Consumer Data Privacy Laws

How privacy laws protect consumer data

Consumer data privacy laws create standards about how businesses collect, use, and store sensitive consumer data. These laws are critical given the abundance of data breaches. Privacy laws typically fall into two categories, vertical and horizontal:

• Vertical privacy laws protect medical records and financial data (such as an individual’s health and financial status).
• Horizontal privacy laws focus on how organizations use sensitive consumer information (such as biometric data and fingerprints) or other personally identifiable information (such as names and addresses).

Both types of laws are important tools in legislative efforts to protect privacy rights. Vertical privacy policies can be an effective way to target risks to specific types of consumer data, while horizontal privacy regulations apply more generally to the processing of all personal data across technologies and industries.

What personal information is protected by data privacy laws?

Personally identifiable information (PII)

Personally identifiable information (PII) refers to information that can be used directly or indirectly to identify an individual. PII is the most accessible and unregulated type of data, which can include both sensitive and nonsensitive information, including:

• Name
• Address
• Birthday
• Driver’s license number
• Biometric records
• Personal information (PI)

Personal information (PI) includes any information that could be linked to a person, such as:

• IP address
• Contact information
• Employment history
• Voting records
• Religious affiliation
• Sexual orientation

Not all PI is PII. However, all PII is PI, since PI is considered a broad category of personal identity.

Sensitive personal information (SPI)

A term first covered under the California Privacy Rights Act (CPRA), sensitive personal information (SPI) is personal information that has the potential to cause harm if released to the public. Examples of SPI include:

• Social Security number
• Passport number
• Medical records
• Financial statements
• Password credentials

Data privacy policy

Data privacy policies are an important tool that can help businesses stay compliant. A data privacy policy informs consumers how a business will collect, use, store, share, and transfer personal information. These policies also allow companies to garner goodwill and trust from consumers by emphasizing the companies’ respect for consumer privacy and transparency about their practices.

Federal data privacy laws

The U.S. does not yet have a comprehensive federal consumer data protection law that covers all varieties of private data. But it does have several federal laws that protect specific data sets, such as the U.S. Privacy Act of 1974, HIPAA, COPPA, and the Gramm-Leach-Bliley Act. As processing and storing data becomes even more essential to businesses, consumers can anticipate more states – and potentially the federal government – will pass comprehensive data privacy laws.

U.S. Privacy Act of 1974

The Privacy Act of 1974 establishes rules for collecting, maintaining, using, and disseminating personal information by all federal agencies. Individuals have the right to know what information is being collected, how that data is being utilized, and the ability to request corrections.

HIPAA

HIPAA protects a person’s medical records by setting national standards for privacy, confidentiality, and consent.

COPPA

COPPA regulates how personal information is collected from children under the age of 13. Online operators must get parental consent, disclose how the information is handled, and allow a child’s guardian to access or delete the information under COPPA.

Gramm-Leach-Bliley Act

The Gramm-Leach-Bliley Act, enacted in 1999, allows commercial and investment banks, securities firms, and insurance companies to consolidate, in addition to protecting the privacy of consumers’ financial information.

Which states have consumer data privacy laws?

More than a dozen states have enacted comprehensive consumer data privacy laws. And with several privacy bills currently on statehouse dockets, that list is growing.

California

California led the charge in being the first state to enact comprehensive data privacy legislation via the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). CCPA, signed into law on June 8, 2018, and which went into effect on Jan. 1, 2020, establishes privacy rights and business requirements for collecting and selling Californians’ personal information. On Nov. 3, 2020, California voters approved the CPRA, which amended and expanded the CCPA. The CPRA took effect on Dec. 16, 2020 – although most of its CCPA revisions didn’t take effect until Jan. 1, 2023.

Colorado

Joining California and Virginia in the privacy race, Colorado signed the Colorado Privacy Act (CPA) into law on June 8, 2021, and it became effective as of July 1, 2023. The CPA lays out five key rights for Colorado consumers:

• Right to access
• Right to correction
• Right to delete
• Right to data portability
• Right to opt out

The CPA protects information that can be linked to an identifiable individual and excludes de-identifiable data and publicly available data.

