State Of US Data Privacy Law Compliance

Executive Summary

In May 2017, the world of data privacy was irreparably changed when four members of the Chinese military hacked into credit-reporting company Equifax, exposing the personal information of nearly 150 million Americans. The regulatory response was swift. States amended data breach laws and introduced new ones around data security and consumer privacy. The following May, the European Union's sweeping privacy law update, the General Data Protection Regulation, took effect, sending ripples across global businesses. The next month brought the passage of the California Consumer Privacy Act (CCPA).

Fast forward to 2022, and CCPA-like consumer privacy laws have passed in four additional states (Colorado, Connecticut, Utah and Virginia). Several states are currently weighing similar comprehensive legislation to protect consumer privacy. While the measures differ in significant ways, they share key tenets, including granting consumers the right to