {
    "name": "EasyPrivacy",
    "url": "https://easylist.to/easylist/easyprivacy.txt",
    "status": 200,
    "retrieved": "2026-10-10",
    "version": "202610100228",
    "commit": "73d79fb615d3cd9af447665c02fb489f77c05c58",
    "hosts": 47146,
    "licence": "Dual: GPLv3 or later, and CC BY-SA 3.0 Unported or later (https://easylist.to/pages/licence.html). Both permit commercial use.",
    "licenceQuestion": "Share-alike: public/trackers.json is an adaptation and is offered under CC BY-SA 3.0 with attribution. Open for the operator: whether a paid receipt that prints an EasyPrivacy annotation beside a host is itself an adaptation that must carry the same licence. Our reading: the receipt reports facts about one site and quotes a list membership, which is not an adaptation of the list; counsel should confirm.",
    "rejected": "DuckDuckGo Tracker Radar: CC BY-NC-SA 4.0, non-commercial, not used."
  },
  "statutes": [
    {
      "state": "CA",
      "url": "https://cppa.ca.gov/pdf/20260101_ccpa_statute.pdf",
      "status": 200,
      "retrieved": "2026-10-10",
      "checkedFor": "a PDF body",
      "quote": "A business that sells or shares personal information shall process any opt-out preference signal that meets the following requirements as a valid request to opt-out of sale/sharing",
      "statuteUrl": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.135",
      "note": "leginfo.legislature.ca.gov is behind a Cloudflare challenge: it returned 403 to every plain curl and Node fetch in this run and 200 only intermittently to a full Chrome UA. The CPPA-hosted statute PDF (CCPA as of 1/1/2026, includes AB 566) answers 200 everywhere and is used as url."
    },
    {
      "state": "CO",
      "url": "https://content.leg.colorado.gov/sites/default/files/2021a_190_signed.pdf",
      "status": 200,
      "retrieved": "2026-10-10",
      "checkedFor": "a PDF body",
      "quote": "EFFECTIVE JULY 1, 2024, A CONTROLLER THAT PROCESSES PERSONAL DATA FOR PURPOSES OF TARGETED ADVERTISING OR THE SALE OF PERSONAL DATA SHALL ALLOW CONSUMERS TO EXERCISE THE RIGHT TO OPT OUT [...] THROUGH A USER-SELECTED UNIVERSAL OPT-OUT MECHANISM",
      "note": "url is the signed bill (session law as enacted) on the General Assembly content server; Colorado’s codified C.R.S. is published through LexisNexis, not a state host. leg.colorado.gov/sites/default/files/2021a_190_signed.pdf 301-redirects to this URL."
    },
    {
      "state": "CT",
      "url": "https://portal.ct.gov/ag/sections/privacy/the-connecticut-data-privacy-act",
      "status": 200,
      "retrieved": "2026-10-10",
      "checkedFor": "preference signals",
      "quote": "Not later than January 1, 2025, allowing a consumer to opt out of any processing of the consumer's personal data for the purposes of targeted advertising, or any sale of such personal data, through an opt-out preference signal sent, with such consumer's consent",
      "note": "url is the AG page because the statute page fails under Node: www.cga.ct.gov serves only its leaf certificate (no GoDaddy G2 intermediate), so Node fetch throws UNABLE_TO_VERIFY_LEAF_SIGNATURE (http:// redirects to https://). Windows curl (schannel fetches the intermediate) gets 200. To use the statute page from Node, add the GoDaddy Secure Certificate Authority - G2 intermediate via NODE_EXTRA_CA_CERTS."
    },
    {
      "state": "DE",
      "url": "https://delcode.delaware.gov/title6/c012d/index.html",
      "status": 200,
      "retrieved": "2026-10-10",
      "checkedFor": "preference signal",
      "quote": "Not later than January 1, 2026, allowing a consumer to opt out of any processing of the consumer’s personal data for the purposes of targeted advertising, or any sale of such personal data, through an opt-out preference signal sent, with such consumer’s consent"
    },
    {
      "state": "MT",
      "url": "https://mca.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0090/0300-0140-0280-0090.html",
      "status": 200,
      "retrieved": "2026-10-10",
      "checkedFor": "preference signal",
      "quote": "by no later than January 1, 2025, allow a consumer to opt out of any processing of the consumer's personal data for the purposes of targeted advertising, or any sale of such personal data through an opt-out preference signal sent with the consumer's consent",
      "note": "leg.mt.gov/bills/mca/... 301-redirects to mca.legmt.gov; the mca.legmt.gov URL answers 200 directly."
