State Privacy Rights

Universal Consumer Rights

Across all states with comprehensive privacy laws, consumers have the following core rights:

States with Active Privacy Laws (2026)

State-Specific Rights

California (CCPA/CPRA)

California residents have the universal rights listed above, plus:

• Right to limit use of sensitive personal information
• Right to restrict data retention to what is reasonably necessary
• Private right of action for data breaches

How to exercise: Visit our California Privacy Rights page or email privacy@rchotelgroup.com.

Colorado, Connecticut, Virginia

Residents of these states have the universal rights listed above, plus:

• Right to opt out of targeted advertising — We do not engage in targeted advertising based on sensitive data
• Right to opt out of profiling — We do not profile consumers for decisions that produce legal or similarly significant effects

How to exercise: Email privacy@rchotelgroup.com with subject line "Colorado/Connecticut/Virginia Privacy Rights."

Delaware, New Hampshire, New Jersey, Oregon

Residents have the universal rights listed above, plus:

• Right to opt out of targeted advertising
• Universal opt-out recognition — We honor Global Privacy Control (GPC) signals where required

How to exercise: Email privacy@rchotelgroup.com or use the GPC browser extension.

Florida (Florida Digital Bill of Rights)

Florida residents have the universal rights listed above. Note that Florida's law applies to businesses with $250M+ annual gross revenue.

How to exercise: Email privacy@rchotelgroup.com with subject line "Florida Privacy Rights."

Indiana, Kentucky, Rhode Island (Effective Jan 1, 2026)

Residents of these states gained comprehensive privacy rights effective January 1, 2026.

How to exercise: Email privacy@rchotelgroup.com with subject line "[State] Privacy Rights."

Iowa, Montana, Tennessee, Texas, Utah

These states have comprehensive privacy laws with varying thresholds.

How to exercise: Email privacy@rchotelgroup.com with subject line "[State] Privacy Rights."

Maryland, Minnesota, Nebraska

Maryland (Oct 1, 2024), Minnesota (July 1, 2025), and Nebraska (July 18, 2026) have comprehensive privacy laws.

How to exercise: Email privacy@rchotelgroup.com with subject line "[State] Privacy Rights."

Global Privacy Control (GPC)

We honor the Global Privacy Control (GPC) signal where required by law (Delaware, starting Jan 2026 in California for data brokers). When your browser sends a GPC signal, we treat it as an opt-out request for the sale and sharing of personal information.

Browser extensions that support GPC:

• Privacy Badger
• DuckDuckGo Privacy Essentials
• GPC-specific extensions

Verification and Response Timeline

When you submit a privacy rights request:

1. Verification — We will verify your identity using the email address associated with your account or other reasonable methods
2. Acknowledgment — We will acknowledge receipt within 5 business days
3. Response — We will respond within the timeframe required by your state's law:
   • California: 45 days (extendable to 90 days with notice)
   • Colorado, Connecticut, Virginia: 45 days
   • Other states: 45 days unless otherwise specified
4. Appeal — If we deny your request, you may appeal by emailing privacy@rchotelgroup.com with "Appeal" in the subject line

Authorized Agents

Some states (California, Colorado, Connecticut) allow you to designate an authorized agent to submit requests on your behalf. To use an authorized agent:

1. Provide written authorization signed by you
2. The agent must provide proof of their authority
3. We may still require you to verify your identity directly

Mail authorization to:

Contact Us

If you have questions about your state privacy rights:

Related Pages

• Full Privacy Policy
• California Privacy Rights
• Terms of Service