NIST Privacy Framework, Communicate-PCM.AW-P1

Obtain a person's prior consent before sending them unsolicited direct marketing communications of any kind, tell them before their data is first used for that purpose or disclosed to a third party, and let them withdraw consent at any time.

Tell a data subject, no later than when you collect their data, your identity, the purposes of the processing, the categories of data, the recipients, the rights of access, rectification, erasure and objection, the retention period, any transfer abroad, and how to give or withdraw consent.

Tell a data subject, except where they already know it, your identity and any representative's, the purposes of processing, the recipients or categories of recipients, whether a reply is mandatory or voluntary and the consequences of not replying, and the existence and conditions of the rights of access and rectification, at the time of collection or, if not collected from the data subject, no later than first disclosure to a third party.

Warn a data subject, when their data is collected over an open network and unless they already know it, that their personal data may circulate without security measures and risk being seen or used by unauthorised third parties.

If enacted as drafted, a data controller would have to give a data subject the information article 27 lists before processing their personal data, and act on a request to access, rectify, erase, restrict, receive in a portable form, or object to the processing of their personal data, generally within one month of the request.

At the point of collecting personal data, provide the data subject the controller's identity, the processing purposes, the data categories, the recipients, the retention period, and any prospect of transfer to a third country.

Before requesting a data subject's authorization, tell them clearly and expressly the purpose of the processing, that answering a question about sensitive data or a minor's data is optional, their rights as a data subject, and how to identify and contact you, and keep proof that you gave this notice.

Tell a data subject, when you collect their personal data directly from them, your identity, the processing's purpose, whether answering is mandatory, the recipients, and how to exercise the rights of objection, access and rectification.

Tell a network communication user, clearly and completely, the purpose of accessing or storing information in their terminal equipment and the means available to object to it, before doing so.

Before you restrict, in whole or in part, a person's rights under GDPR Articles 12, 18, 19 or 20 in Cyprus on a ground in GDPR Article 23(1), carry out an impact assessment and consult the Commissioner, and tell the person about the restriction, under Law 125(I)/2018 Article 11.

Give the person concerned, at the latest when you collect their data, your identity, the purpose, the categories of data, the recipients, their right to refuse to appear on the file, their rights of access and rectification, the retention period, and whether the data may be transferred to a third country.

Stop processing a person's data for prospecting purposes as soon as they object, free of charge, and tell them before their data are first disclosed to a third party for prospecting so they can object to that disclosure.

Let a data subject object at any time, on legitimate grounds, to processing of their data, offer them that right expressly and free of charge before their data is first communicated to a third party or used for prospecting, and answer an objection within thirty days.

At collection, give the data subject your identity, the purposes and legal basis, the categories of data, the recipients, whether a reply is mandatory or optional, their rights of access, rectification, objection and complaint, the retention period, and any transfer to a third country; give the same information within a reasonable time when you did not collect the data from them directly.

Inform the data subject clearly, specifically, and transparently about personal-data processing carried out through an AI system, including its purposes.

Tell a data subject, before you collect their data, its purpose, its recipients, the database it will sit in, how to reach you and your delegate, the content of their ARCO-POL rights, and the security measures you keep; get a fresh authorization if you later plan a different purpose.

Publish a privacy notice, consistent with your privacy policy, naming your address, which data are sensitive, your legal basis, your purposes, how to exercise ARCO-POL rights and revoke consent, your delegate's contact details, and your use of cookies, and give it to the data subject in writing before they consent.

If you operate a whistleblowing system, preserve fairness, proportionality and openness about its scope and purpose, and inform a person implicated in a report as soon as possible of the report's existence and the facts alleged.

Tell a data subject, when you obtain their personal data, who you are, the purposes and lawful basis of the processing, the recipients, any transfer to a third-party jurisdiction, the retention periods, their rights, and whether automated decision-making including profiling is in use; where the data came from elsewhere, add the categories obtained and their source, and give the information within a reasonable period and at the latest one month after obtaining it.

Stop processing personal data for direct marketing, including the profiling related to it, as soon as the data subject objects, and bring the right to object to the data subject's attention explicitly.

