2024 was a busy year for state consumer data privacy laws in the United States. Seven states enacted comprehensive data privacy statutes throughout the year, and laws enacted in 2023 went into effect in Montana, Florida, Texas, and Oregon. While consumer data privacy laws are still relatively new, we are beginning to see evidence of enforcement in some states and far greater attention and resource expenditure internally from businesses working hard to determine which laws apply to their organizations and what steps are necessary to ensure compliance with similar but sometimes varying requirements across different states.

With a number of statutes enacted in recent years already in force, or taking effect in 2025, we encourage any business collecting personal data from consumers to monitor on an ongoing basis which state data privacy laws will (or already) apply to them. We update this State Data Privacy Law Round-Up article on an annual basis and maintain a dedicated website for U.S. State Consumer Privacy Laws to help our readers with this effort.

The 2024 Class: Data and Observations about Laws Passed in 2024¹

We have prepared summary charts below describing key features of new laws enacted in 2024 as well as laws passed the year prior in Delaware and Iowa. The charts will track applicability criteria, consumer rights, business obligations, and enforcement provisions. Like earlier consumer data privacy laws, the latest statutes are similarly structured and provide consumers with comparable rights to request information about personal data a business is collecting and to exercise greater control over how it will be used. Covered businesses will also have largely consistent obligations with respect to personal data they are collecting, though some variations require attention. Potential penalties vary somewhat but all of the new states joining the group will rely on state attorneys general offices to enforce their statutes, rather than provide consumers with a private right of action.

Like existing state consumer data privacy laws, the newer statutes establish applicability thresholds described in Table 1 for determining what are “covered businesses” subject to the applicable statute. Most of the laws follow a similar framework where a business will be subject to requirements if it processes the data of a certain number of state residents, or processes personal data of a certain number of residents (lower than the other prong) and derives a certain percentage of revenue from the sale of personal data. Notably, Nebraska opted for a different approach (without a resident and revenue threshold) but it categorically exempts small businesses, and Rhode Island includes an additional tier of applicability for internet service providers and commercial websites.

Table 1: Applicability Criteria

To provide a comparative overview of requirements and enforcement provisions under these new laws, the charts below provide snapshots of consumer rights (Table 2), business obligations (Table 3), and enforcement procedures / penalties (Table 4) under the new state consumer privacy laws. Please note that the consumer rights created by these new laws are not available with respect to personal data collected from individuals acting in a commercial context (i.e., B2B) or employment context. As evidenced by the degree of uniformity in the charts, most state consumer data privacy laws have the same or similar core protections for consumers and obligations for businesses, with some sporadic outliers.

Table 2: Consumer Rights

The latest state consumer data privacy statutes contain substantially similar or the same business obligations, except for departures concerning providing a reasonably accessible and clear privacy notice (Rhode Island) and conducting document and data protection assessments (Iowa). Otherwise, the obligations businesses have under state consumer privacy laws are fairly consistent, which will ease the burden of these laws for businesses operating in some or all of the indicated states.

When it comes to enforcement, Maryland, New Jersey, and Delaware have higher-end maximum civil fines per violation, starting at $10,000, whereas penalties in Rhode Island are much lighter ($500 per violation). Another notable feature of these laws is the timeline for expiration of the cure period available to covered entities. Unlike many earlier statutes, newer laws (except for Kentucky) tend to terminate the cure period after a shorter period of time, after which the enforcement body retains discretion whether to provide cure opportunities. As a result businesses should be aiming to achieve compliance as soon as possible so that they are ready to comply with applicable laws from the outset.

A note on the Connecticut Attorney General Report on Connecticut Data Privacy Act Enforcement

Earlier this year in February, Connecticut’s Attorney General (AG) William Tong released a report summarizing the enforcement efforts of the Connecticut AG’s office with respect to the Connecticut Data Privacy Act (“CTDPA”), which went into effect in July of 2023. According to the report, the Connecticut AG’s office had issued over a dozen notices of violation (“cure notices”) as well as other information requests to businesses across different industries since the law took effect. The report indicates that the Connecticut AG’s priorities included enforcement of the CTDPA’s provisions concerning privacy policies, sensitive data, and teens’ data. Businesses in all states with comprehensive data privacy laws should take note of this report and the areas of enforcement important to at least one state AG.

Looking Ahead

We expect that 2025 will bring new state data privacy laws and greater enforcement in this area, particularly in the continued absence of a federal omnibus privacy statute. We will be watching this space and look forward to sharing more updates with you about what is happening in the states. If you have any questions related to state consumer data privacy laws, please feel free to contact anyone from Mintz’s Privacy & Cybersecurity team.

ENDNOTES

[1] Note: We will also cover the Delaware and Iowa laws in this article, which were enacted in 2023. We are covering these states this year because we didn’t address them in our 2023 Round-Up Article and each of these laws becomes effective on January 1, 2025.

[2] Note: The Rhode Island law does not include a disclosure requirement with respect to sale of personal data or use of personal data for targeted advertising; however, as indicated in Table 1, consumers do have a right to opt out of these activities.