    },
    {
      "state": "NE",
      "url": "https://nebraskalegislature.gov/laws/statutes.php?statute=87-1111",
      "status": 200,
      "retrieved": "2026-10-10",
      "checkedFor": "global setting on an electronic device",
      "quote": "A consumer may designate an authorized agent using a technology, including a link to an Internet website, an Internet browser setting or extension, or a global setting on an electronic device [...] A controller shall comply with an opt-out request received from an authorized agent"
    },
    {
      "state": "NH",
      "url": "https://www.doj.nh.gov/data-privacy-enforcement",
      "status": 200,
      "retrieved": "2026-10-10",
      "checkedFor": "preference signal",
      "quote": "Controllers must establish one or more means to submit a request to exercise rights. These must include at least: [...] allowing targeted advertising and data sales opt-outs through an opt-out preference signal. RSA 507-H:6, V (b).",
      "note": "NO 200 STATUTE URL FOUND. The statute host gc.nh.gov (and www.gencourt.state.nh.us, which 301s to it) drops the TLS connection for curl (schannel renegotiation, then close), Node fetch (UND_ERR_SOCKET), Python and the WebFetch tool. url is therefore the NH Attorney General (DOJ) Data Privacy Unit page, which quotes the section. That page answers 200 with real content to Node fetch (Chrome and short UA) but 403 to Windows curl with any UA."
    },
    {
      "state": "NJ",
      "url": "https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.PDF",
      "status": 200,
      "retrieved": "2026-10-10",
      "checkedFor": "a PDF body",
      "quote": "Beginning not later than six months [...] a controller that processes personal data for purposes of targeted advertising, or the sale of personal data shall allow consumers to exercise the right to opt out of such processing through a user-selected universal opt-out mechanism.",
      "note": "url is the chaptered law PDF on the Legislature site (pub.njleg.gov serves the same file). Avoid njconsumeraffairs.gov: it answers HTTP 200 with an Incapsula bot-challenge page and no content to both curl and Node."
    },
    {
      "state": "MD",
      "url": "https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&section=14-4707&enactments=false",
      "status": 200,
      "retrieved": "2026-10-10",
      "checkedFor": "preference signal",
      "quote": "On or before October 1, 2025, allowing a consumer to opt out of any processing of the consumer’s personal data for the purposes of targeted advertising, or any sale of personal data, through an opt–out preference signal sent, with the consumer’s consent",
      "note": "The mgaleg StatuteText page returns HTTP 200 with \"File Not Found\" for wrong sections (MODPA is subtitle 47, not 46), so a 200 alone does not prove content."
    },
    {
      "state": "MN",
      "url": "https://www.revisor.mn.gov/statutes/cite/325M.14",
      "status": 200,
      "retrieved": "2026-10-10",
      "checkedFor": "preference signal",
      "quote": "A controller must allow a consumer to opt out of any processing of the consumer's personal data for the purposes of targeted advertising, or any sale of the consumer's personal data through an opt-out preference signal sent, with the consumer's consent"
    },
    {
      "state": "OR",
      "url": "https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html",
      "status": 200,
      "retrieved": "2026-10-10",
      "checkedFor": "preference to opt out",
      "quote": "Allow a consumer or authorized agent to send a signal to the controller that indicates the consumer’s preference to opt out of the sale of personal data or targeted advertising under ORS 646A.574 (1)(d) by means of a platform, technology or mechanism",
      "note": "url is the whole ORS chapter 646A page (large, cp1252-encoded HTML)."
    },
    {
      "state": "TX",
      "url": "https://capitol.texas.gov/tlodocs/88R/billtext/html/HB00004F.htm",
      "status": 200,
      "retrieved": "2026-10-10",
      "checkedFor": "global setting on an electronic device",
      "quote": "A consumer may designate an authorized agent using a technology, including a link to an Internet website, an Internet browser setting or extension, or a global setting on an electronic device [...] A controller shall comply with an opt-out request received from an authorized agent",
      "note": "url is the enrolled bill on capitol.texas.gov. statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm answers 200 but is now an Angular app shell; the statute text loads client-side, so a plain fetch gets no statute text."
    }
  ],
  "regulation": {
    "citation": "11 CCR 7025 (California Consumer Privacy Act Regulations, effective 1/1/2026)",
    "url": "https://cppa.ca.gov/regulations/pdf/ccpa_statute_eff_20260101.pdf",
    "status": 200,
    "retrieved": "2026-10-10",
    "checkedFor": "a PDF body",
    "quote": "(6) A business must display whether it has processed the consumer’s opt-out preference signal as a valid request to opt-out of sale/sharing on its website.",
    "effective": "2026-01-01"
  },
  "ab566": {
    "chapter": "Chapter 465, Statutes of 2025",
    "adds": "Cal. Civ. Code 1798.136",
    "operative": "2027-01-01",
    "url": "https://cppa.ca.gov/pdf/20260101_ccpa_statute.pdf",
    "status": 200,
    "retrieved": "2026-10-10",
    "checkedFor": "a PDF body",
    "quote": "A business shall not develop or maintain a browser that does not include functionality configurable by a consumer that enables the browser to send an opt-out preference signal to businesses with which the consumer interacts through the browser."
