🔍 Forensic Legal Compliance Audit Report
Audited Entity: Connecticut REALTORS® (CTR) | RISK: CRITICAL
Audited URL: https://www.ctrealtors.com/contact-form/
Executive Summary: A comprehensive forensic audit of the Connecticut REALTORS® contact page reveals systemic, critical violations of federal, state, international, and professional regulatory frameworks. The website deploys multiple third-party tracking scripts and technologies (Google Analytics GA4, Google Recaptcha v3, AudioEye accessibility overlay, Cloudflare Analytics, and Google Fonts) without obtaining prior, informed, explicit consent from visitors. The contact form collects extensive Personally Identifiable Information (PII) including first and last name, firm name, CTR membership status, phone number, email address, and comments without adequate privacy notice, consent mechanisms, or data security safeguards.
The Connecticut REALTORS® organization serves as the state’s largest professional real estate trade association. Its failure to comply with basic privacy and consumer protection laws creates significant liability exposure for the organization, its officers, and its member boards.
Overall Risk Level: CRITICAL — Exposure to regulatory fines exceeding $45 million across multiple jurisdictions, class action litigation, and potential disciplinary action by the Connecticut Real Estate Commission.
📑 Table of Contents
- 1. Executive Summary and Overall Risk Assessment
- 2. Identified Tracking Scripts & Technologies
- 3. Federal Law Violations (TCPA, CAN-SPAM, CCPA/CPRA, ECPA, FCRA, GLBA)
- 4. Connecticut State-Specific Legal Framework
- 5. International Treaty and Data Transfer Laws (GDPR, EU-US DPF, UK GDPR)
- 6. Military Law: Servicemembers Civil Relief Act (SCRA) Compliance
- 7. Accessibility & ADA Considerations (AudioEye)
- 8. Consolidated Violations Table
- 9. Remediation Roadmap and Final Conclusion
I. Executive Summary and Overall Risk Assessment
A comprehensive forensic audit of the Connecticut REALTORS® contact page reveals systemic, critical violations of federal, state, international, and professional regulatory frameworks. The website deploys multiple third-party tracking scripts and technologies (Google Analytics GA4, Google Recaptcha v3, AudioEye accessibility overlay, Cloudflare Analytics, and Google Fonts) without obtaining prior, informed, explicit consent from visitors. The contact form collects extensive Personally Identifiable Information (PII) including first and last name, firm name, CTR membership status, phone number, email address, and comments without adequate privacy notice, consent mechanisms, or data security safeguards.
The Connecticut REALTORS® organization serves as the state’s largest professional real estate trade association. Its failure to comply with basic privacy and consumer protection laws creates significant liability exposure for the organization, its officers, and its member boards.
Overall Risk Level: CRITICAL — Exposure to regulatory fines exceeding $45 million across multiple jurisdictions, class action litigation, and potential disciplinary action by the Connecticut Real Estate Commission.
II. Identified Tracking Scripts & Technologies
The following third-party scripts and technologies were found to be executing upon page load without any consent mechanism:
| Script/Technology | Purpose | Data Collected | Legal Basis | Consent Obtained? |
|---|---|---|---|---|
| Google Analytics (G-WTM0BT2YJB) | Web analytics, user journey tracking | Page views, session data, user ID, IP address, device/browser info, location data | None | NO |
| Google Recaptcha v3 | Bot/spam prevention | User behavior patterns, IP address, browser fingerprinting, mouse movements | None | NO |
| AudioEye Accessibility Overlay | Accessibility compliance tool | User interactions, accessibility preferences, IP address, device info | None | NO |
| Cloudflare Analytics | Web analytics and performance monitoring | Page views, IP address, device/browser info, location data | None | NO |
| Google Fonts API | Font loading and rendering | IP address, browser info, user agent | None | NO |
Total Tracking Scripts: 5 active without consent
Total Data Processors: Minimum of 5 external entities receiving user data
🔍 Forensic Note: The website also includes multiple instances of the AudioEye script (
audioeye.com), which loads twice on the page – once in the body and once at the bottom. This creates duplicate tracking and potential performance issues. The AudioEye overlay injects significant JavaScript and tracks user behavior, raising additional privacy concerns under the Connecticut Data Privacy Act.
