Comprehensive Privacy Laws Take Effect in Seven New States
Seven additional states had comprehensive consumer privacy laws take effect in 2024: Texas, Oregon, Montana, Florida, Iowa, Delaware, and New Hampshire. These laws join existing frameworks in California (CCPA/CPRA), Virginia, Colorado, Connecticut, Utah, and Indiana, bringing the total to 17 states with comprehensive privacy legislation.
Common provisions include: consumer rights to access, delete, and correct personal data; opt-out rights for targeted advertising and data sales; data protection assessments for high-risk processing; and requirements for privacy notices. Most laws exempt small businesses below certain revenue or data processing thresholds.
The laws vary significantly in enforcement mechanisms. California's CCPA includes a private right of action for data breaches, while most other state laws are enforced exclusively by the state attorney general. No comprehensive federal privacy law has been enacted, despite ongoing Congressional efforts.
Practical Impact
Businesses operating in multiple states need a comprehensive privacy compliance strategy. Review and update privacy policies, implement data subject request processes, and conduct data mapping to understand what personal information is collected and processed. The patchwork of state laws increases compliance costs and complexity, making a unified approach essential.
Related Topics
This is legal information, not legal advice. Laws vary by jurisdiction and change frequently. Always verify current law with official sources and consult a licensed attorney in your jurisdiction for advice on your specific situation.