NP Digital Privacy Notice: U.S. Addendum

Last updated: May 27, 2025

Table of Contents

1. California
2. Colorado
3. Connecticut
4. Delaware
5. Florida
6. Indiana
7. Iowa
8. Kentucky
9. Maryland
10. Minnesota
11. Montana
12. Nebraska
13. Nevada
14. New Hampshire
15. New Jersey
16. Oregon
17. Rhode Island
18. Tennessee
19. Texas
20. Utah
21. Virginia

This U.S. State-Specific Privacy Rights Addendum to NPD’s Privacy Notice provides detailed information regarding NPD’s compliance with various U.S. state-specific privacy laws. As part of our commitment to protecting your personal data, we comply with privacy acts or laws that have been implemented across the United States of America. Each law offers distinct rights related to the collection, use, access, deletion, and correction of personal data, as well as your rights to opt-out of certain data processing activities.

The sections below outline the specific rights granted to residents of these states under their respective laws. If you reside in one of these states, or in any other U.S. jurisdiction not specifically listed, rest assured that we comply with all applicable privacy regulations and protect your rights accordingly. If you have any questions or wish to exercise your rights under these laws, please refer to the instructions in this document and the contact information provided in NPD’s Privacy Notice. The states are provided in alphabetical order for your convenience.

NPD is dedicated to fulfilling its responsibilities in relation to collection, retention, use, and other processing of personal information that is within the scope of the CCPA/CPRA. The CCPA/CPRA provides the following specifics to California residents, as that term is defined in the CCPA/CPRA.

Right to Request Access to or Deletion of Personal Information. You may have the right under the CCPA/CPRA to request information about the collection of your personal information by NPD, or access to or deletion of your personal information. If you wish to make a data subject access request (DSAR) under the CCPA/CPRA, please contact us by way of the contact methods outlined in the Privacy Notice, including by calling 1(800) 656-1628 or clicking here. Depending on your data choices, certain services may become limited or unavailable.

You may have the right to request that we disclose certain information to you about our collection and use of your personal information over the past twelve (12) months. Once we receive and confirm your verifiable consumer request, we will disclose to you:

• The categories of personal information we collected about you.
• Our business or commercial purpose for collecting that personal information.
• The categories of third parties with whom we share that personal information.
• The specific pieces of personal information we collected about you (also called a data portability request).

We may deny a deletion request if retaining the information is necessary for us or our service providers to, for example:

• Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you.
• Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
• Exercise free speech rights, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
• Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
• Comply with a legal obligation.
• Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

Sale or Sharing of Personal Information. In the twelve (12) months prior to the effective date of this Privacy Notice, NPD may have sold personal information of consumers, as those terms are defined under the CCPA/CPRA, to the following categories of third parties:

• NPD affiliates
• Third parties to whom you authorize us to disclose your Personal Information in connection with products or services we provide to you
• Third parties that support our efforts to maintain cookie-based marketing information.

Right to Correct/Right to Rectification. In certain circumstances, you have the right to request correction of any inaccurate personal information. Upon verifying the validity of a verifiable consumer correction request, we will use commercially reasonable efforts to correct your personal information as directed, taking into account the nature of the personal information and the purposes of maintaining your personal information.

No Discrimination. NPD will not discriminate against any consumer for exercising their rights under the CCPA/CPRA.

You may only make a verifiable consumer request for access or data portability twice within a one-year period. The verifiable consumer request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative.
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. Please note that the above rights are not absolute, and we may be entitled to refuse requests, wholly or partly, where exceptions under applicable law apply.

NPD is dedicated to fulfilling its responsibilities in relation to collection, retention, use, and other processing of personal information that is within the scope of ColoPA. The ColoPA protects Colorado residents and grants them certain rights concerning their personal data. Specifically, the ColoPA permits consumers to submit authenticated requests to data controllers to: (1) opt out of the processing of personal data for targeted advertising, sale, or profiling; (2) confirm if a controller is processing their personal data and to access that data; (3) correct inaccuracies in a consumer’s personal data; (4) delete personal data concerning the consumer; and (5) if technically feasible, to obtain a copy of their data in a portable manner.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.  Please note that the above rights are not absolute, and we may be entitled to refuse requests, wholly or partly, where exceptions under applicable law apply.

