Nineteen states have followed the lead of California and passed consumer privacy laws. Three went into effect this year and eight will become effective in 2025. The remainder become effective in 2026. Charts at the end of this post track effective dates (see Table 1) and applicability thresholds (see Table 2). While there are many similar aspects to these laws, they also diverge from each other in material ways, creating a compliance challenge for organizations. In addition, there are other privacy laws pertaining specifically to consumer health data,^[1] laws specific to children’s and minors’ personal data and not part of a comprehensive consumer privacy law,^[2] AI-specific laws,^[3] or laws, including part of overall consumer privacy laws, regulating data brokers^[4] that enterprises need to consider. 

A recent article published by the authors in Competition Policy International’s TechReg Chronical details the similarities and differences between the 20 state consumer privacy laws and a chart at the end of this post provides a quick reference comparison of these laws (see Table 3).

Enterprises need to determine which of these laws apply to then, and how to reconcile the differences between the laws, or adopt a high water mark approach. As enterprises prepare their annual privacy notice updates, a requirement under the California law, now is a good time to confirm what additional state laws will apply and ensure compliance with those that are, or will become in 2025, applicable. 2025 will also see the finalization of California’s data risk assessment and cybersecurity audit, and ADM/AI/Profiling, regulations, which will create complex operational and reporting requirements on businesses subject to the CCPA, which companies should be budgeting and planning for now.

For more information on becoming 2025-ready, contact the authors or your SPB relationship partner.

Table 1

Table 2

Table 3

The following chart demonstrates the similarities and differences among current U.S. consumer privacy laws of general application, compares them to the GDPR and notes differences between the original CCPA and the current version amended by the California Privacy Rights Act (“CPRA”).

GDPR, CCPA, CPRA, Virginia Law & Colorado Law

	GDPR	CCPA	CPRA	Virginia Law	Colorado Law
Right to Access
Right to Confirm Personal Data is Being Processed		Implied	Implied
Right to Data Portability
Right to Delete[6]
Right to Correct / Right to Rectification		X
Right to Opt-Out of Sale	[7]	[8]	[17]	[9]	[17]
Right to Opt-Out of Targeted / Behavioral Advertising[10]		X[11]
Right to Object or Opt-Out of ADM		X	[12]	X	[13]
Right to Opt-Out of Profiling[14]		X
Choice Required for Processing of “Sensitive” Personal Data	Opt-In	X	Opt-Out[15]	Opt-In	Opt-In
Right to Object to or Restrict Processing Generally		X	X	X	X
Required Opt-Out Links on Website or Elsewhere	No Explicit Requirement	DNS	DNSell, DNShare, Sensitive PI Opt-Out[16]	Targeted Ad & Sale Opt-Outs	Targeted Ad & Sale Opt-Outs
Right to Non-Discrimination[17]	Implied
Specific Privacy Policy Content Requirements
Purpose, Use, and/or Retention Limitations		Implied
Privacy & Security Impact Assessments Sometimes Required		X
“Reasonable” Security Obligation		Implied
Notice at Collection Requirement		(Statute + Regs)		X	X
Honor Universal Opt-out Signals	X	X		X

Utah Law, Connecticut Law, Nevada Law, Iowa Law & Indiana Law

	Utah Law	Connecticut Law	Nevada Law	Iowa Law	Indiana Law[18]
Right to Access			X
Right to Confirm Personal Data is Being Processed			X
Right to Data Portability			X
Right to Delete			X
Right to Correct / Right to Rectification	X		X	X
Right to Opt-Out of Sale	[18]	[17]	[19]	[18]	[18]
Right to Opt-Out of Targeted / Behavioral Advertising			X
Right to Object or Opt-Out of ADM	X	X	X	X	X
Right to Opt-Out of Profiling	X		X	X
Choice Required for Processing of “Sensitive” Personal Data	Notice & Opp. to Opt-Out	Opt-In	X	Notice & Opp. to Opt-Out	Opt-In
Right to Object to or Restrict Processing Generally	X	X	X	X	X
Required Opt-Out Links on Website or Elsewhere	Targeted Ad & Sale Opt-Outs	Targeted Ad & Sale Opt-Outs	None	Targeted Ad & Sale Opt-Outs	Targeted Ad & Sale Opt-Outs
Right to Non-Discrimination			X
Specific Privacy Policy Content Requirements
Purpose, Use, and/or Retention Limitations	X		X	X
Privacy and Security Impact Assessments Sometimes Required	X		X	X
“Reasonable” Security Obligation
Notice at Collection Requirement	X	X	X	X	X
Honor Universal Opt-out Signals	X		X	X	X