Tell the data subject, when collecting their data and on any access request, that this kind of automated decision-making occurs, and give meaningful information about the logic involved, the significance, and the envisaged consequences.

When you collect personal data from a minor under fifteen in France, give them the information GDPR Article 13 lists in clear, easily accessible language, under Loi n. 78-17 Article 48.

At collection, tell the person your identity, the data protection officer's contact details where designated, the purpose and legal basis, any legitimate interest relied on, recipients, any transfer abroad, the retention period or the criteria for it, their rights including withdrawal of consent, their right to complain to the APDPVP, and the existence and logic of any automated decision-making or profiling that concerns them.

Where you did not collect the data from the person, give them the same categories of information, including the data's origin and whether it came from a publicly accessible source, within one month, or by the time you first contact them or first disclose the data to another recipient, whichever is earliest.

Give a data subject your identity, the purposes of the processing, the recipients of the data and your legal basis, at the time you collect their personal data or within a reasonable period where you obtained it indirectly.

Give written notice to an employee in Greece before installing workplace video surveillance, limited to protecting persons and property, per Law 4624/2019's employment chapter.

Give the data subject notice of the purpose and source of collection, their access and rectification rights, the classes of third party the data may be disclosed to, and whether supplying the data is obligatory, when they request it.

Carry in every direct marketing communication the identity of the sender and an address or other contact details the recipient can use to ask that the communication cease.

Notify a data subject in writing when a decision about them is based solely on automated processing, including profiling, that produces a legal or similarly significant effect, and allow them to request reconsideration or a new decision that is not based solely on automated processing.

On commencement, tell a data subject before collecting their personal data who the controller is and how to contact them, the purpose of the processing, how to exercise their Part IV rights, and how to lodge a complaint with the Digital Transformation Office, and give that information as soon as possible afterward where it could not be given beforehand.

Tell a data subject, at the point you collect or first obtain their personal data, your identity, the purposes and legal basis of processing, the recipients, any transfer to a third country, the storage period, and their rights, within one month where the data came from elsewhere.

Stop processing personal data for direct marketing, including related profiling, as soon as a data subject objects, and bring that right to their attention explicitly and separately no later than the first communication with them.

Tell the people you collect personal data from who you are or who your representative is, what the processing is for, whether answering is mandatory or optional, what follows from not answering, who the data will be sent to, and that they may access and correct it, and print that statement explicitly and clearly on the collection form itself.

Where you did not collect the data from the person, tell them personally and explicitly what the data contains, what the processing is for and that they may object to it, unless they already know or telling them is impossible or takes an effort out of proportion to the benefit.

Give a data subject notice, before or as soon as practicable after collecting personal information about them, of your name and address, the purpose of the collection, whether supply is mandatory, and the consequences of not providing it.

Before processing a person's data, give them notice of who is responsible for the processing and the nature, purpose, and method of the processing.

Tell a person, when you collect their personal data, who you are, the purpose of the processing, whether the information is mandatory or optional, the data categories, the recipients, their rights of objection, access, and rectification, and any transfer and its safeguards, and give the same notice, including how to object, before storing or reading information on their communications-terminal equipment.

When collecting personal data from a data subject, tell them who the data controller is, together with any representative, the purpose of the processing, and that they have rights of access, rectification and objection.

If enacted as drafted, a Controller would have to tell a data subject about the processing of their personal data and answer a request to access it, correct it, erase it, restrict its processing, receive it in a portable form, or object to the processing.

At collection, or before transmitting data you did not collect directly, tell the person your identity, the purposes of processing, the categories of data, the recipients, whether answering is obligatory or optional and the consequences of not answering, their right to ask to no longer appear in the file, their rights of access and rectification, the retention period, and any transfer abroad you envisage.

Before accessing or writing information to a user's connection terminal equipment over an electronic communication network, clearly and completely tell them the purpose and how to object, unless doing so is solely to enable the communication itself or is strictly necessary to supply a service the user expressly asked for.

Tell the person, at the time of collection, who is responsible for the processing, its purpose, the categories of data, whether a reply is mandatory or optional, and any recipients, and let them access, object to, correct, or delete their data on request.

