New Jersey’s Office of Consumer Protection has prepared proposed rules for the New Jersey Data Privacy Act (NJDPA) (Proposed Rules). While the bulk of the Proposed Rules consist of recitations of the obligations found in the...more
6/4/2025
/ California Consumer Privacy Act (CCPA) ,
Consent ,
Consumer Privacy Rights ,
Data Collection ,
Data Controller ,
Data Protection ,
Disclosure Requirements ,
Personal Data ,
Privacy Laws ,
Proposed Rules ,
State Privacy Laws
On April 14, 2025, the National Institute of Standards and Technology (NIST) released a draft update to the NIST Privacy Framework 1.1. The updates are meant to enhance organizations’ data governance and risk management and...more
On March 7, 2025, the California Privacy Protection Agency (CPPA) issued a settlement order imposing a $632,500 fine on American Honda Motor Co., Inc. for violations of the California Consumer Privacy Act (CCPA). The CPPA...more
3/17/2025
/ Automotive Industry ,
California ,
California Consumer Privacy Act (CCPA) ,
California Privacy Protection Agency (CPPA) ,
Consumer Privacy Rights ,
Data Privacy ,
Data Protection ,
Enforcement Actions ,
Honda ,
Personal Information ,
Privacy Laws ,
Regulatory Requirements ,
Settlement
Ahead of its next board meeting, scheduled for March 6 and 7, 2025, the California Privacy Protection Agency (CPPA) released even more proposed regulations, adding to an already full slate of proposed regulations, to amend...more
The act of predicting what will become the dominating storyline of data privacy and cybersecurity in 2025 is a hazardous enterprise, as one is almost surely to get something wrong. Without fail, every year, regulators and the...more
1/6/2025
/ Artificial Intelligence ,
Corporate Counsel ,
Cybersecurity ,
Data Privacy ,
Data Protection ,
Data Security ,
Digital Operational Resilience Act (DORA) ,
Enforcement Actions ,
EU ,
Machine Learning ,
PCI-DSS Standard ,
Privacy Laws ,
Regulatory Agenda ,
Regulatory Requirements ,
Risk Management ,
State Privacy Laws ,
Technology Sector ,
Web Tracking ,
Websites
On December 5, 2024, the Colorado Department of Law (Department) adopted an amended draft of its latest proposed Colorado Privacy Act (CPA) regulations. This set of amended regulations follows a public comment period that...more
12/11/2024
/ Colorado ,
Comment Period ,
Consumer Privacy Rights ,
Data Protection ,
Data Security ,
Legislative Agendas ,
Privacy Acts ,
Proposed Regulation ,
Proposed Rules ,
Regulatory Agenda ,
State Privacy Laws
On October 30, 2024, the Colorado attorney general (AG) announced a November 7, 2024, public rulemaking hearing to receive feedback on its latest proposed Colorado Privacy Act (CPA) regulations...more
On September 13, 2024, the Colorado Attorney General’s (AG) Office published proposed draft amendments to the Colorado Privacy Act (CPA) Rules. The proposals include new requirements related to biometric collection and use...more
On June 25, 2024, the governor of Rhode Island transmitted without signature a comprehensive privacy bill, the Rhode Island Data Transparency and Privacy Protection Act (DTPPA), back to the state legislature, which is still...more
7/2/2024
/ Data Privacy ,
Data Protection ,
Exemptions ,
Gramm-Leach-Blilely Act ,
Health Insurance Portability and Accountability Act (HIPAA) ,
Personal Data ,
Policies and Procedures ,
Popular ,
Privacy Laws ,
Rhode Island ,
State and Local Government
On May 19, 2024, the Minnesota Legislature passed a comprehensive privacy bill, sending the Minnesota Consumer Data Privacy Act (MCDPA) to Governor Tim Walz’s desk for signature into law.
The law, which would take effect...more
5/23/2024
/ Consumer Privacy Rights ,
Data Privacy ,
Data Protection ,
Data Protection Acts ,
Legislative Agendas ,
New Legislation ,
Personal Data ,
Privacy Laws ,
Regulatory Requirements ,
Sensitive Personal Information ,
State and Local Government ,
State Legislatures ,
State Privacy Laws ,
Summary of Consumer Rights
On April 12, 2024, the Nebraska Legislature passed the Data Privacy Act (NEDPA), sending the bill to Governor Jim Pillen’s desk for signature.