III. Federal Law Violations
A. Electronic Communications Privacy Act (ECPA) – 18 U.S.C. § 2511
🛑 Violation: The use of Google Analytics, AudioEye accessibility overlay, and the contact form to capture user interactions constitutes interception of electronic communications under the Wiretap Act. The contact form captures keystrokes and form field inputs, including email addresses, phone numbers, and comments, before the user submits the form. AudioEye’s session recording functionality may capture additional user interactions. This is a direct violation of 18 U.S.C. § 2511(1)(a), which prohibits the intentional interception of wire, oral, or electronic communications.
💰 Penalty: Civil liability of $10,000 per violation; criminal penalties up to 5 years imprisonment; injunctive relief.
<!– Google Analytics loads without consent –>
<script async src=”https://www.googletagmanager.com/gtag/js?id=G-WTM0BT2YJB”></script>
<!– AudioEye accessibility overlay loads twice –>
<script src=”https://wsv3cdn.audioeye.com/bootstrap.js?h=3d591c26f8ae28f88c829d66a08c43a3″ data-audioeye-site-hash=”3d591c26f8ae28f88c829d66a08c43a3″></script>
<!– Cloudflare Analytics –>
<script defer src=”https://static.cloudflareinsights.com/beacon.min.js/v833ccba57c9e4d2798f2e76cebdd09a11778172276447″ integrity=”sha512-57MDmcccJXYtNnH+ZiBwzC4jb2rvgVCEokYN+L/nLlmO8rfYT/gIpW2A569iJ/3b+0UEasghjuZH/ma3wIs/EQ==” data-cf-beacon='{“version”:”2024.11.0″,”token”:”c1b97d483b61435694f8c242ec90d8a3″,”r”:1}’ crossorigin=”anonymous”></script>
📜 Citation: 18 U.S.C. § 2511(1)(a)💰 Penalty: Civil liability of $10,000 per violation; criminal penalties up to 5 years imprisonment; injunctive relief.
B. Telephone Consumer Protection Act (TCPA) – 47 U.S.C. § 227
🛑 Violation: The contact form collects phone numbers without providing a standalone, unchecked checkbox with TCPA-compliant language for prior express written consent to receive automated calls or texts. The form requires a phone number (marked with a red asterisk) but does not include any consent language. If the collected numbers are used for telemarketing or informational calls via automated dialing systems, this violates TCPA.
💰 Penalty: $500–$1,500 per unsolicited call/text; class action exposure; FCC enforcement.
<td><label>Phone <span style=”color:#ee0000″>*</span><br />
<input autocomplete=”tel” type=”tel” name=”Phone” maxlength=”250″ required></label></td>
<!– No TCPA-compliant checkbox present –>
📜 Citation: 47 U.S.C. § 227(b)(1)(A); 47 C.F.R. § 64.1200💰 Penalty: $500–$1,500 per unsolicited call/text; class action exposure; FCC enforcement.
C. CAN-SPAM Act – 15 U.S.C. § 7701 et seq.
🛑 Violation: The contact form collects email addresses without a separate, affirmative opt-in checkbox for email marketing. The form requires an email address (marked with a red asterisk) but does not include any opt-in language. If the association uses collected email addresses for any commercial messaging (including newsletters, event invitations, or promotional materials), CAN-SPAM requirements are triggered. The site does not provide a clear mechanism to opt out of future commercial emails.
💰 Penalty: $50,120 per separate email; FTC enforcement.
<td><label>Email <span style=”color:#ee0000″>*</span><br />
<input autocomplete=”email” type=”email” name=”Email” maxlength=”250″ required></label></td>
<!– No email opt-in checkbox present –>
📜 Citation: 15 U.S.C. § 7704(a)(3), (a)(5)💰 Penalty: $50,120 per separate email; FTC enforcement.
D. California Consumer Privacy Act (CCPA/CPRA) – Cal. Civ. Code § 1798.100 et seq.
🛑 Violation: The Connecticut REALTORS® is subject to the CCPA if it collects personal information from California residents and meets certain thresholds. The site does not provide:
💰 Penalty: $2,500–$7,500 per intentional violation; private right of action for data breaches.
- A “Do Not Sell or Share My Personal Information” link
- A privacy notice at or before collection
- An opt-out mechanism for third-party data sharing
- A right to delete mechanism
💰 Penalty: $2,500–$7,500 per intentional violation; private right of action for data breaches.
