2023: A Patchwork of Data Privacy Proposals
UPDATE 4/13/2023: CCIA is planning to update the interactive state legislative map for privacy at least weekly on Friday afternoons.
As lawmakers return to state capitol buildings early this year to swear in newly elected legislators and kick off 2023 legislative sessions, consumer data privacy will continue to be a top priority. The November 2022 elections also ushered in a greater number of “trifectas” – unified party control across the two state legislative chambers and governor’s office – increasing the likelihood for legislation favorable to one party to advance. This may facilitate the enactment of various data privacy proposals ranging in caliber and focus. Furthermore, 2023 is also an important milestone as recently enacted laws (and law revisions) in California, Colorado, Connecticut, Utah, and Virginia go into effect.
During the 2021-2022 biennium, state legislatures were particularly active in elevating data privacy as further detailed in CCIA’s data privacy landscape. These previously introduced proposals can serve as a good barometer to predict where and how proposals will be shaped going forward.
For example, states like Indiana, Kentucky, New York, and others have already introduced legislation to establish comprehensive consumer data privacy laws. However, other states are introducing legislation focused specifically on biometric and health data, in particular, in Maryland and Washington. While still others are following in the footsteps of California in introducing measures that are similar to the Age-Appropriate Design Code, including in New Jersey and Oregon.
As states consider such proposals, it must be stressed that any patchwork approaches to address data privacy issues presents unique challenges to consumers and businesses alike – a vast array of disparate laws promotes confusion among consumers as to what their privacy rights are, and, on the business side creates compliance challenges as the requirements and standards become a moving target. These challenges are further compounded for smaller businesses who tend to have smaller legal compliance teams and less capacity to track and meet different (and potentially conflicting) requirements.
Learn more about the state data privacy landscape here.