Ongoing issues over the processing, storage and safety of non-public knowledge, plus the influence of AI, proceed to consequence within the passage of state-level privateness laws.
Over the previous decade, dozens of legal guidelines, laws, statutes and different steering have been issued on knowledge safety and privateness by the U.S. federal authorities, states and native municipalities, and worldwide governments and legislative our bodies. Contemplating the rising strain on enterprise leaders to guard the confidentiality, integrity and availability of personally identifiable data (PII), it’s more and more necessary that CISOs, CIOs and different IT leaders are conscious of and conform to the necessities laid out in that laws.
Whereas there are various well-known requirements for knowledge safety and privateness — amongst them ISO/IEC 27001, ISO/IEC 27002 and NIST Particular Publication 800-53 — these requirements signify solely a small share of the laws and laws governing knowledge privateness and safety.
What are knowledge privateness legal guidelines and laws?
Think about how a lot knowledge is generated each hour and the way a lot of that knowledge accommodates PII and private well being data (PHI). It’s important to safe knowledge with these distinctive traits from unauthorized entry and preserve it from most of the people. To that finish, it’s critical to guard the confidentiality, integrity and availability of information.
Consequently, dozens of legal guidelines and laws have been developed — and proceed to be developed — to manipulate how knowledge is collected, processed and saved. These statutes are supposed to do the next:
- Prohibit unauthorized entry to private and personal knowledge.
- Defend towards actions which may alter knowledge with out the proprietor’s information or approval.
- Set up entry processes that stop entry to private knowledge apart from by the proprietor(s).
- Guarantee knowledge homeowners can entry and look at their knowledge.
- Present permissions for private knowledge to be collected.
- Forestall the promoting or launch of information to outdoors third events with out proprietor consent.
- Guarantee homeowners can overview their knowledge to validate that it’s appropriate.
- Allow homeowners to delete knowledge about them.
- Guarantee homeowners are notified if a safety breach has compromised their knowledge.
Complying with these pointers helps firms decrease the chance of being sued or fined and mitigate the consequences of unfavourable buyer fallout and reputational harm.
U.S. privateness laws
Whereas the U.S. at present would not have a nationwide knowledge privateness legislation, three initiatives have been developed:
- American Knowledge Privateness and Safety Act. ADPPA was launched throughout the 117th Congress (2021-2022). Whereas it was handed by the Home Committee on Power and Commerce in 2022, it by no means obtained a full Home vote. A few of its provisions may develop into legislation in future laws (see APRA).
- Government order on defending People’ delicate private knowledge. Issued by President Joe Biden on Feb. 28, 2024, the order authorizes the U.S. legal professional normal to stop the large-scale switch of delicate American knowledge to international locations of concern.
- American Privateness Rights Act. APRA was proposed in 2024 by Sen. Maria Cantwell (D-Wash.) and Rep. Cathy McMorris Rodgers (R-Wash.). It was constructed upon prior laws, together with ADPPA, to supply a framework for nationwide knowledge privateness rights that might be utilized by states and federal companies. It additionally offered an replace to the Youngsters’s On-line Privateness Safety Act (COPPA) of 1998. Whereas the laws tried to determine a nationwide legislation for knowledge privateness, it has confronted many challenges and has not been handed into legislation.
The Federal Commerce Fee is a key regulator chargeable for assessing compliance with legal guidelines that have an effect on knowledge privateness. Its enforcement actions shield shoppers from unfair or misleading practices and impose federal privateness and knowledge safety laws.
Further companies that train authority on privateness points embrace the Workplace of the Comptroller of the Forex, Division of Well being and Human Providers, Federal Communications Fee, Securities and Trade Fee, Shopper Monetary Safety Bureau and Division of Commerce.
U.S. statutes that cowl privateness points embrace the next:
- Privateness Act of 1974. This legislation established a code of honest data practices to manipulate the gathering, processing, administration, dissemination and destruction of PII.
- Well being Insurance coverage Portability and Accountability Act. Enacted in 1996, HIPAA has two key sections: the Safety Rule and Privateness Rule. These guidelines give protected well being data suppliers and processors flexibility in how they shield person knowledge. As well as, it is an necessary audit doc. Compliance with the legislation and its many provisions is crucial to keep away from penalties and fines.