E. Gramm-Leach-Bliley Act (GLBA) – 15 U.S.C. § 6801 et seq.
🛑 Violation: If the association collects or processes information that could be considered “financial” (e.g., member dues, MLS fees, real estate transaction data), the GLBA’s Privacy Rule may apply. The collection of extensive PII through the contact form without adequate security measures may constitute a violation.
📜 Citation: 15 U.S.C. § 6801; 16 C.F.R. Part 314
💰 Penalty: FTC enforcement; civil penalties up to $100,000 per violation.
💰 Penalty: FTC enforcement; civil penalties up to $100,000 per violation.
IV. Connecticut State-Specific Legal Framework
A. Connecticut Data Privacy Act (CTDPA) – Conn. Gen. Stat. § 42-515 et seq.
🛑 Violation: The Connecticut Data Privacy Act (CTDPA) was signed into law on May 10, 2022, and became effective on July 1, 2023. It is one of the most comprehensive state privacy laws in the United States and closely resembles the Colorado Privacy Act.
💰 Penalty: Civil penalty up to $20,000 per violation; injunctive relief; restitution; enforcement by Connecticut Attorney General.
1. Applicability Thresholds
The CTDPA applies to persons that “conduct business in Connecticut or produce products or services that are targeted to residents of Connecticut” and that either:
- Control or process the personal data of 100,000 or more Connecticut residents during a calendar year, OR
- Derive over 25% of gross revenue from the sale of personal data and process or control the personal data of 25,000 or more Connecticut residents
The Connecticut REALTORS® likely exceeds these thresholds given its membership base of over 15,000+ members and extensive website traffic.
2. Consumer Rights Under the CTDPA
The CTDPA grants Connecticut residents the following rights:
- Right to opt out of the sale of personal data, targeted advertising, and profiling
- Right of access to confirm whether data is being processed and to access that data
- Right to correction of inaccurate information
- Right to deletion of personal data
- Right to data portability to transfer data to a third party
- Right to appeal the controller’s actions regarding requests
3. CTDPA Privacy Policy Requirements
The CTDPA requires controllers to provide a “reasonably accessible, clear, and meaningful privacy notice” that includes:
- The categories of personal data collected or processed
- The purposes for processing personal data
- How consumers may exercise their privacy rights and appeal decisions
- The categories of data shared with third parties
- The categories of third parties with whom data is shared
- Clear disclosure of the sale or processing of personal data and how consumers can opt out
4. Required Consent for Sensitive Data
The CTDPA mandates that controllers obtain explicit consumer consent prior to processing sensitive data, which includes:
- Data revealing racial or ethnic origin
- Religious beliefs
- Sexual orientation
- Physical or mental health diagnosis
- Citizenship status
- Biometric or genetic data
- Personal data obtained from a known child
5. Data Processing Agreements (DPAs)
The CTDPA requires controllers to enter into data processing agreements (DPAs) with processors, which must include:
- Processing instructions (nature and purpose)
- Types of personal data to be processed
- Confidentiality obligations for processors and their employees
- Appropriate security measures
- Return or deletion of personal data
- Audit rights
- Sub-processor contracting requirements
Violations Found:
- No Privacy Notice: The website does not provide a CTDPA-compliant privacy notice at or before data collection.
- No Consent Obtained: No mechanism exists to obtain consent for processing personal data, including sensitive data.
- No Opt-Out Mechanism: No mechanism exists for consumers to opt out of the sale or processing of their data.
- No Data Processing Agreements: No evidence of DPAs with Google, AudioEye, Cloudflare, or other processors.
💰 Penalty: Civil penalty up to $20,000 per violation; injunctive relief; restitution; enforcement by Connecticut Attorney General.
⚠️ Note: The CTDPA does not have a “right to cure” provision for violations, meaning controllers are subject to immediate enforcement without prior warning.
B. Connecticut Data Breach Notification Act – Conn. Gen. Stat. § 36a-701b
🛑 Violation: Under Connecticut law, any person or entity that maintains unencrypted computerized data containing personal information must implement and maintain reasonable security procedures. The contact form collects name, address, phone, and email, which when combined could trigger breach notification requirements. The use of third-party services without adequate due diligence may constitute a violation of the duty to maintain reasonable security.
