Data Privacy Laws By State – Summer 2022 Update

Data privacy is a basic human right, and we need strong laws to protect it. Too often, we see people’s personal data being mishandled or simply stolen in huge data breaches. With proper regulation, we can help put a stop to this and give people the peace of mind that their data is safe.

As more states wake up to the importance of data privacy laws, we’re seeing an increasing trend of legislation designed to protect people’s personally identifiable information (PII). These data privacy laws usually require companies to get explicit consent before collecting, using, or sharing people’s data.

Some states have already passed their own data privacy laws which are setting up great models for other states to follow. Virginia is one of the best examples because they have enacted clear and precise data privacy laws that are influencing the future of data privacy legislation.

While many companies have increased efforts toward protecting their users’ data privacy and setting up policies for it, this needs to become an industry standard. Other than regulations, there should also be stricter penalties for companies that do not comply with these requirements.

Data Privacy Laws By State in 2022

As more states keep enacting their own data privacy laws, other states will follow and realize the importance of these laws. Down below, you will be able to find current data privacy laws by state and a general overview of what rights are included in these laws. If you have a specific state you’d like further information about, please use the list below!

Note: Current data and information is as of mid-July 2022.

Note 2: When you see bills that start with “SB“, that stands for Senate Bill, and is/was in the associated state Senate. When you see bills that start with “HB“, that stands for House Bill, and is/was associated with the associated state House of Representatives.

Data Privacy Laws in Alabama

  • Bills in place: There are no active bills or privacy-related legislation in place in Alabama currently.
  • Statute/bill in the legislative process: No comprehensive bills on digital privacy have been introduced in the state of Alabama.

Data Privacy Laws in Alaska

  • Bills in place: No active bills
  • Statute/bill in the legislative process: There are a few inactive bills in Alaska that relate to privacy. Those inactive bills include HB 159, SB 116, and HB 222.

Link here to full data privacy statutes in Alaska:

Data Privacy Laws in Arizona

  • Bills in place: No active bills
  • Statute/bill in legislative process: There are a few inactive bills in Alabama that relate to privacy. Those inactive bills include HB 2790.

Link here to full data privacy statute in Arizona:

Data Privacy Laws in Arkansas

Bills in place: There are no active bills or privacy-related legislation in place in Arkansas currently.
Statute/bill in the legislative process: No comprehensive bills on digital privacy have been introduced in the state of Arkansas.

Data Privacy Laws in California

  • Bills in place: California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA)
  • Statute/bill in legislative process: Signed

As the first comprehensive consumer privacy legislation in the U.S., the CCPA and CPRA are potential models for other states to follow. The overall goal of these statutes is to enhance privacy rights and consumer protection for residents of California.

The California Consumer Privacy Act (CCPA) enacted in 2018 and took effect on Jan. 1, 2020, created a variety of consumer privacy rights and business obligations with regard to the collection and sale of personal information. 

The CCPA establishes the following privacy rights for people in California:

  • A right to know what personal data is collected, used, shared, or sold by businesses.
  • A right to delete personal data.
  • A right to prohibit the sale of personal data. Children under the age of 16 must give explicit consent to have their data eligible for sale, and a parent or guardian must give explicit consent for a child under the age of 13.
  • A guarantee that consumers who exercise their rights under the CCPA will not be penalized with higher prices or lower levels of service than those who do not.1

The California Privacy Rights Act (CPRA), also known as Proposition 24, significantly amends and expands the CCPA, and is sometimes referred to as “CCPA 2.0.” 

Link here to full data privacy statutes in California (CCPA and CPRA): https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?division=3.&part=4.&lawCode=CIV&title=1.81.5

Data Privacy Laws in Colorado

  • Bills in place: Colorado Privacy Act (CPA)
  • Statute/bill in legislative process: Signed

The Colorado Privacy Act (CPA) was signed into law on July 8th, 2021, and will go into effect on July 1st, 2023. It protects the privacy rights of Colorado residents and applies responsibilities to companies doing business in the state.

