Comparing The 5 Comprehensive Privacy Laws Passed By US States

On May 10, 2022, Connecticut became the fifth state to enact a comprehensive privacy law to protect personal data, joining California, Virginia, Colorado and Utah. Although privacy and data security laws have existed in the U.S. for decades, until recently they were limited to certain industries, jurisdictions or data types. These five new laws reflect a growing movement to protect an individual's general right to privacy rather than regulate only particular types of data processing. See our analyses of the California, Virginia and Colorado laws for how to comply with privacy requirements in those states.

The table below shows that patterns are emerging in how state legislatures are approaching general privacy protection laws. For example, the Connecticut statute adopts large portions of the Colorado and Virginia laws almost verbatim, including with regard to the definition of personal data, how to process sensitive personal data and when to perform data protection