Twenty States Have Consumer Privacy Laws; More Likely to Come

The push by states to enact comprehensive consumer privacy laws has accelerated in recent years. There’s no national data privacy standard, so it’s vital for businesses to understand their obligations under this dizzying array of requirements. Even if a company doesn’t have a physical presence in a jurisdiction, it can nevertheless be subject to that state’s privacy laws when they process personal data from individuals who reside there.

In 2018, California became the first state to pass a comprehensive data privacy law, the California Consumer Privacy Act. Over the next few years, adoption of these laws was slow: 2021 and 2022 each saw the passage of two state privacy enactments.

In 2023, the floodgates opened as eight states passed statutes that year. Coupled with the seven new laws that have been added so far in 2024, the number of states with comprehensive consumer privacy enactments now stands at 20.

In light of the obstacles facing the passage of a broad national law, and the desire by state lawmakers to protect consumers from cyber risks, it’s likely that most, if not all, states could follow suit. Next year could see another seven to eight state comprehensive privacy laws get passed.

These laws impose extensive obligations on covered businesses and strengthen consumer rights. Yet they also differ in certain respects, and as the number of states enacting comprehensive laws has grown, so have the nuances between these laws.

GENERATE THE DATA

To replicate the research for this article:

1. Visit Bloomberg Law’s State Privacy Law Landscape Chart Builder. (Bloomberg Terminal subscribers: Run BLAW OUT <GO> and search for “State Privacy Law Landscape”.)

Chart builder is a tool that enables users to quickly compare privacy law requirements between jurisdictions. Included are summaries of these laws with links to relevant supplemental content from across the Bloomberg Law platform.

2. Select “All” from the Jurisdiction column.

3. Select “Comprehensive Consumer Privacy” from the Topics row.

4. Click “Create” for the tailored chart builder results.

5. The resulting table can be exported to Excel.

The chart builder tool also allows users to compare selected state privacy laws. For example, Iowa and Utah are unique because they don’t give consumers the right to correct their data. Likewise, Florida, Nebraska, and Texas are the only states that have no data processing thresholds for determining which businesses are subject to their consumer privacy laws.

6. Repeat step 1 (see above).

7. Select the desired states (here: Florida, Iowa, Nebraska, Texas, and Utah) from the Jurisdictions column.

8. Under Topics, click the arrow by “Comprehensive Consumer Privacy” to drop down the categories under that topic. Select “Applicability” and “Consumer Rights” and click “Create” at the bottom right of the screen.

9. The tailored chart builder results can be viewed in a table format or exported to Excel.

Bloomberg Law subscribers can find a variety of Practical Guidance documents, workflow tools, and reference materials on our Privacy & Data Security practice page.

If you’re reading this on the Bloomberg Terminal, please run BLAW OUT in order to access the hyperlinked content or click here to view the web version of this article.