Data

State Privacy Laws

U.S. data privacy has entered a new era. Historically, the data privacy legal landscape has been dominated by sector-specific legislation, such as the Gramm-Leach-Bliley Act and Health Insurance Portability and Accountability Act, often with a focus on cybersecurity or preventing misuse of certain types of personal information. The California Consumer Privacy Act was the first comprehensive (i.e., broad sweeping) state data privacy law added to this U.S. regulatory framework that focused on consumer protection. Since its adoption, various state-level regulatory and legislative activity has been building momentum. Today, several states have enacted or are continuing to develop comprehensive data privacy laws with requirements that apply across nearly all business sectors. Understanding the scope, applicability, and requirements of these state data privacy laws is more crucial than ever for companies operating in the U.S. While many of the recently enacted state data privacy laws became effective (i.e., operative and enforceable) in 2023, a number of new state data privacy laws will come into effect in 2024 and in the coming years, and additional data privacy legislation is also likely on the horizon.

Read our individual overviews of currently enacted comprehensive state data privacy laws to learn more. If you would like to see a chart comparison of key provisions in these laws, please contact inna.jackson@cliffordchance.com

California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA / CPRA”)

As 2023 approaches, a flurry of activity in California means big changes in the year ahead for data privacy. New obligations, an expanded scope of covered data, increasing enforcement, and scant regulations all mean it’s a good time for companies processing the personal information of California residents to make sure they’re prepared for the new year. Read ahead for insights into what’s coming and strategies for compliance, including Frequently Asked Questions.

Read

Data

Virginia passes the Consumer Data Protection Act

2021 is projected to be a pivotal year in privacy legislation and the year is off to a fast start. On2nd March, the Commonwealth of Virginia became the first state to enact a comprehensive consumer privacy law in 2021. The Virginia Consumer Data Protection Act draws heavily from the California Consumer Privacy Act and the EU General Data Protection Regulation and will impose significant new obligations on certain companies that process personal information of Virginia residents. The new law will go into effect in 2023.

Read

Data

Colorado joins California and Virginia with a comprehensive data privacy law

The Colorado Privacy Act (CPA) will give Colorado consumers certain rights with respect to their personal data. The new law will go into effect on 1 July 2023

Read

Data

Connecticut Data Privacy Act Becomes Nation's Fifth State Privacy Law, Setting Stricter Standards

The Act is the latest stitch in the patchwork of state and federal privacy laws that is growing ever more complex. And as has become a trend, while the law shares many similarities with its counterparts in other states, the Act also has certain unique provisions that companies that do business in Connecticut will need to carefully consider before the law goes into effect on July 1, 2023

Read

Data

Utah Becomes Fourth State To Pass Consumer Privacy Act, First With Republican-Controlled House And Senate

On March 24, 2022, Utah Governor Spencer Cox signed the Utah Consumer Privacy Act into law, making Utah the fourth state to pass a comprehensive consumer privacy law

Read

Data

The Iowa Data Privacy Law: An Overview

On March 28, 2023, Iowa became the sixth state in the U.S. to enact comprehensive data privacy legislation with Iowa Governor, Kim Reynolds, signing Iowa Senate File 262, an Act relating to consumer data protection, providing civil penalties and including effective date provisions (the Iowa Consumer Data Protection Act or IACDPA). The IACDPA comes into effect on January 1, 2025. The IACDPA joins other U.S. state data privacy laws that are either in effect or will soon come into force (together with the IACDPA, the "State Data Privacy Laws"). This article summarizes key provisions of the IACDPA

Read

Data

The Indiana Data Privacy Law: An Overview

On May 1, 2023, Indiana became the seventh state in the U.S. to enact comprehensive data privacy legislation with Indiana Governor, Eric Holcomb, signing Indiana Senate Bill 5 (the Indiana Consumer Data Protection Act or INCDPA). The INCDPA comes into effect on January 1, 2026. The INCDPA joins other U.S. state data privacy laws that are either in effect or will soon come into force (together with the INCDPA, the "State Data Privacy Laws"). This article summarizes key provisions of the INCDPA.

