New omnibus privacy laws are coming to Virginia, Colorado, Utah, and Connecticut in 2023. Updates to California’s existing privacy law arrive in 2023 too. Don’t wait to implement your compliance updates as it could require changes to your operations. These state privacy laws can apply to businesses that do not have offices or employees in that state and can reach activities conducted outside of the particular state. See our prior alert to understand whether these state laws apply to your business.

Here are the enforcement mechanisms under each of the state privacy laws. 

*California has a private right of action if a company fails to maintain reasonable security measures to protect this data and it leads to a compromise of the data, which also opens the door to broader CPRA compliance scrutiny and liability.

**The information contained in this table is a condensed summary and is not exhaustive of all legal requirements, potential exceptions or variables under the referenced laws.  This overview does not substitute for considering the legal requirements in their entirety or in light of facts specific to a particular organization.