As summer approaches, three new state comprehensive privacy laws are poised to take effect, raising the number of states with effective comprehensive privacy legislation in the US to sixteen (with more to come in 2026). The new laws are:
- Tennessee, which applies to companies generating $25 million in gross annual revenue and either: collecting the personal information of 175,000 state residents annually or 25,000 residents while deriving 50% of revenue or more from data sales. The effective date is July 1, 2025.
- Minnesota, which applies to companies that collect the personal information of 100,000 state residents annually (excluding payment transactions) or that collect the data of 25,000 residents and derive 25% or more of their revenue from data sales. The effective date is July 21, 2025.
- Maryland, which applies to companies collecting the personal information of 35,000 state residents annually or 10,000 residents while driving 20% or more of annual revenue from data sales. The effective date is October 1, 2025.
Please also note in particular that Maryland’s law contains certain novel restrictions, such as a per se prohibition on “sales” of any data considered “sensitive,” and a restriction that businesses may only collect any personal data when necessary to provide a good or service requested by the individual to whom the data pertains. This unique restriction promises some difficulties for any B2B business in receipt of consumer information and does not have direct relationships with consumers (and may raise the question of whether such businesses are no longer legal in Maryland).