NPD is dedicated to fulfilling its responsibilities in relation to collection, retention, use, and other processing of personal information that is within the scope of CTDPA. Under the CTDPA, Connecticut consumers have the right to:

Access. You have the right to confirm whether NPD is processing your personal data and also access such personal data unless such actions would reveal a trade secret.

Correction. You have the right to correct inaccuracies in your personal data, subject to limitations.

Deletion. You have the right to delete personal data provided by or about you.

Data portability. You have the right to obtain a portable copy of your personal data to the extent technically feasible and provided NPD will not be required to reveal any trade secret.

Opt-out of certain data processing. You have the right to opt out of the processing of personal data for purposes of (i) targeted advertising, (ii) the sale of personal data or (iii) profiling in connection with automated decisions that produce legal or similarly significant effects concerning you, which NPD does not do.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.  Please note that the above rights are not absolute, and we may be entitled to refuse requests, wholly or partly, where exceptions under applicable law apply.

NPD is dedicated to fulfilling its responsibilities in relation to collection, retention, use, and other processing of personal information that is within the scope of DPDPA. Under the DPDPA, Delaware residents are entitled to specific rights regarding personal data. These rights are designed to give Delaware residents more control over personal information. Consumers under the DPDPA have the right to (1) confirm whether a controller is processing their personal data and access such personal data; (2) correct inaccuracies in the consumer’s personal data; (3) delete personal data provided by, or obtained about, the consumer; (4) obtain a copy of their personal data processed by the controller in a format that allows the consumer to transmit that data to another controller, provided the controller is not required to reveal any trade secret; or (5) opt out of processing for the purposes of targeted advertising, sale of personal data, or profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.  Please note that the above rights are not absolute, and we may be entitled to refuse requests, wholly or partly, where exceptions under applicable law apply.

NPD is dedicated to fulfilling its responsibilities in relation to collection, retention, use, and other processing of personal information that is within the scope of FDBR. Under the FDBR, Florida residents are entitled to specific rights regarding personal data. These rights are designed to give Florida residents more control over personal information.

Right to Access: You have the right to request access to the personal data we have collected about you. This includes the categories of data, specific pieces of data, the sources from which we collected the data, the purposes for collecting or selling the data, and third parties with whom we share the data.

Right to Portability: You have the right to obtain a copy of your personal data previously provided to NPD in a readily usable format, with some exceptions.

Right to Correction: You have the right to request corrections to any inaccurate personal data we hold about you. Upon your request, we will correct any inaccurate or incomplete information.

Right to Deletion: You can request the deletion of your personal data that we have collected and retained, subject to certain exceptions. We will delete or obfuscate your data from our records in accordance with our record retention policies and direct our service providers to do the same.

Right to Opt-Out of Data Sales: NPD does not sell your data but if we did, you have the right to opt-out of data sales. You can exercise this right at any time, and we will not sell your data after receiving your opt-out request.

Right to Non-Discrimination: We will not discriminate against you for exercising any of your rights under the Florida Digital Bill of Rights. This means we will not deny you goods or services, charge you different prices or rates, or provide you a different level or quality of goods or services because you have exercised your privacy rights.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.  Please note that the above rights are not absolute, and we may be entitled to refuse requests, wholly or partly, where exceptions under applicable law apply. 

NPD is dedicated to fulfilling its responsibilities in relation to collection, retention, use, and other processing of personal information that is within the scope of INCDPA. The INCDPA protects Indiana residents and grants them certain rights concerning their personal data. Specifically, the INCDPA grants Indiana residents the following: (1) right of access, (2) right to correct, (3) right to data portability, (4) right to delete, and (5) the right to opt-out of targeted advertising. In accordance with the INCDPA, NPD will only process sensitive data with your consent. However, these rights are limited in some circumstances, and NPD will comply in accordance with your request and its obligations under the law.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.  Please note that the above rights are not absolute, and we may be entitled to refuse requests, wholly or partly, where exceptions under applicable law apply. 

