As we enter 2025, a new wave of state-level privacy legislation is set to reshape the landscape of consumer data protection in the United States. While the California Consumer Privacy Act (CCPA) has been the focus of much attention, several other states are following suit with their own comprehensive privacy laws. Here's a brief overview of some key upcoming state privacy laws:
California Consumer Privacy Act (CCPA)
The CCPA, which went into effect on January 1, 2020, grants California residents new rights regarding their personal information. It requires businesses to disclose what information they collect, allows consumers to request deletion of their data, and gives them the right to opt-out of the sale of their personal information. This law acts as a framework for most other states. To see how RampedUp complies, please review our privacy policy.
Iowa Act Relating to Consumer Data Protection (ICDPA)
Taking effect on January 1, 2025, the ICDPA will grant Iowa consumers new rights over their personal data, including the right to access, delete, and correct their information, as well as opt out of certain data processing activities.
Kentucky Consumer Data Protection Act (KCDPA)
Scheduled to become effective on January 1, 2026, the KCDPA establishes consumer rights relating to personal data. It allows consumers to confirm data processing, correct inaccuracies, delete personal data, obtain copies of their data, and opt out of targeted advertising, data sales, or profiling.
Maryland Online Data Privacy Act (MODPA)
Set to take effect on October 1, 2025, MODPA aims to enhance consumer privacy protections in Maryland. While specific details are still being finalized, the law is expected to align with other state privacy regulations in granting consumers more control over their personal data.
Minnesota Consumer Data Privacy Act (MNCDPA)
Set to take effect on July 31, 2025, the MNCDPA will provide Minnesota residents with new rights regarding their personal data. While specific details are still being finalized, it is expected to align with other state privacy regulations in granting consumers more control over their personal information.
Nebraska Data Privacy Act (NDPA)
Taking effect on January 1, 2025, the NDPA will grant Nebraska consumers new rights over their personal data, including the right to access, delete, and correct their information, as well as opt out of certain data processing activities. The law applies to businesses that meet certain thresholds and includes provisions for consumer rights and business obligations.
New Hampshire Data Privacy Act (NHDPA)
Scheduled to become effective on January 1, 2025, the NHDPA aims to enhance consumer privacy protections in New Hampshire. While specific details are still being finalized, the law is expected to align with other state privacy regulations in granting consumers more control over their personal data.
New Jersey Data Privacy Act (NJDPA)
Set to take effect on January 15, 2025, the NJDPA will provide New Jersey residents with new rights regarding their personal data. The law is expected to include provisions for consumer rights and business obligations similar to those in other state privacy laws.
Oregon Consumer Privacy Act (OCPA)
Taking effect on July 1, 2024, the OCPA gives Oregon consumers new rights over their personal data. The law introduces the concept of "L.O.C.K.E.D." rights, which include:
- List: Consumers can request a list of specific entities that received their data from a business.
- Opt-out: Consumers can say "no" to businesses selling, profiling, or using targeted advertising with their personal information.
- Copy: Consumers can obtain a copy of the personal and sensitive data a business has about them.
- Know: Consumers can learn what information a business has collected about them.
- Edit: Consumers can correct any inaccuracies in the data about them.
- Delete: Consumers can request the deletion of personal and sensitive information businesses have about them.
Tennessee Information Protection Act (TIPA)
Set to take effect on July 1, 2025, TIPA aims to enhance consumer privacy protections in Tennessee. While specific details are still being finalized, the law is expected to align with other state privacy regulations in granting consumers more control over their personal data.
These new laws reflect a growing trend towards stronger consumer data protection at the state level. Businesses operating across multiple states will need to stay informed about the evolving regulatory landscape and adapt their data practices accordingly. As more states enact similar legislation, the call for comprehensive federal privacy law may grow louder to provide consistency and clarity for both businesses and consumers.