The Colorado Privacy Act is intended to protect consumers in their online activities. It gives them certain rights over their personal data, including making inquiries or requests to data controllers or data processors about it.

Consumers have five specific rights under the Colorado Privacy Act:

  1. The right to opt-out of data processing for targeted advertising, sale or profiling using their personal data
  2. The right to access any data that a company has collected about them
  3. The right to have any data corrected that has been collected about them and is incorrect or outdated
  4. The right to have any data collected about them deleted
  5. The right to data portability (being able to have your data transferred to another entity)

Unlike the California Consumer Privacy Act (CCPA) and some other laws, the CPA does not provide consumers with a private right of action, i.e. the ability to sue companies for damages or injury in the event of an alleged violation.

Colorado is aware there is still improvement to be made and will likely pass future legislation that extends on the CPA.

Link here to full data privacy statute in Colorado: https://leg.colorado.gov/bills/sb21-190

Data Privacy Laws in Connecticut 

  • Bills in place: Connecticut Data Privacy Act (CTDPA)
  • Statute/bill in legislative process: Signed

On May 10th, 2022, Connecticut became the fifth state to enact consumer data privacy legislation. The CTDPA will take effect on July 1st, 2022. 

The CTDPA gives consumers the right to access, correction, deletion, data portability, and opt-out for targeted advertising, the sale of personal data, and automated decision-making profiling. 

Beginning on July 1st, 2023, consumers have the right to:

  1. Access their personal data and confirm whether it is being processed;
  2. Correct inaccuracies in their personal data;
  3. Delete personal data provided by or obtained about them;
  4. Obtain a copy of their personal data in a portable, readily usable, and transmissible format; and
  5. Opt out of the processing of their personal data for the purposes of targeted advertising, sale, or profiling.

Link here to full data privacy statute in Connecticut: https://www.cga.ct.gov/asp/cgabillstatus/cgabillstatus.asp?selBillType=Bill&bill_num=SB00006&which_year=2022

Data Privacy Laws in Delaware

Bills in place: There are no active bills or privacy-related legislation in place in Delaware currently.
Statute/bill in the legislative process: No comprehensive bills on digital privacy have been introduced in the state of Delaware.

Data Privacy Laws in Florida

  • Bills in place: There are no active bills or privacy-related legislation in place in Florida currently.
  • Statute/bill in legislative process: There are a few inactive bills in Florida that relate to privacy. Those inactive bills include SB 1864 and HB 9.

Link here to full data privacy statutes in Florida:

Data Privacy Laws in Georgia 

  • Bills in place: There are no active bills or privacy-related legislation in place in Georgia currently.
  • Statute/bill in legislative process: There are a few inactive bills in Georgia that relate to privacy. Those inactive bills include SB 394

Link here to full data privacy statutes in Georgia:  https://www.legis.ga.gov/legislation/61417

Data Privacy Laws in Hawaii 

  • Bills in place: There are no active bills or privacy-related legislation in place in Hawaii currently.
  • Statute/bill in legislative process: There are a few inactive bills in Hawaii that relate to privacy. Those inactive bills include HB 2051, SB 2428, SB 2797, and HB 2341.

Link here to full data privacy statutes in Hawaii:

Data Privacy Laws in Idaho 

Bills in place: There are no active bills or privacy-related legislation in place in Idaho currently.
Statute/bill in the legislative process: No comprehensive bills on digital privacy have been introduced in the state of Idaho.

Data Privacy Laws in Illinois 

Bills in place: There are no active bills or privacy-related legislation in place in Illinois currently.
Statute/bill in the legislative process: No comprehensive bills on digital privacy have been introduced in the state of Illinois.

Data Privacy Laws in Indiana

  • Bills in place: There are no active bills or privacy-related legislation in place in Indiana currently.
  • Statute/bill in legislative process: There are a few inactive bills in Indiana that relate to privacy. Those inactive bills include HB 1261 and SB 358.

