Look Ahead: Three New State Privacy Laws Take Effect January 2023. Is Your Business Prepared?
Beginning in 2023, three new state privacy laws (and their applicable regulations) will come into effect. They follow in the footsteps of the California Consumer Privacy Act that took effect in 2018 and represented the first major state privacy and data protection law in the United States.
The three new privacy and data protection laws build on the momentum that the California Consumer Privacy Act started--one of the new law’s actually amends the existing California law--and marks a continuation of separate states continuing to try and address consumer privacy and data protection concerns. The federal government, while taking action on the cybersecurity front, has largely shied away from taking action on omnibus privacy and data regulation. This has left the states to take California’s lead in passing their own.
Additional Resources
-
In 2020, California privacy interest groups were successful in getting a privacy referendum on the November ballot. The referendum consisted of overhauling and amending the existing California Consumer Privacy Act. On November 3, 2020, California voters approved of the California Privacy Rights Act with over 56% of voters supporting the measure and over 43% disapproving of the measure. The California Privacy Rights Act takes effect on January 1, 2023.
-
In July of 2021, the governor of Colorado officially signed the Colorado Privacy Act into law. The Colorado Privacy Act largely sets up a dynamic similar to Europe’s GDPR where there are Controllers and Processors of Personal Data. Additionally, the new Colorado law is very similar in substance to the Virginia law below. The Colorado Privacy Act takes effect on July 1, 2023.
-
In March of 2021 the governor of Virginia signed the Consumer Data Protection Act into law, making it only the second state at the time to have passed a comprehensive privacy and data protection law. Similar to the GDPR in Europe, the new Virginia law sets up a Controllers and Processors dynamic. Additionally, the new Virginia law is very similar in substance to the Colorado law above, which was passed after the Virginia law. The Consumer Data Protection Act takes effect on January 1, 2023.