Updated Privacy Laws Now in Effect

A spate of state laws come into effect in 2023 and, for some, the effective date is already upon us. The California Privacy Rights Act (CPRA), which amends the California Consumer Privacy Act (CCPA), and the Virginia Consumer Data Protection Act (VCDPA) both went into affect on January 1, 2023. The VCDPA is also now enforceable, while the CPRA enforcement date is July 1, 2023.

These are not the only state privacy laws that companies and individuals should be watching – the Colorado Privacy Act (CPA) and Connecticut SB6 (CTPA) both will be effective and enforceable starting on July 1, 2023 and the Utah Consumer Privacy Act (UCPA) makes it under the wire this year as well, with an effective and enforcement date of December 31, 2023.

While several of the laws share similarities, terms and requirements are sufficiently distinct that they will require separate compliance review and strategies. For example, while all grant data subjects rights to access, deletion, and data portability regarding their data, some provide additional rights, such as the right to correct inaccurate data or opt-out of data sales. The regulations also have different requirements when it comes to Privacy Policy content, notice at collection of data, options that must be available regarding sensitive categories of data, privacy and security impact assessments, and more.

EPIC frequently comments on and contributes to discussion of proposed state and federal privacy laws, including recent comments to the California Privacy Protection Agency and regarding the Colorado Privacy Act rulemaking.