We summarized Virginia’s Consumer Data Protection Act (CDPA) in advance of its passage by the legislature and it now awaits Governor Ralph Northam’s signature.   This will make Virginia the second state (behind California) with a comprehensive state data privacy law.   There are some key differences between the Virginia CDPA and the California Consumer Privacy Act (CCPA) and Consumer Privacy Rights Act (CPRA).   We will have a full analysis of the Virginia CDPA next week, so watch this space. 

Other states are jumping into the pool, and since our last overview, several other states have begun to move bills through their legislatures.  Alabama, Arizona, Connecticut, Florida, and Kentucky have all introduced CCPA/GDPR-like bills that are moving through committees.  We are watching all of them, and will keep you updated.

Also, Consumer Reports has proposed a “Model State Privacy Act” “to ensure that companies are required to honor consumers’ privacy.”   This Model Act is similar to the CPRA, but has broad prohibitions on secondary data sharing, an opt-out of first-party advertising, and a private right of action in addition to state Attorneys General enforcement.