The Bare Minimum And More: Complying With The Contracting Requirements Under U.S. Privacy Laws

Part 1 of How to Approach DPAs in view of Final CCPA Regs: A Series

This is the first in our series of blog posts on top considerations for approaching data processing terms required under the state privacy laws that have, or will, come into effect this year, namely the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CPRA") (collectively the "CCPA"), the Colorado Privacy Act ("CPA"), the Virginia Consumer Data Protection Act ("VCDPA"), the Utah Consumer Privacy Act ("UCPA"), and Connecticut's Act Concerning Personal Data Privacy and Online Monitoring ("CTPA"), which we collectively refer to throughout as "U.S. Privacy Laws." This post will focus on the statutory and regulatory requirements on provisions that must be in contracts with data recipients (notably, we use "recipient" for ease of reference, although recipients may, in fact, collect directly from a consumer). For a handy list and chart summarizing the required