And then there were five. On May 10, Connecticut Governor Ned
Lamont signed his state's Consumer Privacy Act, causing Utah to
join California, Virginia, Colorado, and Utah as states that have
enacted a consumer data privacy protection law. The Virginia law
will take effect on January 1, 2023. The Connecticut law, along
with that of Colorado, will take effect on July 1, 2023. Utah's
will take effect on December 31, 2023.
California was the first to adopt such a law, and its California
Consumer Privacy Act was amended and toughened by the approval in
2020, by referendum, of the California Privacy Rights Act. The
California law, as amended, continues to be the most privacy
protective—and arguably burdensome to businesses—of the
state laws enacted to date.