- Gramm-Leach-Bliley Act. Enacted in 1999, GLBA modernized compliance necessities for monetary providers and addressed issues associated to client monetary privateness by requiring monetary establishments to clarify their information-sharing practices to prospects and safeguard delicate knowledge.
- Youngsters’s On-line Privateness Safety Act. COPPA goals to guard the privateness and PII of kids below the age of 13 who use on-line providers.
- Driver’s Privateness Safety Act. DPPA governs the privateness and disclosure of non-public data gathered by state-level motorized vehicle departments.
- Video Privateness Safety Act. VPPA restricts the disclosure of rental or sale information of movies or comparable audiovisual supplies, together with on-line streaming.
- Cable Communications Coverage Act of 1984. This consists of provisions devoted to defending subscriber privateness.
- Truthful Credit score Reporting Act. FCRA restricts the usage of data that addresses a person’s creditworthiness, credit score standing, credit score capability, character, normal status, private traits or mode of dwelling as a part of efforts to find out eligibility for credit score, employment or insurance coverage.
- Phone Shopper Safety Act. TCPA regulates calls and textual content messages despatched to cellphones, in addition to calls made to residential telephones utilizing automated dialing techniques for advertising and marketing functions.
- Controlling the Assault of Non-Solicited Pornography and Advertising Act of 2003. The CAN-SPAM Act establishes pointers for sending industrial emails, together with provisions that permit recipients to decide out of additional messages.
- Household Instructional Rights and Privateness Act. FERPA lets college students examine and revise their pupil information for accuracy. It additionally prohibits disclosure of pupil information or different pupil PII with out the coed’s or mother or father’s consent.
State-level privateness laws
Whereas no nationwide laws exists, many U.S. states have enacted their very own knowledge privateness legal guidelines, together with California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah and Virginia. As well as, greater than half of U.S. states have proposed or handed some type of focused laws citing the usage of AI in political campaigns, education, crime knowledge, sexual offenses and deepfakes.
California
California has been the chief in knowledge privateness laws, enacting extra legal guidelines than some other state.
The California Shopper Privateness Act (CCPA) has been in impact since 2020. It specifies that residents can ask companies to reveal the kind of data they gather, why they’re amassing the knowledge and the supply of the info.
The California Privateness Rights Act, in impact since 2023, amends and builds on CCPA by giving residents the power to stop companies from sharing their private knowledge, request that non-public knowledge inaccuracies be corrected, and stop firms from utilizing delicate PII, akin to race and sexual desire.
California’s legislature has handed a number of AI-related payments, defining AI and regulating the most important AI fashions, generative AI coaching knowledge transparency, algorithmic discrimination and deepfakes in election campaigns.
Colorado
The Colorado Privateness Act, in impact since 2023, grants shoppers rights to handle their private knowledge and specifies how companies should shield private knowledge.
Colorado was the primary state to enact a broad-based regulation on AI utilization, often called the Colorado Synthetic Intelligence Act. Handed in 2024 and going into impact in 2026, it is going to require AI techniques builders “to make use of affordable care to guard shoppers from any recognized or fairly foreseeable dangers of algorithmic discrimination within the high-risk system.”
Connecticut
The Connecticut Knowledge Privateness Act, also called the Connecticut Private Knowledge Privateness and On-line Monitoring Act, has been in impact since 2023. It specifies client rights associated to private knowledge, on-line monitoring and knowledge privateness.
Delaware
The Delaware Private Knowledge Privateness Act was signed in 2023 and took impact on Jan. 1, 2025. It outlines client rights and enterprise necessities for shielding private knowledge.
Florida
The Florida Digital Invoice of Rights, efficient since 2024, applies to entities that generate greater than $1 billion in gross income and both derive 50% or extra of their world annual income from the sale of on-line commercials, function a client sensible speaker with a cloud-based voice assistant, or run an app retailer with a minimum of 250,000 apps.
Indiana
The Indiana Shopper Knowledge Safety Act, which fits into impact Jan. 1, 2026, outlines client rights and necessities for knowledge safety, together with knowledge entry, correction and deletion, and the power to decide out of focused promoting.
Iowa
Signed into legislation in 2023, the Iowa Shopper Knowledge Safety Act went into impact Jan. 1, 2025. It describes client rights and necessities for knowledge safety.