Where you did not collect the data from the person directly, give them the same information when you record it or, if you plan to disclose it, no later than the first disclosure.

Give a data subject, at collection, your identity and contact details, the purposes and legal basis of the processing, the recipients, any transfer abroad, the retention period and their rights, and where the data came from elsewhere, its source and the categories concerned.

Tell a person, at the point you collect their data, who you are, the purposes and legal basis of the processing, any legitimate interest relied on, the categories of data, the retention period or the criteria for setting one, whether a reply from them is mandatory, the right to withdraw consent, the recipients, how to exercise their rights, the right to complain to the Authority, whether automated decision making including profiling is in use, and any transfer outside Monaco and its safeguards.

Stop processing a person's data for direct marketing, including any profiling tied to it, the moment they object, and flag that right to them clearly and separately no later than the first communication.

Explain to a Mongolian data subject a decision made by processing their data electronically without human involvement, and its consequences.

Tell a data subject, when you collect their personal data directly, your name and address, the purpose of processing, the recipients or categories of recipients, and the existence of their rights of access and rectification, under Article 20, and give the same information no later than when processing begins where the data were not obtained from the data subject directly, under Article 21.

Before or when you collect personal data directly from the data subject, tell them, expressly, precisely, and unambiguously, your identity, the purposes of the processing, and, where fair processing requires it, the recipients, whether their response is mandatory, and their access and rectification rights.

Where you did not collect the data from the data subject, give them that same information no later than the first disclosure to a third party, unless they already have it.

Where personal data was not collected from the data subject directly, give the subject the reason it was collected and your identity as the processor, by the time the data is first disclosed to a third party, unless notice is impossible, disproportionately burdensome, permitted by law, or the data is collected for statistical, historical, or scientific purposes.

Make available to any person specific information about your policies and practices for managing personal information, including who to contact with a complaint or question, how to obtain access to personal information you retain, and a description of the type of personal information retained and its general use.

Post a privacy notice if you operate a commercial internet website or online service directed at Nevada residents, or act as a data broker.

Before obtaining a data subject's personal data, tell them, expressly and clearly, the purpose and possible recipients, the existence and location of the file and who is responsible for it, whether answering is mandatory or optional, the consequences of refusing or of giving inaccurate data, and their rights of access, rectification, and cancellation.

Tell a data subject about the privacy policies you adopt and notify them of any change to those policies.

Give the data subject information about the processing no later than the time you collect their data.

Let a person know and contest the information and reasoning used in any processing of their data, automated or not, whose results are used against them, and, where the processing involves artificial intelligence, tell them the criteria and the nature of the personal data behind it from the point of collection.

Carry a clause on the right to lodge a complaint with the Commission in every regulation, policy, framework or legal instrument of yours that pertains to processing personal data, and answer a Standard Notice to Address Grievance a data subject serves on you.

Give a data subject the information section 27 of the Act requires in clear terms, taking their circumstances into account.

Tell a data subject what article 27 requires about the processing of their personal data.

Tell a person, in detailed, simple, express and unequivocal terms before collecting their personal data, the purpose of the processing, who its recipients are, the data bank's existence and its owner's identity and address, whether their answers are mandatory or optional, any transfer, how long you will keep the data, and how to exercise their rights; an easily accessible and identifiable privacy policy satisfies this for data collected online.

Tell a person when you engage a new processor after they gave consent, or when a merger, portfolio acquisition, or similar transfer gives their data a new data-bank owner.

Before or at the time you communicate a decision based exclusively on automated processing of personal information, tell the person that the decision was made this way.

At collection, give the data subject your identity, the purposes and categories of data, the recipients, whether a reply is obligatory or optional and the consequences of not replying, their right to be removed from the file, their rights of access and rectification, the retention period, and any transfer envisaged to a third country.

Let a data subject object to processing of their personal data on legitimate grounds, and tell them, before their data is first communicated to or used by a third party for prospecting, of their free right to object to it.

