During the 2025 legislative session, Louisiana, Utah, and Texas all enacted statutes imposing new regulatory obligations on app store providers and software developers with respect to minors and, in the case of Utah, include...more
On April 8, the U.S. Department of Justice’s (DOJ) Final Rule, codified at 28 CFR Part 202, (Final Rule), implementing President Biden’s Executive Order 14117 “Preventing Access to U.S. Sensitive Personal Data and...more
5/8/2025
/ Biden Administration ,
CFIUS ,
China ,
Data Privacy ,
Data Protection ,
Department of Justice (DOJ) ,
Executive Orders ,
Final Rules ,
International Data Transfers ,
National Security ,
Regulatory Agenda ,
Regulatory Requirements
States continued to pass comprehensive consumer privacy laws throughout 2024. 2025 brings eight new state-level comprehensive consumer privacy laws into effect. As with the five state privacy laws that went into effect in...more
On June 28, the Rhode Island Data Transparency and Privacy Protection Act (DTPPA) was enacted without Governor Dan McKee’s signature, making Rhode Island the twentieth state to enact comprehensive consumer data privacy...more
7/18/2024
/ Consumer Privacy Rights ,
Data Privacy ,
Data Protection ,
Data Protection Acts ,
New Legislation ,
Personal Data ,
Privacy Laws ,
Privacy Policy ,
Regulatory Requirements ,
State and Local Government ,
State Privacy Laws
The list of U.S. state-level data privacy laws will grow substantially this summer as three more comprehensive state laws become effective. Texas, Oregon and Florida each have a comprehensive data privacy law taking effect on...more
5/7/2024
/ Consumer Privacy Rights ,
Corporate Counsel ,
Data Privacy ,
Data Protection ,
Data Protection Acts ,
Legislative Agendas ,
New Legislation ,
Personal Data ,
Privacy Laws ,
Privacy Policy ,
Regulatory Requirements ,
Sensitive Personal Information ,
Small Business ,
State and Local Government ,
State Legislatures ,
State Privacy Laws
As of March 31, 2024, Nevada’s state consumer health data law, Senate Bill No. 370 (SB 370), enters the state-level consumer health data privacy fray. Similar to Washington’s My Health My Data Act (MHMDA), SB 370 focuses on...more
3/21/2024
/ Consumer Privacy Rights ,
Data Collection ,
Data Privacy ,
Data Protection ,
Healthcare ,
New Regulations ,
Personal Data ,
Personal Information ,
Privacy Laws ,
State and Local Government ,
State Privacy Laws
On March 6, New Hampshire joined the growing list of states that have enacted a comprehensive consumer privacy statute when Governor Chris Sununu signed into law Senate Bill 255 (the Act). Generally, the Act follows the...more
3/15/2024
/ Consumer Privacy Rights ,
Data Privacy ,
Data Protection ,
Data Protection Acts ,
Legislative Agendas ,
New Legislation ,
Personal Data ,
Privacy Acts ,
Privacy Laws ,
Privacy Policy ,
Regulatory Requirements ,
State and Local Government ,
State Legislatures ,
State Privacy Laws
State-level privacy laws in the United States continue to develop at a dizzying pace and it is understandably difficult to keep track of what takes effect when. Below we’ve outlined the statutes and regulations taking effect...more
1/30/2024
/ Consumer Privacy Rights ,
Corporate Counsel ,
Data Collection ,
Data Privacy ,
Data Protection ,
Healthcare ,
New Regulations ,
Opt-Outs ,
Personal Data ,
Personal Information ,
Privacy Laws ,
State and Local Government ,
State Privacy Laws
The Indian Central Government (Central Government) enacted a broad and significant privacy law, the Digital Personal Data Protection Act (the DPDP), on August 11. The DPDP, when effective (as per dates to be notified by the...more
Oregon Governor Tina Kotek signed into law the Oregon Consumer Privacy Act (OCPA) (Senate Bill 619) on July 18, making Oregon the twelfth state to enact comprehensive data privacy legislation. The OCPA is primarily based on...more
8/16/2023
/ Consumer Privacy Rights ,
Consumers ,
Data Protection ,
Enforcement ,
Exemptions ,
