Following the lead of California and then Virginia, Colorado recently became the third U.S. state to pass a comprehensive law providing its residents with personal data privacy rights. While there is significant overlap between how each of these state laws defines who it applies to and what consumer rights are granted, there are several key differences, including the scope of consumers’ opt-out rights:

These states make up a combined 16% of the U.S. population, making it increasingly difficult for even strictly U.S.-focused organizations to fall out of scope of comprehensive data security and privacy laws requiring, for example, the use of data protection assessments.

The U.S. regulatory landscape continues to evolve on a nearly weekly basis. Indeed, similar comprehensive bills have already been introduced in Massachusetts, New York, and Illinois. As more states pass legislation related to collecting personal information, it remains imperative for businesses to stay updated on how each state regulates this activity.