Before or when collecting personal data, tell the data subject your identity and contact details, the purposes and recipients, whether provision is mandatory, their rights including to withdraw consent, access, rectify, restrict, erase, object and appeal, the retention period, and the existence and consequences of any automated decision making.

Give a data subject, at collection, your identity and contact details, the purposes and legal basis of the processing, the recipients, any transfer abroad, the retention period and their rights, and where the data came from elsewhere, its source and the categories concerned.

Inform the data holder, at collection, of your identity, the purpose of the processing, and their right of access and rectification, and where you did not collect the data from the holder directly, give that information by the time you register the data or before you first disclose it to a third party.

Tell the person, at the time of collection, who is responsible for the processing, its purpose, the categories of data, whether a reply is mandatory or optional, and any recipients, and let them access, object to, correct, or delete their data on request.

Where you did not collect the data from the person directly, give them the same information when you record it or, if you plan to disclose it, no later than the first disclosure, unless it falls within the state-security, defence, criminal-enforcement, or major economic-interest exemption.

Tell a person, at the time you collect their personal data from them, your identity and contact details, the purpose and legal basis of processing, the recipients, any cross-border transfer, the retention period, and their rights.

Where personal data was not collected from the person, give them the same information, plus its source and category, within a reasonable time and no later than when you first communicate with them or disclose the data to someone else.

Before you collect personal data, tell the data subject who you are, the basis and purposes of the processing, who you will share the data with, their rights and their right to complain to the Authority, and describe any automated decision-making and its likely consequences.

Before or when you collect personal information, tell the data subject what is being collected and its source, your identity, the purpose of collection, whether supplying it is voluntary or mandatory, any intended transfer to another country, and their rights of access, correction, objection and complaint to the Information Regulator.

An app that makes a decision about a Korean data subject using a fully automated system, including one applying artificial intelligence, that significantly affects the subject's rights or obligations, must let the subject object to or request an explanation of the decision, must not apply the decision over an objection absent a compelling reason or must reprocess it with human involvement, and must disclose the criteria and procedures it uses for automated decisions.

If you use a person's data in Spain for profiling, state in the basic information you give them that they may object to a solely automated decision that produces legal or similarly significant effects on them, where GDPR Article 22 gives that right, under LOPDGDD Article 11(2).

Give a data subject the transparency information article 10(3) lists, including your identity, the purposes and legal basis of processing, recipients, retention period, and their rights, at collection, or, where the data did not come from the data subject, within a reasonable time and at latest within one month.

An app must notify a Tajikistani data subject of the personal data collected about them and let them correct inaccurate or misleading data. An app that transfers a subject's data to a third party must notify the subject within three working days, naming the recipient, the purpose, and the data's source, unless the subject already consented to the transfer.

Tell a data subject, at the latest when you collect their personal data directly from them, your identity, the purposes of the processing, the categories of data and recipients, whether answering is mandatory, their right to be excluded from the file, their rights of access and rectification, the retention period, and any transfer abroad you envisage.

Let a data subject object, on legitimate grounds, to the processing of their personal data, and tell them before their data is first disclosed to or used by a third party for prospecting, offering a free right to object to it, unless the processing meets a legal obligation.

At the time you collect personal information, tell the data subject your identity and contact details, that you are collecting it, the purpose including any direct marketing, whether sensitive personal information is collected and of what nature, and who the intended recipients are.

Give the person written notice, at least one month before processing their data, of its nature, the processing's purpose, whether their answer is mandatory or optional, the recipient's and your own identity and address, their rights of access, withdrawal and objection, the retention period, a summary of your security measures, and the destination country of any transfer.

Before or as soon as practicable after collecting personal data, tell the data subject its nature and category, your name and address, the purpose, whether supplying it is discretionary or mandatory, the consequences of not providing it, the recipients, their rights of access and rectification, and the retention period.

Once enacted, disclose your automated decision making mechanisms to a data subject in Ukraine, under Article 18.

Before or when you collect personal data, tell the data subject expressly, precisely, and unambiguously the purpose of the processing and who may receive it, the existence and identity of the database's controller, whether answering is mandatory, the consequences of refusing or of inaccuracy, their rights of access, rectification, and challenge, whether the data will be transferred internationally, and, for an automated-decision process, the valuation criteria, the process applied, and the technology or program used.

