On June 3, 2025, the Connecticut legislature passed a bill amending the Connecticut Data Privacy Act (CTDPA). The amendment introduces a variety of changes, including a broadening of the CTDPA’s applicability, changed...more
New Jersey’s Office of Consumer Protection has prepared proposed rules for the New Jersey Data Privacy Act (NJDPA) (Proposed Rules). While the bulk of the Proposed Rules consist of recitations of the obligations found in the...more
6/4/2025
/ California Consumer Privacy Act (CCPA) ,
Consent ,
Consumer Privacy Rights ,
Data Collection ,
Data Controller ,
Data Protection ,
Disclosure Requirements ,
Personal Data ,
Privacy Laws ,
Proposed Rules ,
State Privacy Laws
On May 1, 2025, the California Privacy Protection Agency (CPPA) announced a major overhaul of its draft California Consumer Privacy Act (CCPA) regulations on automated decision-making, cybersecurity audits, risk assessments,...more
On April 14, 2025, the National Institute of Standards and Technology (NIST) released a draft update to the NIST Privacy Framework 1.1. The updates are meant to enhance organizations’ data governance and risk management and...more
Following our recent client alert, learn more about enforcement targeting website tracking technologies and the impact on organizations in 2025. Elliot Golding and David Saunders share further insights from working with...more
1/27/2025
/ California Consumer Privacy Act (CCPA) ,
Consent ,
Cookies ,
Data Collection ,
Data Privacy ,
Popular ,
Privacy Acts ,
Privacy Laws ,
Risk Management ,
State Privacy Laws ,
Web Tracking ,
Websites
The act of predicting what will become the dominating storyline of data privacy and cybersecurity in 2025 is a hazardous enterprise, as one is almost surely to get something wrong. Without fail, every year, regulators and the...more
1/6/2025
/ Artificial Intelligence ,
Corporate Counsel ,
Cybersecurity ,
Data Privacy ,
Data Protection ,
Data Security ,
Digital Operational Resilience Act (DORA) ,
Enforcement Actions ,
EU ,
Machine Learning ,
PCI-DSS Standard ,
Privacy Laws ,
Regulatory Agenda ,
Regulatory Requirements ,
Risk Management ,
State Privacy Laws ,
Technology Sector ,
Web Tracking ,
Websites
On December 5, 2024, the Colorado Department of Law (Department) adopted an amended draft of its latest proposed Colorado Privacy Act (CPA) regulations. This set of amended regulations follows a public comment period that...more
12/11/2024
/ Colorado ,
Comment Period ,
Consumer Privacy Rights ,
Data Protection ,
Data Security ,
Legislative Agendas ,
Privacy Acts ,
Proposed Regulation ,
Proposed Rules ,
Regulatory Agenda ,
State Privacy Laws
California is set to amend the California Consumer Privacy Act of 2018 (CCPA) with two recent amendments that have been signed into law. Assembly Bill (AB 1008) and Senate Bill 1223 (SB 1223) aim to clarify how the law...more
On September 13, 2024, the Colorado Attorney General’s (AG) Office published proposed draft amendments to the Colorado Privacy Act (CPA) Rules. The proposals include new requirements related to biometric collection and use...more
Just past midnight on May 11, 2024, the Vermont Legislature passed H.121, the Vermont Data Privacy Act (VDPA). If signed into law, the VDPA would become the most onerous state comprehensive privacy law in the country. Among...more
5/30/2024
/ Consumer Privacy Rights ,
Governor Scott ,
Legislative Agendas ,
New Legislation ,
Popular ,
Privacy Acts ,
Privacy Laws ,
Private Right of Action ,
State and Local Government ,
State Legislatures ,
State Privacy Laws ,
Vermont
On May 19, 2024, the Minnesota Legislature passed a comprehensive privacy bill, sending the Minnesota Consumer Data Privacy Act (MCDPA) to Governor Tim Walz’s desk for signature into law.
The law, which would take effect...more
5/23/2024
/ Consumer Privacy Rights ,
Data Privacy ,
Data Protection ,
Data Protection Acts ,
Legislative Agendas ,
New Legislation ,
Personal Data ,
Privacy Laws ,
Regulatory Requirements ,
Sensitive Personal Information ,
State and Local Government ,
State Legislatures ,
State Privacy Laws ,
Summary of Consumer Rights
On April 12, 2024, the Nebraska Legislature passed the Data Privacy Act (NEDPA), sending the bill to Governor Jim Pillen’s desk for signature.
