The following is a compilation of existing privacy laws, as well as proposed and pending privacy legislation. These laws vary greatly from state to state – if you have any questions about any of these statutes, what is covered by them, and/or their compliance requirements and enforcement, please contact us.
This page is updated regularly, and news impacting consumer privacy will also be posted on our Privacy News page.
Date last updated: November 6, 2024
- What are the privacy laws in Alabama?
Current Privacy Laws? NONE
Bill ('HB') 216 for the Alabama Consumer Privacy Act was introduced on February 2, 2021 but failed to pass.
However, the state’s public disclosure law exempts “records related to, or having an impact upon, the security and safety of persons…the public disclosure of which could reasonably be expected to be detrimental to the public safety or welfare (Code § 36-12-40).
- What are the privacy laws in Alaska?
Current Privacy Laws? PENDING
In April of 2021, at the behest of Governor Mike Dunleavy, Alaska introduced the Consumer Data Privacy Act into both chambers of the state’s legislature. The Act is modeled after the California Consumer Privacy Act (CCPA) and provides consumers certain rights and imposes obligations on businesses that collect consumers' personal information.
The bill initially failed to progress, but was reintroduced in January of 2022. It is still under consideration.
- What are the privacy laws in Arizona?
Current Privacy Laws? YES
In Arizona it is unlawful for a person to knowingly make available on the Internet the personal information of a peace officer, justice, judge, commissioner, hearing officer, public defender, member of the commission on appellate court appointments, employee of the department of child safety or employee of adult protective services who has direct contact with families in the course of employment, or prosecutor if the dissemination of the personal information poses an imminent and serious threat to their safety, or the safety of that person's immediate family, and the threat is reasonably apparent to the person making the information available on the internet to be serious and imminent.
Applicable Statutes: ARS §§ 11-483, 11-484, 12-290, 16-153 and 28-454
- What are the privacy laws in Arkansas?
Current Privacy Laws? NONE
While the Arkansas Personal Information Protection Act requires entities that collect personal information to use reasonable security procedures and practices to protect such information, it does not provide consumers or professionals in criminal justice and law enforcement a means to have their content removed from sites that collect, share, and sell this content.
- What are the privacy laws in California?
Current Privacy Laws? YES
California added another legal arrow to its quiver of privacy laws in October 2023 after Gov. Gavin Newsom, D-Calif., signed Senate Bill 362, colloquially referred to as the Delete Act, into law. The move comes just days before the 14 Oct. deadline for Newsom to sign the bill.
The California Online Privacy Protection Act (CalOPPA) and the California Privacy Rights Act of 2020 are the most comprehensive laws of their kind passed in the US, and are the models for similar legislation enacted or under consideration in other states. The law provides for consumers to obtain and delete their own personal information, and to prevent the sale of their information. It also protects children by requiring a guardian’s permission before the sale of a child’s information can take place.
In addition, California Government Code 6254.21 and 6254.24 stipulate that no state or local agency, person, business or association shall post the home address or telephone number of any elected or appointed official on the Internet without first obtaining the written permission of that individual. These include public safety officials, specified as active or retired peace officers, attorneys employed by the Department of Justice, the State Public Defender, or a county office of the district attorney or public defender, city attorneys, specified employees of the Department of Corrections, the Department of the California Highway Patrol, federal, state, and local detention facilities, and local juvenile halls, camps, ranches, and homes.
- What are the privacy laws in Colorado?
Current Privacy Laws? YES
On July 7, 2021, Governor Jared Polis signed the Colorado Privacy Act (CPA) as a part of the State of Colorado’s Consumer Protection Act. The CPA requires that, by July 1, 2023, the Colorado Attorney General specifically adopt rules that detail the technical specifications for one or more universal opt-out mechanisms that clearly communicate a consumer’s affirmative, freely given, and unambiguous choice to opt out of the processing of personal data for purposes of targeted advertising or the sale of personal data
Other statutes address publishing of personal information on the Internet, and include home address in the definition (Colo. Rev. Stat. §18-9-313 (2.7). A “protected person” is defined as a human services worker, a public health worker, a judge, a peace officer, a prosecutor, a public defender, or a public safety worker (Colo. Rev. Stat. § 18-9-313 (1)(f)
Colorado is also the only state to pass into law protection of social workers’ personal information on the Internet. This law was later amended to add child representatives, code enforcement officers, health-care workers, an officer or agent of the state bureau of animal protection, an animal control officer, and office of the respondent parents' counsel staff members and contractors to the list of protected persons whose personal information may be withheld from the internet, if the protected person believes dissemination of such information poses an imminent and serious threat to the protected person or the safety of the protected person's immediate family.
