Staying Compliant with CCPA and Other State Data Privacy Legislation

In the absence of comprehensive federal consumer privacy legislation, companies must continue to contend with an evolving landscape of state privacy laws when managing consumer data and information. So far in 2023, we have seen significant expansions to US state privacy laws, including important changes to the California Consumer Privacy Act (including that it now applies to employees) and new consumer privacy laws in effect in Colorado, Connecticut, Virginia, and soon Utah. There has also been a flurry of new laws enacted over the last six months—to date, Indiana, Iowa, Montana, Oregon, Tennessee, and Texas have new comprehensive privacy protections that will go into effect over the next three years.

While the new laws have some notable variations from the existing laws, they also have important similarities. The state privacy laws can be grouped into three “styles”: California-style, Virginia-style, and Utah-style. Assessing the similarities and differences between these styles is vital to planning and executing a compliance strategy for companies operating in these states.

This session will provide a framework for understanding privacy compliance while highlighting key differences and recent developments across jurisdictions. In addition to understanding the contours of current privacy legislation, practitioners will be offered practical tips and considerations for developing best practices on how to create or update privacy compliance programs.