A California-only implementation is not a national assessment. Oregon and Maryland provide particularly useful tests of whether an integration can support different state requirements. Their applicability tests and substantive rules must be assessed separately. (doj.state.or.us)
What changed in Oregon on 1 January 2026?
Covered businesses must recognise qualifying universal opt-out signals. Oregon also introduced restrictions on selling precise geolocation data and on selling under-16 users’ personal data or using it for targeted advertising and specified profiling. (doj.state.or.us)
Recommended action: test a recognised signal rather than assuming a cookie banner is sufficient. Ask why the demo needs any precise location data, what information each party receives, and how age-related restrictions are implemented where applicable.
Do not automatically prescribe precise geolocation for a non-wagering demo merely because regulated wagering platforms use location controls. Specify the territorial objective first, then have counsel and engineering assess a proportionate implementation.
Why does Maryland matter to smaller publishers?
The Attorney General identifies coverage thresholds of 35,000 Maryland consumers, or 10,000 consumers plus more than 20% of gross revenue from personal-data sales, subject to the law’s qualifications and exemptions. Its guidance also explains that a processor’s role depends on actual decision-making authority, not simply its contractual label. (oag.maryland.gov)
Maryland requires collection to be reasonably necessary and proportionate to the requested product or service. Sensitive-data processing faces a stricter necessity standard, and sensitive-data sales are prohibited. (oag.maryland.gov)
Recommended action: ask each supplier to justify individual data fields against the playable service. Remove unnecessary collection rather than assuming that a disclosure or consent prompt cures every issue.
Coverage limitation: these examples are not a complete state privacy inventory. Before a national rollout, commission an applicability matrix using the publisher’s actual processing volumes, revenue model, audience and exemptions.