Check out our comprehensive 2024 State Data Privacy Law Round-Up for the latest US State laws in data privacy. While consumer data privacy laws are still relatively new, we are beginning to see evidence of enforcement in some states and far greater attention and resource expenditure internally from businesses working hard to determine which laws apply to their organizations and what steps are necessary to ensure compliance. 

On April 4, 2024, Kentucky Governor Andy Beshear (D) signed the Kentucky Consumer Data Protection Act (“KCDPA”) into law, with a slow roll to the date it takes effect on January 1, 2026. The KCDPA goes a bit easier on businesses and (1) does not impose a requirement to provide a universal opt-out mechanism, and (2) has a permanent cure provision that will afford violators ongoing opportunities to rectify alleged violations of the law. Learn more about the Kentucky Consumer Data Protection Act.

Minnesota Governor Tim Walz (D) signed into law the Minnesota Consumer Data Privacy Act, which will take effect on July 31, 2025. Learn more about the Minnesota Consumer Data Privacy Act.

Everything you need to know about the Delaware Personal Data Privacy Act as it becomes effective on January 1, 2025. Here's what impacted companies need to gear up and prepare for.

The Nebraska Data Privacy Act (or NEDPA) becomes effective on January 1, 2025.  This relatively short period between signature and effective date left little time for impacted companies to prepare; however, Nebraska’s approach to applicability criteria has cast a specifically tailored net focused on businesses selling personal data of Nebraska residents.

Iowa's consumer privacy law is taking effect soon. Learn more about the Iowa Consumer Data Protection Act or “IACDPA” which becomes effective on January 1, 2025.

Learn about the Oregon Consumer Privacy Law which took effect in July of 2024.

Read about the FTC’s business guidance blog post discussing its resolve to enforce the privacy commitments of certain AI firms known as “model-as-a-service” companies in the latest edition of AI: The Washington Report, a joint undertaking of Mintz and ML Strategies covering potential federal legislative, executive, and regulatory activities related to AI.

The California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (the “CCPA”), has been further expanded under Governor Gavin Newsom. The signing of Assembly Bills 947 and 1194 expands the protection of sensitive personal information. Read more to find out the impacts of these bills and the Delete Act.