Connecticut

Connecticut became the fifth state to implement comprehensive consumer privacy legislation on May 10, 2022. The Connecticut Data Privacy Act (CTDPA), effective as of July 1, 2023, includes stronger data protections for children but a similar framework as its predecessors.

Delaware

Delaware became the 12th state to join the data privacy race, giving consumers more control over how their data is processed and stored. Effective Jan. 1, 2025, the Delaware Personal Data Privacy Act has stronger privacy rights for consumers, such as heightening protections for children’s data, broadening definitions of sensitive data, and being able to opt out of the processing of personal data for targeted advertising purposes.

Florida

Florida’s SB 262 created the Florida Digital Bill of Rights, which grants residents certain protections relating to the processing of their personal data by businesses, similar to provisions used by other states like Texas and California. The law also requires search engines, such as Google, to disclose if they prioritize results based on political ideology and prohibits government-mandated content moderation on social media. Florida’s law only regulates companies that make more than $1 billion in gross annual revenues and derive more than half their revenue from online ads. Most provisions go into effect July 1, 2024.

Indiana

Indiana is the seventh state to pass comprehensive legislation that regulates how consumer data is collected and secured. The Indiana Consumer Data Protection Act will regulate businesses that process the personal data of at least 100,000 Indiana residents, or those that handle the information of at least 25,000 state consumers but derive more than 50% of their revenue from selling data. It will take effect on Jan. 1, 2026.

Iowa

The sixth state to sign comprehensive data protections into law, Iowa’s Consumer Data Protection Act (ICDPA) is considered one of the most business-friendly so far, which privacy advocates say results in weaker data protections. Slated to go in effect Jan. 1, 2025, Iowa’s law does not grant consumers the right to delete or correct data collected by third parties.

Montana

Modeled after Connecticut’s privacy law, Montana’s Consumer Data Privacy Act limits the collection of personal data to only “adequate, relevant, and reasonably necessary” information. Residents have the right to opt-out or decline the sale of their personal data. This law is set to go into effect Oct. 1, 2024.

New Jersey

The New Jersey Data Privacy Act (NJDPA) provides New Jersey residents with comprehensive privacy protections against how companies collect and use their personal information. The law applies to entities that do business in the state and handle the personal data of at least 100,000 consumers per year, or at least 25,000 if the company also sells personal data. NJDPA will take effect on Jan. 15, 2025.

Oregon

One of the strongest data privacy laws passed to date, the Oregon Consumer Privacy Act (OCPA) includes provisions on biometric data, sensitive and personal data, and children’s data protections, and it doesn’t have the same exemptions found in other state privacy laws. OCPA has made Oregon the eleventh state to pass comprehensive privacy legislation – the sixth in 2023 – and the bill is effective July 1, 2024.

Tennessee

Passed with bipartisan support, the Tennessee Information Protection Act enables consumers to confirm that a business has collected their personal data, obtain a copy of the information, and request that inaccuracies be corrected. This law makes Tennessee the eighth state to sign comprehensive data privacy into law, and it is effective July 1, 2025.

Texas

Texas is the second-largest state after California to enact comprehensive privacy laws, giving residents more control over their personal data. Effective July 1, 2024, the Texas Data Privacy and Security Act (TDPSA) will apply to large companies that do business in Texas or sell, collect, or process personal data. Small businesses will mostly be exempt.

Utah

On March 24, 2022, Utah became the fourth state to pass comprehensive data legislation. The Utah Consumer Privacy Act (UCPA) – which takes a business-friendly approach to consumer protection – took effect on Dec. 31, 2023.

Virginia

On March 21, 2021, Virginia became the second state to pass comprehensive data privacy legislation with the enactment of Virginia Consumer Data Protection Act (VCDPA). The law went into effect on Jan. 1, 2023, and it gives Virginians the right to access their data and request that their personal information be deleted by businesses. It also requires companies to conduct data protection assessments to process personal data for targeted advertising and sales purposes.