Consumer Data Privacy – The Rush for States to Enact Laws in 2023
As efforts to establish a comprehensive consumer data privacy law in the U.S. Congress continued to stall, state legislatures picked up speed in advancing such proposals in their respective legislative chambers. In fact, 2023 state legislative sessions saw more than 140 bills introduced across 37 states. While many of these proposals were focused on comprehensive data privacy protections for consumers, others focused on specific aspects of privacy including biometric and health data.
Comprehensive Consumer Data Privacy
2023 marked an important development across state governments. At the start of 2023, just five states – California, Colorado, Connecticut, Utah, and Virginia – had successfully enacted legislation to establish comprehensive consumer privacy data privacy laws. And today the number of states with such laws has more than doubled; Delaware, Indiana, Iowa, Montana, Oregon, Tennessee, and Texas have also joined the pack.
There are important similarities between these laws, which will help to not only facilitate business compliance efforts, but will also bolster consumers’ ability to understand their rights across state borders, especially in the continued absence of baseline consumer privacy protections at the federal level. Notably, every state has opted to invest enforcement authority with the state attorney general and many have strived to include consistent and clear definitions that are narrowly tailored to providing consumer protections without introducing unnecessary barriers to innovation or limiting currently available beneficial services.
Biometric and Health Data Privacy
Largely a result of last year’s Dobbs decision and now-heightened concerns surrounding health and biometric information, state legislatures saw pushes to enact measures aimed at protecting such data. Washington enacted the My Health, My Data Act, which, while branded as a health data privacy bill, is akin to a comprehensive bill given its broad scope and definitions. Nevada passed SB 370 to create certain data privacy protections surrounding health data.
Roundup of 2023 and What to Expect in 2024
Many states that introduced privacy legislation allow for bills to “carry over” from odd to even numbered years, meaning that action on these proposals may pick up where it left off. While it is anyone’s guess just how many additional states will enact legislation in 2024, it is almost certain these conversations will continue to take center stage from New York to Michigan to Wyoming.
For more information about state privacy legislation trends from 2023 and leading into 2024, see CCIA’s 2023 state privacy landscape.
