Get expert advice on every topic you need as a small business owner, from the ideation stage to your eventual exit. Our articles, quick tips, infographics and how-to guides can offer entrepreneurs the most up-to-date information they need to flourish.
January 19, 2023
Despite mounting concern over companies that amass and sell troves of information on consumers without their knowledge, the U.S. hasn’t yet developed federal data-privacy legislation. Data brokers are largely unregulated and free to do what they want with the data, unless a state enacts its own privacy law.
California was the first to do just that. The California Consumer Privacy Act (CCPA) of 2020 made headlines as state became the first state to regulate the use of consumers’ personal information.
Now the popular saying “As California goes, so goes the nation” has seemingly come to fruition. Four more states are following its lead by enacting their own privacy laws.
Businesses subject to any of these new state data-privacy laws must understand what is required to be compliant. Even those not subject to these laws should pay attention, because similar laws will almost inevitably pass in more states in coming years.
In addition to the Golden State, whose California Privacy Rights Act (CPRA) took effect on Jan. 1, 2023, the following states will initiate enforcement of privacy statutes this year: Colorado, Connecticut, Utah and Virginia.
These privacy laws don’t apply only to companies and websites located in that particular state. In general, they also apply to companies and websites that sell, gather or share the private information of the state’s customers, regardless of which state the entity itself is based in.
Below is a rundown of state data privacy statutes going into effect in 2023.
The CPRA amended the California Consumer Privacy Act (CCPA), which implemented an array of individual privacy rights and models elements of the EU’s General Data Protection Regulation. The CPRA also created a state agency tasked with enforcing California’s privacy laws.
The CPRA has effectively replaced the CCPA as of Jan. 1, 2023, but government enforcement of the CPRA will not begin until July 1, 2023. It provides a 30-day cure for alleged violations. Noncompliance penalties range from $2,000 per violation to $2,500 for negligent violations to $7,500 for willful violations.
The CPRA also broadens the CCPA’s private right of action by enabling individuals to file lawsuits after data breaches involving new categories of personal data. The set of actionable data types is expanded to include email addresses, in addition to security questions and answers or passwords.
After California and Virginia, Colorado became the third state to enact state consumer privacy legislation when Gov. Jared Polis signed Senate Bill 21-190: Protect Personal Data Privacy into law on July 7, 2021.
Known as the Colorado Privacy Act (CPA), the law will take effect July 1, 2023. It provides a 60-day cure period for alleged violations through Jan. 1, 2025, after which the law no longer requires a cure period. Penalties can be up to $20,000 per violation.
| Talk to us about how Escalon’s essential business services can help your business meet its compliance requirements. |
Connecticut became the fifth state to adopt full consumer privacy legislation when Gov. Ned Lamont signed Senate Bill 6 into law on May 10, 2022.
Known as the Connecticut Data Privacy Act (CTDPA), the law takes effect July 1, 2023. It provides a 60-day cure period for alleged violations before Jan. 1, 2025, after which the cure period will sunset. Noncompliance is subject to penalties of up to $5,000 per violation.
The CTDPA grants Connecticut consumers the right to:
Utah became the fourth state — following California, Virginia and Colorado — to enact broad privacy legislation when Gov. Spencer Cox signed Senate Bill 227 into law on March 3, 2022.
Known as the Utah Consumer Privacy Act (UCPA), the law will take effect Dec. 31, 2023 and provides a 30-day cure for alleged violations. Noncompliance is subject to penalties of up to $7,500 per violation.
Virginia became the second state after California to officially enact comprehensive consumer privacy legislation when Gov. Ralph Northam signed Senate Bill 1392 on March 20, 2021.
Known as the Virginia Consumer Data Protection Act (VCDPA), the law took effect Jan. 1, 2023 and provides a 30-day cure for alleged violations. Noncompliance is subject to penalties of up to $7,500 per violation.
either (i) control or process personal data of at least 100,000 consumers; or (ii) derive over 50% of gross revenue from the sale of personal data and control or process personal data of at least 25,000 consumers.
Complying with different state data-privacy laws in the U.S. poses a significant challenge for affected businesses. This has spurred more interest in a federal data-privacy bill, but so far those attempts have stalled. In the event a federal privacy framework is adopted, it would pre-empt state privacy laws.
Tasnim Ahmed is a content writer at Escalon Business Services who enjoys writing on a multitude of subjects that include finops, peopleops, risk management, entrepreneurship, VC and startup culture. Based in Delhi NCR, she previously contributed to ANI, Qatar Tribune, Marhaba, Havas Worldwide, and curated content for top-notch brands in the PR sphere. On weekends, she loves to explore the city on a motorcycle and binge watch new OTT releases with a plateful of piping hot dumplings!
We provide you with essential business services so you can focus on growth.