Link here to full data privacy statutes in Indiana:

Data Privacy Laws in Iowa

  • Bills in place: There are no active bills or privacy-related legislation in place in Iowa currently.
  • Statute/bill in legislative process: There are a few inactive bills in Iowa that relate to privacy. Those inactive bills include HF 2506 and SF 2208.

Link here to full data privacy statutes in Iowa:

Data Privacy Laws in Kansas

Bills in place: There are no active bills or privacy-related legislation in place in Kansas currently.
Statute/bill in the legislative process: No comprehensive bills on digital privacy have been introduced in the state of Kansas.

Data Privacy Laws in Kentucky

  • Bills in place: There are no active bills or privacy-related legislation in place in Kentucky currently.
  • Statute/bill in legislative process: There are a few inactive bills in Kentucky that relate to privacy. Those inactive bills include SB 15 and HB 586.

Link here to full data privacy statutes in Kentucky:

Data Privacy Laws in Louisiana

  • Bills in place: There are no active bills or privacy-related legislation in place in Louisiana currently.
  • Statute/bill in legislative process: There are a few inactive bills in Louisiana that relate to privacy. Those inactive bills include primarily HB 987.

Link here to full data privacy statutes in Louisiana:

Data Privacy Laws in Maine

  • Bills in place: There are no active bills or privacy-related legislation in place in Maine currently.
  • Statute/bill in legislative process: There are a few inactive bills in Maine that relate to privacy. Those inactive bills include primarily LD 1982.

Link here to full data privacy statutes in Maine:

Data Privacy Laws in Maryland

  • Bills in place: There are no active bills or privacy-related legislation in place in Maryland currently.
  • Statute/bill in legislative process: There are a few inactive bills in Maryland that relate to privacy. Those inactive bills include primarily SB 11.

Link here to full data privacy statutes in Maryland:

Data Privacy Laws in Massachusetts

  • Bills in place: There are no active bills or privacy-related legislation in place in Massachusetts currently.
  • Statute/bill in legislative process: There are two bills in Massachusetts that are currently going through committee. There are also a few inactive bills.

Massachusetts Information Privacy and Security Act (MIPSA) is currently in committee. There are two bills under the (MIPSA), called S 2687 and H 4514. If enacted, this legislation would be very similar to the data privacy laws in California, Colorado, and Virginia.

The Act provides Massachusetts residents with the right to opt-out of certain data collection, the sale of personal data, and the right to limit the use and disclosure of personal information.

Some of the additional requirements found in MIPSA include:

  • Providing privacy notices to customers on how their personal information is used;
  • Mandating risk assessments to determine potential exposure to high-risk business practices; and
  • Limiting the use of personal information for a specific purpose.

There are a few inactive bills in Massachusetts that relate to privacy. Those inactive bills include: S 46, H 142, H 136

Link here to full data privacy statutes in Massachusetts:

Data Privacy Laws in Michigan 

  • Bills in place: There are no active bills or privacy-related legislation in place in Michigan currently.
  • Statute/bill in legislative process: There is one data privacy bill in Michigan that is currently in committee.

Michigan Consumer Privacy Act (HB 5989) is currently in committee. 

HB 5989 is a bill to protect the privacy rights of consumers by requiring businesses to provide notice of how they collect, use, and sell personal data, prohibiting certain uses of personal data, and establishing standards and practices for handling personal data. The bill would also create a state privacy enforcement fund and provide for remedies.

Link here to full data privacy statutes in Michigan:

Data Privacy Laws in Minnesota

  • Bills in place: There are no active bills or privacy-related legislation in place in Minnesota currently.
  • Statute/bill in legislative process: There are a few inactive bills in Minnesota that relate to privacy. Those inactive bills include primarily HF 1492.

Link here to full data privacy statutes in Minnesota:

Data Privacy Laws in Mississippi

  • Bills in place: There are no active bills or privacy-related legislation in place in Mississippi currently.
  • Statute/bill in legislative process: There are a few inactive bills in Mississippi that relate to privacy. Those inactive bills include primarily HB 2330.