Read

Data

The Tennessee Data Privacy Law: An Overview

On May 11, 2023, Tennessee became the eighth state in the U.S. to enact comprehensive data privacy legislation with Tennessee Governor, Bill Lee, signing amended House Bill No. 1181 (the Tennessee Information Protection Act or TIPA). The TIPA comes into effect on July 1, 2025. The TIPA joins other U.S. state data privacy laws that are either in effect or will soon come into force (together with the TIPA, the "State Data Privacy Laws"). This article summarizes key provisions of the TIPA.

Read

Data

The Montana Data Privacy Law: An Overview

On May 19, 2023, Montana became the nineth state in the U.S. to enact comprehensive data privacy legislation with Montana Governor, Greg Gianforte, signing Montana Senate Bill 384, an Act establishing the consumer data privacy act (the Montana Consumer Data Privacy Act or MTCDPA). The MTCDPA comes into effect on October 1, 2024. The MTCDPA joins other U.S. state data privacy laws that are either in effect or will soon come into force (together with the MTCDPA, the "State Data Privacy Laws"). This article summarizes key provisions of the MTCDPA.

Read

Data

The Florida Data Privacy Law: An Overview

On June 6, 2023, Florida became the tenth state in the U.S. to enact comprehensive data privacy legislation with Florida Governor, Ron DeSantis, signing Florida Senate Bill 262 (the Florida Digital Bill of Rights or FLDBOR). The FLDBOR will come into effect on July 1, 2024. The FLDBOR joins other U.S. state data privacy laws that are either in effect or will soon come into force (together with the FLDBOR, the "State Data Privacy Laws"). This article summarizes key provisions of the FLDBOR.

Read

Data

The Texas Data Privacy Law: An Overview

On June 18, 2023, Texas became the eleventh state in the U.S. to enact comprehensive data privacy legislation with Texas Governor, Greg Abbott, signing HB 4, the Texas Data Privacy and Security Act (the Texas Data Privacy and Security Act or "TXDPSA"). The TXDPSA comes into effect on July 1, 2024. The TXDPSA joins other U.S. state data privacy laws that are either in effect or will soon come into force (together with the TXDPSA, the State Data Privacy Laws). This article summarizes key provisions of the TXDPSA.

Read

Data

The Oregon Data Privacy Law: An Overview

On July 18, 2023, Oregon governor Tina Kotek signed the Oregon Consumer Data Privacy Act (the Oregon Consumer Data Privacy Act or OCDPA), making Oregon the twelfth state in the U.S. to enact comprehensive data privacy legislation. The OCDPA will take effect on July 1, 2024. The OCDPA joins other U.S. state data privacy laws that are either in effect or will soon come into force (together with the OCDPA, the "State Data Privacy Laws"). This article summarizes key provisions of the OCDPA.

Read

Data

The Delaware Data Privacy Law: An Overview

On September 11, 2023, Delaware governor John Carney signed the Delaware Personal Data Privacy Act (the Delaware Personal Data Privacy Act or DPDPA), making Delaware the thirteenth state in the U.S. to enact comprehensive data privacy legislation. The DPDPA will take effect on January 1, 2025. The DPDPA joins the other U.S. state data privacy laws are either in effect or will soon come into force (together with the DPDPA, the "State Data Privacy Laws"). This article summarizes key provisions of the DPDPA.

Read

Data

The New Jersey Data Privacy Law: An Overview

On January 16, 2024, New Jersey governor Phil Murphy signed the New Jersey Data Protection Act (New Jersey Data Privacy Act or NJDPA), making the Garden State the fourteenth state in the U.S. to enact comprehensive data privacy legislation (together with the NJDPA, the State Data Privacy Laws). The NJDPA is also notably the first law enacted in 2024, carrying last year's privacy law momentum—when eight states passed their own privacy laws—into the new year. The NJDPA will take effect on January 15, 2025

Read

Data

The New Hampshire Data Privacy Law: An Overview

On January 4, 2024, the New Hampshire legislature passed Senate Bill 255 (the New Hampshire Data Privacy Act or NHDPA), which after New Hampshire Governor Chris Sununu's signature, would make New Hampshire the fifteenth state in the U.S. to enact comprehensive data privacy legislation. The NHDPA as currently proposed will take effect on January 1, 2025

