Skip to main content

Clifford Chance

Clifford Chance
All

US State Data Regulation

Talking Tech

US-states_600x400px

State Privacy Laws

U.S. data privacy has entered a new era. Historically, the data privacy legal landscape has been dominated by sector-specific legislation, such as the Gramm-Leach-Bliley Act and Health Insurance Portability and Accountability Act, often with a focus on cybersecurity or preventing misuse of certain types of personal information. The California Consumer Privacy Act was the first comprehensive (i.e., broad sweeping) state data privacy law added to this U.S. regulatory framework that focused on consumer protection. Since its adoption, various state-level regulatory and legislative activity has been building momentum. Today, several states have enacted or are continuing to develop comprehensive data privacy laws with requirements that apply across nearly all business sectors. Understanding the scope, applicability, and requirements of these state data privacy laws is more crucial than ever for companies operating in the U.S. While many of the recently enacted state data privacy laws became effective (i.e., operative and enforceable) in 2023, a number of new state data privacy laws will come into effect in 2024 and in the coming years, and additional data privacy legislation is also likely on the horizon.

Read our individual overviews of currently enacted comprehensive state data privacy laws to learn more. If you would like to see a chart comparison of key provisions in these laws, please contact Rory.Griffith@cliffordchance.com
Data

California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA / CPRA”)

As 2023 approaches, a flurry of activity in California means big changes in the year ahead for data privacy. New obligations, an expanded scope of covered data, increasing enforcement, and scant regulations all mean it’s a good time for companies processing the personal information of California residents to make sure they’re prepared for the new year. Read ahead for insights into what’s coming and strategies for compliance, including Frequently Asked Questions.

Read
Data

Virginia passes the Consumer Data Protection Act

2021 is projected to be a pivotal year in privacy legislation and the year is off to a fast start. On2nd March, the Commonwealth of Virginia became the first state to enact a comprehensive consumer privacy law in 2021. The Virginia Consumer Data Protection Act draws heavily from the California Consumer Privacy Act and the EU General Data Protection Regulation and will impose significant new obligations on certain companies that process personal information of Virginia residents. The new law will go into effect in 2023.

Read
Data

Colorado joins California and Virginia with a comprehensive data privacy law

The Colorado Privacy Act (CPA) will give Colorado consumers certain rights with respect to their personal data. The new law will go into effect on 1 July 2023

Read
Data

Connecticut Data Privacy Act Becomes Nation's Fifth State Privacy Law, Setting Stricter Standards

The Act is the latest stitch in the patchwork of state and federal privacy laws that is growing ever more complex. And as has become a trend, while the law shares many similarities with its counterparts in other states, the Act also has certain unique provisions that companies that do business in Connecticut will need to carefully consider before the law goes into effect on July 1, 2023

Read
Data

Utah Becomes Fourth State To Pass Consumer Privacy Act, First With Republican-Controlled House And Senate

On March 24, 2022, Utah Governor Spencer Cox signed the Utah Consumer Privacy Act into law, making Utah the fourth state to pass a comprehensive consumer privacy law

Read
Data

The Iowa Data Privacy Law: An Overview

On March 28, 2023, Iowa became the sixth state in the U.S. to enact comprehensive data privacy legislation with Iowa Governor, Kim Reynolds, signing Iowa Senate File 262, an Act relating to consumer data protection, providing civil penalties and including effective date provisions (the Iowa Consumer Data Protection Act or IACDPA). The IACDPA comes into effect on January 1, 2025. The IACDPA joins other U.S. state data privacy laws that are either in effect or will soon come into force (together with the IACDPA, the "State Data Privacy Laws"). This article summarizes key provisions of the IACDPA

Read
Data

The Indiana Data Privacy Law: An Overview

On May 1, 2023, Indiana became the seventh state in the U.S. to enact comprehensive data privacy legislation with Indiana Governor, Eric Holcomb, signing Indiana Senate Bill 5 (the Indiana Consumer Data Protection Act or INCDPA). The INCDPA comes into effect on January 1, 2026. The INCDPA joins other U.S. state data privacy laws that are either in effect or will soon come into force (together with the INCDPA, the "State Data Privacy Laws"). This article summarizes key provisions of the INCDPA.

