Most modern U.S. state data privacy laws exempt from their definition of personal information “publicly available information.” What constitutes publicly available information differs between state privacy laws and may not correlate to the lay definition understood by many businesses and individuals. For example, while some businesses may consider information that is available on the internet to be “publicly available information,” most data privacy statutes would not classify all internet-accessible information as being “publicly available.” The following chart compares the definition of publicly available information between and among modern state privacy laws.

[1] Cal. Civ. Code § 1798.140(o)(2) (West 20202).

[2] Cal. Civ. Code § 1798.140(v)(2) (West 2021).

[3] Va. Code § 59.1-571 (2021).

[4] C.R.S. § 6-1-1303(17)(b) (2021).

[5] Utah Code Ann. § 13-61-101(29)(a) (2022).

[6] Conn. Sub. Bill No. 6, § 1(25) (enacted by legislature on April 28, 2022).

[7] Cal. Civ. Code § 1798.140(v)(2) (West 2021).

[8] Va. Code § 59.1-571 (2021).

[9] While media-sourced information is not defined as being publicly available under the CPA, note that the CPA includes exceptions for specific compliance obligations (e.g., classification of data transfer as a sale) for information “intentionally made available by a consumer to the general public via a channel of mass media” See C.R.S. § 6-1-1303(23)(b)(V)(B) (2021).

[10] Utah Code Ann. § 13-61-101(29)(b) (2022).

[11] Conn. Sub. Bill No. 6, § 1(25) (enacted by legislature on April 28, 2022).

[12] Cal. Civ. Code § 1798.140(v)(2) (West 2021).

[13] Va. Code § 59.1-571 (2021).

[14] C.R.S. § 6-1-1303(17)(b) (2021).

[15] Utah Code Ann. § 13-61-101(29)(b) (2022).

[16] Conn. Sub. Bill No. 6, § 1(25) (enacted by legislature on April 28, 2022).

[17] Cal. Civ. Code § 1798.140(v)(2) (West 2021).

[18] Va. Code § 59.1-571 (2021).

[19] Utah Code Ann. § 13-61-101(29)(c) (2022).

[20] Information obtained from the internet does not fall under the definition of “publicly available,” however, the CPRA separately exempts from the definition of “personal information” other “lawfully obtained, truthful information that is a matter of public concern.” Cal. Civ. Code § 1798.140(v)(2) (West 2021). To the extent that a business obtains information from the internet that is truthful and a matter of public concern, this exception may apply.