# Regulatory Standards — US State Privacy Law Tracker

## Enacted Comprehensive State Privacy Laws

### California Consumer Privacy Act / California Privacy Rights Act
- **Cal. Civ. Code 1798.100-1798.199.100** (CCPA as amended by CPRA)
- CPRA approved by voters as Proposition 24, November 2020
- California Privacy Protection Agency (CPPA) Final Regulations, 16 CCR Division 27
- CPPA Enforcement Advisory 2024-01: Opt-out preference signals

### Virginia Consumer Data Protection Act
- **Va. Code Ann. 59.1-575 through 59.1-585** (VCDPA)
- Effective 1 January 2023; AG sole enforcement authority
- No implementing regulations — statute is self-executing

### Colorado Privacy Act
- **C.R.S. 6-1-1301 through 6-1-1313** (CPA)
- Colorado AG Final Rules, 4 CCR 904-3, effective 1 July 2023
- Universal opt-out mechanism rules effective 1 July 2024

### Connecticut Data Privacy Act
- **Conn. Gen. Stat. 42-515 through 42-525** (CTDPA)
- Amended by SB 3 (2023) adding protections for children and teens
- Universal opt-out mechanism required from 1 January 2025

### Utah Consumer Privacy Act
- **Utah Code Ann. 13-61-101 through 13-61-404** (UCPA)
- Most business-friendly state privacy law — opt-out model only
- No private right of action; AG enforcement only

### Texas Data Privacy and Security Act
- **Tex. Bus. & Com. Code Chapter 541** (TDPSA)
- No revenue threshold — applies to entities conducting business in Texas
- Small business exception for entities meeting SBA size standards
- No cure period — AG may request cure at discretion

### Oregon Consumer Privacy Act
- **ORS 757A.005 through 757A.100** (OCPA)
- Notably includes non-profit organisations (unlike most state laws)
- Employee and job applicant data excluded until 1 January 2026

### New Jersey Data Privacy Act
- **N.J.S.A. 56:12C-1 through 56:12C-20** (NJDPA)
- No cure period; relatively low applicability threshold
- Financial incentive disclosure requirements

### Maryland Online Data Privacy Act
- **Md. Code Ann., Com. Law 14-4801 through 14-4824** (MODPA)
- Strongest data minimisation requirements among state laws
- Prohibits sale of sensitive data; strict purpose limitation

## Federal Reference Points

### American Data Privacy and Protection Act (ADPPA)
- H.R. 8152, 117th Congress (2022) — passed House Energy and Commerce Committee but not enacted
- Represented the closest Congress has come to comprehensive federal privacy legislation
- Key sticking point: federal preemption of state laws, particularly California
- Remains a reference point for federal legislative efforts

### Children's Online Privacy Protection Act (COPPA)
- **15 U.S.C. 6501-6506** — federal baseline for children's data (under 13)
- FTC COPPA Rule: 16 CFR Part 312
- State laws increasingly extending protections to teens (13-17) beyond COPPA's scope

### FTC Section 5 Authority
- **15 U.S.C. 45(a)** — prohibition on unfair or deceptive acts or practices
- FTC uses Section 5 as a de facto federal privacy enforcement tool
- Health Breach Notification Rule: 16 CFR Part 318

## Industry and Advocacy Resources

### National Conference of State Legislatures (NCSL)
- Maintains comprehensive database of privacy legislation across all 50 states
- Publishes annual summary of enacted and pending privacy bills
- Tracks legislative session dates and committee assignments

### International Association of Privacy Professionals (IAPP)
- US State Privacy Legislation Tracker — comprehensive comparison matrix
- Published analysis of each enacted law with side-by-side provisions
- State law implementation guides and practice resources

### Future of Privacy Forum (FPF)
- State privacy law comparison charts updated regularly
- Analysis of emerging trends (children's privacy, health data, AI governance)
- Stakeholder comment letters on state regulatory proceedings