- What are the privacy laws in Connecticut?
Current Privacy Laws? YES
Senate Bill 6, An Act Concerning Personal Data Privacy and Online Monitoring, takes effect on July 1, 2023. The Act establishes a framework for controlling and processing personal data; provides responsibilities and privacy protection standards for data controllers and processors; and grants consumers the right to access, correct, delete and obtain a copy of personal data, and opt out of the processing of personal data.
In addition, the Connecticut Freedom of Information Act exempts the residential address from disclosure for judges, magistrates, court employees, state marshals, law enforcement officers, corrections officers, attorneys, including prosecutors and public defenders, social workers employed by the Division of Public Defender Services, firefighters, and inspectors employed by the Division of Criminal Justice. Other statutes prevent the disclosure of home addresses for probation officers (Conn. Gen. Stat. § 54-108g)
- What are the privacy laws in Delaware?
Current Privacy Laws? YES
The Delaware Personal Data Privacy Act gives consumers the right to access, correct, delete, and port personal information. Delaware will also allow consumers to designate an authorized agent to act on the consumer’s behalf. Like a handful of other states, businesses will need to comply with universal online opt-out mechanisms. The law takes effect on January 1, 2025.
In addition, Attorney General opinions, other statutes and case law have identified other situations where home addresses are confidential, according to a summary of the FOI Act published by the Reporters Committee for Freedom of the Press Open Government Guide. This includes public officials (judges) (Del. Op. Att’y Gen. No. 06-ib17)
Upon receipt of a judge’s written request, government agencies and other persons, businesses, and associations are prohibited from publicly posting or displaying certain personal information of judges. Protected information includes a judge’s home address, home and mobile telephone numbers, personal email address, social security number, tax identification number, bank account numbers, credit card numbers, birth or marital records, property tax records, and the identity of any children under the age of eighteen. Delaware law further provides that publicly posting or displaying a judge’s personal information may result in criminal penalties. These protections are provided to active, formerly active, and retired state court judges, but not to federal judges. (Del Code Ann. tit. 10 §§ 1922–1923 (2022)
- What are the privacy laws in Florida?
Current Privacy Laws? YES
Florida’s Public Records Act and other privacy laws cover the home addresses, telephone numbers, social security numbers, dates of birth, and photographs of active or former sworn or civilian law enforcement personnel, Supreme Court Justices, federal and state judges, current or former state attorneys, state prosecutors, correctional probation officers, personnel of the Department of Children and Families, personnel of the Department of Health, and personnel of the Department of Revenue or local governments whose responsibilities include revenue collection and child support enforcement. It also covers the personal content of their spouses and children, as well as the names and locations of schools and day care facilities they attend.
In addition, Governor Ron DeSantis signed the Florida Digital Bill of Rights (“FDBR”) into law on June 6th. However, it is not similar to other state privacy laws, as it only applies to businesses with more than $1 billion in annual revenue.
F.S. 119.071 2.a.(I) stipulates that the home addresses, telephone numbers, social security numbers, dates of birth, and photographs of active or former sworn or civilian law enforcement personnel, as well as their spouses and children, can be protected online.
- What are the privacy laws in Georgia?
Current Privacy Laws? PENDING
The Georgia Records Act exempts home address disclosure in records for jury list data and public employees.
There is legislation under consideration allowing federal, state or local public employees to request that their residential addresses and phone numbers be removed from online property records posted by local governments.
Also, the Georgia Senate voted for legislation allowing federal, state or local public employees to request that their residential addresses and phone numbers be removed from online property records posted by local governments. That bill is now pending in the House.
- What are the privacy laws in Hawaii?
Current Privacy Laws? YES
In 2024 Hawaii officially passed a law relating to the disclosure of personal information associated with public servants, including judges, elected officials, school board officials and election officials. It prohibits persons, organizations and government agencies from making their protected personal information publicly available on the internet.
- What are the privacy laws in Idaho?
