State Law Privacy Alert—Key Compliance Updates

The beginning of 2022 saw a flurry of activity in privacy. In the United States, most of this has been at the state level, where legislatures all around the country have been debating comprehensive privacy proposals. As these legislative sessions wind to a close, Utah (thus far) is the only state to join California, Colorado and Virginia as one of the few jurisdictions in the country with a comprehensive privacy law. As we detail in our blog post about this topic, the Utah Consumer Privacy Act is most similar to Virginia's Consumer Data Protection Act (CDPA), both in terms of how it is structured and in its more business-friendly provisions, such as its broad exemptions for entities regulated under certain federal laws and limited enforcement provision. It's unclear whether Utah's new law will move the needle forward enough for Congress to act and pass a federal comprehensive privacy law, but we will continue to provide updates on that front as well.