Stop processing personal data for direct marketing as soon as the data subject objects, and bring the rights of objection to their attention clearly and separately at your first communication with them.

Give a data subject notice of who is responsible for processing and why, and let them access, object to, correct, or have deleted false or misleading personal data about them.

Make the disclosures section 15 requires when you collect personal information directly from the data subject.

If you process the personal data of Colorado residents at the qualifying volume thresholds, give clear privacy notice and honor consumer requests to access, correct, delete, and port their data within 45 days.

Before collecting a person's personal data, inform them of the purpose of collection and obtain their express, written consent, unless the data are publicly accessible or a law or judicial order compels disclosure.

Before transferring personal data to another party, obtain the data subject's prior consent and tell them the transfer's purpose and the recipient's identity.

Before collecting a person's data, tell them plainly the purpose, destination, and recipients of the collection, whether answering is mandatory, and the consequences of refusing.

Tell a data subject, before or as soon as practicable after collecting their personal data, the nature of the data, your identity, the purpose of collection, the recipients, and whether supplying the data is mandatory or discretionary.

Give the data subject your identity, the identity of your data protection officer, the purposes of the processing, the recipients you contemplate disclosing to, the expected retention period and the legal authority for seeking the data, before you first process it.

An app that collects, uses, or discloses the personal data of an individual in Japan must give notice of, or publicly disclose, its purpose of use before or promptly after collection, must not acquire the data by wrongful or deceptive means, and must confine use to the stated purpose unless a statutory exception or the data subject's consent applies.

Give the data subject a privacy notice, at or before the first collection of their personal data, stating your identity and address, the categories of data collected and which are sensitive, the purposes that require consent, the options to limit use or disclosure, the ARCO mechanisms, and how you will communicate any change to the notice.

Where you run video surveillance of business or official premises, display a public notice of it, avoid recording residential interiors or apartment entrances, and store the recordings for no longer than one year, under Articles 35 to 40.

Specify the purpose for collecting personal data and your identity as the processor before collecting it, and limit any later use to that stated purpose.

Limit personal data collection to what is adequate, relevant, and reasonably necessary, and describe your purposes in a privacy notice.

If you collect personal information about an individual other than from that individual, including by scraping it from a third-party source, take reasonable steps to make the individual aware, as soon as practicable after collection, of the fact of collection, its purpose, the intended recipients, your identity, any legal authority for the collection, and their access and correction rights.

Before deploying data processing software that tracks a data subject or opens a communication link with one, carry out an impact assessment, design it for privacy by design and by default, put a data privacy policy inside the software, and give a prospective user a privacy statement before installation.

Publish a clear, visible notice that video surveillance is in place before operating it, naming the controller and explaining how to learn the place and storage period of the recordings, and notify employees of video surveillance on official or business premises.

Present a clear, distinguishable privacy notice before collecting personal data online, and keep any bundled consent request identifiable from the rest of the terms.

Before collecting personal information through technology with functions that identify, locate or profile the individual, disclose that use and the means available to activate those functions.

Before collecting personal data, tell the data subject the purpose of collection, the source of the data where available, the classes of third party it may be disclosed to, whether supplying the data is obligatory or voluntary, and how to request access or correction.

Before collecting personal data directly from a person, tell them what is being collected, why, who will receive it, whether providing it is mandatory, the consequences of not providing it, and their rights to access, correct, and have it destroyed.

Identify the purposes for which customer information is collected at or before collection, and do not collect, use, maintain, or disclose customer information for an undisclosed purpose without the customer's consent or legal authority.

Where your processing is exempt from notification, still give any person who asks your identity, the processing's purposes, and the data holder's rights of access and rectification.

An app that collects, uses, or discloses the personal data of an individual in Singapore must obtain the individual's consent, or rely on a Part 3 or Schedule exception, and must state its purpose for the collection, use, or disclosure.

Disclose to a consumer the purpose of collecting information about them, and do not use or maintain that information for an undisclosed purpose.

