Why lots of states are passing bad state privacy laws

California first passed the CCPA in 2018, and then made it stronger in 2020. Last year, it passed the DELETE Act, giving people the ability to tell hundreds of data brokers to delete their data with one push of a button.

Things California does well:

• Established a specific new privacy agency
• One-button push deletion mechanism
• Lets consumers hold companies accountable in court for data breaches

Things it could do better:

• Enact real data minimization
• Let consumers hold companies accountable in court for all legal violations
• Establish clear limits on cookies that track you across the internet over time & across sites

Colorado passed the Colorado Privacy Act in 2021. In July 2024, Colorado residents will be able to download a special browser tool to automatically broadcast to websites they don’t want their data to be collected. (Read our guide on that here).

Things Colorado does well:

• Special browser tool for automatic data opt-outs
• Attorney General can write helpful clarifying rules
• Good rules stopping companies from using tricky designs to get you to consent to data collection

Things it could do better:

• Enact real data minimization
• Let consumers hold companies accountable in court for breaking the law
• Make it clearer that companies “sharing” people’s data for money is the same as selling

New Jersey’s Senate Bill 332 (name still pending) is one of the most recent states to pass a privacy law. The governor signed it into law on Jan. 16, 2024.

Things New Jersey does well:

• Attorney General can write helpful clarifying rules
• Makes sure data that’s “pseudonymous” (aka stuff that’s not your name but is still easily tied to you, like your IP address) still falls under protections

Things it could do better:

• Enact a data minimization standard
• Let consumers hold companies accountable in court for breaking the law
• Change the carveout for financial institutions to make sure they have to follow the law

Passed in June 2023, the Oregon Consumer Privacy Act was the result of a working group led by the Oregon Attorney General’s office. Despite this, it still followed the Connecticut model, though Oregon did add some important protections – including minimizing the number of entities who were exempt from the law.

Things Oregon does well:

• Consumers can request a list of what 3rd parties a company has sold or shared their data with
• Limited carveouts meaning financial institutions and health providers have to follow the law
• Makes sure data that’s “pseudonymous” (aka stuff that’s not your name but is still easily tied to you, like your IP address) still falls under protections

Things it could do better:

• Enact a data minimization standard
• Let consumers hold companies accountable in court for breaking the law
• Give the Attorney General authority to write helpful clarifying rules

The Delaware governor signed the Personal Data Privacy Act into law on Sept. 11, 2023. The legislature was pressured by industry groups to water it down to match Connecticut and Virginia. 

Things Delaware does well:

• Special browser tool for automatic data opt-outs
• Bans targeted advertising to minors under 18 years old
• Consumers can request a list of what 3rd parties a company has sold or shared their data with

Things it could do better:

• Enact a data minimization standard
• Let consumers hold companies accountable in court for breaking the law
• Give the Attorney General authority to write helpful clarifying rules

Connecticut’s Data Privacy Act was first introduced in 2019 and originally included strong provisions such as a private right of action. The bill, however, was whittled down over time, making it more similar to Virginia’s failing law. In 2022, Connecticut’s bill was passed with a few additional provisions — such as requirements to honor global opt-out signals — making it a little stronger than Virginia. This bill has now become a favored piece of template legislation for lobbyists, particularly in bluer states.

A year after its original passage, Connecticut passed legislation amending the law to include heightened protections for kids and teens online and adding a category of sensitive data for “consumer health data.” The “Connecticut model” pushed by industry in other states does not include these updates.

Things Connecticut does well:

• Allows consumers to use a special browser tool to automatically tell websites they don’t want their data collected (with some less helpful limitations)
• Bans targeted advertising to kids and teens under 18 (which pass passed in an amendment)

Things it could do better:

• Enact a data minimization standard
• Let consumers hold companies accountable in court for breaking the law
• Give the Attorney General authority to write helpful clarifying rules (like what opt-out browser tools companies will have to listen to)

New Hampshire is the most recent comprehensive consumer privacy law to pass. The bill passed out of the Legislature on Jan. 18, 2024 and is awaiting the governor’s signature.

Things New Hampshire does well:

• Gives the Attorney General some ability to write helpful clarifying rules

Things it could do better:

• Enact a data minimization standard
• Let consumers hold companies accountable in court for breaking the law
• Make it clearer that companies “sharing” people’s data for money is the same as selling

Before Republican Sen. Daniel Zolnikov introduced the Consumer Data Privacy Act, a tech lobbyist told him the Connecticut model was too difficult for industry to comply with and that it would be better to introduce something closer to the weaker Virginia model. According to Politico, after Zolnikov heard the same lobbyist testify in Maryland — a blue state — that industry would be happy with a Connecticut model, he strengthened his bill.

