Tracking State Privacy Laws
In the absence of comprehensive federal privacy legislation, state legislatures have taken is upon themselves to pass laws regulating data collection and privacy. Currently, three states have passed such legislation: California (twice), Virginia, and Nevada. Many other states are in various stages of the process to passing similar laws with Washington being the closest.
​
Note: All these laws give the Attorney General the power of enforcement these laws. There is no private right of action, where the citizens can privately sue a company. As these laws come into effect, state AG offices will likely have more materials for practitioners to consult.
State Privacy Laws
States that have passed Privacy Legislation:
California
California Consumer Privacy Act
(CCPA)
Cal. Civ. Code § 1798.100
In Effect: January 1, 2020
California Privacy Rights Act
(CPRA) - AKA Proposition 24
Cal. Civ. Code § 999.300
In Effect: January 1, 2023
Virginia
Virginia Consumer Data Protection Act
(VCDPA)
Va. Code. §§ 59.1-571 - 59.1-581
In Effect: January 1, 2023
Nevada
Nevada SB 220
NV ST 603A.100
In Effect: October 1, 2019
All these state laws offer varying degrees of protection, making it very difficult for companies to comply. Practitioners should have a good understanding of all the state laws because consumer data is rarely state-specific. For example, a NJ company may have to be compliant with the CCPA if their customer is in CA.
States in the process of passing Privacy Legislation:
Other states are looking to pass privacy legislation too. As seen in the chart below, 16 other states have introduced privacy legislation to their legislatures. The International Association of Privacy Professionals keeps an updated list of state privacy laws (with links to the legislation or laws) and their status in the legislature.
Sarah Rippy, US State Comprehensive Privacy Law Comparison, iapp (Mar. 2021).
Tracking State Privacy Laws
Bloomberg
The CCPA Copycat Legislative Tracker, Bloomberg Law Tracker
Bloomberg keeps a tracker of the latest developments in state privacy law. The CCPA was a catalyst for many other states to enact privacy legislation of their own.
The International Association of Privacy Professionals keeps track of the status of various state privacy laws. Their detailed tracker requires a subscription, but the above PDF and map are accessible to all users.
Sarah Rippy, US State Comprehensive Privacy Law Comparison, iapp (Mar. 2021).
One Trust Data Guidance also tracks state privacy legislation. In addition to their map that visually shows the state of privacy laws across the country, they keep a detailed table with links to legislation that has been passed or is in progress. They also have a table that analyzes the legislation based on which privacy principles they include.
USA State Law Tracker Map, One Trust Data Guidance. (last visited Apr.10, 2021).
Husch Blackwell is a law firm that has recently built a state privacy law tracker. Their tracker has links to various state bills and links to their blog where they analyze the provisions in current privacy legislation. Their blog also has state-specific categories so you can find all the privacy information for one state in one place.
David Stauss, 2021 State Privacy Law Tracker, Husch Blackwell, (last visited Apr. 10, 2021).
Ballard Spahr LLP, another law firm, also has a privacy law tracker. Their tracker is slightly outdated, however it has useful information about the types of provisions that are included in the legislation, specifically how they relate to federal privacy laws.
Philip N. Yannella, Ballard Launches US State Privacy Law Tracker, Ballard Spahr LLP (Jun. 2019).
Practitioners should use these trackers with a grain of salt because the landscape of the privacy world changes very quickly. Some of these trackers, especially the law firms, may not update their trackers as often. Check out the Current Awareness page to find more resources to stay updated on privacy legal news.
Tracking State Privacy Cases
Most of the State privacy laws have passed recently and are not going to go into effect until 2023. The CCPA went into effect on January 1, 2020 so there have been some cases filed with the California Attorney General. Below are some law firms and organizations who have kept track of CCPA litigation.
-
O'Melveney Law Firm - CCPA Tracker
-
Bryan, Cave, Leighton, & Paisner - CCPA Litigation Tracker (PDF)
-
Kelley Drye - CCPA Litigation Tracker (PDF)