State Privacy Information
Updated October 2, 2026
These individual notices supplement the Privacy Policy of UMG, LLC dba AutoAccident.co. State protections are not identical. Coverage requirements, the information involved, the activity and legal exceptions determine which provisions apply. These summaries identify selected relevant protections, not every privacy, security, advertising or professional rule in a jurisdiction. A summary’s silence does not waive another applicable protection.
Make A Request From Any State
Use Your Privacy Choices, email Contact@AutoAccident.co, call (617) 539-7610, or write to 540 Main Street, Suite 12b, Hyannis, MA 02601, attention Privacy Requests. Identify the request and how to contact you. We may verify identity or representative authority proportionately and assess applicable rights, exceptions and appeal requirements.
Our request channel is available nationwide; it does not mean every state grants an identical statutory right, or that a participating lawyer is available in every state. Required responses follow the applicable law. The form records a request for review, rather than automatically completing deletion or an opt-out across every recipient. State provisions describing a required browser signal do not claim that this form alone implements that signal.
Choose Your State
AL · AK · AZ · AR · CA · CO · CT · DE · DC · FL · GA · HI · ID · IL · IN · IA · KS · KY · LA · ME · MD · MA · MI · MN · MS · MO · MT · NE · NV · NH · NJ · NM · NY · NC · ND · OH · OK · OR · PA · RI · SC · SD · TN · TX · UT · VT · VA · WA · WV · WI · WY
Alabama (AL)
Alabama’s enacted Personal Data Protection Act is scheduled to take effect May 1, 2027. Its future access, correction, deletion and opt-out provisions are not presented here as rights already effective on October 2, 2026. Existing applicable protections remain in place. You may use our request channel now; a future law does not retroactively authorize a data use or eliminate a present obligation.
Official source or regulator reference.
Alaska (AK)
Alaska’s personal-information protections include requirements concerning qualifying security breaches and handling of protected information. The type of data and circumstances determine the applicable response. A deletion remedy in a particular regulator settlement is not a universal deletion right against every business. Use our privacy contact to raise a handling or security concern; all independently applicable statutory and contractual protections are preserved.
Official source or regulator reference.
Arizona (AZ)
Arizona’s breach-notification framework addresses qualifying compromises of defined personal information. Notice and related obligations depend on the information involved and the statutory conditions, rather than every website error being a reportable breach. This security protection is distinct from a general advertising opt-out or deletion right. Our privacy-request channel remains available for questions, corrections and other applicable choices.
Official source or regulator reference.
Arkansas (AR)
Arkansas protections can require notice to affected residents and the Attorney General following a qualifying personal-information breach. Applicable definitions, investigations and exceptions determine the response. Our ordinary retention statement does not override a specific legal obligation to preserve a breach determination or related evidence. Contact us about a concern without sending additional unnecessary sensitive records.
Official source or regulator reference.
California (CA)
If you are a California resident and the California Consumer Privacy Act applies to our handling of your information, you may request access to information about our collection, use and disclosures, a portable copy, correction, and deletion, subject to legal exceptions. You may opt out of selling personal information or sharing it for cross-context behavioral advertising. Covered businesses must honor applicable Global Privacy Control signals for these opt-outs. Where the statutory right applies, you may limit uses and disclosures of sensitive personal information beyond permitted purposes, such as providing services you reasonably expect. This is not a blanket requirement for prior consent to every sensitive-information use. You have a right to exercise CCPA rights without unlawful discrimination. Use Your Privacy Choices or the Privacy Policy’s contact methods; an authorized agent may act for you as permitted by law.
Official source or regulator reference.
Colorado (CO)
If you are a Colorado resident acting in an individual or household capacity and the Colorado Privacy Act applies to our processing, you may access, correct, delete and obtain a portable copy of your personal data, subject to legal exceptions. You may opt out of sales, targeted advertising and profiling used for decisions producing legal or similarly significant effects. Covered controllers must honor recognized universal opt-out mechanisms, including Global Privacy Control, for sales and targeted advertising. Processing sensitive data, including information revealing a health condition or diagnosis, generally requires your prior consent. You may withdraw that consent and appeal a denied rights request. Submit a request or appeal through Your Privacy Choices or the Privacy Policy’s contact methods. If you remain dissatisfied with an appeal outcome, you may contact the Colorado Attorney General.
Official source or regulator reference.