Zolnikov has expressed frustration with being pushed to pass a weaker bill in Montana than in blue state counterparts. “I’m not an idiot,” Zolnikov said in an interview with Politico after the passage of his bill, directing his comments at the lobbyist. “And you treating us in Montana like a bunch of rural backwoods folks is quite an insult.”

Things Montana does well:

• Allows consumers to use a special browser tool to automatically tell websites they don’t want their data collected (with some less helpful limitations)
• While it gives companies the “right to cure” (fix a problem after it’s been found, incentivizing companies to break the law and just fix things as they come up), it sunsets after 18 months. This means companies will have to start taking their violations more seriously after that point.

Things it could do better:

• Enact a data minimization standard
• Let consumers hold companies accountable in court for breaking the law
• Change the carveouts to make it that financial institutions and health providers do have to follow the law

Texas passed the Texas Data Privacy and Security Act in June, 2023. Unfortunately, there’s a lot it could do better when it comes to protecting consumers.

What Texas does well:

• Allows consumers to use a special browser tool to automatically tell websites they don’t want their data collected. (This is neat – but the law doesn’t let the AG or anyone else clarify what counts as a viable tool, which will make it hard for consumers to know if the tool they’ve downloaded is working or not.)

What it could do better:

• Let consumers hold companies accountable in court for breaking the law
• Change the carveouts to make it that financial institutions, health providers and utility companies do have to follow the law
• Enact a data minimization standard

While the TDPSA leaves a lot to be desired, last year Texas enacted a pretty great data broker registry law. This will require data brokers – shadowy companies that specialize in harvesting and selling data – to register with the state. That’s a win for transparency. The next step? Maybe Texas will pass its own DELETE Act, and let consumers tell all those data brokers to delete their data with the click of one button.

In 2021, Virginia became the 2nd state to pass a data privacy law. The original bill text was handed to the sponsor by an Amazon lobbyist, enshrining such industry-friendly measures it’s hard to say this bill does all that much for consumers. It’s gone on to be a favorite template of industry lobbyists across the country, pushing states to all match Virginia’s bad standard.

• Companies can keep collecting whatever data they want from people and using it just about however they like.
• If consumers want to opt-out of data collection or tell companies to delete their data, they have to do so one at a time to the hundreds, if not thousands, of entities already holding their personal information.
• Consumers can’t hold companies accountable in court for violating the few rights consumers are given.

Indiana passed the Indiana Consumer Data Protection Act in May, 2023. Unfortunately, like with all of the other states that get a failing grade, it provides no meaningful privacy protections to consumers.

• Companies can keep collecting whatever data they want from people and using it just about however they like.
• If consumers want to opt-out of data collection or tell companies to delete their data, they have to do so one at a time to the hundreds, if not thousands, of entities already holding their personal information.
• Consumers can’t hold companies accountable in court for violating the few rights consumers are given.

Tennessee passed the Tennessee Information Protection Act in May, 2023. Unfortunately, like with all of the other states that get a failing grade, it provides no meaningful privacy protections to consumers.

• Companies can keep collecting whatever data they want from people and using it just about however they like.
• If consumers want to opt-out of data collection or tell companies to delete their data, they have to do so one at a time to the hundreds, if not thousands, of entities already holding their personal information.
• Consumers can’t hold companies accountable in court for violating the few rights consumers are given.

Utah passed the Utah Consumer Privacy Act in March, 2022. It started with a Virginia model, and then weakened it by making the law apply only to businesses making more than $25 million a year.

Unfortunately, like with all of the other states that get a failing grade, it provides no meaningful privacy protections to consumers.

• Companies can keep collecting whatever data they want from people and using it just about however they like.
• If consumers want to opt-out of data collection or tell companies to delete their data, they have to do so one at a time to the hundreds, if not thousands, of entities already holding their personal information.
• Consumers can’t hold companies accountable in court for violating the few rights consumers are given.

Iowa passed the Iowa Data Privacy Act in March, 2023. Unfortunately, like with all of the other states that get a failing grade, it provides no meaningful privacy protections to consumers.

• Companies can keep collecting whatever data they want from people and using it just about however they like.
• If consumers want to opt-out of data collection or tell companies to delete their data, they have to do so one at a time to the hundreds, if not thousands, of entities already holding their personal information.
• Consumers can’t hold companies accountable in court for violating the few rights consumers are given.