The race is on to enact consumer data privacy laws across state lines, which, in the absence of a comprehensive federal law, would provide American consumers with more choice over how companies acquire and utilize their personal data.
Currently, there are 12 states – California, Virginia, Connecticut, Colorado, Utah, Iowa, Indiana, Tennessee, Oregon, Montana, Texas, and Delaware – that have comprehensive data privacy laws in place. During the 2022-23 legislative cycle, at least 16 states have introduced privacy bills that address a range of issues, including protecting biometric identifiers and health data. However, this patchwork approach to privacy legislation could pose compliance and liability risks for companies that have multistate operations.
Proposed bills in Massachusetts, New Jersey, Pennsylvania, North Carolina, and several other states have similar rights in preexisting privacy legislation but differ in implementation and enforcement. The data privacy map below shows the status of narrow and comprehensive legislation to stay abreast of changing regulatory landscapes.
U.S. states with consumer data privacy laws
Which states have enacted comprehensive privacy legislation?
In the coming years, more states will implement privacy laws to protect consumers from cyber risks and stay competitive with international data regulation, like the EU’s GDPR and China’s PIPL. At the time of publication, 12 U.S. states have enacted comprehensive consumer data privacy laws, which are detailed below.
California
California led the charge in being the first state to enact comprehensive data privacy legislation via the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). CCPA, signed into law on June 8, 2018, and which went into effect on Jan. 1, 2020, establishes privacy rights and business requirements for collecting and selling Californians’ personal information. On Nov. 3, 2020, California voters approved the CPRA, which amended and expanded the CCPA. The CPRA took effect on Dec. 16, 2020 – although most of its CCPA revisions didn’t take effect until Jan. 1, 2023.
;
