To comply with U.S. state privacy laws, starting April 1, 2025, Entrata will no longer redirect to its privacy policy if a client does not provide one for ProspectPortal, Resident Portal, and Online Application. Clients must provide their own privacy policies. If, after April 1, 2025, a client does not have an associated privacy policy, website visitors will be instructed to directly contact the property for their privacy practices.

‍Please note: this change will only affect clients who have not yet provided their own privacy policy for ProspectPortal, ResidentPortal, and Online Application. Entrata is here to support our clients through this change, and this article provides additional background and resources.

Overview of the Requirement to Publish a Privacy Policy

Currently, 20 U.S. states have enacted privacy laws, with more on the horizon. If your business collects personal information from residents in these states—and, in some cases, meets additional criteria such as revenue thresholds or the number of individuals whose data is collected—you may be subject to these laws. These regulations often require businesses to provide consumers with a privacy policy that clearly explains personal data collection, usage, and sharing practices, as well as other disclosures, such as how they protect that data and what rights consumers have (such as the right to access, correct, or delete their data). If you haven’t yet created a privacy policy, we encourage you to familiarize yourself with the privacy laws that may apply to your business and understand your obligations under them. 

Even if privacy laws don’t currently apply to your business—depending on factors such as your property locations—having a privacy policy helps to protect your business. This proactive step can help you prepare for new regulations and align with consumer expectations. Today’s consumers (your residents) increasingly demand transparency and the ability to make informed choices about their data, making a privacy policy an essential tool for building trust. 

What is a Data Controller? 

The term “Data Controller” is used in the EU’s data protection law, the General Data Protection Regulation (GDPR), which U.S. state privacy laws are modeled after, though U.S. laws use different terms like “Controller” (e.g., the Texas Data Privacy and Security Act) or “Business” (e.g., the California Consumer Privacy Act). Generally, U.S. privacy laws define the Controller or Business as the person or entity that determines the purposes and means of processing personal data, either alone or jointly with others. While the specific definition may vary among privacy laws, the general thrust is the same. If you are unsure whether you meet the thresholds to be considered a data controller, we strongly advise you to speak with legal counsel.

A universal requirement across these laws is for Controllers and Businesses to provide consumers a privacy notice providing information about their personal data collection, use, and sharing practices, including describing the categories of personal information collected, the purposes for which it’s processed, consumers’ rights to their data, and other information. 

What is a Data Processor? 

“Data Processors” or “Service Providers” are generally defined as a person that processes personal data on behalf of a Controller. Entrata acts as a Service Provider to our clients - and we may be one of several that may handle personal data on your behalf.

Changes coming to ProspectPortal, ResidentPortal, and Online Application

Currently, if a ProspectPortal website, ResidentPortal, or Online Application does not have a privacy policy, the user is directed to Entrata’s privacy policy. Beginning April 1, 2025, Entrata will no longer provide Entrata’s privacy policy as a stand-in. Instead, if a customer has not provided a privacy policy, users will be directed to a landing page with a generic statement advising them to contact the property manager directly for their privacy policy.

• Important: These changes will not affect the ability to publish ProspectPortal websites. If a privacy policy is not provided for a website, you will still be able to publish that website.

In October 2024, Entrata implemented a flag within the Entrata platform to notify users of any ProspectPortal websites that do not have a privacy policy provided.

Resources

We encourage clients to review the resources located in the Entrata Help Center [Compliance > Entrata and Data Privacy]. In there you will find an article titled, “Privacy Policy Changes Affecting ProspectPortal, Online Application, and ResidentPortal.” This article provides instructions for updating your privacy policy in Entrata as well as detailed information about this change. You will also find related privacy articles related to managing data subject requests you may receive within Resident Portal via the data privacy dashboard.

If you have any further questions, please reach out to your Entrata representative.