What are the US States with Data Privacy Laws? | DataGrail

Table of Contents

Eight out of ten Americans agree there should be a federal law protecting their personal data, according to 2022 DataGrail research.

In 2018, the European Union spearheaded the process of establishing regulations for consumer data protection with the General Data Protection Regulation (GDPR). The United States has yet to develop federal data privacy legislation, but some states have gotten the ball rolling on their own.

If your company currently conducts business in the United States or plans to in the future, you need to stay up to date on the evolving US state privacy laws. To make this easier, we’ll break down the most notable US data privacy laws by state below.

What Are Data Privacy Laws?

Data privacy laws regulate how companies must manage and protect consumer data when it’s collected, used, or shared. Generally, data privacy laws often seek to give consumers the right to:

Adhering to strict data privacy and protection standards will help you stay on the right side of the law and establish trust with your customers. In contrast, violating relevant data privacy laws in states where you conduct business can lead to legal repercussions, expensive penalties, and reputational damage.

U.S. States with Comprehensive Data Privacy Laws

As of 2022, only five U.S. states have comprehensive data privacy laws on the books:

These states give residents the right to obtain their personal information from companies, request to have it deleted, and opt out of having it sold to third parties. They also compel companies to post clear privacy policies that detail the types of personal information they collect about their consumers, who they share this data with, and how consumers can control their data.

Let’s take a closer look at each of these state’s data privacy laws:

California

California has led the charge in establishing consumer data privacy laws within the United States. As a result, the Golden State has currently enacted more data privacy laws than any other in the nation—both in quantity and protective rigor.

Here are some of the data privacy laws that companies operating in California must abide by:

Additionally, this act increases the maximum penalties for violations against consumers who are 16 years of age or below and prohibits companies from keeping personal data longer than necessary.

This law will go into effect on January 1, 2023. The California Privacy Protection Agency will be tasked with enforcing it.

Some other laws that California has enacted regarding data security and privacy include:

Colorado

Colorado’s comprehensive data privacy law is known as the CPA, or Colo. Rev. Stat. § 6-1-1301 et seq.

This law adds the Colorado Privacy Act to the Colorado Consumer Protection Act. It details consumers’ privacy rights and companies’ personal data protection duties. It also grants the Attorney General and district attorneys power to enforce the law. Finally, this act clearly defines any terms relevant to the law to dissolve any confusion.

This law will go into effect on July 1, 2023.

Connecticut

Connecticut’s primary data privacy law is known as Personal Data Privacy and Online Monitoring, or 2022 S.B. 6 or Public Act No. 22-15.

This law establishes standards for how companies must control and process Connecticut residents’ personal data. Like comparable state data laws, it gives residents the right to request a copy of their personal data, correct any inaccuracies, and opt out of personal data processing with a company altogether. It will take effect on July 1, 2023.

Connecticut residents are also protected by Conn. Gen. Stat. § 42-471, which mandates that entities possessing personal information about consumers must safeguard it from being misused by third parties and erase it upon disposal. This statute also requires companies that collect Social Security numbers to publicly post privacy protection policies.

Utah

Utah’s 2022 S.B. 227, known as the Utah Consumer Privacy Act, gives consumers the right to know:

As with the other comprehensive state laws we’ve discussed so far, this act lets consumers access and delete their data and opt out of data collection. It also gives companies clear guidelines on how they must protect consumer data.

Once this Utah privacy law takes effect on December 31, 2023, it will be enforced by the Attorney General through the administration of penalties.

Virginia

The last state on our list with an active comprehensive data privacy law is Virginia. This state’s Consumer Data Protection Act (2021 H.B. 2307/2021 S.B. 1392) is quite detailed. It lays out clear regulations for companies that conduct business in Virginia regarding how they can control and process data. It also gives consumers the right to access, delete, and correct their data, as well as opt-out of personal data processing for advertising purposes.

This law only applies to non-government companies that:

This law will take effect on January 1, 2023. It will be enforced by the Attorney General exclusively with the Consumer Privacy Fund financing these efforts. Virginia was the second state to enact comprehensive privacy legislation in the U.S.

U.S. States with Limited Data Privacy Laws

While these five states are the only ones to enact comprehensive data privacy laws so far, there are other states with moderate protective measures in place, such as Nevada.

Nevada

Nevada’s NRS § 603A.300 mandates that websites allow Nevada users to opt-out of having their personal information sold to third parties. The Attorney General has the right to pursue injunctions and penalties for any violations.

Nevada 2021 S.B. 260, Chap. 292 also applies in this state. This law outlines certain exemptions and prevents data brokers from selling consumer information against their wishes.

Nevada’s other data security and privacy laws are as follows:

Other U.S. State Consumer Protection Laws

Ten more states have data protection laws, though they are quite limited compared to the ones above. For example, these laws may only specify how children’s data can be used or how e-reader data can be collected.

These U.S. states with data privacy laws that are limited include:

ADPPA—A Proposed Federal Law To Supersede Existing State Regulations

While the US does not currently have a data privacy and protection law enacted at the federal level, this may soon change. A bill known as the American Data Privacy Protection Act (ADPPA) is currently stalled in the legislative process. If it or another US federal data privacy law is enacted, it will supersede the existing state laws and require uniform compliance for all companies conducting business in the US.

However, a federal law doesn’t mean that state-level privacy rules and restrictions disappear. Many of the current state data privacy laws may remain to provide additional protections beyond the federal regulation’s scope, depending on a federal bill’s final structure.

How Can Companies Ensure Compliance?

As you can see, each state has distinct privacy rules and regulations when it comes to data collection and processing. Unfortunately, keeping up with these laws can be difficult if you don’t have the right tools.

One way you can stay in compliance with ease is by utilizing DataGrail, a comprehensive data privacy management software system. With DataGrail’s data privacy platform, you can automate your privacy fulfillment, reducing your reliance on manual labor and enhancing your compliance. As your business grows and expands into new states, DataGrail can ensure your privacy management is up for the task.