/>iNow that we have passed the halfway mark in 2025, we are taking a look back at significant developments that have already occurred this year in the consumer data privacy landscape. Five more states’ comprehensive privacy laws went into effect, and several states enacted noteworthy amendments to their existing statutes.
Given the shifting environment, particularly as different states introduce new applicability thresholds and require different treatment for specific types of protected consumer data, we encourage any business collecting or processing personal data from consumers to monitor which state data laws do (or will) apply to them and understand their obligations within each state.
Laws Taking Effect in 2025
Several state privacy laws passed in previous years took effect at the beginning of 2025, and a few additional comprehensive data privacy statutes are set to go into effect in the coming months. To date, there is little or no public enforcement of these new laws by state attorneys general, which mirrors the pattern of enforcement in states with older laws (for instance, the California Privacy Protection Agency announced its first settlement under the California Consumer Privacy Act this year, nearly three years after the law went into effect).
The following table details which laws went into effect or will go into effect this year. In the rightmost column, please find links to articles published by the Mintz team providing in depth summary of each law’s applicability thresholds, consumer rights framework, business requirements, and more.
Table 1: Newly Effective Laws
*The New Jersey Division of Consumer Affairs recently announced proposed regulatory rules intended to implement further the consumer rights established within the NJDPA. Consumers can provide public comment on the rules until August 1, 2025, and publication of a Notice of Adoption is expected sometime in 2026.
Recent Amendments
Several states with existing consumer privacy laws have implemented new amendments this year, which will become effective in the coming months.
Montana’s comprehensive amendment
The most sweeping amendment comes from Montana, which adjusts applicability thresholds and exemptions, changes requirements for responding to consumer requests, requires additional opt-out capabilities, and builds out additional obligations for privacy notices.
Effective October 1, 2025, the applicability threshold bar for Montana will be lowered to cover persons or businesses which control or process the personal data of 25,000 or more consumers (replacing current threshold of 50,000 or more consumers). And, for an entity which earns more than 25% of its gross revenue from sale of personal data, the threshold will be decreased from 25,000 or more consumers to 15,000 or more consumers. This will mark the lowest applicability threshold of any state with a comprehensive consumer privacy statute and demonstrates intent by Montana’s state lawmakers to cast a wide net with its amended law.
Under the amended law, nonprofits as a general category are no longer exempt. Instead, only nonprofits established with the purpose of detecting and preventing insurance fraud are exempt from the law. Montana’s amendment also enhances requirements for privacy notices. Businesses must now provide a “clear and conspicuous” method for consumers to opt out of the sale of their personal data or processing of that personal data for targeted advertising, and other requirements are aimed at making sure businesses provide an easily accessible and comprehensible privacy notice providing clear explanation of rights available to Montana consumers.
The amendment makes additional changes regarding disclosure of information in response to consumer data subject requests, it clarifies what constitutes a heightened risk of harm to minors in connection with processing data of minors under 18, and it expands enforcement and investigative tools available to Montana’s attorney general.
Other State Amendments
Other state amendments to consumer privacy statutes were more targeted: Oregon passed an amendment in June that restricts the selling of personal data if the information can accurately identify a person or their personal device’s past or present location within a 1,750 foot radius, or if the business has actual knowledge that, or willfully disregards whether, the consumer is under 16 years of age. Those changes will become effective on January 1, 2026.
Colorado also focused on geolocation data in a June amendment, changing its consumer privacy statute to include precise geolocation data (defined in part to capture data that identifies a person within a 1,850 foot radius) as part of its definition of “sensitive data,” and providing that a controller cannot process or sell a consumer’s sensitive data without first getting consent. This change became effective June 3, 2025.
Utah amended its Utah Consumer Privacy Act (UCPA) by establishing that, in addition to already existing consumer rights with respect to personal (e.g., the right of access, the right of deletion, the right to obtain copies, and the right to opt out of processing), a consumer has the right to request a controller correct inaccuracies with personal data. Within the same bill, Utah also focused on social media rights covered by its Digital Choice Act, establishing that personal data, as defined by the UCPA, also includes a social media user’s “social graph”, meaning a user’s social connections, content, and responses between a user and other users, and a consumer has a right to request this personal data from a social media service pursuant to rights under the UCPA. These changes become effective on July 1, 2026.
Looking ahead
As of this writing, 20 states have passed comprehensive consumer privacy laws and several others have passed narrowly-tailored acts targeting specific rights or industries. Many other states have recently introduced or progressed comprehensive bills in their respective legislatures, such as Illinois, Maine, Massachusetts, Michigan, New York, North Carolina, Oklahoma, Pennsylvania, and Vermont. Notably, 2025 has not yet seen any omnibus privacy law move out of legislative consideration to a governor’s desk for signature. This is a departure from the trend we saw at this time last year, when seven states had enacted comprehensive state privacy laws in the first half of 2024. We will continue to watch this space and provide additional updates as state legislatures wind down their 2025 session.
