State Law Privacy Notice

How to Contact Us About Your Privacy

1. Fill out our Consumer Privacy Request form
2. Call us at 1-800-635-4772 (MELISSA), extension 4

Updated July 2026

I. About Melissa’s State Law Privacy Notice

To protect your privacy, various U.S. states have enacted comprehensive consumer privacy laws that give residents specific rights regarding their personal data. This notice applies to residents of states including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Florida, Minnesota, Maryland, Indiana, Kentucky, and Rhode Island. Residents of California should refer to the Privacy Notice for Residents of California for the specifics of that state law. Nevada residents also have specific rights under Nevada law, described in Section IV below. Comprehensive privacy laws enacted in Louisiana and Oklahoma (effective January 1, 2027), Alabama (effective May 1, 2027), and Vermont (effective January 1, 2028) will be reflected in this notice as they take effect.

This notice is intended to inform residents of the other specified states regarding their rights under the following data privacy laws:

• Colorado: The Colorado Privacy Act (“CPA”).
• Connecticut: The Connecticut Data Privacy Act (“CTDPA”). (A special notice for this state appears in Section IV below.) 
• Virginia: The Virginia Consumer Data Protection Act (“VCDPA”). 
• Utah: The Utah Consumer Privacy Act (“UCPA”). 
• Texas: The Texas Data Privacy and Security Act (“TDPSA”). The entity maintaining this website is a data broker under Texas law. To conduct business in Texas, a data broker must register with the Texas Secretary of State (Texas SOS). Information about data broker registrants is available on the Texas SOS website. (A special notice for this state appears in Section IV below.) 
• Oregon: The Oregon Consumer Privacy Act (“OCPA”). 
• Montana: Montana Consumer Data Privacy Act (“MTCDPA”). 
• Delaware: Delaware Personal Data Privacy Act (“DPDPA”). 
• Iowa: Iowa Act Relating to Consumer Data Protection (“ICDPA”). 
• Nebraska: Nebraska Data Privacy Act (“NEDPA”). 
• New Hampshire: New Hampshire Data Privacy Act (“NHDPA”). 
• New Jersey: New Jersey Data Privacy Act (“NJDPA”). 
• Tennessee: Tennessee Information Protection Act (“TIPA”). 
• Florida: Florida Digital Bill of Rights (“FDBR”). 
• Minnesota: Minnesota Consumer Data Privacy Act (“MNCDPA”). (A special notice for this state appears in Section IV below.) 
• Maryland: Maryland Online Data Privacy Act (“MODPA”). 
• Indiana: Indiana Consumer Data Protection Act (“ICDPA”). 
• Kentucky: Kentucky Consumer Data Protection Act (“KCDPA”). 
• Rhode Island: Rhode Island Data Transparency and Privacy Protection Act (“RIDTPPA”). (A special notice for this state appears in Section IV below.) 

Residents of these states may invoke their state-specific consumer rights by submitting a request to a “controller” of “personal data.” For purposes of this notice, the following general definitions are relevant (please refer to each state law for the specific wording of each definition and any other defined terms):

A "Controller" is a person (or business) that determines the purpose for and means of processing personal data.

"Personal data" is any information that is linked or reasonably linkable to an identified or identifiable natural person. "Personal data" does not include de-identified data or publicly available information.

"Publicly available information" means information that is lawfully made available through federal, state, or local government records, and information that a controller has a reasonable basis to believe is lawfully made available to the general public.

Data Minimization and Purpose Limitation We limit our collection of personal data to what is adequate, relevant, and reasonably necessary to provide the services you have requested. In Maryland, we further restrict the processing of your information to only that which is strictly necessary for the specific product or service you interact with.

Melissa does not knowingly collect, process, or sell “sensitive data” as defined by the state privacy laws listed above. Melissa does not collect, use, or sell personal data for the purpose of training artificial intelligence models, including large language models.

II. Consumer Personal Data Rights

As a resident of one of the states identified above, you may invoke your consumer rights by submitting a consumer request to Melissa specifying the consumer rights you wish to invoke.

Your consumer rights are:

Right to Know and Access
You have the right to confirm whether we are processing your personal data and, subject to successful identity verification, to access a copy of that data. (Connecticut, Minnesota, and Oregon residents may also request a list of specific third parties to which personal data has been sold or disclosed; see Section IV for details.)

Right to Correct Inaccuracies
You have the right to correct inaccuracies in your personal data, based on the nature of the personal data and our purposes for processing that personal data.

Right to Delete
You have the right to delete personal data provided by or obtained about you.

Right to Data Portability
You have the right to obtain a copy of the personal data that you previously provided to us in a portable and readily usable format, if technically possible. (Indiana residents also have the right to request a representative summary of the personal data previously provided to us.)

Right to Opt-Out
You have the right to opt-out of the processing of your personal information for purposes of (1) targeted advertising, (2) the sale of personal data, or (3) profiling in furtherance of decisions that produce legal or similarly significant effects on you. We will also collect opt-in or opt-out consent, depending on the state in which you reside. Melissa sells personal data to third parties, as described in our Privacy Policy and in Section IV below; you may opt out of the sale of your personal data at any time using the methods described in this notice. To the extent Melissa processes personal data for targeted advertising, you may opt out of that processing as well.

For more information about the categories of personal data Melissa collects, the purpose for collecting that data, the categories of personal data we share with third parties, and the categories of third parties with whom we share the data, please see our Melissa Privacy Policy.