NEDPA adds to the patchwork of state consumer privacy laws in that it does not...more
4/19/2024
/ Consumer Privacy Rights ,
Data Privacy ,
Data Protection ,
Data Protection Acts ,
Enforcement Actions ,
Legislative Agendas ,
New Legislation ,
Personal Data ,
Privacy Laws ,
Privacy Policy ,
Private Right of Action ,
Regulatory Requirements ,
Small Business ,
State and Local Government ,
State Legislatures ,
State Privacy Laws
On April 7, 2024, Rep. Cathy McMorris Rodgers (R-WA), the chair of the US House Committee on Energy and Commerce, and Sen. Maria Cantwell (D-WA), the chair of the US Senate Committee on Commerce, Science, and Transportation,...more
4/18/2024
/ Covered Entities ,
Data Privacy ,
Data Protection ,
Disclosure Requirements ,
Enforcement ,
Federal Trade Commission (FTC) ,
Legislative Agendas ,
New Legislation ,
Preemption ,
Privacy Acts ,
Privacy Laws ,
Privacy Policy ,
State and Local Government ,
State Privacy Laws ,
U.S. House
On April 6, 2024, the Maryland Legislature passed a comprehensive privacy bill, sending the Maryland Online Data Privacy Act of 2024 (MODPA) to Governor Wes Moore’s desk for signature into law. The law, which would take...more
4/11/2024
/ Consumer Privacy Rights ,
Data Privacy ,
Data Protection ,
Data Protection Acts ,
Legislative Agendas ,
New Legislation ,
Personal Data ,
Privacy Laws ,
Privacy Policy ,
Regulatory Requirements ,
State and Local Government ,
State Legislatures ,
State Privacy Laws
On January 18, 2024, the New Hampshire Senate passed by voice vote SB255, the New Hampshire Privacy Act (NHPA), amended by the New Hampshire House of Representatives. The bill will head to Governor Chris Sununu’s desk. After...more
1/25/2024
/ Consumer Privacy Rights ,
Corporate Counsel ,
Data Privacy ,
Data Protection ,
Data Protection Acts ,
Legislative Agendas ,
New Legislation ,
Personal Data ,
Privacy Acts ,
Privacy Laws ,
Regulatory Requirements ,
State and Local Government ,
State Legislatures ,
State Privacy Laws
On January 8, 2024, the New Jersey legislature passed the New Jersey Data Privacy Act (NJDPA). The bill, SB 332, will soon head to Governor Phil Murphy’s desk for signing. Assuming the bill is signed quickly, it will go into...more
This has been a busy year for privacy legislation, with dozens of states deliberating consumer privacy bills. Today, 13 states have their own consumer privacy laws, a tally that climbs to 15 if we include the health privacy...more
On September 11, 2023, Delaware Governor John Carney signed the Delaware Personal Data Privacy Act (DPDPA) into law, making Delaware the 13th state to enact a consumer privacy law. The DPDPA closely tracks the laws in...more
Add Oregon to the list of states passing consumer privacy laws this year. On June 22, 2023, the Oregon House of Representatives passed SB 619, the proposed Oregon Consumer Privacy Act (OCPA), following the Senate’s passage on...more
6/27/2023
/ Consumer Privacy Rights ,
Consumers ,
Data Protection ,
Enforcement ,
Exemptions ,
Legislative Agendas ,
New Legislation ,
Oregon ,
Personal Data ,
Privacy Laws ,
Proposed Legislation ,
Sensitive Personal Information ,
State and Local Government ,
State Legislatures ,
State Privacy Laws
We said it earlier this month: With many state legislative sessions coming to an end, we were likely to see a push by states to finish up debates and votes on consumer privacy laws, and now you can count Tennessee (and...more
4/25/2023
/ Consumer Privacy Rights ,
Corporate Counsel ,
Data Privacy ,
Data Protection ,
Data Protection Acts ,
New Legislation ,
Personal Data ,
Privacy Acts ,
Privacy Laws ,
State Legislatures ,
State Privacy Laws
We said it earlier this month: With many state legislative sessions coming to an end, we were likely to see a push by states to finish up debates and votes on consumer privacy laws. Now you can count Montana (and Tennessee)...more
4/25/2023
/ Consumer Privacy Rights ,
Data Privacy ,
Data Protection ,
Legislative Agendas ,
New Legislation ,
Personal Data ,
Privacy Acts ,
Privacy Laws ,
State and Local Government ,
State Legislatures ,
State Privacy Laws
With the end of several state legislative sessions on the horizon, it is perhaps unsurprising that we are seeing an uptick in state legislatures passing consumer (or health) data privacy laws. You can now count Indiana among...more
As expected, the number of state consumer privacy laws continues to rise. Joining the ranks of California, Colorado, Connecticut, Utah and Virginia is now Iowa. On March 28, 2023, Iowa’s Governor signed the Iowa Data Privacy...more
There has been a flurry of state privacy activity in the past week, with Colorado becoming the latest state to finalize sweeping data privacy rules and Iowa on the precipice of becoming the sixth state to enact comprehensive...more
In a recent non-binding opinion, EU regulators expressed timid positivity about the European Commission’s draft adequacy decision on the EU-US transatlantic data flows framework (Data Privacy Framework or DPF). While some...more
We would not blame companies for feeling fatigued after the race to comply with the amended California Consumer Privacy Act (CCPA), the soon-to-be finalized CCPA regulations and the new Virginia Consumer Data Protection Act...more