  },
  "settlements": [
    {
      "name": "The Walt Disney Company",
      "amount": "$2.75 million",
      "date": "2026-02-11",
      "regulator": "California Attorney General",
      "url": "https://oag.ca.gov/news/press-releases/california-wont-let-it-go-attorney-general-bonta-announces-275-million",
      "status": 200,
      "retrieved": "2026-10-10",
      "checkedFor": "global privacy control",
      "quote": "For consumers who opted out via the Global Privacy Control (GPC), Disney limited the request to the specific device the consumer was using, even when the consumer was logged into their account."
    },
    {
      "name": "Healthline Media",
      "amount": "$1.55 million",
      "date": "2025-07-01",
      "regulator": "California Attorney General",
      "url": "https://oag.ca.gov/news/press-releases/attorney-general-bonta-announces-largest-ccpa-settlement-date-secures-155",
      "status": 200,
      "retrieved": "2026-10-10",
      "checkedFor": "global privacy control",
      "quote": "Businesses and website publishers must honor these requests, including requests submitted through the Global Privacy Control."
    },
    {
      "name": "Tractor Supply Company",
      "amount": "$1.35 million",
      "date": "2025-09-30",
      "regulator": "California Privacy Protection Agency",
      "url": "https://cppa.ca.gov/announcements/2025/20250930.html",
      "status": 200,
      "retrieved": "2026-10-10",
      "checkedFor": "global privacy control",
      "quote": "Failing to provide consumers with an effective mechanism to opt-out of the selling and sharing of their personal information, including through opt-out preference signals such as Global Privacy Control;"
    },
    {
      "name": "American Honda Motor Co.",
      "amount": "$632,500",
      "date": "2025-03-12",
      "regulator": "California Privacy Protection Agency",
      "url": "https://cppa.ca.gov/announcements/2025/20250312.html",
      "status": 200,
      "retrieved": "2026-10-10",
      "checkedFor": "opt-out of sale",
      "quote": "requiring Californians to verify themselves and provide excessive personal information to exercise certain privacy rights, such as the right to opt-out of sale or sharing and the right to limit;"
    },
    {
      "name": "Joint sweep: California, Colorado, Connecticut",
      "amount": "Letters",
      "date": "2025-09-09",
      "regulator": "Three attorneys general and the California Privacy Protection Agency",
      "url": "https://oag.ca.gov/news/press-releases/attorney-general-bonta-announces-joint-investigative-privacy-sweep%C2%A0co-ct-and-ca",
      "status": 200,
      "retrieved": "2026-10-10",
      "checkedFor": "global privacy control",
      "quote": "As part of the sweep announced today, the coalition sent letters to businesses that do not appear to be processing consumer requests to opt out of the sale of their personal information submitted via the GPC as required by law and requested that those businesses come into immediate compliance."
    }
  ],
  "statuteNotes": [
    "Status method: curl 8.19 (Windows/schannel) with -L -A \"Mozilla/5.0\", without -L, and with the default curl UA; plus Node fetch (redirect: follow) with a full Chrome 141 UA and with \"Mozilla/5.0\", checking that the body contains the quoted text (PDFs via pdftotext). Run 2026-10-09 (UTC 2026-10-10).",
    "A 200 is not proof of content: njconsumeraffairs.gov (Incapsula challenge), statutes.capitol.texas.gov (SPA shell) and mgaleg StatuteText (\"File Not Found\") all answer 200 with no statute text. Check body text in the build script, not just the status.",
    "States with no 200 URL on the state legislature/code site from Node fetch: New Hampshire (gc.nh.gov unreachable for every client tried; DOJ page used) and Connecticut (cga.ct.gov fails Node TLS verification because of a missing intermediate; AG page used). California leginfo is Cloudflare-gated (CPPA-hosted statute PDF used). Colorado has no state-hosted codified C.R.S. (signed bill PDF used). Texas codified-statute site is client-rendered (enrolled bill used).",
    "Display duty: only California requires it (11 CCR 7025(c)(6), from 2026-01-01). Colorado Rule 5.08(E) permits it. No other statute in the set mentions it.",
    "All six settlement/bill figures in the request checked out: Disney $2.75M (2026-02-11, CA AG), Healthline $1.55M (2025-07-01, CA AG), Tractor Supply $1.35M (2025-09-30, CPPA), Honda $632,500 (2025-03-12, CPPA), GPC sweep 2025-09-09 (CA AG + CPPA + CO AG + CT AG), AB 566 = Ch. 465, Stats. 2025, chaptered 2025-10-08, operative 2027-01-01. Caveat: the Honda release never mentions GPC.",
    "Disconnect services.json is NOT GPLv3; it is CC BY-NC-SA 4.0 (non-commercial) since 2020-06-24. EasyPrivacy is GPLv3-or-later / CC BY-SA 3.0-or-later dual licence.",
    "Maryland 14-4707(f)(3) is drafted as \"may utilize ... (i) link; or (ii) signal\"; treat the mandate as resting on (f)(3)(ii) plus the authorized-agent duty in 14-4706, and say so if challenged.",
    "Connecticut and other states have 2025 amendments with later effective dates (e.g. CT P.A. 25-113, operative 2026-07-01); citations here are to text in force on 2026-01-01 as published."
  ]
}