Advertising Law Blog

Following the lead of California, which passed the first comprehensive privacy legislation in the United States in 2018, many states have now enacted their own laws governing the collection and use of personal data. In addition to California, a comprehensive privacy law is effective in the following states as of 2024: Colorado, Connecticut, Montana, Oregon, Texas, Utah, and Virginia. New laws go into effect in 2025 in Delaware, Iowa, Maryland, Minnesota, Nebraska, New Hampshire, New Jersey, and Tennessee. Indiana, Kentucky, and Rhode Island have also passed comprehensive privacy laws that go into effect in 2026. There are active bills in the legislatures of Michigan, Ohio, and Pennsylvania. The laws apply to businesses that collect personal information from consumers in those states regardless of where the business is located.

While there are some differences in each of the laws, they all require businesses to take certain actions when collecting and using personal information and also require that businesses are transparent with their consumers regarding how the information is used. All of the laws also provide consumers with various rights which businesses must honor, such as: the right to opt-out of targeted and cross-contextual advertising, the right to have information corrected or deleted, the right to know how information is collected and with whom it is shared, and the right to limit the use of sensitive personal data. Some of the laws restrict the use of personal information for consumer profiling and also require businesses to conduct privacy impact studies before collecting and using certain types of information.