Link here to full data privacy statutes in Mississippi:

Data Privacy Laws in Missouri

Bills in place: There are no active bills or privacy-related legislation in place in Missouri currently.
Statute/bill in the legislative process: No comprehensive bills on digital privacy have been introduced in the state of Missouri.

Data Privacy Laws in Montana

Bills in place: There are no active bills or privacy-related legislation in place in Montana currently.
Statute/bill in the legislative process: No comprehensive bills on digital privacy have been introduced in the state of Montana.

Data Privacy Laws in Nebraska

  • Bills in place: There are no active bills or privacy-related legislation in place in Nebraska currently.
  • Statute/bill in legislative process: There are a few inactive bills in Nebraska that relate to privacy. Those inactive bills include primarily LB 1188.

Link here to full data privacy statutes in Nebraska:

Data Privacy Laws in Nevada

Bills in place: There are no active bills or privacy-related legislation in place in Nevada currently.
Statute/bill in the legislative process: No comprehensive bills on digital privacy have been introduced in the state of Nevada.

Data Privacy Laws in New Hampshire

Bills in place: There are no active bills or privacy-related legislation in place in New Hampshire currently.
Statute/bill in the legislative process: No comprehensive bills on digital privacy have been introduced in the state of New Hampshire.

Data Privacy Laws in New Jersey

  • Bills in place: There are no active bills or privacy-related legislation in place in New Jersey currently.
  • Statute/bill in legislative process: There are quite a few bills in New Jersey currently going through the legislative process.

Assembly Bill (‘A505’) for the New Jersey Disclosure and Accountability Transparency Act was introduced, on 11 January 2022. It would establish certain requirements for the processing and disclosure of personally identifiable information. A505 would, among other things:

  • require affirmative consent to the processing of personal information;
  • mandate transparency requirements for the processing of personal information;
  • establish data subject rights for consumers;
  • regulate automated decision-making processing; and
  • establish rules regarding securing consumer personal data.

There are two other bills included in this act, S332 and A1971. S332 and A1971 would require commercial Internet websites and online services to notify consumers of the collection and disclosure of personally identifiable information and allows consumers to opt out.

Link here to full data privacy statutes in New Jersey:

Data Privacy Laws in New Mexico

Bills in place: There are no active bills or privacy-related legislation in place in New Mexico currently.
Statute/bill in the legislative process: No comprehensive bills on digital privacy have been introduced in the state of New Mexico.

Data Privacy Laws in New York

  • Bills in place: There are no active bills or privacy-related legislation in place in New York currently.
  • Statute/bill in legislative process: There are a few inactive bills in New York that relate to privacy. Those inactive bills include A 680, S 6701, A 6042, S 567, and A 3709.

Link here to full data privacy statutes in New York:

Data Privacy Laws in North Carolina

  • Bills in place: There are no active bills or privacy-related legislation in place in North Carolina currently.
  • Statute/bill in legislative process: North Carolina currently has a consumer privacy act working its way through a committee for assessment.

On April 7, 2021, North Carolina Introduces Consumer Privacy Act. The Act is very similar to  Virginia’s Consumer Data Protection Act.

Under this act North Carolina residents have the following rights:

  1. Right to access personal data.
  2. Right to correct inaccuracies in personal data.
  3. Right to have their personal data deleted.
  4. Right to obtain a copy of their personal data.
  5. Right to opt-out of further processing of their personal data.

Link here to full data privacy statutes in North Carolina: https://www.ncleg.gov/BillLookUp/2021/S569

Data Privacy Laws in North Dakota

Bills in place: There are no active bills or privacy-related legislation in place in North Dakota currently.
Statute/bill in the legislative process: No comprehensive bills on digital privacy have been introduced in the state of North Dakota.

Data Privacy Laws in Ohio

  • Bills in place: There are no active bills or privacy-related legislation in place in Ohio currently.
  • Statute/bill in legislative process: Ohio currently has OPPA that has been introduced and is working its way through the committee.

