This article highlights some notable differences between the applicability of the new comprehensive data privacy laws in California, Virginia and Colorado, and their requirements with respect to consumer rights, notice to consumers, vendor management and enforcement.

In 2023 comprehensive data privacy laws in California, Virginia and Colorado will go into effect, reflecting a significant and continually growing state legislative trend. With each of the laws providing for significant penalties for non-compliance, organizations are well-advised to begin preparing in 2022. The rise of comprehensive state legislation began when the California legislature hastily passed the California Consumer Privacy Act (“CCPA”) in 2018. In 2020, shortly after enforcement of the CCPA began, California voters approved the California Privacy Rights Act (“CPRA”), which makes sweeping amendments to the CCPA.

Originally published in the April 2022 edition of Pratt’s Privacy & Cybersecurity Law Report.