Oregon Attorney General Dan Rayfield has released a report detailing implementation steps and enforcement actions taken during the first six months of the Oregon Consumer Privacy Act ("OCPA"), which entered into force in July...more
The Texas Attorney General has emerged as a significant regulatory enforcement authority for data privacy in the US. Traditionally, data privacy enforcement in the US has emanated from the Federal Trade Commission and other...more
2/4/2025
/ Compliance ,
Consent ,
Consumer Privacy Rights ,
Data Brokers ,
Data Privacy ,
Data Protection ,
Personal Data ,
Popular ,
Privacy Laws ,
Privacy Notice Rule ,
State Privacy Laws
The momentum for change in US state privacy laws accelerated in 2024, driven by several significant developments, including efforts for a federal privacy law, state-level enforcement actions and the activation of four new...more
1/22/2025
/ Business Entities ,
Compliance ,
Consumer Privacy Rights ,
Corporate Counsel ,
Corporate Governance ,
Data Privacy ,
Data Protection ,
Enforcement Actions ,
Personal Data ,
Privacy Laws ,
Regulatory Requirements ,
State and Local Government ,
State Privacy Laws
California Bills, Rulemaking, and Enforcement Update -
CPPA automated decision-making technology -
On November 22, 2024, the California Privacy Protection Agency (CPPA) opened the formal public comment period on its...more
1/21/2025
/ Algorithms ,
Automated Decision Systems (ADS) ,
California ,
California Consumer Privacy Act (CCPA) ,
California Privacy Protection Agency (CPPA) ,
Consumer Privacy Rights ,
Data Brokers ,
Data Privacy ,
Data Protection ,
Enforcement Actions ,
Federal Trade Commission (FTC) ,
New York ,
Online Safety for Children ,
Privacy Laws ,
State Privacy Laws ,
Texas
On October 16, 2024, the New York State Department of Financial Services (the "DFS"), under its Cybersecurity Regulation—23 NYCRR Part 500—issued a memorandum providing guidance on the risks posed by artificial intelligence...more
11/26/2024
/ Artificial Intelligence ,
Consumer Privacy Rights ,
Covered Entities ,
Cybersecurity ,
Cybersecurity Framework ,
Enforcement ,
Financial Institutions ,
Financial Services Industry ,
NYDFS ,
Regulatory Agenda ,
Regulatory Requirements ,
Risk Assessment ,
Risk Management ,
Technology Sector
On May 24, 2024, Minnesota Governor Tim Walz signed into law the nation's 19th comprehensive data privacy law, the Minnesota Consumer Data Privacy Act (the "Minnesota Act"), which will take effect on July 31, 2025. This law...more
6/4/2024
/ Consumer Privacy Rights ,
Data Controller ,
Data Privacy ,
Data Protection ,
Governor Walz ,
Legislative Agendas ,
New Legislation ,
Personal Data ,
Regulatory Agenda ,
Regulatory Requirements ,
State Privacy Laws
On May 9, 2024, Maryland Governor Wes Moore signed into law Senate Bill 541 (the "Maryland Online Data Privacy Act") making Maryland the eighteenth state to adopt comprehensive data privacy legislation in the United States...more
5/15/2024
/ Consumer Privacy Rights ,
Consumer Protection Laws ,
Data Privacy ,
Data Protection ,
Enforcement ,
New Legislation ,
Online Privacy Protection Act ,
Personal Data ,
Privacy Acts ,
Privacy Laws ,
Privacy Policy ,
State and Local Government ,
State Privacy Laws
On March 6, 2024, New Hampshire joined the steadily expanding number of states adopting a comprehensive data privacy law, when Governor Chris Sununu signed SB 225 (the "New Hampshire Privacy Act"). The law will take effect...more
5/7/2024
/ Consumer Privacy Rights ,
Data Privacy ,
Data Protection ,
Data Protection Acts ,
Legislative Agendas ,
New Legislation ,
Personal Data ,
Privacy Acts ,
Privacy Laws ,
Privacy Policy ,
Regulatory Requirements ,
State and Local Government ,
State Legislatures ,
State Privacy Laws
On 17 April, 2024, Nebraska Governor Jim Pillen signed into law omnibus Legislative Bill 1074, which includes the Nebraska Data Privacy Act, making Nebraska the seventeenth state to adopt comprehensive data privacy...more
Proposed American Privacy Rights Act of 2024 seeks to establish national consumer data privacy rights, govern Artificial Intelligence and automated decision-making, impose additional obligations on high-impact social media...more
4/19/2024
/ Consumer Privacy Rights ,
Covered Entities ,
Data Privacy ,
Data Protection ,
Data Protection Acts ,
Legislative Agendas ,
New Legislation ,
Personal Data ,
Privacy Acts ,
Privacy Laws ,
Privacy Policy ,
Regulatory Requirements ,
State and Local Government ,
State Privacy Laws
On April 4, 2024, Kentucky joined the rapidly growing number of states adopting a comprehensive data privacy law, when Governor Andy Beshear signed, the Kentucky Consumer Data Protection Act ("Kentucky CDPA"). The law will...more
4/16/2024
/ Consent ,
Consumer Privacy Rights ,
Data Privacy ,
Enforcement ,
Exemptions ,
GLBA Privacy ,
Health Insurance Portability and Accountability Act (HIPAA) ,
Opt-Outs ,
Penalties ,
Personal Data ,
Personally Identifiable Information ,
Sensitive Personal Information ,
State Privacy Laws
On February 21, 2024, California Attorney General Rob Bonta ("Cal AG") announced that his office reached a settlement with DoorDash, the food delivery service company, for violating the California Consumer Privacy Act...more