NPD is dedicated to fulfilling its responsibilities in relation to collection, retention, use, and other processing of personal information that is within the scope of ICDPA. The ICDPA protects Iowa consumers and grants them certain rights concerning their personal data. Specifically, the ICDPA grants Iowa residents the following: (1) right of access, (2) right to data portability, (3) right to delete, and (4) the right to opt-out of the sale of personal data. However, these rights are limited in some circumstances, and NPD will comply in accordance with your request and its obligations under the law.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.  Please note that the above rights are not absolute, and we may be entitled to refuse requests, wholly or partly, where exceptions under applicable law apply.

NPD is dedicated to fulfilling its responsibilities in relation to collection, retention, use, and other processing of personal information that is within the scope of KCDPA. Under the KCDPA, Kentucky residents are entitled to specific rights regarding personal data. These rights are designed to give Kentucky residents more control over personal information. Consumers under the KCDPA have the right to (1) confirm whether a controller is processing personal data and to access said data (without revealing controller trade secrets); (2) correct inaccuracies in the consumer’s personal data; (3) delete personal data provided by or obtained about the consumer; (4) obtain a portable copy of their personal data to the extent feasible and without revealing trade secrets; and (5) opt out of the processing of data for purposes of targeted advertising, sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.  Please note that the above rights are not absolute, and we may be entitled to refuse requests, wholly or partly, where exceptions under applicable law apply.

NPD is dedicated to fulfilling its responsibilities in relation to collection, retention, use, and other processing of personal information that is within the scope of MODPA. Under the MODPA, Maryland residents are entitled to specific rights regarding personal data. These rights are designed to give Maryland residents more control over personal information. Consumers under the MODPA have the right to (1) confirm whether a controller is processing personal data and to access said data (without revealing controller trade secrets); access the consumer’s personal data; (3) correct inaccuracies in the consumer’s personal data; (4) delete personal data provided by or obtained about the consumer; (5) obtain a portable copy of their personal data to the extent feasible and without revealing trade secrets; and (5) opt out of the processing of data for purposes of targeted advertising, sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. Additionally, MODPA provides consumers the right to request a list of the specific third parties to which the controller has disclosed the consumer’s personal data.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.  Please note that the above rights are not absolute, and we may be entitled to refuse requests, wholly or partly, where exceptions under applicable law apply.

NPD is dedicated to fulfilling its responsibilities in relation to collection, retention, use, and other processing of personal information that is within the scope of MCDPA. Under the MCDPA, Minnesota residents are entitled to specific rights regarding personal data. These rights are designed to give Minnesota residents more control over personal information. Consumers under the MCDPA have the right to (1) confirm whether a controller is processing personal data and to access said data (without revealing controller trade secrets); access the consumer’s personal data; (3) correct inaccuracies in the consumer’s personal data; (4) delete personal data provided by or obtained about the consumer; (5) obtain a portable copy of their personal data to the extent feasible and without revealing trade secrets; and (5) opt out of the processing of data for purposes of targeted advertising, sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. Additionally, MCDPA provides consumers the right to request a list of the specific third parties to which the controller has disclosed the consumer’s personal data.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.  Please note that the above rights are not absolute, and we may be entitled to refuse requests, wholly or partly, where exceptions under applicable law apply.

NPD is dedicated to fulfilling its responsibilities in relation to collection, retention, use, and other processing of personal information that is within the scope of MTCDPA. The MTCDPA protects Montana residents and grants them certain rights concerning their personal data. Specifically, the MTCDPA grants Montana residents the following: (1) right to access, (2) right to correction, (3) right to delete, (4) right to portability, (5) right not to be discriminated against, and (6) the right to opt-out of the sale of personal data, targeted advertising, or profiling “in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer.” However, these rights are limited in some circumstances, and NPD will comply in accordance with your request and its obligations under the law.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.  Please note that the above rights are not absolute, and we may be entitled to refuse requests, wholly or partly, where exceptions under applicable law apply.