An app that collects or processes the personal data of individuals in Tajikistan must obtain the subject's consent, limit processing to a specific, predetermined, lawful purpose, and notify the subject of the data collected about them with a right to correction.

Make available to individuals your policies and practices for managing personal information, and give an individual the ability to challenge your compliance with these Principles and a timely, appropriate response.

Obtain the INPDP's prior authorization before using video surveillance, confine it to the listed categories of place, never pair it with audio recording, and post clear, permanent notice that it is in use.

Communicate personal data to a third party only for a purpose directly tied to the sender's and recipient's legitimate interest, only with the data subject's prior consent, and only after telling them the purpose of the communication and identifying the recipient.

Provide Utah consumers a reasonably accessible, clear privacy notice describing the categories of personal data you process, the purposes, how consumers may exercise their rights, and any third parties you share data with, if you meet UCPA's 25 million dollar revenue and consumer-volume thresholds.

Do not disclose personal data without the data subject's consent, and before any disclosure tell them when and to whom it will be disclosed, why, what policies will protect it, and how to complain.

As a live operator, immediately state your name, the name of the business or organization you represent, and the purpose of the call, ask at the outset whether the called person consents to the solicitation, and do not continue without that consent.

Do not solicit in a way that impedes a called party's caller ID display when your equipment can display your number.

If your telephone service or equipment lets you choose whether to display your number, do not block or otherwise prevent its transmission to the person you are soliciting.

On every telephone solicitation, transmit your originating telephone number, and your name where your carrier makes it available, to the called party's caller identification service (the seller's name and customer service number may stand in), do not act to block that transmission, and do not use technology that displays a different number to conceal your identity.

Before saying anything else besides a greeting, state your identity, the trade name of the person you represent, and the kind of goods or services you are offering, when soliciting a sale by telephone at a prospective buyer's residence, and do not use a plan, scheme, or ruse that misrepresents your true status or purpose for doing so.

Identify yourself, the company you are calling on behalf of, and the purpose of the call within the first minute of a telephonic sales call, before requesting, accepting, or arranging for payment, and disclose the ultimate seller's name and a complete and accurate description of the goods or services offered, including their retail value, plus the cost, any restrictions, and the refund and cancellation terms, before accepting payment.

At the start of a telephone solicitation to a residential subscriber, state your name and the full name of the organization or person on whose behalf the call is made, and provide on request a telephone number answered by a natural person who can describe the organization and the solicitation; do not intentionally block or interfere with the caller ID display of your number.

Do not deliver or attempt to deliver intrastate commercial advertising while blocking the display of caller identification information the subscriber would otherwise see.

When contacting a consumer, promptly and clearly disclose your identity, that the purpose of the call is to sell goods or services, the nature of the goods or services, and that no purchase or payment is necessary to win a prize or enter a prize promotion.

State your identity clearly at the start of every telephone solicitation call to a Montana residential subscriber, and do not knowingly block or circumvent the subscriber's caller identification service.

Do not block or otherwise intentionally circumvent a service used to identify you as the caller, and do not place an unsolicited call that such a service cannot identify by your telephone number or business name, unless identification is not technically feasible.

When soliciting a sale or lease by telephone, identify yourself, whom you represent and the purpose of the call within 30 seconds after the conversation begins.

Before a device for automatic dialing and announcing plays a prerecorded sales message, have a recorded or unrecorded natural voice tell the person who answers the nature of the call, including that such a device will deliver the message if they stay on the line, and give the name, address and telephone number of the business or organization you represent.

Whatever equipment you use, do not disseminate an unsolicited prerecorded sales message by telephone in the course of your business to a person with whom you have no preexisting business relationship unless a natural voice first gives the nature of the call and your business's name, address and telephone number.

Do not make an unsolicited call for the sale of goods or services to a number on the currently effective registry list, unless you have a preexisting business relationship with that person (a purchase or other financial transaction directly with you within the preceding 18 months), keep an internal do-not-call registry of people who asked you not to call, and send each such customer an annual written notice explaining how to join it.

