The FTC requires that privacy notices be clear, conspicuous, and not misleading. A vague statement like ‘to enhance your experience’ does not adequately inform consumers about the specific nature of data sharing with third parties. The other options provide more concrete, specific, or accessible information, aligning with FTC expectations to avoid deception by omission or ambiguity.

For a non-HIPAA covered entity collecting health data directly from consumers, the primary federal regulatory framework is the FTC Act. The FTC actively enforces against unfair or deceptive privacy and security practices involving sensitive data, including health information. HIPAA does not apply, GLBA is for financial institutions, and COPPA is only triggered if the app is knowingly collecting data from children under 13.

The CCPA/CPRA allows businesses to withhold information in response to an access request if it would reveal the company’s internal, confidential business information. Internal notes containing personal analyses, opinions, or judgments about a consumer (like customer service evaluations) typically fall under this exemption. Transaction history and IP addresses collected about the consumer are generally disclosable, though IP addresses used solely for security may have limited exceptions under the fraud exemption.

The FCRA is triggered when a consumer report is used or communicated for certain permissible purposes. Using information from a consumer report (obtained from a consumer reporting agency) to screen customers for a credit offer is a classic FCRA scenario. Internal marketing using only the institution’s own transaction data, without a CRA’s involvement, is generally not subject to the FCRA. Making a firm offer of credit using an in-house list is governed by FCRA’s affiliate marketing rules but the core obligations are tied to the use of a *consumer report*.

A company’s privacy policy forms a binding commitment. Transferring data to an acquirer who will use it under a different, broader policy represents a material change to the original promise of limited sharing. Under FTC precedent and state laws like California’s, such a material change typically requires prominent notice and, for sensitive data or where the original promise was explicit, affirmative (opt-in) consent. It is not automatically permissible, and while it relates to the purpose specification principle, the primary legal risk is breaking the original promise, which is an unfair or deceptive practice.

BIPA defines ‘biometric identifier’ to include voiceprints. However, a key defense in early BIPA litigation against consumer devices has been arguing that the raw audio or the derived data is not used to *identify* an individual, but rather to recognize a command pattern for a specific device or service. If the company can show the voice template is not matched against a database to ascertain identity (e.g., it’s only used to improve general algorithm accuracy), it may fall outside BIPA’s scope. BIPA applies broadly, not just to employers, and its consent requirements are strict, negating implied consent.

COPPA’s verifiable parental consent requirement is triggered when an operator of a website or online service directed to children, or with actual knowledge it is collecting personal information from a child under 13, collects such information. An app that gains ‘actual knowledge’ (e.g., through user disclosure or other means) that a user is under 13 must comply with COPPA, regardless of the age stated during sign-up. The other options describe activities that are either exempt (internal operations, one-time response) or where the information collected (a non-identifying username) may not constitute ‘personal information’ under COPPA’s specific definition.

The Virginia Consumer Data Protection Act (VCDPA) grants consumers the right to opt-out of the ‘sale’ of personal data, which includes exchanging data for monetary consideration. Licensing data profiles for marketing constitutes a sale. While there are exemptions for publicly available information, a data broker that is aggregating and creating profiles from that data is typically not exempt when engaged in selling those profiles. The appropriate response to a valid opt-out request is to stop selling that specific consumer’s data, not necessarily to delete it (which is a separate deletion right) or to continue selling it with a notice.

A company’s self-certification to the EU-U.S. DPF and public commitment to its Principles makes those commitments enforceable under U.S. law by the FTC (or DOT for airlines). The FTC can bring an enforcement action for deceptive practices if the company fails to comply with its stated DPF commitments. This provides a legal mechanism for transfers of personal data from the EU to the U.S. It does not provide blanket immunity from other laws, exempt from state laws, or apply to outbound transfers of U.S. data.

The FTC requires that privacy notices be clear, conspicuous, and not misleading. A vague statement like ‘to enhance your experience’ does not adequately inform consumers about the specific nature of data sharing with third parties. The other options provide more concrete, specific, or accessible information, aligning with FTC expectations to avoid deception by omission or ambiguity.0