NPD is dedicated to fulfilling its responsibilities in relation to collection, retention, use, and other processing of personal information that is within the scope of NDPA. Under the NDPA, Nebraska residents are entitled to specific rights regarding personal data. These rights are designed to give Nebraska residents more control over personal information. Consumers under the NDPA have the right to (1) confirm whether a controller is processing personal data and to access said data (without revealing controller trade secrets); (2) correct inaccuracies in the consumer’s personal data; (3) delete personal data provided by or obtained about the consumer; (4) obtain a portable copy of their personal data to the extent feasible and without revealing trade secrets; and (5) opt out of the processing of data for purposes of targeted advertising, sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.  Please note that the above rights are not absolute, and we may be entitled to refuse requests, wholly or partly, where exceptions under applicable law apply.

Nevada law gives Nevada consumers the right to request that a company not sell their personal information. This right applies even if their personal information is not currently being sold. If you are a Nevada consumer and wish to exercise this right, please submit your request.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. Please note that the above rights are not absolute, and we may be entitled to refuse requests, wholly or partly, where exceptions under applicable law apply.

NPD is dedicated to fulfilling its responsibilities in relation to collection, retention, use, and other processing of personal information that is within the scope of NHPA. Under the NHPA, New Hampshire residents are entitled to specific rights regarding personal data. These rights are designed to give New Hampshire residents more control over personal information. Consumers under the NHPA have the right to (1) confirm whether a controller is processing personal data and to access said data (without revealing controller trade secrets); (2) correct inaccuracies in the consumer’s personal data; (3) delete personal data provided by or obtained about the consumer; (4) obtain a portable copy of their personal data to the extent feasible and without revealing trade secrets; and (5) opt out of the processing of data for purposes of targeted advertising, sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. The NHPA also allows consumers to opt out using universal opt-out mechanisms.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.  Please note that the above rights are not absolute, and we may be entitled to refuse requests, wholly or partly, where exceptions under applicable law apply.

NPD is dedicated to fulfilling its responsibilities in relation to collection, retention, use, and other processing of personal information that is within the scope of NJDPL. Under the NJDPL, New Jersey residents are entitled to specific rights regarding personal data. These rights are designed to give New Jersey residents more control over personal information. Consumers under the NJDPL have the right to (1) confirm whether a controller is processing personal data and to access said data (without revealing controller trade secrets); (2) correct inaccuracies in the consumer’s personal data; (3) delete personal data provided by or obtained about the consumer; (4) obtain a portable copy of their personal data to the extent feasible and without revealing trade secrets; and (5) opt out of the processing of data for purposes of targeted advertising, sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. Consumers may also designate an authorized agent to exercise their right to opt out on their behalf.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.  Please note that the above rights are not absolute, and we may be entitled to refuse requests, wholly or partly, where exceptions under applicable law apply.

NPD is dedicated to fulfilling its responsibilities in relation to collection, retention, use, and other processing of personal information that is within the scope of OCPA. The OCPA protects Oregon residents and grants them certain rights concerning their personal data. Specifically, Oregon consumers have the following privacy rights: (1) the right to confirm whether and what categories of your personal data have been processed; (2) the right to obtain a copy of all of your personal data; (3) the right to correct inaccuracies in your personal data; (4) the right to delete your personal data – including both information NPD obtained from another source as well as “derived data”; (5) the right to opt-out from NPD’s processing of your personal data for targeted advertising, sale, or profiling purposes; (6) the right to revoke consent provided to NPD for processing your personal data; (7) the right to not to be discriminated against for exercising a consumer privacy right; and (8) the right to appeal NPD’s denial of a request to exercise one of the above rights.

