U.S. Data Privacy Laws To Enter New Era In 2023

The year 2023 will go down in history as marking the beginning of a profound shift in the philosophy underlying data privacy laws in the United States.

Historically data privacy laws here have been rooted in a "harms-prevention-based" hodgepodge of privacy protections, seeking to prevent or mitigate harms in specific sectors. In contrast, under the broader "rights-based" approach exemplified by the European Union's General Data Protection Regulation (GDPR), individuals effectively own their personal information and thus presumptively have the legal right to control it, and who can use it is a matter for them to decide.

Following California's lead, four other states — Colorado, Connecticut, Utah, and Virginia — will begin enforcing new GDPR-inspired statutes in 2023. More states are sure to follow. The implications of this fundamental shift in the underlying philosophical framework regarding data privacy protection will be profound in the years and decades to