A growing number of states have comprehensive consumer privacy statutes with broadly similar structures and materially different details.
Applicability thresholds based on revenue, the number of consumers whose data is processed, or the share of revenue from selling data. Several statutes have no revenue threshold, catching smaller businesses that process at volume.
Consumer rights. Access, correction, deletion, portability, and opt-out of targeted advertising, sale, and profiling with legal or similarly significant effects. Sensitive data generally requires opt-in consent.
Notices. A privacy notice with prescribed content, and specific notices at collection.
Universal opt-out signals must be honoured in several states.
Data protection assessments for higher-risk processing, retained and producible to the attorney general.
Processor contracts with prescribed terms, flowing down to subprocessors.
Enforcement. By attorneys general in most statutes, with cure periods that are sunsetting in several. A private right of action exists in a small number and only for defined breaches.
Practical compliance. A data inventory is the prerequisite for everything else. Rights requests cannot be honoured, and assessments cannot be written, without knowing what data is held, where, and why.