In the backdrop of the continuing impasse on federal privacy legislation, states continued to introduce measures aimed at addressing an array of data privacy concerns – ranging from bills tailored to biometric or health data to those addressing comprehensive consumer data privacy. In 2023 alone, the first year of the biennium for many state legislatures, over 140 bills have been introduced across 37 states. Just last year, CCIA reported that over 80 bills had been introduced across 33 states, marking a significant increase – it is almost certain that policy debates about data privacy will continue across the states.
Many states that introduced privacy legislation allow for bills to “carry over” from odd to even-numbered years, meaning that action on these proposals may pick up where it left off. However, as occurred in Virginia and Colorado, new proposals may be better positioned to swiftly move toward passage before policymakers and other stakeholders have time to become entrenched on divisive issues, as we witnessed in Maryland in recent years. Prior to 2023, comprehensive consumer privacy legislation had largely been a phenomenon enacted in “blue trifecta” states, with Utah being the primary exception. However, 2023 ushered in a “red wave” of states enacting such laws – Indiana, Iowa, Montana, Tennessee, and Texas joined California, Colorado, Connecticut, Utah, and Virginia is establishing comprehensive consumer data privacy laws, while Democrats in Delaware, Oregon, and Washington led the charge to pass legislation as well. In 2024, it is anticipated that those states who considered and “carried over” legislation from the first year of the biennium will continue debating such proposals while even more states will follow suit in introducing their own frameworks.
In 2023, California and Colorado released guidance following two lengthy rulemaking processes and by the end of the calendar year laws in Colorado, Connecticut, and Virginia will have become effective. And in 2024, California Privacy Rights Act regulations will go into effect along with the recently enacted laws in Florida, Montana, Oregon, Texas, and Washington. In addition to comprehensive data privacy laws, it is likely that states on both sides of the aisle will continue considering proposals related to biometric and health data in addition to privacy protections specifically targeted to younger users. Below, CCIA offers details regarding state-level data privacy conversations during the 2023 session along with a look-ahead to the 2024 legislative sessions.
Views: 22