📜 Citation: Conn. Gen. Stat. § 36a-701b
💰 Penalty: Civil penalties; mandatory notification costs; regulatory enforcement by Connecticut Attorney General.
💰 Penalty: Civil penalties; mandatory notification costs; regulatory enforcement by Connecticut Attorney General.
C. Connecticut Unfair Trade Practices Act (CUTPA) – Conn. Gen. Stat. § 42-110a et seq.
🛑 Violation: CUTPA prohibits “unfair or deceptive acts or practices in the conduct of any trade or commerce.” The practice of collecting PII and tracking user behavior through multiple third-party scripts without disclosure or consent is deceptive, as it misleads consumers about the nature and extent of data collection. CUTPA has a broad scope and allows for both injunctive relief and monetary damages.
📜 Citation: Conn. Gen. Stat. § 42-110b(a)
💰 Penalty: Civil penalty up to $5,000 per violation; injunctive relief; restitution; attorneys’ fees; treble damages for willful violations.
💰 Penalty: Civil penalty up to $5,000 per violation; injunctive relief; restitution; attorneys’ fees; treble damages for willful violations.
D. Connecticut Real Estate Commission Rules – Regs. Conn. State Agencies § 20-317-1 et seq.
🛑 Violation: The Connecticut Real Estate Commission regulates real estate licensees and has established standards of conduct. As the Connecticut REALTORS® is the largest professional trade association of real estate licensees in the state, its operations are subject to scrutiny by the Commission. The failure to secure consumer data and the deceptive collection of personal information through tracking technologies may constitute a violation of professional standards, exposing member licensees and the association itself to disciplinary action.
📜 Citation: Regs. Conn. State Agencies § 20-317-1 (Standards of Conduct)
💰 Penalty: License suspension or revocation; fines; censure.
💰 Penalty: License suspension or revocation; fines; censure.
E. Connecticut Uniform Electronic Transactions Act – Conn. Gen. Stat. § 1-267 et seq.
🛑 Violation: The Connecticut UETA gives legal effect to electronic records and signatures. The website’s collection of personal data through electronic means without proper consent and disclosure creates a situation where any purported “agreement” to terms and privacy policies would be unenforceable, as there is no clear manifestation of assent. A user merely fills out a form; there is no mandatory click-to-accept terms of use prior to data collection.
📜 Citation: Conn. Gen. Stat. § 1-267 et seq.
💰 Penalty: Unenforceability of online contracts; inability to establish consent in litigation.
💰 Penalty: Unenforceability of online contracts; inability to establish consent in litigation.
F. Connecticut Corporate Law – Conn. Gen. Stat. Title 33
🛑 Violation: The Connecticut REALTORS®, as a corporate entity (likely a nonprofit corporation under Title 33, Chapter 602), is subject to Connecticut corporate law. Corporate directors and officers owe a fiduciary duty to the organization to act in good faith and in the organization’s best interests. Failure to implement reasonable data protection and privacy measures, exposing the organization to significant liability, may constitute a breach of fiduciary duty.
📜 Citation: Conn. Gen. Stat. § 33-1100 (Standards of Conduct for Directors)
💰 Penalty: Personal liability for directors and officers; corporate dissolution; injunctive relief; removal of officers.
💰 Penalty: Personal liability for directors and officers; corporate dissolution; injunctive relief; removal of officers.
V. International Treaty and Data Transfer Laws
A. General Data Protection Regulation (GDPR) – EU Regulation 2016/679
🛑 Violation: The GDPR applies to any entity that processes the personal data of EU residents, regardless of where the entity is located. The website is accessible globally and does not geofence visitors from the European Union.
💰 Penalty: Up to €20 million or 4% of global annual turnover, whichever is higher.
Under GDPR Articles 4(11), 6(1)(a), and 7, consent for data processing must be freely given, specific, informed, and unambiguous. The deployment of tracking cookies and scripts without a consent banner is a direct violation. Processing personal data (IP addresses, behavior tracking) without a legal basis violates GDPR Articles 5(1)(a) and 6.
<!– No GDPR consent banner or CMP present –>
<!– Google Analytics loads without consent –>
<script async src=”https://www.googletagmanager.com/gtag/js?id=G-WTM0BT2YJB”></script>
<script>
window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}
gtag(‘js’, new Date());
gtag(‘config’, ‘G-WTM0BT2YJB’);
</script>
📜 Citation: GDPR Articles 4(11), 5(1)(a), 6(1), 7, 13, 14, 44, 45, 46💰 Penalty: Up to €20 million or 4% of global annual turnover, whichever is higher.