Current Privacy Laws? YES
The Statement of Purpose in Idaho’s law reads as follows: Judges, prosecutors and law enforcement officers and their families often face very real threats of harm or death, both on and off duty, in the routine order of upholding the laws of the State of Idaho. Keeping their home addresses confidential is a key element of providing safety and peace of mind to these public servants, their spouses and their children. This Legislation provides residential address and telephone number public record confidentiality for judges, prosecutors, peace officers, federal peace officers, correction officers, probation officers and parole officers living in Idaho, who voluntarily participate in the Address Confidentiality For Law Enforcement Officers Program. Officers would provide a personally coordinated mailing address that would be used for public disclosure if they elect to participate in the program.
- What are the privacy laws in Illinois?
Current Privacy Laws? YES
Illinois’s Judicial Privacy Act was passed to improve the safety and security of Illinois judicial officers by allowing them to request the removal of their personal information online. "Personal information" means a home address, home telephone number, mobile telephone number, pager number, personal email address, social security number, federal tax identification number, checking and savings account numbers, credit card numbers, marital status, and identity of children under the age of 18.
The Illinois Consumer Privacy Act states that a consumer has the right to request that a business delete any personal information about the consumer, which the business has collected from the consumer, with some exceptions. It also requires a business that collects or sells a consumer's personal information to make certain disclosures to the consumer upon receipt of a verifiable consumer request. And it provides that a consumer has the right, at any time, to opt out of the sale of his or her personal information to third parties. This bill is still being considered.
- What are the privacy laws in Indiana?
Current Privacy Laws? Yes
Indiana became the seventh U.S. state to pass a comprehensive privacy law. The Indiana . Consumer Data Protection Act, signed into law in May, follows in the footsteps of the Colorado, Connecticut and Virginia privacy laws with its rights and requirements. Indiana differentiated itself by providing covered entities with over two and a half years to come into compliance.
This act will go into effect January 1, 2026. Until then, the state’s Public Records Act lists individual exemptions to home address release for emergency management workers, public safety officers, correctional officers, probation officers, law enforcement officers and judges (Ind. Code. Ann. § 5-14-3-4(b)(23)(A)
- What are the privacy laws in Iowa?
Current Privacy Laws? YES
Iowa is the sixth state in the US to adopt a comprehensive data privacy law. The law applies to companies that (1) control or process data of at least 100,000 Iowa consumers, or (2) control or process data of at least 25,000 Iowa consumers and derive 50% of their revenue from the sale of personal data. Exceptions do exist, however. Iowa assigns specific requirements to controllers of personal data, and establishes rights for consumers, including the right to confirm if the processing of personal data will occur and access to personal data. Data subjects are also permitted the right to request that personal data be deleted, obtain a copy of personal data, and opt out of the sale of personal data.
Other state statutes provide “personal information exemptions,” though home addresses are not specified, for officials, officers, or employees of government bodies (Iowa Code § 22.7(11)(a). There is also a home address exemption for law enforcement officers and their families (Iowa Code § 80G.2(1)(a)
- What are the privacy laws in Kansas?
Current Privacy Laws? NONE
The state has no active or pending legislation concerning data privacy. However, the Kansas Open Records Act specifically exempts home address disclosure for law enforcement officers, judges, parole, probation, correctional or court services officers, and district, city, county, or US attorneys.
- What are the privacy laws in Kentucky?
Current Privacy Laws? YES
On April 4, 2024, Kentucky’s Governor signed the Kentucky Consumer Data Protection Act (the “Act”) making Kentucky the latest state to join the trend of states enacting a comprehensive privacy law. The Act will take effect on January 1, 2026 and is substantially similar to other state comprehensive privacy laws, including in particular, the Virginia Consumer Data Protection Act.
Senate Bill 267, known as the “Anti-Doxing Bill,” makes it a crime to disseminate personal identifying information with the intent to intimidate, abuse, threaten, harass, or frighten. To bring a civil claim, a Kentucky resident’s personal identifying information must be published, posted, or otherwise disclosed to a public Internet site or public forum. As defined in the law, personal identifying information includes one’s home address, birth date, telephone number, email address, school or employment locations, and financial account numbers.
- What are the privacy laws in Louisiana?
Current Privacy Laws? YES
Louisiana has re-introduced the Louisiana Consumer Privacy Act (HB 947), which provides similar protections to other state consumer privacy laws, albeit not as restrictive as those in California.
