From 5 to 11: Keeping up with new state data privacy laws

If multi-state businesses thought at the start of 2023 complying with a patchwork of U.S. state privacy laws was going to be a lot of work, now they must be overwhelmed.

In a few short months, the number of states sporting comprehensive privacy laws went from five to 11, plus one more in Delaware awaiting the governor’s signature.

Those states include California, Colorado, Connecticut, Indiana, Iowa, Montana, Oregon, Tennessee, Texas, Utah, and Virginia, as tracked by the International Association of Privacy Professionals. There are also states, like Florida, with more lenient privacy laws on the books.

There is such variation among the laws, including when they take effect, that coming into compliance requires significant footwork, said Roy Wyman, a member at law firm Bass, Berry & Sims focusing on security and data privacy.