Read
Data

The Tennessee Data Privacy Law: An Overview

On May 11, 2023, Tennessee became the eighth state in the U.S. to enact comprehensive data privacy legislation with Tennessee Governor, Bill Lee, signing amended House Bill No. 1181 (the Tennessee Information Protection Act or TIPA). The TIPA comes into effect on July 1, 2025. The TIPA joins other U.S. state data privacy laws that are either in effect or will soon come into force (together with the TIPA, the "State Data Privacy Laws"). This article summarizes key provisions of the TIPA.

Read
Data

The Montana Data Privacy Law: An Overview

On May 19, 2023, Montana became the nineth state in the U.S. to enact comprehensive data privacy legislation with Montana Governor, Greg Gianforte, signing Montana Senate Bill 384, an Act establishing the consumer data privacy act (the Montana Consumer Data Privacy Act or MTCDPA). The MTCDPA comes into effect on October 1, 2024. The MTCDPA joins other U.S. state data privacy laws that are either in effect or will soon come into force (together with the MTCDPA, the "State Data Privacy Laws"). This article summarizes key provisions of the MTCDPA.

Read
Data

The Florida Data Privacy Law: An Overview

On June 6, 2023, Florida became the tenth state in the U.S. to enact comprehensive data privacy legislation with Florida Governor, Ron DeSantis, signing Florida Senate Bill 262 (the Florida Digital Bill of Rights or FLDBOR). The FLDBOR will come into effect on July 1, 2024. The FLDBOR joins other U.S. state data privacy laws that are either in effect or will soon come into force (together with the FLDBOR, the "State Data Privacy Laws"). This article summarizes key provisions of the FLDBOR.

Read
Data

The Texas Data Privacy Law: An Overview

On June 18, 2023, Texas became the eleventh state in the U.S. to enact comprehensive data privacy legislation with Texas Governor, Greg Abbott, signing HB 4, the Texas Data Privacy and Security Act (the Texas Data Privacy and Security Act or "TXDPSA"). The TXDPSA comes into effect on July 1, 2024. The TXDPSA joins other U.S. state data privacy laws that are either in effect or will soon come into force (together with the TXDPSA, the State Data Privacy Laws). This article summarizes key provisions of the TXDPSA.

Read
Data

The Oregon Data Privacy Law: An Overview

On July 18, 2023, Oregon governor Tina Kotek signed the Oregon Consumer Data Privacy Act (the Oregon Consumer Data Privacy Act or OCDPA), making Oregon the twelfth state in the U.S. to enact comprehensive data privacy legislation. The OCDPA will take effect on July 1, 2024. The OCDPA joins other U.S. state data privacy laws that are either in effect or will soon come into force (together with the OCDPA, the "State Data Privacy Laws"). This article summarizes key provisions of the OCDPA.

Read
Data

The Delaware Data Privacy Law: An Overview

On September 11, 2023, Delaware governor John Carney signed the Delaware Personal Data Privacy Act (the Delaware Personal Data Privacy Act or DPDPA), making Delaware the thirteenth state in the U.S. to enact comprehensive data privacy legislation. The DPDPA will take effect on January 1, 2025. The DPDPA joins the other U.S. state data privacy laws are either in effect or will soon come into force (together with the DPDPA, the "State Data Privacy Laws"). This article summarizes key provisions of the DPDPA.

Read
Data

The New Jersey Data Privacy Law: An Overview

On January 16, 2024, New Jersey governor Phil Murphy signed the New Jersey Data Protection Act (New Jersey Data Privacy Act or NJDPA), making the Garden State the fourteenth state in the U.S. to enact comprehensive data privacy legislation (together with the NJDPA, the State Data Privacy Laws). The NJDPA is also notably the first law enacted in 2024, carrying last year's privacy law momentum—when eight states passed their own privacy laws—into the new year. The NJDPA will take effect on January 15, 2025

Read
Data

The New Hampshire Data Privacy Law: An Overview

On January 4, 2024, the New Hampshire legislature passed Senate Bill 255 (the New Hampshire Data Privacy Act or NHDPA), which after New Hampshire Governor Chris Sununu's signature, would make New Hampshire the fifteenth state in the U.S. to enact comprehensive data privacy legislation. The NHDPA as currently proposed will take effect on January 1, 2025

Read
see all our data content

Toolkits & Client Log-in