Louisiana’s Public Records Law does exempt public employees and some law enforcement officers from home address disclosure on some documents, such as voter registration records.
- What are the privacy laws in Maine?
Current Privacy Laws? YES
Maine’s Internet Privacy Law, passed in 2019, prohibits Internet service providers from using, disclosing, selling, or granting access to a customer’s personal information unless a customer gives the provider permission to do so. Maine was the first state in the US to require ISPs to get consent from customers before companies could use, disclose, or sell their data, and also protects customers who refuse to consent to the use of their data.
- What are the privacy laws in Maryland?
Current Privacy Laws? YES
The Maryland Online Data Privacy Act of 2024 defines the rights a consumer may exercise to protect the consumer’s personal data, including, among other things, the right to require the deletion of personal data provided by (or obtained about) the consumer (unless retention of the personal data is required by law) and to opt out of the processing of personal data (e.g., targeted advertising). The bill takes effect October 1, 2025.
- What are the privacy laws in Massachusetts?
Current Privacy Laws? PENDING
Three separate privacy bills are now under consideration: the Massachusetts Data Privacy Protection Act (MDPPA), the Massachusetts Information Privacy and Security Act (MIPSA), and the Internet Bill of Rights (HD 3245). We are tracking their progress.
- What are the privacy laws in Michigan?
Current Privacy Laws? PENDING
On September 27, 2022, State Senator Rosemary Bayer and fellow Senate Democrats presented Senate Bill 1182, the Michigan Personal Data Privacy Act, to the Michigan Senate. The Act would give consumers the right to opt out of the processing of personal data if the processing is for certain purposes. The legislation provides no guidance on the process to obtain consent or makes any other reference to opt in being the default for processing all personal data. The bill is still under consideration.
Currently, the Michigan Freedom of Information Act exempts the release of home address of law enforcement agents and their family members, while also providing a general exemption for “information of a personal nature, if public disclosure of the information would constitute a clearly unwarranted invasion of an individual’s privacy.”
(§ 15.243(1)(s))
- What are the privacy laws in Minnesota?
Current Privacy Laws? YES
On May 19, 2024, the Minnesota Legislature passed a comprehensive privacy bill, sending the Minnesota Consumer Data Privacy Act (MCDPA) to Governor Tim Walz’s desk for signature into law. The law, which takes effect July 31, 2025, is similar to prior state consumer privacy laws but with several twists. These differences will require additional compliance steps for companies that might have been subject to previously implemented state consumer privacy laws.
- What are the privacy laws in Mississippi?
Current Privacy Laws? PENDING
The Mississippi Consumer Data Privacy Act was introduced in January of 2022. If passed, the Act would provide consumers with certain protections and rights regarding the use and disclosure of their personal information by businesses, but is not as extensive in its requirements as similar laws in other states. This bill did not pass. We are tracking any subsequent efforts to introduce privacy legislation.
However, the state’s Public Records Act does specifically exempt home address disclosure for law enforcement and court personnel/officers (Miss. Code. Ann. § 25-61-12)
Also, the Missouri Senate recently voted for legislation that allows judges and prosecutors to request that their home addresses, phone numbers, personal email addresses, marital status, children’s identities and other information be removed from public display. The shield would apply not only to government records and websites but also to privately run sites such as online phone directories and internet search engines. That bill is now pending in the House.
- What are the privacy laws in Missouri?
Current Privacy Laws? PENDING
The Missouri Judicial Privacy Act provides restrictions on the use of a judicial officer's personal information. It states that persons, businesses, and associations shall refrain from publicly posting or displaying on the Internet publicly available content that includes a judicial officer's personal information, provided that the judicial officer has made a written request to the person, business, or association that it refrain from disclosing that information. The Missouri Senate passed this legislation by a vote of 30-1; the bill is now pending in the House.
- What are the privacy laws in Montana?
Current Privacy Laws? YES
The Montana Consumer Data Privacy Act (MCDPA) will go into effect on October 1, 2024. It is modeled after similar privacy laws regarding how it is applied to businesses within the state, and what exemptions are allowed. It provides consumers with the right to opt out of the sale of their personal data, targeted marketing and profiling. It also provides the right to access and delete said data.
The Montana Attorney General has exclusive enforcement authority, and there is an express provision disclaiming any private right of action.