3/25/2024
/ California Consumer Privacy Act (CCPA) ,
Consumer Privacy Rights ,
Data Selling ,
DoorDash ,
Enforcement Actions ,
Opt-Outs ,
Personal Information ,
Privacy Policy ,
Settlement ,
State Attorneys General ,
State Privacy Laws ,
Third-Party Service Provider
The effective dates of new U.S. data privacy laws are closing in. Currently, thirteen states have passed comprehensive data privacy laws in the United States: California, Virginia, Colorado, Connecticut, Utah, Iowa, Indiana,...more
On January 16, 2024, New Jersey Governor Phil Murphy signed into law Senate Bill 332 (the "New Jersey Data Privacy Law") making New Jersey the thirteenth state to adopt comprehensive data privacy legislation. This signing...more
2/6/2024
/ Consumer Privacy Rights ,
COPPA ,
Data Privacy ,
Data Protection ,
Data Security ,
New Jersey ,
New Legislation ,
New Regulations ,
Opt-Outs ,
Personal Data ,
Sensitive Personal Information ,
State Privacy Laws ,
Targeted Digital Advertising
On July 18, 2023, Oregon Governor Tina Kotek signed into law Senate Bill 619 (the "Oregon Consumer Privacy Act"), Oregon's new state consumer privacy law, which will become effective July 1, 2024. Oregon now joins California,...more
On September 11, 2023, Delaware Governor John Carney signed into law House Bill No. 154 ("Delaware Personal Data Privacy Act"), Delaware's new state consumer privacy law, which will become effective January 1, 2025. Delaware...more
9/18/2023
/ Consumer Privacy Rights ,
Delaware ,
Enforcement ,
FERPA ,
Governor Carney ,
Gramm-Leach-Blilely Act ,
Health Insurance Portability and Accountability Act (HIPAA) ,
Investigations ,
Opt-Outs ,
Personal Data ,
State Privacy Laws
The California Attorney General's (the "Cal AG") office appears to be moving forward with enforcement activities, despite a recent court ruling delaying enforcement of CPRA regulations. In the past month, since the amendments...more
8/16/2023
/ California ,
California Consumer Privacy Act (CCPA) ,
California Privacy Rights Act (CPRA) ,
Compliance ,
Consumer Privacy Rights ,
Data Collection ,
Data Privacy ,
Employees ,
Employer Liability Issues ,
Employment Policies ,
Enforcement Actions ,
Hiring & Firing ,
Mobile Apps ,
New Regulations ,
Personal Information ,
Privacy Laws ,
Regulatory Agenda ,
State Privacy Laws
On May 11, 2023, Governor Bill Lee signed the Tennessee Information Protection Act (TIPA) into law. Tennessee now joins the rapidly increasing group of states, California, Utah, Colorado, Connecticut, Virginia, Iowa and...more
6/26/2023
/ Consumer Privacy Rights ,
Cybersecurity ,
Data Controller ,
Data Privacy ,
Data Processors ,
Data Protection ,
Data Security ,
Gramm-Leach-Blilely Act ,
NIST ,
Personal Information ,
Privacy Laws ,
State Privacy Laws
On May 19, 2023, Montana Governor Greg Gianforte signed into law Senate Bill 384 ("Montana Consumer Data Privacy Act"), Montana's new state consumer privacy law, which will become effective October 1, 2024. Montana now joins...more
6/26/2023
/ Consumer Privacy Rights ,
Data Controller ,
Data Privacy ,
Data Protection ,
Legislative Agendas ,
Montana ,
New Legislation ,
New Regulations ,
Privacy Laws ,
Regulatory Agenda ,
State and Local Government ,
State Legislatures ,
State Privacy Laws
On May 1, 2023, Indiana Governor Eric Holcomb signed into law Senate Enrolled Act No. 5 ("Indiana Data Privacy Law"), Indiana's new state consumer privacy law, which will become effective January 1, 2026. Indiana now joins...more
The Colorado Attorney General's Office recently finalized rules for the Colorado Privacy Act ("CPA Rules") which was signed into law in July 2021. The Colorado Privacy Act ("CPA") will soon join the California Consumer...more
4/18/2023
/ California ,
Colorado ,
Consumer Privacy Rights ,
Corporate Counsel ,
Corporate Governance ,
Data Privacy ,
Data Protection ,
Data Security ,
Legislative Agendas ,
New Legislation ,
Privacy Laws ,
State and Local Government ,
State Privacy Laws ,
Virginia
On January 27, 2023 California Attorney General Rob Bonta ("Cal AG") announced a new enforcement sweep, aimed at businesses with mobile apps that do not comply with the California Consumer Privacy Act ("CCPA"). The...more
In a long anticipated development, on August 24 California Attorney General Rob Bonta ("Cal AG") announced the state's first monetary penalty under the California Consumer Privacy Act ("CCPA"), in a settlement with the beauty...more
This week, on Tuesday May 10, 2022, Connecticut Gov. Ned Lamont approved Connecticut Senate Bill 6, an Act Concerning Personal Data Privacy and Online Monitoring (the "Connecticut Privacy Act"). Governor Lamont’s approval...more
5/19/2022
/ Connecticut ,
Consent ,
Consumer Privacy Rights ,
Data Collection ,
Data Protection ,
Enforcement ,
GLBA Privacy ,
Governor Lamont ,
Health Insurance Portability and Accountability Act (HIPAA) ,
New Legislation ,
Opt-Outs ,
Personal Data ,
State Privacy Laws
Continuing efforts at the state level to establish a data privacy framework in the US, a fourth state has passed a comprehensive consumer privacy law. Utah has joined the ranks of Colorado, California and Virginia after...more