Join us as we spotlight select chapters of Venable's popular Advertising Law Tool Kit, which helps marketing teams navigate the legal risk of campaigns and promotions. Click here to download the entire Tool Kit, and tune in to the Ad Law Tool Kit Show podcast, to hear the authors of this chapter dive deeper into the issue of State Privacy Laws in this week's episode.
State privacy laws continue to evolve rapidly, challenging businesses to keep pace. In 2023, new omnibus privacy laws went into effect in California, Colorado, Connecticut, Utah, and Virginia, while eight additional states enacted similar laws. Of the eight states with newly enacted laws, four have laws that will come into effect in 2024—Florida, Montana, Oregon, and Texas. Therefore, businesses should be prepared to comply with up to nine comprehensive state privacy laws in 2024, with more laws slated to come into force in 2025 and 2026.
To date, all such laws draw inspiration from both the first comprehensive state privacy law—the California Consumer Privacy Act (CCPA)—and the European Union General Data Protection Regulation (GDPR). For example, all of the state laws give individuals certain rights with respect to "personal information" or "personal data" that "businesses" or "controllers" maintain about them. Similarly, all of the laws impose certain obligations related to "service providers" or "processors."
However, the new laws differ from the CCPA, GDPR, and each other in a range of ways. For instance, while all of the state omnibus laws have requirements related to "sensitive" personal data, the specific requirements and the types of data considered to be "sensitive" vary. Additionally, while the CCPA and GDPR can apply to personal data collected in an employment context, other laws exclude such data.
The first step is to assess what laws, if any, apply to your business. Smaller businesses are generally exempt. The thresholds for being subject to the state laws vary, and businesses may be subject to some laws but not others, depending on practices. Businesses subject to one or more laws should then take steps to drive compliance. Experienced privacy counsel can help businesses to develop a practical compliance program that harmonizes with the different laws.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
