US Data Privacy Laws: A Brief Guide for Businesses

When the California Consumer Privacy Act, or CCPA was passed in 2018, it was the first of its kind data privacy legislation in the United States. As the US currently lacks a federal data privacy law, CCPA became a blueprint for several states to enact their own consumer privacy legislation. In 2021, Virginia became the second state to pass a privacy law, while more and more states have joined the list and several have an active bill in place.

To date, 12 US states have a data privacy law in place - California, Virginia, Colorado, Connecticut, Utah, Iowa, Indiana, Montana, Tennessee, Texas, Oregon and Delaware.

Here's a timeline of the US state data privacy legislation and the effective dates.

In this article, we will explore all the 5 US state privacy laws that begin enforcement in 2023.

• California Privacy Rights Act 
• Virginia Consumer Data Protection Act 
• Colorado Privacy Act 
• Connecticut Data Privacy Act 
• Utah Consumer Privacy Act

CPRA is an amendment to the California Consumer Privacy Act (CCPA), California’s landmark legislation that paved the way for other states to follow suit. The CPRA grants California residents rights over their personal information and imposes obligations on businesses that collect and process personal data.

Who does it apply to

CPRA applies to any for-profit company that processes the personal information of California residents and meets one of the following criteria:

You have annual gross revenue exceeding $25 million.

Buys, sells, or shares the personal information of 100,000 or more consumers or households

Derives at least 50% of your annual revenue from selling or sharing consumers' personal information.

The CPRA expands the rights under CCPA and provides the following rights - (1) the right to access personal data, (2) the right to correct inaccuracies, (3) the right to request to delete personal data, (4) the right to obtain a portable copy of the data, (5) the right to non-discrimination for exercising rights and (6) the right to opt out of the sale or sharing of personal data.

Non-compliance and fines

Businesses may be granted a cure period for a violation of CPRA at the discretion of the Attorney General and the California Privacy Protection Agency (CPPA). Violation of CPRA leads to a civil penalty of not more than $2,500 for each violation or $7,500 for each intentional violation. Consumers also have a private right of action, under certain circumstances.

Virginia was the second state to enact a data privacy legislation with the Virginia Consumer Data Protection Act (VCDPA). The VCDPA provides Virginia residents with certain rights over their data and imposes obligations on businesses that collect and process their information.

Who does it apply to

The CDPA applies to for-profit businesses that conduct business in Virginia or market their goods and services to Virginia residents and either:

• Controls or processes the personal data of at least 100,000 consumers in a year or
• Controls or processes the personal data of at least 25,000 consumers and derives at least 50% of its gross revenue from the sale of personal data.

Similar to California’s CPRA, the VCDPA grants consumers (1) the right to access personal information, (2) the right to correct, (3) the right to delete, (4) the right to data portability and (5) the right to opt out of data processing for purposes of targeted advertising, the sale of personal data, or profiling. A sale under VCDPA is defined more narrowly than under the CPRA to include the exchange of personal data for monetary consideration alone.

Non-compliance and fines

The VCDPA has a 30-day cure period for alleged violations. Non-compliance can result in a civil penalty of up to $7,500 for each violation. Unlike California, Virginia does not have a private right of action.

Colorado is another state that has taken steps to protect consumer data through the enactment of the Colorado Privacy Act (CPA). The CPA, which went into effect in July 2023, establishes requirements for businesses that collect and process the personal data of Colorado residents.

Who does it apply to

Colorado Privacy Act (CPA) applies to any company that conducts business in Colorado and produces products or services that intentionally target the residents of the state and that either:

• Process the personal data of more than 100,000 individuals in any calendar year or 
• Derive revenue or receive discounts on goods or services in exchange for the sale of personal data of 25,000 or more individuals. 

The CPA provides the same consumer rights as the VCDPA. However, individuals acting in the commercial or employment context, including job applicants are not covered under consumer rights.

CPA provides the following rights - (1) the right to access, (2) the right to correction, (3) the right to delete, (4) the right to data portability, and (5) the right to opt out of targeted advertising, sale and certain types of profiling. CPA also requires that beginning July 1, 2024, a business should honour universal opt-out signals as a method for consumers to exercise their opt-out rights.

Non-compliance and fines

The Colorado Privacy Act provides a 60-day cure period for alleged violations (in effect until January 1, 2025). The CPA has a higher possible penalty for violations compared to CPRA or VCDPA. Non-compliance can be subject to maximum civil penalties of up to $20,000 per violation with a total maximum penalty of $500,000. There is no private right of action.

Connecticut has joined the ranks of states with comprehensive data privacy laws with the passage of the Connecticut Privacy Act. This act, which became effective on October 1, 2023, aims to enhance data privacy protections for Connecticut residents and establish guidelines for businesses that collect and process their personal information.

Who does it apply to

The Connecticut Data Privacy Act (CTDPA) applies to entities that conduct business in Connecticut or provide goods or services targeted at Connecticut consumers who either:

• Controls or processes personal data of at least 100,000 Connecticut consumers
• Process personal data for 25,000 or more consumers and receive over 25% of annual gross revenue from selling personal data.

The consumer rights in CTDPA are consistent with the ones in Colorado - (1) the right to access, (2) the right of correction, (3) the right to delete, (4) the right to data portability, and (5) the right to opt out of targeted advertising, the sale of personal data or profiling in connection with automated decisions.

Non-compliance and fines

The CTDPA provides a 60-day cure period for alleged violations, until January 1, 2024. Non-compliance can incur civil penalties of up to $5,000 per violation with a maximum of $500,000 per incident. The CTDPA does not provide for a private right of action.

Utah has taken a proactive approach to data privacy with the passage of the Utah Consumer Privacy Act (UCPA). The UCPA, which became effective on May 5, 2022, grants Utah residents certain rights over their personal data and imposes obligations on businesses that collect and process their information.

Who does it apply to

UCPA applies to any company that conducts business in Utah and produces products or services that target the residents of the state and -

• Has an annual revenue of $25,000,000 or more and
• Satisfies one or more of the following thresholds:
• During a calendar year, has processed the personal data of 100,000 or more consumers:
• Derives 50% of the entity’s gross revenue from the sale of personal data and controls or processes the personal data of 25,000 or more consumers.

Under the UCPA, consumer rights are similar to those in Virginia and Colorado’s data privacy laws but are more restricted. For instance, the right to delete personal data is only available for personal data that the consumer has provided to the controller. UCPA also does not provide the right to opt out of profiling.

Non-compliance and fines

All alleged violations of the UCPA will be granted a 30-day cure period. Failure to comply and rectify it can lead to civil penalties of up to $7,500 per violation. The Act does not provide a private right of action.