Connecticut (CT)
For covered Connecticut processing, access, correction, deletion, portability, specified opt-outs and an appeal may be available. Sensitive-data and consumer-health provisions require separate attention; ordinary volume assumptions do not resolve every sensitive-data obligation. Required opt-out signals and restrictions on selling precise geolocation also matter. A general contact request or a media contract does not replace permissions required for a different sensitive-data use.
Official source or regulator reference.
Delaware (DE)
Covered Delaware residents may seek access, correction, deletion and portability, opt out of specified sale, targeted-advertising or significant-effect profiling uses, and appeal a denial. Sensitive-data consent, applicable opt-out mechanisms and information about recipient categories are additional considerations. Amendments with a future effective date are not treated as already operative. A request is assessed under the version and provisions that actually govern the activity.
Official source or regulator reference.
District of Columbia (DC)
The District of Columbia has protections for qualifying breaches of personal information, including resident and regulator notifications and additional identity-protection measures in specified circumstances. The affected data and statutory conditions determine the response. These protections are separate from the policy’s general request channel. A District resident may contact us about a security concern or any independently applicable privacy right.
Official source or regulator reference.
Florida (FL)
Florida’s Digital Bill of Rights has restricted coverage; it should not be described as applying to every website simply because a visitor lives in Florida. When it applies, access, correction, deletion, portability, certain opt-outs and an appeal may be available, with additional choices concerning sensitive-data sales and specified recognition technologies. Other applicable security and consumer protections are not displaced when a particular comprehensive-law test is not met.
Official source or regulator reference.
Georgia (GA)
Georgia’s personal-information protections include notice for qualifying data breaches. Whether notice is required depends on the information and circumstances under the applicable framework. That does not automatically create the same sale, deletion or advertising rights found in another state’s comprehensive law. You can still use our request channel and raise a concern with the relevant consumer-protection authority.
Official source or regulator reference.
Hawaii (HI)
Hawaii’s breach-notification provisions address qualifying unauthorized access or acquisition of protected personal information and the corresponding notice obligations. Applicable conditions and lawful exceptions affect the timing and response. A security-notice obligation is different from a general right to stop every use of contact information. We preserve any separately applicable request rights and restrictions on the underlying processing.
Official source or regulator reference.
Idaho (ID)
Idaho’s breach rules distinguish obligations involving affected individuals, information owners and parties maintaining data. Requirements directed at a public agency should not automatically be attributed to a private website operator. If an Idaho resident’s protected information is involved in a qualifying incident, the relevant notice provisions apply. Our contact methods can also be used for handling questions and other applicable privacy requests.
Official source or regulator reference.
Illinois (IL)
Illinois has distinct biometric protections. Where the Biometric Information Privacy Act applies, obtaining covered biometric identifiers or information can require specific written notice and a written release, with retention/destruction, disclosure and sale-related restrictions. A general website consent is not a substitute. An ordinary photograph or recording is not automatically every type of covered biometric identifier. Other applicable personal-information and consumer protections remain unaffected.
Official source or regulator reference.
Indiana (IN)
Where Indiana’s Consumer Data Protection Act applies, rights include access, qualifying correction, deletion, portability and opt-outs concerning sale, targeted advertising and certain significant-effect profiling, plus an appeal process. Correction and copy rights have statutory scope limits rather than applying identically to every record or inference. Sensitive-data consent must be assessed separately from the permission to respond to an inquiry.
Official source or regulator reference.
Iowa (IA)
Iowa’s law provides a different set of rights from some other state frameworks: covered requests can include access, deletion of consumer-provided information, portability and sale opt-out, with an appeal. It does not supply a general correction right or the same significant-effect profiling opt-out as several other laws. Sensitive-data notice and opt-out provisions and sale/targeted-advertising disclosures must be evaluated under Iowa’s own rules.
Official source or regulator reference.
Kansas (KS)
Kansas requires notice in circumstances involving a qualifying breach of defined personal information, subject to the governing conditions and permitted delays. This is not interchangeable with a comprehensive access, deletion or advertising-choice framework. If you have a concern about information submitted to us, use the request channel; nothing in this summary limits another protection that applies to the data or conduct.
Official source or regulator reference.
Kentucky (KY)
Where Kentucky’s Consumer Data Protection Act applies, you may request access, correction, deletion and portability and opt out of qualifying sale, targeted advertising or significant-effect profiling. A denial can be subject to appeal. Sensitive-data processing generally requires the relevant consent. Whether a right applies depends on coverage, data and statutory exceptions, not simply the presence of a Kentucky location page.
Official source or regulator reference.
