The Complex Landscape of Data Privacy Legislation in the United States: A State-by-State Analysis

The United States is lagging behind much of the world when it comes to data privacy legislation, despite widespread support among Americans for such laws. The failure to pass a federal data privacy bill in 2022 has left the country scrambling to catch up, with states taking on the responsibility instead.

In 2023, eight states passed comprehensive data privacy laws, with two more—New Jersey and New Hampshire—following suit in 2024. This brings the total tally to 15 states with comprehensive privacy laws, covering over 40% of the U.S. population. These laws grant individuals the right to access and delete their personal data from companies, but they also create a complex patchwork of state privacy policies that many businesses struggle to navigate.

The business community has been vocal about the potential stifling effects of privacy regulations on innovation, leading to compromises in state legislation to appease their concerns. For example, New Hampshire’s privacy bill had aspects modified in legislative negotiations, including the length of the cure period for companies found in violation of the law.

California was the first state to pass comprehensive privacy regulation with the California Consumer Privacy Act (CCPA) in 2018, but even that bill has been amended to make it stricter on businesses. Virginia followed suit with the Virginia Consumer Data Protection Act (VCDPA), which became a model for other states but had to strip away key elements of the CCPA to pass.

While the passage of privacy bills is a step in the right direction, the numerous exemptions, lack of regulatory reach, and failure to include basic individual rights like the right to revoke consent can minimize their impact. A federal data privacy law is needed to create a common vision and shared standards for data usage online, balancing individual data rights with business responsibilities.

As states continue to lay the foundation for data privacy legislation, it is clear that a coordinated effort is necessary to ensure the protection of individual privacy and data rights in the modern digital economy. With the support of the public and a focus on meaningful data rights, the U.S. can work towards a more perfect union in data privacy protection.