This legislation joins the previously passed Governmental Internet Information Privacy Act, which mandates that Internet service providers serving consumers within the state obtain consent from said consumers prior to collecting, storing, or disclosing their personal information.
- What are the privacy laws in Nebraska?
Current Privacy Laws? YES
In 2024, the Nebraska Data Privacy Act (LB 1074) was signed into law. The Nebraska bill largely tracks the Texas Data Privacy and Security Act.
Nebraska also acted to include judges in an existing law that withholds from the public information held by the county assessor and register of deeds.
- What are the privacy laws in Nevada?
Current Privacy Laws? YES
Nevada has a provision that protects the confidentiality of home addresses of police officers. The state has also passed a consumer data privacy law that requires website owners to establish a designated request address, through which a consumer may submit a verified request directing the operator not to sell covered information collected about the consumer. This law was later amended to impose additional obligations on qualifying “data brokers” while permitting consumers to opt out of a broader range of sales of their personal information.
The Nevada Public Records Act lists more than 100 record types that are made confidential by other statutes, some of which may include home addresses for certain groups, including judges, court clerks and administrators, social workers, prosecutors and public defenders, code enforcement officers, and family members of those in these occupations. (Nev Rev. Stat. § 250.140(1) and Nev. Rev. Stat. § 293.908(1))
- What are the privacy laws in New Hampshire?
Current Privacy Laws? YES
In March of 2024, New Hampshire became the fourteenth state to enact a state consumer data privacy law. The law shall take effect January 1, 2025. As with similar bills, state consumers now have the right to opt out of the processing or sale of their personal data.
The state’s Right-To-Know Law includes a general exemption for records “whose disclosure would constitute invasion of privacy” (N.H. Rev. Stat. § 91-A:5(IV)). Court decisions on requests are rendered on a case-by-case basis.
- What are the privacy laws in New Jersey?
Current Privacy Laws? YES
On January 16, 2024, Senate Bill 332 was signed by the Governor of New Jersey, following its passage by the General Assembly and the State Senate. The bill provides for its entrance into effect 365 days following its enactment. New Jersey is thirteenth state to pass a consumer data privacy law.
The bill provides New Jersey consumers with the typical set of privacy rights found in Washington Privacy Act variants, and mirrors the Connecticut law in this regard. The bill does not provide for additional rights with respect to third parties as found in the Delaware and Oregon laws passed last year.
Home addresses in New Jersey are specifically exempted from disclosure for judges, prosecutors, and law enforcement officers. New Jersey was also the first state to adopt Daniel’s Law, which provides a means for certain public servants to request the redaction of certain personal information from public-facing State, county, and municipal websites. Similar legislation was passed at the federal level in 2022.
- What are the privacy laws in New Mexico?
Current Privacy Laws? PENDING
A privacy bill has been introduced into the New Mexico legislature by State Senator Michael Padilla (D) called the Consumer Information Privacy Act. SB 176 copies in large part the privacy protections and obligations of the California Consumer Privacy Act (CCPA). The proposed law is likely to be broader in scope than the CCPA because it has short, general definitions of the terms “business,” “consumer,” and “minor.” Although there isn’t a penalty limit for every type of violation, there is a cap set for $10,000 per intentional violation.
- What are the privacy laws in New York?
Current Privacy Laws? PENDING
Senate Bill S04367, a bill that prohibits the disclosure of personally identifiable information by an internet service provider without the express approval of the consumer was introduced into to the New York State Senate in February of 2023 and referred to the Committee on Consumer Protection.
The New York State Judicial Security Act permits judges or former judges to request that personal information about themselves or family members be removed from the internet . Such information includes home addresses, unlisted telephone numbers, cell phone numbers, email addresses, license plate numbers, identity of children under the age of 18, etc. The act would also restrict businesses and other entities in possession of such information from sharing it (L. 2024, Ch. 55, eff. July 19, 2024).
- What are the privacy laws in North Carolina?
Current Privacy Laws? YES
The North Carolina Consumer Privacy Act (NCCPA) came into effect on January 1, 2024. The NCCPA empowers North Carolina residents with control over their personal data and imposes obligations on organizations engaged in processing the personal data of North Carolina residents, positioning the state at the forefront of state-level privacy legislation in the United States.
- What are the privacy laws in North Dakota?
