Compliance posture
This overview renders requirements and implementation status recorded by FetchSet’s compliance module. It distinguishes planned filings, implemented code paths, and public workflows that are not yet connected.
This is a structural draft. It is not legal advice, a certification, or a representation that any registration has already been filed.
Data-broker registrations
FetchSet operates as a data broker and plans to register in every state where registration is required. Four registrations are treated as certain; two more are tracked, pending timing or legislation.
| Jurisdiction | Status | Timing | Basis |
|---|---|---|---|
| CaliforniaCCPA/CPRA | Certain | Annual, by Jan 31 · renews annually | Delete Act / DROP obligations attach |
| Texas | Certain | On first brokering activity · renews annually | >50%-brokering-revenue prong; no threshold escape |
| Oregon | Certain | On first brokering activity · renews annually | No processing-threshold exemption |
| Vermont | Certain | Annual, by Jan 31 · renews annually | Vermont data-broker registration |
| Connecticut | Tracked | Registration duty begins Jan 1 2027 | Tracked for enactment timing |
| Illinois | Tracked | Pending (HB2913) | Monitoring for enactment and fee |
Around twenty comprehensive-privacy states impose opt-out-of-sale and universal-opt-out (GPC) duties on any seller regardless of registration. A single GPC mechanism is intended to satisfy all of them.
Data-subject rights
The compliance module models access, deletion, correction, objection, and “Do Not Sell or Share” requests, including GDPR one-month and CCPA 45-day deadline fields.
The public request form, identity-verification flow, case tracking, and production handler connection are not complete in this draft. See Your privacy choices for the current counsel scaffold.
Global Privacy Control
The compliance module implements a true-signal GPC handler as a binding sale/share opt-out and models GDPR Article 21(2) marketing objections as immediate suppression. The public website and gateway are not yet connected to that handler, so this draft does not claim that a browser signal is currently recorded.
Deletion and suppression
The implemented compliance behavior is deletion-with-suppression: after the required verification for deletion, eligible data is purged and suppression entries are written to prevent reacquisition.
The resolution code checks suppression before returning personal data, including on cache hits. Tests require a suppressed subject to receive the same empty envelope as a genuine miss, at tokens_charged: 0, without revealing suppression status. Production wiring and live verification remain release steps.
Provenance on every record
The write path requires three provenance fields: source, acquired_at, and redistribution_basis. The licensing rule permits shared caching and resale only for records carrying a redistribution grant; internal-use-only finder, validation, and IP results are not eligible for that shared resale path.
Advertising audiences
Advertising-audience, mobile-ad-ID (MAID), hashed-email (HEM), and identity-graph endpoints are not part of the product. Reserved routes return 403 feature_disabled and remain gated behind separate counsel and go/no-go review.
Requests and contact
Draft contact: privacy@fetchset.dev. Do not route launch traffic to email alone; the accessible request form, confirmation, identity verification, case tracking, and handler integration remain required.
The full draft document set is available from the legal & trust center.