On July 13th, 2021, the Ohio Person Privacy Act (OPPA) was introduced. This act would provide “data rights” for Ohio residents, such as the ability to have your personal data deleted and a request to businesses to not sell a person’s data. These rights would give Ohio residents control over how businesses are using their data and give them the option to tell businesses to not sell their data.

Link here to full data privacy statutes in Ohio: https://www.legislature.ohio.gov/legislation/legislation-summary?id=GA134-HB-376

Data Privacy Laws in Oklahoma

  • Bills in place: There are no active bills or privacy-related legislation in place in Oklahoma currently.
  • Statute/bill in legislative process: There are a few inactive bills in Oklahoma that relate to privacy. Those inactive bills include HB 1602, HB 3447, and HB 2969.

Link here to full data privacy statutes in Oklahoma:

Data Privacy Laws in Oregon

Bills in place: There are no active bills or privacy-related legislation in place in Oregon currently.
Statute/bill in the legislative process: No comprehensive bills on digital privacy have been introduced in the state of Oregon.

Data Privacy Laws in Pennsylvania

  • Bills in place: There are no active bills or privacy-related legislation in place in Pennsylvania currently.
  • Statute/bill in legislative process: There are actually three comprehensive privacy-related bills working their way through committees currently in the state of Pennsylvania.

On April 7, 2021, Pennsylvania legislators introduced a comprehensive consumer data protection bill (HB 1126) modeled on the California Consumer Privacy Act. Under the proposed bill, Pennsylvania consumers would have a right to 

  • request disclosure of personal information collected by a business 
  • have their personal information deleted
  • request information about personal information sold or used for business purposes by a business
  • decline or opt out of the sale of personal information to third parties

House Bill (‘HB’) 2202, is also a part of the Pennsylvania Consumer Privacy Act. This is a bill providing for consumer data privacy, for rights of consumers and duties of businesses relating to the collection of personal information, and for duties of the Attorney General.

House Bill (‘HB’) 2257 for the Pennsylvania Consumer Data Protection Act was introduced, on 20 January 2022. This act would: 

  • provide consumers with rights of access, deletion, correction, opt-out, and portability in relation to their personal data;
  • require organizations to abide by data processing principles of data minimization and purpose specification;
  • require organizations to implement and maintain reasonable administrative and technical security practices for personal data;
  • require contracts between controllers and processors; 
  • require organizations to undertake data protection assessments; and
  • designate the Pennsylvania Attorney General for enforcement.

Link here to full data privacy statutes in Pennsylvania:

Data Privacy Laws in Rhode Island

Bills in place: There are no active bills or privacy-related legislation in place in Rhode Island currently.

Statute/bill in legislative process: There are a few inactive bills in Rhode Island that relate to privacy. Those inactive bills include primarily HB 7917.

Link here to full data privacy statutes in Rhode Island:

Data Privacy Laws in South Carolina

Bills in place: There are no active bills or privacy-related legislation in place in South Carolina currently.
Statute/bill in the legislative process: No comprehensive bills on digital privacy have been introduced in the state of South Carolina.

Data Privacy Laws in South Dakota

Bills in place: There are no active bills or privacy-related legislation in place in South Dakota currently.
Statute/bill in the legislative process: No comprehensive bills on digital privacy have been introduced in the state of South Dakota.

Data Privacy Laws in Tennessee

Bills in place: There are no active bills or privacy-related legislation in place in Tennessee currently.
Statute/bill in the legislative process: No comprehensive bills on digital privacy have been introduced in the state of Tennessee.

Data Privacy Laws in Texas

Bills in place: There are no active bills or privacy-related legislation in place in Texas currently.
Statute/bill in the legislative process: No comprehensive bills on digital privacy have been introduced in the state of Texas.