Louisiana (LA)
Louisiana’s personal-information breach framework addresses notice to affected people and related regulator obligations for a qualifying incident. Resident and regulator notices are distinct steps; one generic national incident rule cannot replace them. Applicable definitions, risk determinations and exceptions matter. You may raise security or information-handling concerns through our privacy channel without supplying additional sensitive documents in the initial message.
Official source or regulator reference.
Maine (ME)
Maine’s security-breach notice law distinguishes information brokers and other holders of personal information, with duties to investigate and provide notice when the relevant conditions are met. A service-provider incident can also require communication to the information owner. These provisions are distinct from proposed general privacy legislation or rules aimed at a different industry; proposals are not presented as enacted rights here.
Official source or regulator reference.
Maryland (MD)
Where Maryland’s Online Data Privacy Act applies, rights can include access, correction, deletion, portability, qualifying opt-outs and appeal. Its sensitive-data restrictions are especially important: collection, processing or sharing must meet the applicable strict-necessity standard for the requested product or service, and sensitive-data sales are prohibited. Consent alone is not an alternative to those restrictions. Optional injury-based advertising cannot be justified merely by adding a checkbox.
Official source or regulator reference.
Massachusetts (MA)
Massachusetts has specific safeguards requirements for statutorily defined resident personal information, including a written information-security program where applicable. The defined categories and the activity matter; the rule should not be misstated as an unlimited right to delete every website record. Applicable security, incident-notice and consumer protections remain in force. Our Massachusetts operator contact is available for privacy requests, verification questions and complaints.
Official source or regulator reference.
Michigan (MI)
Michigan’s data-breach and identity-protection framework can provide protections when defined personal information is compromised. The affected data and circumstances determine notice and remedies; regulator reporting rules should not be copied from another state without checking applicability. Our privacy channel is available for a concern or request, and any separate statutory or contractual protection is preserved.
Official source or regulator reference.
Minnesota (MN)
For covered Minnesota processing, access, correction, deletion, portability, qualifying opt-outs and appeals may apply. The law also addresses information about specific third-party recipients and additional rights concerning certain profiling, including explanations and challenges. Recognized opt-out mechanisms and sensitive-data permissions require separate attention. Our operator response is not intended to make an automated legal-eligibility decision about your matter.
Official source or regulator reference.
Mississippi (MS)
Mississippi’s consumer-protection authorities address data-security and privacy concerns, including through enforcement concerning particular incidents. A remedy obtained in a specific enforcement case is not automatically a general deletion or advertising opt-out right against every website. We preserve applicable protections and provide our request channel for questions or complaints about this service; the selected official reference illustrates enforcement rather than a complete privacy code.
Official source or regulator reference.
Missouri (MO)
Missouri’s data-breach rules address qualifying compromises of defined personal information and related notification duties. The information involved, statutory risk conditions and applicable reporting requirements must be assessed for the incident. A security complaint and a request to stop marketing are separate matters. Our privacy contact can receive either, and no general statement here removes an independently applicable remedy.
Official source or regulator reference.
Montana (MT)
Where Montana’s Consumer Data Privacy Act applies, you may have access, correction, deletion, portability, specified sale/advertising/profiling opt-outs and appeal rights. Applicable sensitive-data consent and universal opt-out requirements also matter. Coverage rules have changed, so an older assumption about a business’s size should not be treated as a permanent exemption. Rights and exceptions are evaluated under the law governing the current activity.
Official source or regulator reference.
Nebraska (NE)
Nebraska’s Data Privacy Act provides covered consumers with access, correction, deletion, portability, qualifying opt-outs and an appeal process. Sensitive-data requirements need separate consideration, including provisions affecting sensitive-data sales by small businesses. A general small-business label does not settle every obligation. Required opt-out mechanisms and actual recipient permissions must be assessed for the specific processing.
Official source or regulator reference.
Nevada (NV)
Nevada has both an online covered-information sale opt-out framework and separate consumer-health-data protections. A request under one is not automatically identical to a request under the other. Applicable health rights include access, withdrawal, deletion, recipient information and appeal; collection/sharing permissions and a separate sale authorization may be required. Use our designated privacy contact or request form and identify the choice you wish to exercise.
Official source or regulator reference.
New Hampshire (NH)
For processing covered by New Hampshire RSA 507-H, rights can include access, correction, deletion, portability, sale/targeted-advertising/significant-effect profiling opt-outs and appeal. Sensitive-data consent and applicable universal opt-out mechanisms are additional protections. A permission to respond to a request should not be interpreted as permission for every later advertising use. Verification and lawful exceptions are addressed in the response.