Current Privacy Laws? YES
The North Dakota Open Records Act prohibits the release of home addresses for Supreme Court justices, district court judges, prosecutors, judicial referees and juvenile court directors, probation officers, and employees of law enforcement agencies and correctional facilities (N.D. C.C. § 44-04-18.3).
An additional privacy bill now under consideration (HB 1524) requires opt-in consent for sale of protected consumer data, which includes location and residence details. It would also require that data brokers operating in the state register with the Secretary of State.
- What are the privacy laws in Ohio?
Current Privacy Laws? YES
The Ohio Public Records Act exempts those in specific professions from home address disclosure, including judges, prosecuting attorneys, law enforcement officers, and mental health providers (Ohio R.C. § 149.43(7))
The state has also introduced a comprehensive consumer privacy bill, the Ohio Personal Privacy Act (OPPA) that outlines multiple consumer rights, including rights for access and deletion, as well as an opt-out right for the sale of personal data. A business that sells personal data must provide a “clear and conspicuous notice” to enable the consumer to opt out of the sale of the consumer's personal data.
- What are the privacy laws in Oklahoma?
Current Privacy Laws? YES
The Judicial Security and Privacy Act (HB 2794) allows state judges to ask for personal information such as their home address, personal email address, telephone number, date of birth, and Social Security number to be removed online.
- What are the privacy laws in Oregon?
Current Privacy Laws? YES
The Oregon Consumer Privacy Act will take effect on July 1, 2024. The law is mostly similar to those passed in Connecticut and Colorado with some notable distinctions. Perhaps the most significant distinction is that Oregon residents will be able to obtain, at the controller’s option, “a list of specific third parties, other than natural persons, to which the controller has disclosed: (i) The consumer’s personal data; or (ii) Any personal data.” No other law requires the identification of specific third parties as opposed to categories of third parties. Oregon also will require controllers to recognize universal opt-out mechanisms as of January 1, 2026.
- What are the privacy laws in Pennsylvania?
Current Privacy Laws? YES
The Pennsylvania Right-To-Know Law specifically excludes home address release for judges and law enforcement officers (65 Pa. Stat. Ann. § 67.708 (b)(6)(i)(C)).
The Pennsylvania Consumer Data Privacy Act (PCDPA) is currently a bill moving through the House of Representatives in Pennsylvania. It would provide the same protections as similar bills passed in other states.
- What are the privacy laws in Rhode Island?
Current Privacy Laws? YES
Rhode Island became the 20th US State to pass a privacy law, with the passage of the Data Transparency and Privacy Protection Act (RIDTPPA), which enters into effect on January 1, 2026. It is similar to other US privacy laws that introduce obligations for controllers and processor obligations governing the processing of personal data, and establishes consumer data rights.
- What are the privacy laws in South Carolina?
Current Privacy Laws? NO
A consumer data privacy bill was introduced into the state’s legislature this year. We will track its progress.
- What are the privacy laws in South Dakota?
Current Privacy Laws? NONE
No privacy legislation is currently pending.
- What are the privacy laws in Tennessee?
Current Privacy Laws? YES
Currently, state law addresses home address exemptions on a case-by-case basis. Exceptions have been made for public employees and law enforcement personnel (T.C.A. § 10-7-504)
The Tennessee Information Protection Act (TIPA) will go into effect on January 1, 2025. It is modeled after similar privacy laws regarding how it is applied to businesses within the state, and what exemptions are allowed. It provides consumers with the right to opt out of the sale of their personal information, targeted marketing and profiling. It also provides the right to access and delete said data.
The Tennessee Attorney General has exclusive enforcement authority, and there is an express provision disclaiming any private right of action.
- What are the privacy laws in Texas?
Current Privacy Laws? YES
The Texas Data Privacy and Security Act (TDPSA) allows consumers to access, correct, delete, and opt out of the sale of their personal data. It takes effect on March 1, 2024.
Additionally, Texas law exempts many individuals from home address disclosure, including federal and state judges, law enforcement officers and corrections officers, employees of the office of the Attorney General, government employees, peace officers, juvenile probation officers, and child protective services caseworkers (Tex. Code. § 552-1175)
- What are the privacy laws in Utah?
Current Privacy Laws? YES
Utah’s Consumer Privacy Act provides consumers the right to know what personal data a business collects, how the business uses the personal data, and whether the business sells the personal data. It also provides that consumers may access and delete personal data maintained by businesses and opt out of the collection and use of personal data. It also requires specified businesses to safeguard personal data, provide clear information about how consumers’ personal data are used, and accept and comply with consumer requests to access, delete or stop selling personal data.