Read

Data

Kentucky Consumer Data Protection Act: An Overview

On April 4, 2024, Kentucky governor Andy Beshear signed the Kentucky Consumer Data Protection Act (Kentucky Consumer Data Protection Act or KYCDPA), making Kentucky the sixteenth state in the U.S. to enact comprehensive data privacy legislation (together with the KYCDPA, the State Data Privacy Laws). The KYCDPA is the third law enacted in 2024, building on last year's momentum in states implementing comprehensive privacy laws. The KYCDPA takes effect on January 1, 2026. This article summarizes key provisions of the KYCDPA

Read

Data

Nebraska Data Privacy Act: An Overview

On April 17, 2024, Nebraska governor Jim Pillen signed an omnibus bill headlined by the Nebraska Data Privacy Act (Nebraska Data Privacy Act or NEDPA), making Nebraska the seventeenth state in the U.S. to enact comprehensive data privacy legislation (together with the NEDPA, the State Data Privacy Laws). The NEDPA is the fourth law enacted in 2024, adding to the ever-expanding patchwork of state data privacy laws in the US. The NEDPA takes effect on Janu.ary 1, 2025. This article summarizes key provisions of the NEDPA

Read

Data

Maryland Online Data Privacy Act: An Overview

On May 9, 2024, Maryland Governor, Wes Moore, approved Senate Bill 0541 (the "Maryland Online Data Privacy Act" or MDODPA), making Maryland the seventeenth State in the U.S. to enact comprehensive data privacy legislation. The MDODPA will take effect on October 1, 2025. The MDODPA joins other U.S. State data privacy laws that are either in effect or will soon come into force (together with the MDODPA, the State Data Privacy Laws). This article summarizes key provisions of the MDODPA.

Read

Data

Minnesota Data Privacy Law: An Overview

On May 19, 2024, Minnesota became the 18th State in the U.S. to enact comprehensive data privacy legislation with Minnesota Governor, Tim Walz, signing HF 4757, the Minnesota Consumer Data Privacy Act (the Minnesota Consumer Data Privacy Act or MCDPA). The MNCDPA comes into effect on July 31, 2025. The MNCDPA joins other U.S. State data privacy laws that are either in effect or will soon come into force (together with the MNCDPA, the State Data Privacy Laws". This article summarizes key provisions of the MNCDPA.

Read

Data

Rhode Island Data Transparency and Privacy Protection Act: An Overview

On June 28, 2024, the Rhode Island Data Transparency and Privacy Protection Act (the RIDTPPA) became law after being transmitted by Rhode Island governor Daniel McKee without signature, making Rhode Island the nineteenth state in the U.S. to enact comprehensive data privacy legislation (together with the RIDTPPA, the "State Data Privacy Laws). The RIDTPPA is the seventh law enacted in 2024, adding to the flurry of new laws passed in the last few months. The law takes effect on January 1, 2026. This article summarizes key provisions of the RIDTPPA

Read

see all our data content

State Privacy Laws

Data

California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA / CPRA”)

Data

Virginia passes the Consumer Data Protection Act

Data

Colorado joins California and Virginia with a comprehensive data privacy law

Data

Connecticut Data Privacy Act Becomes Nation's Fifth State Privacy Law, Setting Stricter Standards

Data

Utah Becomes Fourth State To Pass Consumer Privacy Act, First With Republican-Controlled House And Senate

Data

The Iowa Data Privacy Law: An Overview

Data

The Indiana Data Privacy Law: An Overview

Data

The Tennessee Data Privacy Law: An Overview

Data

The Montana Data Privacy Law: An Overview

Data

The Florida Data Privacy Law: An Overview

Data

The Texas Data Privacy Law: An Overview

Data

The Oregon Data Privacy Law: An Overview

Data

The Delaware Data Privacy Law: An Overview

Data

The New Jersey Data Privacy Law: An Overview

Data

The New Hampshire Data Privacy Law: An Overview

Data

Kentucky Consumer Data Protection Act: An Overview

Data

Nebraska Data Privacy Act: An Overview

Data

Maryland Online Data Privacy Act: An Overview

Data

Minnesota Data Privacy Law: An Overview

Data

Rhode Island Data Transparency and Privacy Protection Act: An Overview

Toolkits & Client Log-in