In addition, the OCPA also allows consumers to obtain a list of the “specific third parties” – persons other than a consumer, controller, processor, or affiliates of a controller or processor – to whom a controller discloses their personal data.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.  Please note that the above rights are not absolute, and we may be entitled to refuse requests, wholly or partly, where exceptions under applicable law apply.

NPD is dedicated to fulfilling its responsibilities in relation to collection, retention, use, and other processing of personal information that is within the scope of RIDTPPA. Under the RIDTPPA, Rhode Island residents are entitled to specific rights regarding personal data. These rights are designed to give Rhode Island residents more control over personal information. Consumers under the RIDTPPA have the right to (1) confirm whether a controller is processing personal data and to access said data (without revealing controller trade secrets); (2) correct inaccuracies in the consumer’s personal data; (3) delete personal data provided by or obtained about the consumer; (4) obtain a portable copy of their personal data to the extent feasible and without revealing trade secrets; and (5) opt out of the processing of data for purposes of targeted advertising, sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.  Please note that the above rights are not absolute, and we may be entitled to refuse requests, wholly or partly, where exceptions under applicable law apply.

NPD is dedicated to fulfilling its responsibilities in relation to collection, retention, use, and other processing of personal information that is within the scope of TIPA. The TIPA protects Tennessee residents and grants them certain rights concerning their personal data. Specifically, the TIPA grants Tennessee residents the following: (1) right to access, (2) right to correction, (3) right to delete, (4) right to portability, (5) right to disclosure (with respect to third-party sharing), and (6) the right to opt-out of the sale of personal data. However, these rights are limited in some circumstances, and NPD will comply in accordance with your request and its obligations under the law.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.  Please note that the above rights are not absolute, and we may be entitled to refuse requests, wholly or partly, where exceptions under applicable law apply.

NPD is dedicated to fulfilling its responsibilities in relation to collection, retention, use, and other processing of personal information that is within the scope of TDPSA. The TDPSA protects Texas residents and grants them certain rights concerning their personal data. Specifically, Texas consumers may submit authenticated requests to do the following:

Confirm whether processing of your personal data by NPD is occurring.

Access your personal data.

Correct inaccuracies in your personal data.

Delete personal data provided by or obtained about you.

Obtain a copy of your personal data that you may have previously provided to NPD (i.e., data portability).

Opt-out of the processing of your personal data for targeted advertising, selling personal data about you, or profiling.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.  Please note that the above rights are not absolute, and we may be entitled to refuse requests, wholly or partly, where exceptions under applicable law apply.

NPD is dedicated to fulfilling its responsibilities in relation to collection, retention, use, and other processing of personal information that is within the scope of UCPA. Under the UCPA, Utah consumers have the right to: (1) know or confirm processing activity; (2) access personal data; (3) obtain a copy of personal data in a portable and readily usable format; (4) delete personal data; (5) opt out of targeted advertising and sales of personal information; and (6) avoid discrimination as a result of exercising their consumer rights under the UCPA.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.  Please note that the above rights are not absolute, and we may be entitled to refuse requests, wholly or partly, where exceptions under applicable law apply.

NPD is dedicated to fulfilling its responsibilities in relation to collection, retention, use, and other processing of personal information that is within the scope of VCDPA. The VCDPA provides you, if applicable, with six (6) main rights.

Right to access. You have the right “to confirm whether or not a controller is processing your personal data and to access such personal data.”

Right to correct. You have the right to correct inaccuracies in your personal data, considering the nature of the personal data and the purposes of the processing of your personal data.

Right to delete. You have the right to delete personal data provided by or obtained about you.

Right to data portability. You have the right to obtain a copy of your personal data that you previously provided to the controller in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another controller without hindrance, where the processing is carried out by automated means.

Right to opt out. You have a right to opt out of the processing of the personal data for purposes of targeted advertising, the sale of personal data, and profiling – which NPD does not do.

Right to appeal. Finally, you have a right to appeal to the attorney general should NPD fail to act upon your request within a reasonable time.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.  Please note that the above rights are not absolute, and we may be entitled to refuse requests, wholly or partly, where exceptions under applicable law apply.