States Propose Bills With CCPA-Like Provisions

The U.S. data privacy landscape continues to evolve. Last year, the California Consumer Privacy Act ("CCPA") passed following the EU General Data Protection Regulation ("GDPR"). Nine additional states have since introduced bills modeled at least in part on the CCPA and would require companies to provide notice of the types of personal information they collect and the third parties to whom they disclose it. The bills also grant individuals the right to access or opt-out of the sale of their personal information. Six bills also permit individuals to request deletion of their information. Several other bills propose a private right of action for certain violations. Washington proposes requirements that mirror the GDPR, such as defined roles for controllers and processors and the right to correct information.