Minnesota
The Minnesota Shopper Knowledge Privateness Act went into impact on July 1, 2025, and addresses how shoppers can entry, appropriate and delete their knowledge, decide out of focused promoting, and acquire details about which third events their knowledge has been bought to.
Montana
The Montana Shopper Knowledge Privateness Act, in impact since 2024 and amended in April 2025, applies to entities that conduct enterprise in Montana or present services or products to Montana residents.
Nebraska
The Nebraska Knowledge Privateness Act, which went into impact on Jan. 1, 2025, addresses key points of information privateness and safety for companies that do enterprise in Nebraska or its residents, or course of or promote private knowledge.
New Hampshire
The New Hampshire Privateness Act took impact on Jan. 1, 2025. It applies to entities that conduct enterprise in New Hampshire or create services or products concentrating on New Hampshire residents. It consists of provisions on client rights and opt-out choices.
New Jersey
The New Jersey Knowledge Safety Act took impact on Jan. 15, 2025. It applies to entities that conduct enterprise in New Jersey or create services or products concentrating on New Jersey residents, and consists of provisions on client rights and opt-out choices, in addition to controller and processor safety necessities.
Oregon
The Oregon Shopper Privateness Act went into impact in 2024. It outlines client rights and guidelines for knowledge safety, together with enterprise knowledge safeguard necessities and client entry, deletion and opt-out rights.
Tennessee
Signed in 2023, the Tennessee Info Safety Act took impact on July 1, 2025. It outlines client rights and governs knowledge safety and knowledge breach reporting necessities for companies.
Texas
The Texas Knowledge Privateness and Safety Act went into impact in 2024. It describes client rights and knowledge safety necessities for companies, together with privateness notices, opt-in consent and knowledge influence assessments.
Utah
The Utah Shopper Privateness Act has been in impact since 2023. It gives client rights and describes enterprise knowledge safety assessments and safety measures.
Virginia
The Virginia Shopper Knowledge Safety Act has been in impact since 2023. It grants shoppers the suitable to entry, appropriate, delete and put up their private knowledge; mandates that companies adjust to knowledge safety guidelines; and impacts each authorities and nongovernment organizations that yearly course of particular portions of non-public knowledge.
Worldwide privateness laws
Among the many most important worldwide knowledge privateness legal guidelines are the next:
- Common Knowledge Safety Regulation. GDPR, launched in 2018, was developed by the EU and the European Financial Space. Any group — no matter its headquarters location — that targets or collects knowledge from folks and companies in EU member nations should adjust to the legislation.
- U.Ok. Knowledge (Use and Entry) Act 2025. DUAA was permitted in July 2025. It updates earlier laws, together with the U.Ok. GDPR, the Knowledge Safety Act of 2018 and the Privateness and Digital Communications Rules, however doesn’t supersede or substitute them.
- EU Knowledge Act. This laws took impact in 2024 and was up to date in 2025 to handle knowledge sharing throughout know-how platforms.
The EU AI Act went into impact in 2024 and was up to date throughout its phased implementation course of to extra exactly regulate numerous sorts of AI-based techniques, in addition to present better readability relating to AI practices, high-risk AI techniques, and different AI techniques and fashions.
Greater than 100 international locations worldwide have enacted knowledge privateness laws. Every legislation addresses basic points regarding knowledge creation and processing, knowledge possession and different standards. The necessities of every nation would possibly differ, as do compliance necessities, however the message is evident: Defending private knowledge is essential.
Way forward for U.S. knowledge privateness legal guidelines
Given the significance of information privateness and safety, anticipate extra states to formally enact knowledge privateness legal guidelines, most certainly constructed on the inspiration laid by California and different states which were on the forefront of client safety. A notable pattern to think about is that companies working in a number of states will encounter elevated challenges in complying with every state’s privateness legal guidelines.
Whereas present privateness laws at state and native ranges has developed right into a patchwork of exercise, this might nicely result in a broad-based bipartisan U.S. nationwide knowledge privateness legislation that additionally regulates the event, deployment and software of AI.
Paul Kirvan is an unbiased marketing consultant and technical author. He has greater than 35 years of expertise in enterprise continuity, catastrophe restoration, operational resilience, cybersecurity, governance, threat and compliance, networking and IT auditing.