In addition, a personal privacy exemption in Utah’s Government Records Access and Management Act has been interpreted by courts to cover “at-risk government employees,” which include judges, law enforcement officials, peace officers, prosecutors, and state and local government employees, as well as the families off all those listed above (Utah Code Ann. § 63G-2-303(2))
- What are the privacy laws in Vermont?
Current Privacy Laws? PENDING
The Vermont legislature passed the Vermont Data Privacy Act (VDPA). If signed by Governor Phil Scott, it will take effect on July 1, 2025, making Vermont the 18th state to establish consumer privacy rights similar to the California Consumer Privacy Act (CCPA).
- What are the privacy laws in Virginia?
Current Privacy Laws? YES
The Virginia Consumer Data Protection Act grants consumer rights to access, correct, delete, obtain a copy of personal data, and to opt out of the processing of personal data for the purposes of targeted advertising. The law provides that the Attorney General has exclusive authority to enforce violations of the law, and a Consumer Privacy Fund has been created to support this effort.
In addition, Governor Glenn Youngkin signed a bill in May of 2023 making it a Class 6 felony to publish the identification and personal information of a federal or state justice, judge, or magistrate with the intent to harass or intimidate. The measure further prohibits the state from publishing this information online if, for any reason, the judge, justice or magistrate has requested in writing to have personal information withheld.
- What are the privacy laws in Washington?
Current Privacy Laws? NONE
The Washington Privacy Act, championed by State Senator Reuven Carlyle, is a privacy protection law that would grant consumers various rights regarding their personal data, including the right to access, portability, correction, deletion, and to restrict or object to the processing of their data in certain circumstances. During the 2022 legislative session, the Act did not move nor did its companion bill SB 5813, which sought to regulate children’s data and data brokers. It remains to be seen whether lawmakers will again move forward with privacy legislation in 2023, or if the momentum to move forward will fade after Carlyle’s retirement this year.
The state’s Public Records Act provides home address disclosure exemptions for public employees and health care professionals (Wash. Rev. Code. Ann. § 42.56.250(4) and § 42.56.350(2)).
- What are the privacy laws in West Virginia?
Current Privacy Laws? YES
West Virginia’s Consumer Data Protection Act (HB 5698), now under consideration, contains very similar language and requirements to Virginia’s Consumer Data Protection Act,
However, West Virginia law already prohibits the disclosure of a home address or home or personal telephone number of a judge by a state or local government agency “unless written permission is first obtained.” Protected information cannot be disclosed unless the judge opts out of the applicable protections in writing. When a West Virginia judge requests the removal of protected information, it must be taken down within twenty-four hours or risk a misdemeanor charge. In addition to covering both federal and state judges, and their immediate family members, West Virginia also protects prosecutors, public defenders, law enforcement officers, and these groups’ immediate family members.
Applicable Statutes:
W. Va. Code § 5A-8-24(d)–(e) (2021)
W. Va. Code § 5A-8-24(h)(3).
W. Va. Code § 5A-8-24(d).
- What are the privacy laws in Wisconsin?
Current Privacy Laws? PENDING
In November 2023 the Wisconsin State Assembly passed Assembly Bill 466, otherwise known as the Wisconsin Data Privacy Act (WDPA). The bill passed on its third reading and was immediately ordered to the Wisconsin State Senate. If passed by the senate and signed by the governor, the WDPA will become effective on January 1, 2025. As written, the WDPA closely mirrors other comprehensive state consumer privacy laws including Virginia, Colorado, and Connecticut, all of which are currently in effect.
Currently, the state’s Public Records Act exempts public employees and individuals holding local or state public office from home address disclosure. (Wis. Stat. § 19.36 (10)(a) and (11)
Wisconsin Act 235 creates an exception under the public records law for certifications of residence for judicial candidates and a judicial officer’s “personal information.” It also provides privacy protections for judicial officers by creating an exception that the nomination papers for candidates for judicial office include the candidate’s residential address.
- What are the privacy laws in Wyoming?
Current Privacy Laws? NONE
The Wyoming Data Privacy Act was drafted in 2023 and will be taken up by the state’s legislature in 2024.