Official source or regulator reference.
New Jersey (NJ)
Where New Jersey’s Data Privacy Law applies, you may request access, correction, deletion and portability, exercise the specified sale, targeted-advertising or profiling opt-outs, and appeal a denial. The law also addresses sensitive-data consent and universal opt-out mechanisms. The particular definitions and coverage requirements control; a privacy request is not a request for representation by a New Jersey attorney.
Official source or regulator reference.
New Mexico (NM)
New Mexico’s data-breach protections address handling of covered personal information and responses to qualifying security incidents. Service-provider and information-owner duties can differ. The existence of a bill or an early legislative draft is not treated here as proof that every proposed provision is operative. Contact us about an actual request or incident concern; applicable protections remain unaffected by this summary.
Official source or regulator reference.
New York (NY)
If you are a New York resident, the SHIELD Act and related breach-notification law protect qualifying private information through security and incident-notification requirements. Where applicable, businesses must maintain reasonable safeguards, including appropriate disposal, and notify affected residents of qualifying unauthorized access or acquisition within the time required by law. Protected information can include identifying information combined with medical or health-insurance information, as well as other statutory categories. These laws do not themselves provide a general right to require every business to delete information or stop selling it. Other applicable legal rights remain available. You may contact us using the Privacy Policy’s contact methods about a privacy or security concern, or file a complaint with the New York Attorney General. Requests through Your Privacy Choices are assessed under applicable law and the commitments in our Privacy Policy.
Official source or regulator reference.
North Carolina (NC)
North Carolina’s identity-protection provisions address notice to affected individuals following a qualifying personal-information breach, including requirements for the contents of a notice and lawful delays. They should not be replaced with a single nationwide notification formula. You may use our privacy contact for a security concern, and separately request a correction, contact preference or other choice to the extent applicable.
Official source or regulator reference.
North Dakota (ND)
North Dakota’s breach rules distinguish notices to affected residents, applicable regulator reporting and communications from a data maintainer to the information owner. The protected information and conditions determine the required response. These duties are not the same as consent for marketing or a universal right to delete every record. We preserve any separate right or remedy that applies to your circumstances.
Official source or regulator reference.
Ohio (OH)
Ohio provides protections concerning qualifying compromises of defined personal information, including notice under the statute’s conditions and permitted exceptions. A breach-notice rule does not itself establish a California-equivalent access or sale opt-out framework. Our request methods remain available for handling concerns, corrections and contact preferences, and any independently applicable legal right continues to govern.
Official source or regulator reference.
Oklahoma (OK)
Oklahoma’s Security Breach Notification Act and consumer-protection framework can affect the response to a qualifying compromise of protected information. A regulator’s reporting portal is not a substitute for assessing the law’s actual triggers and exceptions. You can contact us about a security or privacy concern; no general statement in these policies waives a required notice, available remedy or separately applicable protection.
Official source or regulator reference.
Oregon (OR)
Where Oregon’s Consumer Privacy Act applies, rights include access, correction, deletion, portability, specified opt-outs, appeal and information about specific third-party recipients. Sensitive-data consent and universal opt-out requirements apply to covered activity. Oregon also restricts precise-geolocation sales and certain uses of minors’ data. A broad intake permission cannot authorize an activity the law prohibits.
Official source or regulator reference.
Pennsylvania (PA)
Pennsylvania’s Breach of Personal Information Notification Act addresses qualifying compromises and related notice obligations, with additional protections for specified affected information. Applicability depends on the statutory definitions and circumstances. Proposed comprehensive privacy legislation is not treated as effective merely because a bill text is available. Our contact channel remains available, and other applicable statutory or contractual rights are preserved.
Official source or regulator reference.
Rhode Island (RI)
Rhode Island’s Data Transparency and Privacy Protection Act can provide covered rights to access, correction, deletion, portability, qualifying sale/advertising/profiling opt-outs and appeal. Its website transparency provisions also require separate consideration, including relevant recipient-identification disclosures. Do not assume that every disclosure obligation has the same coverage test. Our initial request is to the operator; a later recipient must be identified for the applicable connection.
Official source or regulator reference.
South Carolina (SC)
South Carolina’s personal-information protections include notice for a qualifying breach under the statutory conditions. Notice content, any permitted substitute and relevant reporting duties depend on the incident rather than a generic website policy. A security notification is separate from an advertising preference. Contact us about either concern, and any additional mandatory protection remains available where it applies.
