Get Ready for 2025- More State Privacy Laws

This could all change depending on the outcome of today’s election, but, here is what is currently scheduled to happen in the realm of state privacy laws.

I say this could all change because the new administration could figure out a way to cancel all of these state privacy laws – say by passing a national privacy law that says you have no right to privacy and any state laws to the contrary are null and void. That is probably a bit pessimistic, but who knows. Anyway, here is what is on the books.

As of January 1, 2025:

The Delaware Personal Data Privacy Act goes into effect. It seems in line with most states and applies to companies that process data of at least 35,000 Delaware residents. It requires a data protection assessment for certain high risk activities. Enforcement is by the Delaware DoJ.

The Iowa Data Protection Act gives residents limited rights in their data compared to other states. The threshold is for companies that control or process data on at least 100,000 Iowa residents. Enforcement is only by the Iowa AG.

The Nebraska Data Privacy Act provides middle of the road consumer rights to their data and applies to companies that process data on at least 50,000 Nebraskans. It also requires a data protection assessment for high risk activities and only the Nebraska AG can enforce it.

The New Hampshire Data Privacy Act provides stronger consumer rights in their data and applies to companies that process data of at least 50,000 residents. It to requires a data protection assessment for high risk activities and only the AG can enforce it.

On January 15th the New Jersey Data Privacy Act goes into effect. It has a strong set of consumer rights, requires consent to process sensitive data, applies to businesses that process data of at least 25,000 residents and requires some companies to appoint a data protection officer. Enforcement is by the AG.

Moving on to July, on July 1, 2025 the Tennessee Information Protection Act goes into effect. It provides middle of the road rights in data, requires consent before processing sensitive data and applies to companies who process the data of more than 175,000 residents (which likely is very few companies). It, too, is only enforced by the AG.

On July 31, 2025, the Minnesota Consumer Data Privacy Act goes into effect. It has a more robust set of consumer data rights and requires consent to process sensitive data. It applies to companies that process data of more than 100,000 residents and enforcement is only by the AG.

And last for 2025, the Maryland Online Data Privacy Act goes into effect on October 1, 2025. It provides an average set of consumer rights, requires consent to process sensitive data and applies to companies that process data of more than 100,000 residents. It provides additional protections for minors and the AG is the only one who can enforce it.

As you can see, the variability is what drives businesses to want one single national law. Lobbying would likely water down any such law to effectively provide almost no rights to the average consumer. Even with these laws above, with thresholds in the range of 25,000 to 100,000 residents in that state, these laws would only apply to the biggest companies.

One more thought. Since only the state DoJ or AG can enforce these laws and since most states have limited resources, even if a company breaks the law, maybe the AG will come after them, maybe not. Texas seems to an exception here as they are making it a bit of a priority.

That is not a coincidence. These laws are targeted at the Facebooks of the world. For the average business, that is a good thing because unless you are in a regulated industry such as finance, none of these laws apply to you. As a consumer in one of these states, none of these laws apply to you either, except in dealings with the Facebooks of the world. But, since they have an army of lawyers, they have pretty well figured out how to finesse these laws.

So this is a bit of good news and bad news. As a small or medium size business owner you can pretty much ignore these laws with some caveats. As a consumer, you can also pretty much ignore these laws because they don’t apply to most of the companies that you do business with. You can decide which of these is good news and which is bad news. Credit: Truyo

by