Privacy Laws and Compliance
As you may know, privacy laws are changing fast, and if your website isn’t keeping up, your business could be at risk. States like California, Colorado, and Virginia already have strict privacy regulations in place, and starting in 2025, even more states will be rolling out their own laws to protect consumers’ personal data. That means businesses need to ensure their websites are compliant—think transparent privacy policies, cookie management, and secure data handling. Staying ahead of these changes isn’t just about avoiding penalties; it’s about building trust with your customers. Let us help you navigate these requirements and keep your business in the clear while protecting your valuable customers!
Who must comply with these privacy laws?
Beginning in 2025, a company’s website must comply with each of the following privacy laws if the company conducts business in one of these states or produces products or services targeted to residents in that state. The following list is in alphabetical order.
California
- California Consumer Privacy Act (CCPA): Gives consumers the right to know what personal information is collected, how it's used, and to request its deletion. It also provides rights related to data sale opt-out.
- California Privacy Rights Act (CPRA): Expands the CCPA, adding more protections like restrictions on the use of sensitive personal information.
Colorado
- Colorado Privacy Act (CPA): Grants residents rights to access, correct, delete, and opt out of the sale of personal data, with specific protections for sensitive data.
Connecticut
- Connecticut Data Privacy Act (CTDPA): A comprehensive law that gives consumers similar rights as the laws in California, Virginia, and Colorado.
Delaware Personal Data Privacy Act (DPDPA)
During the preceding calendar year, company's that meet ONE of the following:
- Controlled or processed the personal data of at least 35,000 consumers, excluding personal data controlled or processed solely to complete a payment transaction
- Controlled or processed the personal data of at least 10,000 consumers and derived over 20% of gross annual revenue from the sale of personal data
Iowa Consumer Data Protection Act (ICDPA)
During a calendar year, meet ONE of the following:
- Controls or processes the personal data of at least 100,000 consumers
- Controls or processes the personal data of at least 25,000 consumers and derives over 50% of gross annual revenue from the sale of personal data
Nebraska Data Privacy Act (NDPA)
Meet BOTH of the following:
- Processes or engages in the sale of personal data
- Is not a small business as determined under the federal Small Business Act
New Hampshire Data Privacy Law (NHPA)
During a calendar year, meet ONE of the following:
- Controlled or processed the personal data of at least 35,000 consumers, excluding personal data controlled or processed solely to complete a payment transaction
- Controlled or processed the personal data of at least 10,000 consumers and derived over 25% of gross annual revenue from the sale of personal data
New Jersey Data Privacy Act (NJDPA)
During a calendar year, meet ONE of the following:
- Control or process the personal data of at least 100,000 consumers, excluding personal data controlled or processed solely to complete a payment transaction
- Control or process the personal data of at least 25,000 consumers and derives revenue, or receives a discount on the price of any goods or services, from the sale of personal data
Utah
- Utah Consumer Privacy Act (UCPA): Focuses on giving Utah residents rights to access, delete, and opt-out of the sale of their data, though it is less strict compared to California and Virginia laws.
Virginia
- Virginia Consumer Data Protection Act (VCDPA): Similar to CCPA but applies to companies meeting certain data thresholds. It provides rights to access, correct, delete, and opt-out of data collection.