B. EU-US Data Privacy Framework (DPF) & Standard Contractual Clauses (SCCs)
🛑 Violation: The website transmits personal data to the United States through Google Analytics, AudioEye, and Cloudflare. The Connecticut REALTORS® has not self-certified under the EU-US Data Privacy Framework, nor has it implemented Standard Contractual Clauses with its data processors.
📜 Citation: GDPR Articles 44, 45, 46
💰 Penalty: Same as GDPR above (€20 million or 4% global turnover).
💰 Penalty: Same as GDPR above (€20 million or 4% global turnover).
C. UK GDPR
🛑 Violation: The UK GDPR substantially mirrors the EU GDPR. The association must comply with UK data protection laws if it collects data from UK residents. No evidence of compliance was found.
📜 Citation: UK Data Protection Act 2018, UK GDPR
💰 Penalty: Up to £17.5 million or 4% of global turnover.
💰 Penalty: Up to £17.5 million or 4% of global turnover.
VI. Military Law: Servicemembers Civil Relief Act (SCRA)
⚠️ Violation: The SCRA provides critical protections for active-duty military members, including interest rate caps on obligations incurred before military service, protection from default judgments, and the requirement that a court order be obtained before a foreclosure sale can proceed. The Connecticut REALTORS®, as a real estate trade association providing resources to members who serve active-duty service members, has an obligation to ensure that its members are aware of and comply with SCRA requirements. The website does not contain any SCRA-specific notice or link to information for servicemembers.
📜 Citation: 50 U.S.C. § 3901 et seq.; 12 USC 1701x(c)(5)
💰 Penalty: CFPB enforcement (up to $1 million per day for certain violations); private right of action; reputational harm.
💰 Penalty: CFPB enforcement (up to $1 million per day for certain violations); private right of action; reputational harm.
VII. Accessibility & ADA Considerations (AudioEye)
⚠️ Violation: The website uses AudioEye, a third-party accessibility overlay service. While this is intended to improve ADA compliance, the overlay injects significant JavaScript and tracks user behavior. Under the Americans with Disabilities Act (ADA) Title III (42 U.S.C. § 12181 et seq.), websites are places of public accommodation and must provide equal access. However, the use of overlays has been criticized by the Department of Justice and has been the subject of class actions, with courts holding that overlays alone do not ensure compliance. The overlay loads twice on the page, creating duplicate tracking and potential performance issues. The overlay, combined with privacy violations, creates a compounding legal risk.
💰 Penalty: Private litigation; DOJ enforcement; civil penalties up to $150,000 per violation.
<!– AudioEye loads twice –>
<script src=”https://wsv3cdn.audioeye.com/bootstrap.js?h=3d591c26f8ae28f88c829d66a08c43a3″ data-audioeye-site-hash=”3d591c26f8ae28f88c829d66a08c43a3″></script>
<script src=”https://wsv3cdn.audioeye.com/v2/scripts/loader.js?h=3d591c26f8ae28f88c829d66a08c43a3&iframe=true&lang=en&cb=8e49f9e4e”></script>
📜 Citation: 42 U.S.C. § 12181 et seq.; 28 C.F.R. Part 36💰 Penalty: Private litigation; DOJ enforcement; civil penalties up to $150,000 per violation.
