Strategies For Developing A Multistate Privacy Compliance Program

This practice note provides chief privacy officers and other privacy professionals guidance on how to build a privacy program that complies with evolving state privacy law obligations. While no two privacy laws are necessarily the same, the laws currently passed at the state level-as well as pending proposals-share key principles. This chapter will identify those principles in the existing state privacy laws and will give privacy professionals a framework for building a forward-looking program that is designed to withstand changes in the U.S. privacy landscape.

Privacy compliance obligations are rapidly evolving in the United States, particularly at the state level. California started the trend of comprehensive state privacy laws in the U.S., and has since been joined by Virginia, Colorado, Utah, and Connecticut, with more states likely to follow in the absence of a federal law. States are also actively regulating categories of information they view to be especially