As we predicted in our assessment of U.S. advertising and privacy trends in February of this year, states have continued to adopt comprehensive privacy laws during their 2024 legislative sessions. To date, nineteen states (California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, and Virginia) have enacted comprehensive privacy laws that provide consumers with certain rights regarding their personal data and impose obligations on businesses that process personal data. Another significant privacy law is pending in Vermont. The Kentucky, Maryland, Minnesota, Nebraska, New Hampshire, and New Jersey laws were enacted most recently (in 2024). Five of the state laws are currently effective, and all the laws impose disparate obligations that will certainly complicate compliance for covered entities. Businesses should review the threshold requirements for applicability of each state’s law to determine which laws apply.

At the federal level, Senate Committee on Commerce, Science, and Transportation Chair Maria Cantwell (D-WA) and House Energy and Commerce Committee Chair Cathy McMorris Rodgers (R-WA) unveiled new federal legislation, the American Privacy Rights Act (APRA or Act), in April, and the bill was formally introduced on May 21, 2024. From a business perspective, APRA’s restrictive definitions, weak preemption clause, and private right of action fail to strike the right balance needed in a national privacy framework. Consumer advocates, on the other hand, prefer a federal law that serves as a floor so states can adopt additional requirements and restrictions.

To review our summary of key similarities and key differences in the state privacy laws that have been enacted to date in 2024 and APRA, click here.