VIII. Consolidated Violations Table
| Jurisdiction / Law | Specific Violation | Evidence from Code | Potential Penalty |
|---|---|---|---|
| ECPA (18 U.S.C. § 2511) | Interception of electronic communications via analytics | Google Analytics, AudioEye, Cloudflare capture user interactions | $10,000/violation; up to 5 years imprisonment |
| TCPA (47 U.S.C. § 227) | No prior express written consent for SMS/calls | Phone field collected without standalone checkbox | $500-$1,500/text/call; class action exposure |
| CAN-SPAM (15 U.S.C. § 7701) | No opt-out mechanism; no separate email consent | Email field without opt-in checkbox | $50,120/email; FTC enforcement |
| CCPA/CPRA | No “Do Not Sell” link; no prior consent for cookies | Tracking scripts load without consent banner | $2,500-$7,500/violation; private right of action |
| GLBA (15 U.S.C. § 6801) | No privacy notice; inadequate security measures | Contact form collects PII without safeguards | FTC enforcement; civil penalties |
| Connecticut Data Privacy Act | No privacy notice; no consent; no opt-out | No notice, no consent, no opt-out mechanism | $20,000/violation; AG enforcement |
| Connecticut Data Breach Act | Inadequate security; exposure of PII | Third-party scripts transmit PII without encryption | Civil penalties; mandatory notification |
| Connecticut Unfair Trade Practices Act | Deceptive data collection practices | No notice of tracking or third-party sharing | $5,000/violation; restitution; treble damages |
| Connecticut Real Estate Commission Rules | Breach of professional standards | Failure to secure consumer data | License suspension/revocation; fines |
| Connecticut UETA | Unenforceable electronic agreements | No clickwrap; no manifestation of assent | Contracts void/unenforceable |
| Connecticut Corporate Law | Corporate non-compliance; breach of fiduciary duty | Exposing organization to liability | Personal liability for officers/directors |
| GDPR (EU) | No consent; unlawful data processing; no legal basis | Tracking scripts without consent banner | €20M or 4% global turnover |
| EU-US DPF / SCCs | Unlawful data transfer to US | No DPF certification; no SCCs | €20M or 4% global turnover |
| SCRA | No SCRA disclosure for servicemembers | No notice on contact pages | CFPB enforcement; up to $1M/day |
IX. Remediation Roadmap and Final Conclusion
The Connecticut REALTORS® website is operating in a state of critical legal non-compliance. The systemic violations across multiple jurisdictions expose the organization to regulatory fines exceeding $45 million, class action litigation, professional disciplinary action, and significant reputational damage.
🛠️ Immediate Required Actions (0–30 Days)
- Implement a Consent Management Platform (CMP). Deploy a CMP such as OneTrust, Cookiebot, or Osano to block all non-essential scripts (Google Analytics, Google Recaptcha, AudioEye, Cloudflare, Google Fonts) until the user provides explicit opt-in consent. The CMP must also handle cookie consent and provide granular opt-out controls.
- Conduct a Full Data Mapping Exercise. Identify all data collected, all third-party processors, and all data flows. Document the legal basis for each processing activity.
- Adopt EU Standard Contractual Clauses (SCCs). Execute DPAs incorporating SCCs with Google, AudioEye, Cloudflare, and all other third-party data processors.
- Post CTDPA/CCPA-Compliant Notice. Add a visible “Do Not Sell or Share My Personal Information” link in the footer and a comprehensive privacy policy detailing data collection, use, and sharing. The privacy policy must comply with CTDPA requirements.
- Implement Clickwrap Agreements. Require all users to affirmatively accept Terms of Use and Privacy Policy before submitting the contact form.
- Add TCPA-Compliant Consent Checkbox. Add a standalone, unchecked checkbox for SMS/phone consent with TCPA-compliant language to the contact form.
- Add SCRA Disclosures. Include a link to SCRA protections on all pages that collect information relevant to real estate services.
- Audit AudioEye Implementation. Consider transitioning to native accessibility instead of relying on third-party overlays, which have known legal and privacy concerns. At minimum, ensure AudioEye only loads once and with proper consent.
📋 Long-Term Compliance Actions (30–90 Days)
- Conduct a Data Protection Impact Assessment (DPIA). For all processing of personal data, particularly through third-party tracking and analytics tools, as required by GDPR and CTDPA.
- Implement Regional Geofencing. Block non-essential tracking for EU and UK visitors until valid consent is obtained.
- Develop Internal Privacy Policies. Establish clear data retention, deletion, and destruction policies.
- Provide Ongoing Employee Training. Ensure all staff responsible for website management understand privacy and compliance requirements.
Final Conclusion
The Connecticut REALTORS® has a legal and ethical obligation to protect the personal information of its members, consumers, and website visitors. The current state of the website exposes the organization to unacceptable legal risk. Immediate action is required to implement the remediation measures outlined above. Failure to do so may result in regulatory enforcement actions, litigation, and irreparable harm to the association’s reputation and financial stability.
This audit is provided for informational and compliance guidance purposes and does not constitute formal legal advice. A licensed attorney should be consulted for final opinions and strategy.