Tennessee Law, Montana Law, Florida Law, Texas Law & Oregon Law

	Tennessee Law	Montana Law	Florida Law[20]	Texas Law	Oregon Law[21]
Right to Access
Right to Confirm Personal Data is Being Processed
Right to Data Portability
Right to Delete
Right to Correct / Right to Rectification
Right to Opt-Out of Sale	[18]	[17]	[17]	[17]	[17]
Right to Opt-Out of Targeted / Behavioral Advertising
Right to Object or Opt-Out of ADM	X	X	X	X	X
Right to Opt-Out of Profiling
Choice Required for Processing of “Sensitive” Personal Data	Opt-In	Opt-In	Opt-In (with a right to opt out later)	Opt-In	Opt-In
Right to Object to or Restrict Processing Generally	X	X	X	X	X
Required Opt-Out Links on Website or Elsewhere	Targeted Ad & Sale Opt-Outs	Targeted Ad & Sale Opt-Outs	Targeted Ad & Sale Opt-Outs	Targeted Ad & Sale Opt-Outs	Targeted Ad & Sale Opt-Outs
Right to Non-Discrimination
Specific Privacy Policy Content Requirements
Purpose, Use, and/or Retention Limitations
Privacy and Security Impact Assessments Sometimes Required
“Reasonable” Security Obligation
Notice at Collection Requirement	X	X	X	X	X
Honor Universal Opt-out Signals	X		X

Delaware Law, New Jersey Law, New Hampshire Law, Kentucky Law & Minnesota Law

Delaware Law[22]	New Jersey Law	New Hampshire Law	Kentucky Law	Minnesota Law[23]
Right to Access
Right to Confirm Personal Data is Being Processed
Right to Data Portability
Right to Delete
Right to Correct / Right to Rectification
Right to Opt-Out of Sale	[17]	[17]	[17]	[18]	[17]
Right to Opt-Out of Targeted / Behavioral Advertising
Right to Object or Opt-Out of ADM	X	X	X	X
Right to Opt-Out of Profiling
Choice Required for Processing of “Sensitive” Personal Data	Opt-In	Opt-In	Opt-In	Opt-In	Opt-In
Right to Object to or Restrict Processing Generally	X	X	X	X	X
Required Opt-Out Links on Website or Elsewhere	Targeted Ad & Sale Opt-Outs	Targeted Ad, Sale & Profiling Opt-Outs	Targeted Ad & Sale Opt-Outs	None	Not required, but noted as an approved method.
Right to Non-Discrimination
Specific Privacy Policy Content Requirements
Purpose, Use, and/or Retention Limitations
Privacy and Security Impact Assessments Sometimes Required
“Reasonable” Security Obligation
Notice at Collection Requirement	X	X	X	X	X
Honor Universal Opt-out Signals				X

Maryland Law, Nebraska Law & Rhode Island Law

Maryland Law[24]	Nebraska Law	Rhode Island Law
Right to Access
Right to Confirm Personal Data is Being Processed
Right to Data Portability
Right to Delete
Right to Correct / Right to Rectification
Right to Opt-Out of Sale	17	17	17
Right to Opt-Out of Targeted / Behavioral Advertising
Right to Object or Opt-Out of ADM	X	X	X
Right to Opt-Out of Profiling
Choice Required for Processing of “Sensitive” Personal Data	Only when strictly necessary, no sale allowed	Opt-In	Opt-In
Right to Object to or Restrict Processing Generally	X	X	X
Required Opt-Out Links on Website or Elsewhere	Targeted Ad & Sale Opt-Outs	Targeted Ad & Sale Opt-Outs	X
Right to Non-Discrimination
Specific Privacy Policy Content Requirements
Purpose, Use, and/or Retention Limitations
Privacy and Security Impact Assessments Sometimes Required
“Reasonable” Security Obligation
Notice at Collection Requirement	X	X	X
Honor Universal Opt-out Signals			X

[1] For example, Washington’s My Health My Data Act and a similar Nevada law. See https://www.privacyworld.blog/2024/04/are-you-ready-for-washington-and-nevadas-consumer-health-data-laws.

