New State Data Privacy Laws in 2025: Corporate Counsel Compliance Guidance

Currently, there is no omnibus federal privacy law in effect in the United States--only issue- or industry-related laws such as the Gramm-Leach-Bliley Act for financial institutions, HIPAA for healthcare, and COPPA for children online. Instead, privacy laws consist of a patchwork of myriad state laws with ever-growing complexity.

In 2025, new privacy laws in Delaware, Iowa, Nebraska, New Hampshire, and New Jersey became effective in January; and in Tennessee, Minnesota, and Maryland, comprehensive privacy laws are scheduled to go into effect later this year. Indiana, Kentucky, and Rhode Island join in 2026. These privacy laws define "personal data" broadly, and there are some material differences between them as to obligations and rights. Some states' laws borrow key terms and definitions from the EU General Data Protection Regulation and others from the California regime. All give residents more control over their personal data, especially regarding third-party disclosures and use for advertising.

Effective Jan. 1, 2023, the California Privacy Rights Act (CPRA) amended and broadened the California Consumer Privacy Act passed in 2020. The CPRA is the only one of the comprehensive state privacy laws in the U.S. to date that includes a limited private right of action. The CPRA also created a new enforcement and rulemaking body, the California Privacy Protection Agency. In October 2023, California also passed the Delete Act, which allows consumers to request the deletion of their personal information from all data brokers; and in February the public comment period closed on a draft of new generation of California regulations on automated decision making/profiling/AI, risk assessments, cybersecurity audits and amendments to the existing regulations.

Given the evolving patchwork of laws and regulations, there are significant differences that every enterprise and its counsel should be aware of in the event they meet applicable jurisdictional thresholds and process personal data in those states. It is critical to have thorough knowledge of which state privacy laws apply, how to comply, and ways to avoid regulatory investigations to minimize costly claims and business disruption.

Listen as our distinguished panel of attorneys guides counsel with respect to the requirements, similarities, and differences of recent state privacy laws. The panel will also offer best practices for minimizing data privacy and protection risks and proactive measures for data handling in anticipation of future corporate compliance obligations as additional state laws, and/or a federal law, may emerge.