Data Privacy Laws in Utah

  • Bills in place: Utah Consumer Privacy Act (UCPA)
  • Statute/bill in legislative process: Utah has a signed consumer privacy act, making it one of the most privacy-forward states in the country.

On March 24th, 2022, Utah was the fourth state to introduce consumer data privacy legislation. The UCPA shares many similarities with the Virginia Consumer Data Privacy Act (VCDPA) and will take effect on December 31, 2023. Although it is similar to other consumer data privacy laws, it is a lighter approach to make it easier for businesses to comply with.

UCPA grants consumers rights to:

  • Access the personal data that a controller processes about them;
  • Delete personal data that the consumer provided to the controller;
  • Obtain a copy of the personal data, in a “portable” format, that the consumer provided to the controller; and
  • Opt out of the “sale” of personal data (defined as disclosure by a controller to a third party for a monetary consideration) or processing of personal data for targeted advertising.

This is a great starting point for Utah and they plan on building on this legislation in the future.

Link here to full statutes for Utah: https://le.utah.gov/~2022/bills/static/SB0227.html

Data Privacy Laws in Vermont

  • Bills in place: There are no active bills or privacy-related legislation in place in Vermont currently.
  • Statute/bill in legislative process: There are a few inactive bills in Vermont that relate to privacy. Those inactive bills include H 160 and H 570.

Link here to full data privacy statutes in Vermont:

Data Privacy Laws in Virginia

  • Bills in place: Virginia Consumer Data Privacy Act (VCDPA)
  • Statute/bill in legislative process: A signed bill, VCDPA, has already been put into effect, making Virginia one of the most privacy-forward states in the country.

The VCDPA gives consumers the right to access their data and request that their personal information be deleted by businesses. It also requires companies to conduct data protection assessments related to processing personal data for targeted advertising and sales purposes.

The VCDPA also provides consumers with certain rights related to their personal data. Under the Act, these rights include:

  1. The right to know, access, and confirm personal data.
  2. The right to delete personal data.
  3. The right to correct inaccuracies in personal data.
  4. The right to data portability (i.e., easy, portable access to all pieces of personal data held by a company).
  5. The right to opt out of the processing of personal data for targeted advertising purposes.
  6. The right to opt out of the sale of personal data.
  7. The right to opt out of profiling based upon personal data.
  8. The right to not be discriminated against for exercising any of the foregoing rights.

VCDPA is considered a better model than California’s CCPA because it is much more clear and precise on what the laws are. Other states will most likely use this as a model to pass their own legislation in the future. 

Link here to full statutes: https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/

Data Privacy Laws in Washington DC

Bills in place: There are no active bills or privacy-related legislation in place in Washington DC currently.
Statute/bill in the legislative process: No comprehensive bills on digital privacy have been introduced in Washington DC.

Data Privacy Laws in Washington

  • Bills in place: There are no active bills or privacy-related legislation in place in Washington currently.
  • Statute/bill in legislative process: There are a few inactive bills in Washington state that relate to privacy. Those inactive bills include HB 1433, SB 5062, HB 1850, and SB 5813.

Link here to full data privacy statutes in Washington:

Data Privacy Laws in West Virginia

  • Bills in place: There are no active bills or privacy-related legislation in place in West Virginia currently.
  • Statute/bill in legislative process: There are a few inactive bills in West Virginia that relate to privacy. Those inactive bills include primarily HB 4454.

Link here to full data privacy statutes in West Virginia:

Data Privacy Laws in Wisconsin

  • Bills in place: There are no active bills or privacy-related legislation in place in Wisconsin currently.
  • Statute/bill in legislative process: There are a few inactive bills in Wisconsin that relate to privacy. Those inactive bills include AB 957, SB 957, AB 1050, and SB 977.

Link here to full data privacy statutes in Wisconsin:

Data Privacy Laws in Wyoming

Bills in place: There are no active bills or privacy-related legislation in place in Wyoming currently.
Statute/bill in the legislative process: No comprehensive bills on digital privacy have been introduced in the state of Wyoming.

Leave a Comment