NEDPA adds to the patchwork of state consumer privacy laws in that it does not...more
4/19/2024
/ Consumer Privacy Rights ,
Data Privacy ,
Data Protection ,
Data Protection Acts ,
Enforcement Actions ,
Legislative Agendas ,
New Legislation ,
Personal Data ,
Privacy Laws ,
Privacy Policy ,
Private Right of Action ,
Regulatory Requirements ,
Small Business ,
State and Local Government ,
State Legislatures ,
State Privacy Laws
On April 7, 2024, Rep. Cathy McMorris Rodgers (R-WA), the chair of the US House Committee on Energy and Commerce, and Sen. Maria Cantwell (D-WA), the chair of the US Senate Committee on Commerce, Science, and Transportation,...more
4/18/2024
/ Covered Entities ,
Data Privacy ,
Data Protection ,
Disclosure Requirements ,
Enforcement ,
Federal Trade Commission (FTC) ,
Legislative Agendas ,
New Legislation ,
Preemption ,
Privacy Acts ,
Privacy Laws ,
Privacy Policy ,
State and Local Government ,
State Privacy Laws ,
U.S. House
On April 6, 2024, the Maryland Legislature passed a comprehensive privacy bill, sending the Maryland Online Data Privacy Act of 2024 (MODPA) to Governor Wes Moore’s desk for signature into law. The law, which would take...more
4/11/2024
/ Consumer Privacy Rights ,
Data Privacy ,
Data Protection ,
Data Protection Acts ,
Legislative Agendas ,
New Legislation ,
Personal Data ,
Privacy Laws ,
Privacy Policy ,
Regulatory Requirements ,
State and Local Government ,
State Legislatures ,
State Privacy Laws
On January 18, 2024, the New Hampshire Senate passed by voice vote SB255, the New Hampshire Privacy Act (NHPA), amended by the New Hampshire House of Representatives. The bill will head to Governor Chris Sununu’s desk. After...more
1/25/2024
/ Consumer Privacy Rights ,
Corporate Counsel ,
Data Privacy ,
Data Protection ,
Data Protection Acts ,
Legislative Agendas ,
New Legislation ,
Personal Data ,
Privacy Acts ,
Privacy Laws ,
Regulatory Requirements ,
State and Local Government ,
State Legislatures ,
State Privacy Laws
CALIFORNIA -
On March 29, 2024, the amended California Consumer Privacy Act (CCPA) regulations will take effect. These regulations were originally slated to take effect in 2023, but a court ruling (that is being appealed)...more
1/11/2024
/ California ,
Colorado ,
Connecticut ,
Cybersecurity ,
Data Privacy ,
Data Protection Acts ,
Data Security ,
Florida ,
Montana ,
Oregon ,
Privacy Laws ,
Regulatory Agenda ,
Regulatory Reform ,
State and Local Government ,
State Privacy Laws ,
Texas ,
Virginia ,
Washington
On January 8, 2024, the New Jersey legislature passed the New Jersey Data Privacy Act (NJDPA). The bill, SB 332, will soon head to Governor Phil Murphy’s desk for signing. Assuming the bill is signed quickly, it will go into...more
On November 30, 2023, the Illinois Supreme Court unanimously held in Mosby et al. v. The Ingalls Memorial Hospital et al. that when biometrics of healthcare employees are collected in the course of providing medical services,...more
12/5/2023
/ Biometric Information ,
Biometric Information Privacy Act ,
Data Collection ,
Fingerprints ,
Health Care Providers ,
Health Insurance Portability and Accountability Act (HIPAA) ,
Healthcare ,
IL Supreme Court ,
Illinois ,
Personally Identifiable Information ,
Privacy Laws ,
State Privacy Laws ,
Technology
This has been a busy year for privacy legislation, with dozens of states deliberating consumer privacy bills. Today, 13 states have their own consumer privacy laws, a tally that climbs to 15 if we include the health privacy...more
On September 11, 2023, Delaware Governor John Carney signed the Delaware Personal Data Privacy Act (DPDPA) into law, making Delaware the 13th state to enact a consumer privacy law. The DPDPA closely tracks the laws in...more
On August 28, 2023, the California Privacy Protection Agency (CPPA) released discussion drafts of regulations on cybersecurity audits and privacy risk assessments in advance of the CPPA’s meeting on September 8,...more
9/5/2023
/ Audits ,
California ,
California Privacy Protection Agency (CPPA) ,
Corporate Governance ,
Cybersecurity ,
New Regulations ,
Personal Information ,
Privacy Laws ,
Regulatory Agenda ,
Risk Assessment ,
Risk Management ,
State Privacy Laws
On July 18, 2023, the Illinois Supreme Court denied a petition for rehearing in Cothron v. White Castle System, Inc., 2023 IL 128004. The denial comes five months after the Illinois Supreme Court ruled that claims accrue...more
7/25/2023
/ Biometric Information ,
Biometric Information Privacy Act ,
Damages ,
Data Collection ,
Disclosure ,
Employees ,
Employer Liability Issues ,
Employment Litigation ,
IL Supreme Court ,
Illinois ,
Privacy Acts ,
State Privacy Laws
On June 30, 2023, the California Superior Court hearing Cal. Chamber of Commerce v. Cal. Privacy Prot. Agency, No. 34-2023-80004106 (Cal. Sup. Ct.), delayed enforcement of the latest California Consumer Privacy Act (CCPA)...more
Following in the footsteps of Washington State’s My Health My Data Act, Nevada SB 370 and Connecticut SB 3 were both recently approved by their respective governors. As detailed below, the laws impose a number of new...more
Add Oregon to the list of states passing consumer privacy laws this year. On June 22, 2023, the Oregon House of Representatives passed SB 619, the proposed Oregon Consumer Privacy Act (OCPA), following the Senate’s passage on...more
6/27/2023
/ Consumer Privacy Rights ,
Consumers ,
Data Protection ,
Enforcement ,
Exemptions ,
Legislative Agendas ,
New Legislation ,
Oregon ,
Personal Data ,
Privacy Laws ,
Proposed Legislation ,
Sensitive Personal Information ,
State and Local Government ,
State Legislatures ,
State Privacy Laws