In the absence of a federal data privacy law and despite multiple state privacy regulations, the multibillion-dollar data broker industry is collecting and selling extensive personal data on Americans, including physical and mental health information on the elderly, veterans and kids.
Rep. Morgan Griffith, R-Virginia,Ìýchair of the House Energy and Commerce Subcommittee on Oversight and Investigations, speaks Feb. 8 during a hearing on Capitol Hill in Washington.
“A staggering amount of information is collected on Americans every day, frequently without their knowledge or consent,� Rep. Morgan Griffith, R-Virginia, chair of the House Energy and Commerce Subcommittee on Oversight and Investigations, said at a recent hearing. “This data then gets shared, analyzed, combined with other data sets, bought and sold.�
How data privacy laws vary by state
How data privacy laws vary by state
Updated
Consumer privacy feels more vital than ever, but very few states have laws on the books that protect consumer privacy in a relatable way. Following the 2018 passage of the California Consumer Privacy Act, other states rushed to draft their own versions of this wide-ranging consumer protection law. The singular goal of almost all these pieces of legislation is to increase consumer awareness and empowerment in the face of data collection and sales.
Referencing data from the International Association of Privacy Professionals () and the National Conference for State Legislatures (), compiled laws and bills relating to data privacy across the United States. Bills that failed or were delayed indefinitely are not included in this list. The bills are quite similar but have some small variations and differences, from their scope to whom is exempt—such as organizations that handle medical data subject to HIPAA and those who report credit information for financial institutions.
If your state is among those on this list, take heart that you may soon be protected from the unwitting sale of your data to third parties you’re unaware of. Many of these bills have experienced bipartisan support because of the evergreen popularity of the American ideal of privacy, along with rights like the Bill of Rights' first and fifth amendments.
Keep reading to discover if your state is among those considering this legislation.
California
Updated
- SB 1121: California Consumer Privacy Act of 2018
- Proposition 24: California Privacy Rights Act of 2020
- Status: Signed
The enacts several important privacy goalposts, including limiting companies in how much data they can gather and save about website visitors. If a company violates children’s privacy, in particular, that business can be fined. The law further created a new agency to oversee privacy.
There is one catch: The law’s language specifies only companies that buy or sell 100,000 households� worth of data each year must comply.
Colorado
Updated
- SB 190
- Status: Signed
Colorado’s 2021 law is similar to California’s, including its protections on consumer data as well as the ability to delete your data from company records. But goes a step further, allowing consumers to change the data that companies keep. It also allows consumers to request copies of their saved data.
The law further dictates that companies aren’t able to “profile� consumers. This is, for example, how Twitter forms a marketable “guess� about facts like a person's age, interests, health, income, and more based on their online activity.
Maine
Updated
- LD 946: An Act To Protect the Privacy of Online Customer Information
- Status: Signed
Like the similar laws of California and Colorado, focuses on allowing consumers to make informed decisions about how companies use their data. The law, which was approved unanimously by Maine’s Senate, very specifically applies to internet service providers (ISPs) barring them from keeping or selling data related to consumer information. The law also prohibits ISPs from incentivizing customers to offer their data for sale, effectively restricting discounts or other savings in exchange for giving over data rights.
Massachusetts
Updated
- SD 1726: Massachusetts Information Privacy Act
- Status: In committee
²Ñ²¹²õ²õ²¹³¦³ó³Ü²õ±ð³Ù³Ù²õâ€� filed in March 2021, goes a step further than most of the similar legislation in the works. The law extends privacy into the workplace, preventing employers from recording or monitoring employee data, except when it makes sense to do for reasons like safety. It further bars employers from monitoring employees outside of work.
Some state privacy laws make exemptions for institutions that monitor and report consumer credit, but ²Ñ²¹²õ²õ²¹³¦³ó³Ü²õ±ð³Ù³Ù²õâ€� law doesn’t make those exceptions. This could present some thorny situations for those in the credit business.
Minnesota
Updated
- HF 1492: Minnesota Consumer Data Privacy Act
- Status: In committee
²Ñ¾±²Ô²Ô±ð²õ´Ç³Ù²¹â€™s , introduced in February 2021, includes many of the same provisions seen in those of other states. The law applies to specific companies, though, which could create a loophole-like situation for many other businesses. For the law to apply, companies must handle the data of at least 100,000 consumers each year. They also must earn at least 25% of their overall revenue from the sale or use of data. As in Maine, consumers will be able to request and correct their information in addition to deleting it.
Nevada
Updated
- SB 220
- Status: Signed
Where some states are reaching further into people’s lives in order to extend privacy rights, Nevada’s , signed into law in 2019, is a bit more reserved. Consumers may request the removal of their information from company data, and companies must comply within 60 days. There’s a wrinkle, though: The companies must have actual plans to sell that data in order to be subject to the law. This could lead to workarounds or loopholes where companies do things like “trade� rather than sell data.
New York
Updated
- A 680: New York Privacy Act
- S 6701: New York Privacy Act
- A 6042: Digital Fairness Act
- SB 567
- Status: In committee
New York’s , still in committee, would allow consumers to see what data companies have saved about them. Companies would be required to inform consumers of these rights so they can opt out if they wish, and would be barred from retaliating against customers who choose to opt out of data collection. A 680 would additionally require express written permission from customers before data can be sold. That’s true even for those who don’t opt out of the collection of data in the first place.
North Carolina
Updated
- SB 569: Consumer Privacy Act
- Status: In committee
North Carolina’s seeks to expand on the state’s existing body of law protecting consumers from data and identity theft. With the new legislation, consumers will be able to know who is holding their data—and it will be possible to correct or delete data companies keep. Consumers will additionally be able to totally opt out of data gathering for applicable companies and have the right to bring civil lawsuits against companies that don’t comply with the law.
Ohio
Updated
- SB 376: Ohio Personal Privacy Act
- Status: Introduced
°¿³ó¾±´Ç’s , introduced in July 2021, affords consumers the opportunity to access and even request deletion of their personal data from applicable companies. They may also opt out of the sale of their data altogether. However, there are many exemptions and exceptions in this law. For example, business-to-business (B2B) transactions are not subject to the law—ironic since this is where many data sales take place.
Pennsylvania
Updated
- HB 1126
- Status: In committee
Under Pennsylvania’s proposed consumer privacy law, consumers would be given certain rights as far as disclosure and approval of what happens to their data. The law also makes the state attorney general responsible for enforcing the law, meaning consumers would be able to sue in civil court and potentially cause companies to be fined for violating the law. The typically leads to a huge increase in lawsuits that could start immediately upon the bill’s adoption.
Virginia
Updated
- SB 1392: Consumer Data Protection Act
- Status: Signed
³Õ¾±°ù²µ¾±²Ô¾±²¹â€™s , passed unanimously by the state senate in February 2021, follows the passage of California’s similar law and hopes to enact many of the same ideas for Virginia. The legislation allows consumers to confirm their data is being held and potentially sold. They will also be able to correct that data, which must be available to them in a portable format that can be carried and passed on to another provider readily. Think of this like closing your bank account: You leave the bank with your money, ready to carry to a different bank.
Ìý
This story originally appeared on Ìýand was produced and distributed in partnership with Stacker Studio.
