Looking back sometimes means looking forward. That is absolutely the case for new comprehensive data privacy statutes enacted in a number of U.S. states during 2023, including Indiana, Tennessee, Montana, Florida, Texas and Oregon. While these states have now codified a range of consumer rights with respect to their personal data, as well as new obligations imposed on covered businesses collecting and processing that data, the new laws do not take effect until the middle of 2024 or beyond. All the same, companies who may be subject to these laws in the future should start preparing now to comply with what are becoming increasingly standardized requirements across many U.S. states.

To assist our readers become more familiar with the new laws, we have prepared a summary chart below describing key features with respect to consumer rights, business obligations, and enforcement provisions. A few things jump out – for example, the laws are strikingly similar and provide consumers with nearly identical rights to request information about personal data a business is collecting and to exercise greater control over how it will be used. Covered businesses will also have largely consistent obligations with respect to personal data they are collecting with only minor variations (e.g., how often consumers may request information about their personal data, or when data impact assessments will need to be conducted, or when consent may be required for collecting a minor’s information for targeted advertising purposes). Potential penalties vary somewhat but all of the states will rely on state attorneys general offices to enforce their statutes, rather than provide consumers with a private right of action.

For more comprehensive summaries of each statute, we invite you to review our blog posts from earlier this year by clicking the following links:  Indiana, Tennessee, Montana, Florida and Texas. These articles have direct links to the laws as well. If you have any questions related to state consumer data privacy laws.

Similar to existing state privacy laws, the new laws establish applicability thresholds described in the chart below for determining what are covered businesses subject to the statute.

In addition to the applicability requirements of each law, the chart below provides a snapshot of consumer rights, business obligations and enforcement provisions addressed by the new state consumer privacy laws passed in 2023. Please note that the consumer rights created by these new laws are not available with respect to personal data collected from individuals acting in a commercial context (i.e., B2B) or employment context.

*The procedural notice and cure period will sunset on April 1, 2026 for Montana and January 1, 2026 for Oregon.

We expect that 2024 will bring new state data privacy laws, in the absence of a federal omnibus privacy statute. Watch this space.