Privacy issues have garnered significant attention from the state despite not typically being at the forefront of discussions regarding data regulation. The states included in the article are not in any specific sequence.
Kentucky Steps Up Early
Sectors like entertainment and online platforms in Kentucky take data protection seriously. For example, popular iGaming services that allow users to play from Kentucky offer secure sign-ins, encrypted transactions, and strong data safeguards. These features support safe and fast access to entertainment platforms that offer sign up rewards and secure payments. That attention to user protection aligns with broader concerns about data as transparency becomes increasingly expected.
Recent privacy bills, such as HB 15 and HB 301, demonstrate that Kentucky lawmakers are following national trends, even though the proposals have not been activated.
Even without an active statute in place, public interest has encouraged better handling of consumer data, particularly in areas where users expect discretion.
California Sets the Benchmark
No list on this subject can avoid California. The California Consumer Privacy Act (CCPA) broke new ground. It granted residents more control over the way companies collect, store, and share their data. Later, the California Privacy Rights Act (CPRA) introduced stricter rules and established the California Privacy Protection Agency to enforce them.
The scope of these laws affects nearly every industry, not just technology firms. Businesses that gather data from a sizable portion of Californians are required to address deletion requests, give opt-out choices, and make explicit disclosures.
Virginia Brings Specificity
Virginia passed the Consumer Data Protection Act (CDPA) in 2021, becoming the second state with a comprehensive privacy law. What stands out in Virginia’s approach is the definition of roles, separating entities into controllers and processors, which helps clarify responsibility. The state attorney general holds enforcement power, and the law came into effect in January 2023. While it does not permit private lawsuits, its business-friendly language has elicited both praise and criticism.
Colorado Builds On Transparency
Colorado’s Privacy Act came into effect in July 2023. Like Virginia, it establishes clear definitions and mandates that companies provide consumers with access to their data. The law contains clauses that mandate companies perform data protection analyses before handling sensitive data. Any information about religion, race, or medical history falls under this category.
Colorado’s law applies to businesses targeting residents regardless of physical presence and enforces stricter security standards with universal opt-out options, setting it apart from Virginia’s approach.
Connecticut Adds Enforcement Tools
Connecticut’s Data Privacy Act, which took effect in July 2023, closely mirrors laws in Colorado and Virginia, providing individuals with the right to access, correct, delete, and obtain their data. Controllers must give clear notices, gain consent for sensitive data, and maintain records for high-risk processing. While individual lawsuits are barred, the attorney general provides oversight, with a grace period for corrections set to end in 2025.
Utah Keeps It Light
Utah’s Consumer Privacy Act, effective as of late 2023, follows a familiar structure but adopts a more lenient approach. It grants access and deletion rights but excludes correction rights, and businesses are not required to perform impact assessments or offer opt-outs for profiling.
Enforcement rests solely with the attorney general, with no statutory damages available to consumers, making it less effective than similar laws elsewhere.
Texas Sets Its Own Rules
Texas passed the Texas Data Privacy and Security Act (TDPSA) in 2023, and it will take effect in 2024. One unique feature is its broad applicability—nearly every business that processes consumer data in the state is required to comply, regardless of size. This stands in contrast to the threshold-based models used in other states.
The Texas law includes standard provisions for consumer rights, requiring businesses to publish privacy policies and allow consumers to opt out of data sales. It also prohibits the processing of sensitive data without consent and requires businesses to implement security practices. While similar in structure to other laws, the lower threshold means many more companies are affected.
Montana and Tennessee Enter the Frame
Montana and Tennessee have both passed privacy laws that will go into effect in 2024. Montana provides standard consumer rights and obligations for data controllers, with opt-out options for data sales and targeted ads. Tennessee emphasises data security and risk assessments. Its law pushes organisations to document internal practices and maintain accountability.
These new laws demonstrate that even states without a historical emphasis on data regulation are taking action.
An Increasing Call for Federal Intervention
The need for a single federal privacy law is growing due to the challenging compliance demands posed by state laws. Consumers now want more control and openness, which has changed public expectations. In response, states are taking action. Consumers want transparency. They want control over their information. Whether through detailed statutes or informal pressure, states are responding with measures that reflect this new reality.
