2025 US State privacy laws - What to know

**Alysa:** So five states going live with privacy laws, January, actually, and I just wanted to do a quick round on those. So firstly, Delaware — it looks like it's a little broader. It includes nonprofits, includes education. Is it most companies? **Colleen:** It does. Colorado, of course, already includes nonprofits, but I think as you get more states that add to some of those unique factors, we do see a trend in it. Overall, I think it heightens awareness there. **Alysa:** Delaware also on under-18s. So what is a child and the fact that you need an opt in, for example, when you're doing targeted advertising to children? If children are under-18 as opposed to under-16 or under-13, the COPPA standard, and you think about your website's demographic, that may actually trigger some additional material requirements on when do you collect opt in and who's your audience. So I think Delaware, and we have some of the other states on the list coming online in 2025, but I think it starts really teeing up that age appropriate design code act type questions for a lot more companies. **Colleen:** Gotcha. Thanks. And then Iowa next. Pretty narrow, would you say? **Alysa:** I think about this as the under the over because most of the companies that I talk with, what they're really interested in is, do I need to change — do I need to add more things to my privacy portal? Do I need to add more things to my privacy policy or how I handle data subject access requests? If Iowa doesn't provide for certain rights, like the right to correction, so maybe residents of that state may or may not just get the benefit of that right anyway. But if you have scenarios where states add a new right that the others have not yet done, you both need to notify consumers about that right in your privacy policy, but also on that privacy rights portal that you have. And so on that front, the other one — Minnesota — comes online next summer and has that right to request a list of third parties, which Oregon already has that right in place. And I will just flag Oregon is enforcing that issue, and they said they would do it and they are doing it. So maybe just a little housekeeping. Take a look at your DSAR portal. Does it talk about the right to request a list of third parties? And if not, maybe this would be a good time to — as you're making these other updates — to make some of these updates as well for existing laws. **Colleen:** Gotcha. What we're seeing globally with rights especially is once you have it for one state, that full set, you're doing it across the country. You're not trying to have a separate portal for Iowa that doesn't have a correction. Right? As an example. But Oregon and Minnesota are a little more tricky, right, because they're add-ons. **Alysa:** They're add-ons, and it means putting together that list. A lot of companies have confusion of who goes on the list. The law in Oregon was written a little — you have to really parse the language, and it's a list of third parties. So if you think about your California, your sales, your shares, who's the recipient of those lists — that's your third parties. And having a list of that that you would maintain and refresh and update and provide if consumers ask for it in Oregon and then soon in Minnesota. I will say that is one — just because there's some sensitive, one might argue even slightly proprietary information there. That may be an area where companies don't necessarily give that out across the country. And I think we talked about this on another huddle — it's not which third party vendors have you shared a particular individual's data with. It's here's who we share with generally. And it's not your service providers. So it's those to whom you are, quote, unquote, selling or sharing. So it is your digital advertising tech stack. So think about it that way. But let's just say put your hat on as — yes, you're a consumer but you also have competitors, and you do privacy rights requests, and you happen to be an Oregonian resident. I think it's a good way to see — to the extent that you couldn't already tell from like a cookie scan — who are their third party partners, particularly including via API. So I can see the consumer rights perspective, but I can also see the competitive intelligence angle as well. **Colleen:** Oh, yeah. Nebraska next. There's no minimum. Right? There's no minimum number of Nebraska residents that you hit. **Alysa:** Right. So you're small businesses in Nebraska — you're gonna be thinking about this anyway. I will just say from my experience with a lot of startups, yes, they're paying attention to the minimums, but as you prepare a company, it's usually easier to build your privacy house in order from the beginning than try to retrofit it later on. So I think the minimums, yes, they matter. But at the end of the day, they're probably things you need to be thinking about already, just for evaluation. **Colleen:** Especially if you're growing. Right? Of course. Yeah. Especially if you're growing. Next was New Hampshire. I didn't see anything there that's interesting except for that it's one of the GPC — Global Privacy Control — states. Yeah. **Alysa:** Right. And so maybe we might talk about that. There weren't that many states to date that had this affirmative requirement to honor Global Privacy Control signals. We now have a good extra handful of states that come online next year that also have this requirement, New Hampshire being one of them. But there are still companies who don't have GPC enabled yet, and so it's another reminder that this is already a requirement in some states and now more states. So housekeeping — if you don't have it yet in place, it's a good time to ask and make those changes. **Colleen:** Gotcha. Well, that's all January first. But New Jersey, a little more civilized. They've given us till January fifteenth in case you're, like, leaving it till the last minute. You don't have to do it over New Year's. But what's interesting — they're really short processing period for opt outs. Right? It's fifteen days rather than thirty and forty fives we've been seeing. **Alysa:** It's short, but I'm gonna go back to being a very practical matter. Think about California. Yes. You had some time to do it, but you had to account for all the sales that happened during the interim period. So I think particularly in the web space, you wanted to be able to honor opt outs as soon as you can anyway. So, yes, companies really are trying to make that happen and occur as quickly as possible. The other thing I might flag for New Jersey is — as I think about different states that on the consumer protection front tend to be fairly active on enforcement — New Jersey is one of those I would put in that category. They also have rulemaking. So to date, we have California and we have Colorado who have been doing rulemaking, which meant that the requirements and the details of those requirements continue to expand and something that your program had to really grow with. And now New Jersey will be added to that list. **Colleen:** So and, actually, does this put pressure on New York to come up with something? Because, I mean, New Jersey, basically, at some point now, it's a proxy New York law. Right? I mean, you got New Jersey. You got Connecticut. You got two of the tri states. **Alysa:** There's a little bit of bragging rights in the northeast. You know, you've got Connecticut. You've got Virginia and Maryland. Yeah. I would say there's bragging, peer pressure rights for New York to get something online — not out of the question. **Colleen:** So they're the January states. What else is going on for the rest of the year that we should keep an eye on? **Alysa:** Well, Maryland, I think, is a really important one because we've been talking about Maryland for quite some time. They've got that affirmative data minimization. They've got some outright bans on sales of information. So we saw, for example, with Washington, My Health My Data, that really stopped companies from doing digital advertising in the state. And New Jersey is a really important state. It's really populous. You've got people coming in and out of New Jersey in terms of just regular work and daily patterns. How does industry react to Maryland's requirements? How do they get interpreted and applied with sensitive data, which is, again, a pretty broad category that keeps getting broader with all of these laws? So I think it is a state just to see if anything more of the reaction as some of the requirements come online. **Colleen:** Gotcha. Well, Lisa, thanks for keeping us up to date. Never a dull moment in this space. **Alysa:** Absolutely. Good to see you.