Disclose the name of the caller, the purpose of the call and any goods or services offered immediately after the called party answers, and configure the system to disconnect within 30 seconds after the called party hangs up.

Do not use per-call or per-line blocking, or any other method, to prevent your caller identification information from reaching the called party; that information must include a number at which you can receive calls and may not be misleading, inaccurate or deceptive.

Do not use equipment or techniques designed to block or avoid detection of your identity or telephone number by caller identification devices, and do not use automatic dialing equipment that results in more than five percent abandoned calls a day in a calling campaign.

Transmit your originating telephone number, and your name when your carrier makes it available, to the recipient's caller identification service; you may substitute the seller's name and its customer service number, answered during regular business hours, and any number you display must be able to receive calls and connect the caller to you or to the seller.

As a commercial telephone seller or salesperson, do not make a commercial telephone solicitation call before 8 a.m. or after 8 p.m. in the called person's time zone, or more than three such calls to one person in 24 hours on the same subject matter from any number, and do not block your name or number or display a different caller identification number to conceal your identity.

When you represent free items, offer metals, stones or minerals or an oil, gas or mineral interest, or offer office equipment or supplies below usual prices, give the prospective purchaser, at the time of the solicitation and before any sale, the street address you are calling from, your principal address, and the further information ORS 646.557 lists for that kind of offer.

During the initial contact, disclose promptly the purpose of the call, your name and what you are selling; give the caller's name, the name of the person on whose behalf you call and, on request, a contact number or address; end the solicitation when the called party indicates they want to end it.

Do not act to block or falsify your name or number on the recipient's caller identification, or to circumvent, bypass or disable a call-screening product the subscriber uses, and do not use any technology or any synthetic or computer-generated messaging to defraud, deceive or mislead a subscriber.

State the nature of the call, your identity, and the number you are calling from within the first 30 seconds of the recorded message, add the pay-per-call disclosures where the call promotes such a service, and keep a solicitation message shorter than 30 seconds unless the device can recognize an answering machine and end the call within 30 seconds.

When you make a facsimile solicitation from Texas, include in at least 12-point type your complete name and street address and a toll-free or local number answered by a person on weekdays from 9 a.m. to 5 p.m. or that automatically deletes the recipient's number; on a stop request, send a written acknowledgment within 24 hours and make no further transmission to that number.

In making a telemarketing call, do not block your number, interfere with or circumvent a caller identification service, fail to provide caller identification information you are capable of providing, or transmit misleading caller identification information; you may substitute the name and number of the person on whose behalf you call.

Get the called subscriber's prior consent before transmitting, or instigating the transmission of, recorded matter for direct marketing purposes by an automated calling or communication system (one that can automatically dial a sequence of numbers and play sounds that are not live speech), and either do not prevent presentation of your calling line's identity or present a line on which you can be contacted.

Whether or not the call is solicited, do not prevent presentation of your calling line's identity, or present a line on which you can be contacted, when making a call for direct marketing purposes.

On a solicitation made by telephone call, identify yourself by your first and last name and name the person on whose behalf you are calling, promptly upon making contact.

On every solicitation, transmit your telephone number, and your name where your carrier makes it available, through a number at which any individual can ask during regular business hours not to receive solicitations (for a text message, a number that accepts a reply-text opt-out), and do not block that transmission or cause false or misleading caller-identification information to display; the seller's name and customer service number may be substituted.

Identify yourself and the company or organization on whose behalf you are calling, and the purpose of the call, within the first 30 seconds of a telephone solicitation call.

Obtain a Utah consumer's initial express consent before collecting, using, or disclosing their genetic data through a direct-to-consumer genetic testing product or service, and give them a public privacy notice describing your data practices.

Give Utah consumers clear notice and an opportunity to opt out before processing their sensitive data, including biometric data such as a voiceprint, retina scan, iris scan, or fingerprint collected for the purpose of identifying a specific individual.

Before processing a child's personal data, obtain the consent of a parent, carer or legal guardian, communicate with the child in clear and plain language, and put appropriate age-verification mechanisms in place, unless the processing is in the child's legitimate interests or is necessary for preventive or counselling services offered directly to the child.