Back
Back
industry
Back
Back
In 2024, the legislation around data privacy in the United States has undergone significant transformation, particularly at the state level. With the absence of comprehensive federal data privacy legislation, individual states have proactively established their own legal frameworks to safeguard consumer data. This report will outline significant privacy bills that were passed in 2024 and remark on emerging trends.
One trend observed in 2024 involves the enhancement of consumer rights. States such as Kentucky and Maryland have enacted statutes granting residents the right to access, correct, delete, and obtain copies of their personal information. These legislative measures empower consumers by affording them greater control over their data. Kentucky’s legislation, which includes provisions for opting out of targeted advertising and data sales, exemplifies the increasing desire to shield consumers from invasive data practices.
Another notable trend is the drive for enhanced transparency and accountability in data practices. New Jersey and Rhode Island have mandated the issuance of clear privacy notices and the disclosure of data sales for targeted advertising purposes. These requirements ensure that consumers are adequately informed about the utilization and sharing of their data. Furthermore, Rhode Island’s legislation imposes obligations on businesses to designate data controllers and ensure transparency in data sharing, thereby underscoring the importance of accountability in data privacy.
States are also adopting comprehensive data protection measures to ensure the security of personal information. Legislation in New Hampshire and New Jersey mandates data controllers to implement robust security measures and provide privacy notices. These measures are designed to protect consumer data from breaches and unauthorized access. The inclusion of specific security obligations for businesses, as delineated in Kentucky’s legislation, highlights the priority placed on safeguarding personal information.
There is also a discernible trend towards integrating data privacy with broader regulatory frameworks. Minnesota’s legislation establishes consumer data protections and adjusts appropriations for other regulatory areas, such as cannabis management and health departments. Similarly, Nebraska’s Data Privacy Act aligns state regulations with federal banking laws and updates financial regulations. This integration reflects the interconnected nature of modern governance and the necessity to address data privacy within a more expansive regulatory context.
Another emerging trend is the focus on addressing sector-specific privacy concerns. Nebraska’s legislation, for instance, impacts the banking, finance, and public sectors by amending data breach and background check rules. This approach acknowledges that different industries have unique privacy challenges and necessitates tailored solutions to protect consumer data effectively.
The trend towards robust enforcement mechanisms is evident in several states. New Hampshire and Maryland have vested enforcement authority in the attorney general, ensuring a regulatory body is responsible for overseeing compliance. Rhode Island’s legislation includes penalties for violations, reflecting a stringent approach to data privacy enforcement. These enforcement provisions ensure that businesses adhere to data privacy laws and that consumers’ rights are protected.
In 2024, state privacy laws in the United States are characterized by a focus on strengthening consumer rights, enhancing transparency and accountability, implementing comprehensive data protection measures, integrating with broader regulatory frameworks, addressing sector-specific privacy concerns, and establishing robust enforcement mechanisms. These trends underscore a growing commitment to protecting consumer data in an increasingly digital world. As more states enact their own privacy laws, the landscape of data privacy in the United States will continue to evolve, potentially paving the way for a comprehensive federal privacy framework in the future.
Kentucky Consumer Data Protection Act Kentucky HB 15 (04/04/2024) Became Law, Effective (01/01/2026) - Establishes rules for businesses regarding personal data handling, grants residents rights to access, correct, delete, and obtain copies of their information, opt out of targeted advertising and data sales, and outlines security and notice obligations, with exemptions for certain entities and no specified penalties for non-compliance.
Maryland Online Data Privacy Act Maryland SB 0541(05/09/2024) Became Law, Effective (10/01/2025) - Grants consumers data rights, mandates data protection and privacy practices for controllers, and enforces violations under the Maryland Consumer Protection Act.
Minnesota Consumer Data Privacy Act Minnesota HF 4757 (05/24/2024) Became Law, Effective (07/31/ 2025) - Adjusts appropriations for cannabis management and health departments, modifies cannabis provisions and fees, establishes the Minnesota Consumer Data Privacy Act, adds consumer protections, authorizes rulemaking, classifies data, requires reports, and appropriates funds.
Nebraska Data Privacy Act Nebraska LB 1074 (04/18/2024) Became Law, Effective (01/01/2025) - Aligns state with federal banking laws, updates financial regulations, adopts the Data Privacy Act and Public Entities Pooled Investment Act, exempts certain records from disclosure, and changes data breach and background check rules, impacting banking, finance, and public entities, with specific exemptions.
Expectation of Privacy New Hampshire SB 255 (03/07/2024) Became Law, Effective (01/01/2025) - Establishes consumer privacy rights in New Hampshire, requiring data controllers to limit data collection, implement security measures, provide privacy notices, and grants enforcement authority to the attorney general.
Personal Data New Jersey SB 332 (01/16/2024) Became Law, Effective (01/15/2025) - Regulates online services and personal data by defining key terms, mandating clear privacy notices, disclosure of data sale for targeted ads, consumer rights processes, and data security measures, with exemptions for certain institutions, and enforcement by the Attorney General for violations.
Data Practices Rhode Island SB 2500 and Companion Bill HB 7787 (06/28/2024) Became Law, Effective (01/01/2025) - Mandates businesses and internet providers in Rhode Island to disclose data practices, designate controllers, ensure transparency in data sharing, and grant consumers rights to access, correct, obtain data copies, and opt out of targeted ads and data sales, with penalties for violations.