[2] For example, the California Age-Appropriate Design Code Act (“CA AADCA”). See https://www.privacyworld.blog/2023/10/california-attorney-general-appeals-federal-court-ruling-that-online-child-safety-act-is-likely-unconstitutional/ and https://www.privacyworld.blog/2023/07/texas-two-steps-into-the-childrens-privacy-dance-the-securing-children-online-through-parental-empowerment-act/. A 9^th Circuit federal Court of Appeals decision has struck down the risk assessment and abatement provisions of CA AADCA, and laws making favored and disfavored content distinctions for minors face similar challenges. See https://www.privacyworld.blog/2024/08/are-data-practice-risk-assessments-at-risk-in-the-us/.

[3] For example, Colorado’s Artificial Intelligence (AI) law (C.R.S. 6-1-1701).

[4] A data broker is typically a controller that sells personal data that the controller did not collect directly from consumers. CA, NV, VT, OR and TX all regulate data brokers. VT and NV do not have broad consumer privacy laws and do so on a separate basis.

[5] The General Statutes of Connecticut are supplemented as of January 1, 2024 here.

[6] In California, Utah, and Iowa, deletion obligations are limited to PI collected from the consumer; all other state consumer privacy laws include PI collected about the consumer is in scope of the deletion right.

[7] Selling personal data under the GDPR generally would require the consent of the data subject for collection and would be subject to the right to object to processing.

[8] Any consideration sufficient, but cash consideration not required.

[9] Cash consideration required.

[10] Right to opt-out of cross-context behavioral advertising sharing for California; right to opt-out of targeted advertising in all other state consumer privacy laws.

[11] However, certain data disclosures inherent in this type of advertising are arguably a “sale,” subject to opt-out rights. The CPRA Regulations combine the opt-out right for “sale” and “share.”

[12] Subject to substantial expansion under the CPRA Regulations. Based on preliminary rulemaking activities, it appears that the CPPA is contemplating a GDPR-like approach for ADM and profiling.

[13] Under the CPA Rules, if a consumer requests to opt out of human involved automated processing, organizations can reject the request, but must inform the consumer of the rejection within 45 days and include the following information or link to such information: the decision subject to profiling, the categories of PI used, the logic used in the profiling process, the role of human involvement, how profiling is used in the decision-making process, benefits and potential consequences of the decision, and how consumers can correct or delete the data used in the profiling.

[14] The CPRA’s concept of profiling subject to change under the regulations. The profiling concepts in the other 2023 state consumer privacy laws require legal or substantially similar effects.

[15] Under the CPRA, the Sensitive PI opt-out right applies to certain processing activities beyond business purposes. Section 7027 of the CA Regs includes contextual but not cross-context behavioral advertising.

[16] Businesses will be able to utilize “a single, clearly labeled link” to cover all opt-outs. The CA Regs permit titling the link “Your Privacy Choices” or “Your California Privacy Choices” plus an icon. It is not clear if organizations need to provide both sale/share and limit sensitive info opt-outs where it is not engaging in activities that necessitate both in order to use the alternative link. The former could work well to direct a consumer to the other state opt-outs too.

[17] The CCPA (and the CPRA) take a more onerous approach to non-discrimination with respect to financial incentives and price/service differences, requiring businesses to prove that they are reasonably related to the value of the consumer’s data to the business.

[18] Indiana Law also provides the right to obtain a copy or a representative summary of the consumer’s personal data provided to the controller.

[19] In Nevada, website and online service operators are required to offer an “opt-out,” but only for limited disclosures of certain information and only if the disclosure is made in exchange for monetary consideration.

[20] Florida Law also contains the rights to: (i) opt out of the collection or processing of sensitive data; and (ii) opt out of the collection of personal data through voice or facial recognition.

[21] Oregon Law also contains the right to obtain a list of specific third parties to which the controller has disclosed the consumer’s personal data, OR any personal data (at the controller’s option).

[22] Delaware Law also provides the right to obtain a list of categories of third-party recipients of the consumer’s personal data, by category of personal data.

[23] Under the Minnesota Law, a consumer has a right to obtain a list of the specific third parties to which the controller has disclosed the consumer’s personal data. If the controller does not maintain the information in a format specific to the consumer, a list of specific third parties to whom the controller has disclosed any consumers’ personal data may be provided instead

[24] Maryland Law also provides the right to obtain a list of the categories of third parties to which the controller has disclosed the consumer’s personal data, OR a list of the categories of third parties to which the controller has disclosed any consumer’s personal data IF the controller does not maintain this information in a format specific to the consumer.