This is the latest article in our series highlighting
aspects of U.S. privacy laws. For our most recent previous article,
click here.
As noted in previous installments in our ongoing series on U.S.
privacy laws, the sector-specific and activity-specific model for
U.S. privacy regulation is rapidly changing, with individual states
recently enacting comprehensive consumer data privacy
legislation.
To date, these 12 states have enacted generally applicable (not
industry-specific or activity-specific) laws that impose
affirmative obligations and substantive restrictions on what
covered businesses must and cannot do with personal data:
California, Colorado, Connecticut, Delaware, Indiana, Iowa,
Montana, Oregon, Tennessee, Texas, Utah, and Virginia. And similar
laws are likely on the horizon, with pending proposals in New
England and at the federal level. Below is an overview of
comprehensive consumer privacy legislation currently under
consideration in state