III. Data Retention

We retain personal data only for as long as is reasonably necessary to fulfill the purposes for which it was collected, or to comply with our legal, regulatory, and contractual obligations. Because Melissa provides data quality, identity verification, and address management services using data aggregated from third-party sources (including public records, data licensors, and other data brokers), we do not maintain a single fixed retention period for all data; instead, retention is determined by the following criteria.

Data accuracy and validity: reference data is retained for as long as we have reasonable grounds to believe it is current, accurate, and valid for its intended commercial use; superseded data is deleted or archived solely for fraud prevention or lineage purposes; data determined to be invalid or unverifiable is purged under our data quality protocols. Contractual licensing obligations: data licensed from third-party providers is retained and purged in accordance with our license agreements. Business purpose: data no longer necessary to provide our services is securely removed from active production systems. Legal and regulatory compliance: records of consumer rights requests (such as opt-out or deletion requests) are retained as required to ensure we continue to honor those requests. Backups and archives: where immediate deletion is not possible, personal data is securely stored and isolated from further processing until deletion is possible.

IV. Additional State-Specific Disclosures (Connecticut, Minnesota, Nevada, Rhode Island, and Texas)

Connecticut. In addition to the rights described in Section II, Connecticut residents may request a list of the specific third parties to which Melissa has sold their personal data. Responses to consumer requests are subject to the exceptions set forth in the Connecticut Data Privacy Act, including its protections for trade secrets. As stated above, Melissa does not collect, use, or sell personal data for the purpose of training artificial intelligence models, including large language models.

Minnesota. In addition to the rights described in Section II, Minnesota residents may request a list of the specific third parties to which Melissa has disclosed their personal data; if we do not maintain that information in a consumer-specific format, we may instead provide a list of third parties to which we have disclosed any consumers’ personal data. Responses to consumer requests are subject to the exceptions set forth in Minn. Stat. § 325M.14, including subdivision 4(j), under which a controller is not required to reveal trade secrets. Minnesota residents who are subject to profiling in furtherance of decisions that produce legal or similarly significant effects also have the right to question the result of the profiling, to be informed of the reason the profiling resulted in the decision, to review the personal data used in the profiling, and, if the decision was based on inaccurate personal data, to have the data corrected and the decision re-evaluated.

Nevada. Nevada law (NRS Chapter 603A) gives Nevada consumers the right to direct a website operator not to sell certain covered information collected through the website. Melissa does not sell personal information that you provide to us through this website. Nevada residents may nonetheless submit a request directing us not to sell their covered information, and may exercise the deletion and opt-out options described in this notice, by emailing our designated request address at ConsumerRequest@melissa.com or by using the methods described in Section V.

Rhode Island. Melissa collects the categories of personal data described in this notice and in our Privacy Policy. Melissa sells personal data to its subscribers and customers; these third parties include for-profit private entities, non-profit organizations, marketing agencies, healthcare providers, real estate businesses, political campaigns, government agencies, municipalities, and public utilities. To the extent Melissa processes personal data for targeted advertising, Rhode Island residents may opt out as described in Section II. You may contact us about these disclosures at ConsumerRequest@melissa.com.

Texas.

(Data Broker Notice, Tex. Bus. & Com. Code Ch. 510). The entity maintaining this website is a data broker under Texas law. To conduct business in Texas, a data broker must register with the Texas Secretary of State (Texas SOS). Information about data broker registrants is available on the Texas SOS website.

Melissa Data Corporation is registered as a data broker with the Texas Secretary of State (Registration No. 20260144); information about data broker registrants, including the searchable Texas Data Broker Registry, is available on the Texas SOS website at https://www.sos.state.tx.us/statdoc/data-brokers.shtml. Melissa Data Corporation is a “data broker” as defined by Chapter 510 of the Texas Business and Commerce Code; we collect, process, or transfer certain personal data that we did not collect directly from the individual to whom the data relates. Texas residents have consumer rights under the Texas Data Privacy and Security Act (Tex. Bus. & Com. Code Chapter 541), including the rights described in Section II of this notice; to exercise these rights, use the methods described in Section V.

This notice is intended to be clear, not misleading, and readily accessible to the general public, including individuals with disabilities; it is available in an alternative accessible format upon request using the contact methods described in Section V.

V. Consumer Requests 

If you are a resident of one of the states identified on this page and would like to submit a consumer request to Melissa, go to our Consumer Privacy webform and select the Consumer Request option(s) you would like to exercise. You can also email us at ConsumerRequest@melissa.com, or call us at 1-800-800-6245 ext. 4.

Verification and Security To protect your information from unauthorized access and tampering, state laws and regulations require us to verify your identity.

• Proportionate Verification: Our verification process is designed to be proportionate to the risk associated with your request. For purposes of verification, we will match information you provide against our records, but will not require you to create a new account or provide a government ID for simple opt-out requests. For high-risk requests (such as Right to Access), we may require further authentication to ensure legal compliance and data security.
• Identity Protection: We are legally prohibited from disclosing certain highly sensitive pieces of data in a "Right to Know" report. Instead, we will confirm the existence of that data in our systems.

Any individual, regardless of state of residence, may request to have their personal information deleted from our Melissa Lookups and other database products, and to opt out of the sale or sharing of their personal information. If you would simply like to request deletion of your information, select “Right to Delete” and/or “Right to Opt-Out of Sale” in the Consumer Privacy webform.

If we decline to take action regarding your request, you may appeal such decision within a reasonable period of time by emailing ConsumerRequest@melissa.com.

We will respond to verifiable consumer requests within forty-five (45) days; where reasonably necessary, we may extend this period by an additional forty-five (45) days, in which case we will notify you. If we deny your appeal, we will explain the reason for the denial; you may also contact your state Attorney General to submit a complaint.