Official source or regulator reference.
South Dakota (SD)
South Dakota’s breach framework addresses notification to affected residents and applicable Attorney General reporting. A decision that a breach is unlikely to cause harm has its own investigation and documentation requirements; it is not an unrestricted reason to provide no response. Our privacy channel can receive questions about a concern, while incident-specific duties and other applicable rights remain controlling.
Official source or regulator reference.
Tennessee (TN)
Where Tennessee’s Information Protection Act applies, consumers may request access, correction, deletion and portability, exercise specified sale, targeted-advertising or significant-effect profiling opt-outs, and appeal a denial. Sensitive-data processing generally requires consent under the applicable provisions. A response is assessed against the law’s coverage and exceptions; the site does not imply that every use is permissible merely because a request was submitted.
Official source or regulator reference.
Texas (TX)
Texas’s Data Privacy and Security Act can provide access, correction, deletion, portability, qualifying opt-outs and appeal rights, with sensitive-data and applicable opt-out-mechanism requirements. Specified sensitive or biometric data sales can carry additional notice obligations. Applicable small-business provisions must be considered separately. No website disclaimer or advertising label replaces a permission, restriction or disclosure required for the actual transfer.
Official source or regulator reference.
Utah (UT)
Utah’s Consumer Privacy Act has a narrower rights structure than several other state laws. Covered rights include access, deletion of consumer-provided data, portability and sale/targeted-advertising opt-outs, with sensitive-data notice and an opportunity to opt out as applicable. It does not provide a general correction right or the same controller-appeal process as some other frameworks. Our voluntary contact channel remains available for concerns and review requests.
Official source or regulator reference.
Vermont (VT)
Vermont has distinct requirements relating to qualifying data brokers, including registration and information-security duties. Whether an entity is a broker depends on the actual data sources and business practices; direct website collection and indirectly sourced partner data are not automatically equivalent. A lead or media label does not settle that classification. This policy does not represent that the operator holds a certification or registration that has not been identified.
Official source or regulator reference.
Virginia (VA)
For covered Virginia processing, rights can include access, correction, deletion, portability, specified sale/advertising/profiling opt-outs and appeal. Sensitive-data consent requirements and restrictions on precise-geolocation sales also need to be considered. The applicable definition and exceptions govern a particular request. A broad permission to contact you does not override a statutory restriction on collecting or transferring sensitive information.
Official source or regulator reference.
Washington (WA)
Washington’s My Health My Data Act provides distinct protections for covered consumer health data, including access, withdrawal, deletion, recipient information and appeals. Collection and sharing may require separate permissions unless a statutory requested-service basis applies; permitted sales require a distinct authorization, and prohibited geofencing cannot be approved by a checkbox. Read our separately linked Health Data Notice. Washington consumer-protection remedies are not waived by these policies.
Official source or regulator reference.
West Virginia (WV)
West Virginia’s breach-notification rules distinguish notices to affected individuals, communications from maintainers to data owners and reporting-agency notifications in specified circumstances. The information, incident and statutory conditions control. These duties are separate from an ordinary privacy-choice request. Our policies do not remove any required notice or independently applicable consumer remedy.
Official source or regulator reference.
Wisconsin (WI)
Wisconsin provides notification protections when a qualifying incident involves defined personal information. The law’s definitions and exceptions determine the response, while the state’s consumer-protection authority provides practical guidance on data breaches. Those protections should not be confused with a universal deletion or sale opt-out right. Our privacy-request channel remains available for questions and applicable choices.
Official source or regulator reference.
Wyoming (WY)
Wyoming’s personal-information breach provisions address notification to affected residents and duties where information is maintained for another business. Required notice content and the allocation of responsibilities depend on the circumstances and applicable statute. An ordinary inquiry receipt is not an incident determination. Contact us about a security concern or other applicable privacy request; mandatory protections continue to govern.
Official source or regulator reference.
How These Notices Fit Together
The Consumer Health Data Privacy Notice addresses injury-related information separately. Our Terms And Disclaimers preserve mandatory rights and explain that state attorney-advertising and campaign disclosures are separate from privacy choices. Neither a nationwide directory nor a state privacy notice establishes attorney licensing, a local office or a regulator’s endorsement.
For a question about the particular data, recipient or choice involved in your request, contact us. Applicable mandatory protections take precedence over inconsistent general wording, and a future use must satisfy the law and any required notice or permission before it begins.