U.S. Privacy and Data Protection | Insights | Jan. 2024 (State Law)

In 2023, the United States saw a significant expansion of privacy and data protection laws, marked by the passage of comprehensive privacy legislation in seven states: Delaware, Indiana, Iowa, Montana, Oregon, Tennessee, and Texas. As we enter 2024, businesses and privacy professionals should anticipate the passing of additional state privacy laws, as well as several laws beginning to take effect and becoming enforceable.

Below, we summarize the states whose privacy laws became enforceable as well as states that have passed or are on the precipice of passing their own laws in 2024.

Enforcement of New State Privacy Laws:

1. Utah Consumer Privacy Act (UCPA): The UCPA became effective on December 31, 2023.

1. California & Oregon’s Data Broker Registration: As of January 1, 2024, data brokers will need to register with Oregon’s Department of Consumer and Business Services to comply with HB 2052. Under HB 2052, a data broker is defined as “a business entity or part of a business entity that collects and sells or licenses brokered personal data to another person.” Additionally, as of January 1, 2024, data brokers are required to register with the California Privacy Protection Agency (“CPPA”).

1. California Privacy Rights Act (CPRA): Beginning March 29, 2024, the CPPA will begin enforcing the new CPRA regulations.

1. Nevada’s Consumer Health Data Privacy Law (SB 370) and Washington’s My Health My Data Act: These provisions will be fully effective March 31, 2024. The Washington law grants an extension for small businesses until June 30, 2024.

1. Colorado Privacy Act (CPA): By July 1, 2024, businesses subject to the CPA must recognize GPC opt-out signals.

1. Texas Data Privacy and Security Act, Florida Digital Bill of Rights, and Oregon’s Consumer Privacy Act will all become effective on July 1, 2024.

1. Montana’s Consumer Data Privacy Act will become effective on October 1, 2024.

Each of these laws have distinct requirements, and while they share similarities, they also possess nuanced differences from each other as well as existing state privacy laws. Compliance with each new law will require additional analysis of companies’ current practices to assess whether current privacy practices are meeting the necessary requirements.

Additional New State Privacy Laws:

2024 has already seen the passing of a new comprehensive privacy law in New Jersey, which was signed into law on January 16, 2024, becoming effective January 15, 2025.

In New Hampshire, a comprehensive privacy bill awaits signature by Governor Sununu. Following enactment, the law will take effect January 1, 2025.

Conclusion

Kronenberger Rosenfeld, LLP regularly advises clients regarding advertising and privacy compliance. Contact our firm using our online case submission form here.

To learn about the Federal Privacy and Data Protection January 2024 updates, click here.