Legislative Agendas ,
New Legislation ,
Oregon ,
Personal Data ,
Privacy Laws ,
State and Local Government ,
State Legislatures ,
State Privacy Laws
On June 18, Texas became the eleventh state to enact a comprehensive consumer privacy law by passing the Texas Data Privacy and Security Act (TDPSA) (HB 4). The TDPSA will take effect on July 1, 2024, which is the same day as...more
6/23/2023
/ Consumer Privacy Rights ,
Consumer Protection Laws ,
Data Collection ,
Data Controller ,
Data Privacy ,
Data Protection ,
Data Protection Acts ,
Data Security ,
Data Use Policies ,
Enforcement ,
Opt-In ,
Opt-Outs ,
Right To Cure ,
State Attorneys General ,
State Privacy Laws
On April 21, the Montana legislature unanimously passed the Montana Consumer Data Privacy Act (MCDPA) (SB 384), joining several states with general consumer data privacy bills. The MCDPA most closely aligns with the...more
On April 21, Tennessee lawmakers approved and sent to Governor Bill Lee for signature, the Tennessee Information Protection Act (TIPA), one of nine different state consumer privacy laws that are generally considered to be...more
5/1/2023
/ Consumer Privacy Rights ,
Data Protection ,
Data Selling ,
Governor Lee ,
Legislative Agendas ,
New Legislation ,
Personal Information ,
Personal Information Protection Act ,
Privacy Acts ,
State Legislatures ,
State Privacy Laws ,
Tennessee
Following closely behind Iowa’s new privacy law, on April 20, Indiana passed its consumer privacy act (SB 5) (Privacy Act), making the state the seventh to adopt what is generally considered a comprehensive consumer privacy...more
4/27/2023
/ Consumer Privacy Rights ,
Data Collection ,
Data Privacy ,
Data Protection ,
Data Protection Acts ,
Data Security ,
Enforcement ,
Personal Data ,
Privacy Acts ,
Privacy Laws ,
State Privacy Laws
On March 28, Iowa Governor Kim Reynolds signed into law an Iowa consumer privacy act (SF 262), making the state the sixth to adopt what is generally considered a comprehensive consumer privacy law. The law takes effect on...more
This holiday season and the new year brought us a revised draft of the Colorado Privacy Act (CPA) rules, gifted by the Colorado Attorney General’s (AG) Office on December 21, 2022, along with a second round of revisions...more
2/1/2023
/ Colorado ,
Comment Period ,
Consumer Privacy Rights ,
Data Protection ,
Data Security ,
Legislative Agendas ,
Privacy Acts ,
Proposed Regulation ,
Proposed Rules ,
Regulatory Agenda ,
State Privacy Laws
It has been a bustling fall for the California Privacy Protection Agency (CPPA or Agency). In the spirit of the upcoming holiday season, the Agency gifted us not one but two rounds of proposed modifications to the regulations...more
11/10/2022
/ Audits ,
California ,
California Consumer Privacy Act (CCPA) ,
California Privacy Rights Act (CPRA) ,
Contractors ,
Cybersecurity ,
Data Protection ,
Draft Guidance ,
General Data Protection Regulation (GDPR) ,
Opt-Outs ,
Rulemaking Process ,
Sensitive Personal Information ,
Third-Party Service Provider
The Colorado Attorney General’s Office issued its proposed Colorado Privacy Act (CPA) Rules (Draft Rules) on Friday, September 30. The CPA Rules differ in many ways from those in the proposed California Privacy Rights Act...more
10/13/2022
/ California Privacy Rights Act (CPRA) ,
Colorado ,
Data Protection ,
Data Retention ,
Do Not Sell ,
Notice Requirements ,
Opt-Outs ,
Privacy Notice Rule ,
Sensitive Personal Information ,
State Attorneys General ,
State Privacy Laws
On June 3, 2022, a bipartisan group of U.S. Representatives released a discussion draft of a comprehensive federal data privacy bill entitled the American Data Privacy and Protection Act (ADPPA). Though bipartisan compromise...more
6/22/2022
/ Consumer Privacy Rights ,
Covered Entities ,
Data Collection ,
Data Privacy ,
Data Protection ,
Data Security ,
Data Transfers ,
Preemption ,
Privacy Laws ,
Private Right of Action ,
Proposed Legislation ,
State Privacy Laws