16 States Reviewing Data Privacy Regulations

Alabama

Alabama continued working toward passing the Alabama Consumer Privacy Act which will enable consumers to opt out of the sale of personal information and to request that their information be deleted. Businesses collecting data will also be required to disclose the type of information being gathered and its use.

Arizona

Arizona may add an article to state law that will require businesses of a certain size to disclose the sale of personal data, allow for correction and deletion of data, and give users the ability to opt-out of data collection.

Colorado

The new Colorado Privacy Act, which is awaiting the Governor’s signature, will protect consumers by allowing state residents to obtain their data, delete their data, opt-out of data collection, and confirm if a business is accessing personal information. Businesses subject to the act must also inform third parties of a user’s option to opt-out of data collection.

Connecticut

Connecticut is working to establish a regulatory standard for the control and processing of consumer data. This will give individuals the right to access, obtain a copy of, correct, delete, and opt out of personal data gathering for the use of targeted advertising.

Florida

Two data privacy related bills are continuing to be reviewed in Florida. One, the Florida Privacy Protection Act will allow consumers to direct some businesses not to sell their information, prohibit some businesses from selling the personal information of minors without parental authorization, allow people to request their personal information be edited or deleted, and sets new standards to prevent discrimination against consumers who exercise their rights.

The second bill requires some businesses to give consumers notice about data collection and sale. Consumers will be able to opt-out of the sale of their data and additional non-discrimination measures will be included.

Illinois

Illinois’s Consumer Privacy Act offers several possible new protections for consumer data. It will primarily require businesses to disclose to users which pieces of their data have been collected, and to provide notice to consumers before using their data for additional purposes. Under the bill, consumers will also be able to request deletion of personal data and to opt-out of the sale of their information. Businesses will be allowed to offer financial incentives in exchange for use of consumer data. The bill also provides new nondiscrimination guidelines for businesses regarding data collection.

Kentucky

Kentucky lawmakers are reviewing a bill that legally redefines certain data privacy related terminology and extends the requirements of notice and access to consumer disclosures. This law will allow consumers to opt-out of data collection and protect those consumers from discrimination. The bill also gives new protections to minors.

Maryland

Maryland introduced the Maryland Online Consumer Protection Act that, if passed, will require businesses to provide notice to users before data collection occurs and will allow consumers to request a copy of their information from businesses in a timely manner, free of charge.

Massachusetts

The Massachusetts Information Privacy Act will, if passed, apply stricter data privacy regulations to large companies collecting high volumes of data in-house or with a third party data processing company.

Minnesota

The Minnesota Consumer Data Privacy Act continues to be under consideration by lawmakers. If passed, the bill will require certain businesses that collect and profit from processing large amounts of data to comply with new consumer protection regulations.

New York

The New York Privacy Act remains under consideration and will give consumers the right to obtain the names of all companies that have access to their data and provide additional protections for data sharing and anonymity. The bill will also help fund an office of privacy and data protection for the state.

New York consumers may also be granted the right to request categorical information about how their data is shared or sold by companies and for what business purpose it is being distributed.

North Carolina

The recently introduced North Carolina Consumer Data Privacy Act will, if passed, require some businesses to disclose how they are using consumer data, how consumers can exercise their data privacy rights, and which information third parties receive. Consumers will have the right to correct and delete their data and opt-out of data collection.

Oklahoma

Oklahoma Computer Data Privacy Act is still in process. If passed, the law will require businesses to provide consumers with a list of which personal information is being collected, provided, or sold to other groups.

Pennsylvania

A newly introduced bill in Pennsylvania will give consumers the right to know which of their data is collected, from where it is collected, the purpose of the collection, and which third parties are provided the data. Consumers will also be able to opt-out of collection and delete data.

Texas

If passed, a bill in Texas will enable consumers to request a copy of personal data, correct collected information, and access and delete personal data.

Washington

In Washington, two data privacy acts remain on the table. Both the People’s Privacy Act and the Washington Privacy Act 2021 are efforts to modernize data privacy regulations and provide additional consumer protections in the state. These regulations will apply to certain companies profiting from data collection and sale in Washington.