US Privacy Legislation: Which States Are Still Likely To Enact Comprehensive Laws In 2023?
2023 has already become a landmark year for data privacy developments. On January 1 of this year, the California Privacy Rights Act and the Virginia Consumer Data Protection Act entered into force. Additionally, the Human Resources (HR) and Business-to-Business (B2B) exemptions under California law expired on January 1, which has drastically shifted businesses’ obligations in the state. Other states have also gotten in on the action, with Iowa passing a comprehensive privacy law, set to go into effect in 2025. Before that, however, the Colorado Privacy Act, the Connecticut Data Privacy Act, and the Utah Consumer Privacy Act will all enter into force before the end of this calendar year.
Although businesses have their hands full with the considerations mentioned above, 2023 may yet provide even further privacy developments. Forty state legislatures are still in session, and a number of them are considering bills that would constitute a comprehensive privacy law. Read on to learn which states are the most likely candidates to enact a comprehensive privacy law this year:
Indiana
Indiana is the most likely candidate for enacting the seventh state comprehensive privacy law in the United States. SB 5 has been passed by both the state senate and state house, but the bill has not yet been signed by Governor Eric Holcomb. However, even in the event that Governor Holcomb does veto the bill, the bill has seen veto-proof support in both Indiana legislative chambers, making the enactment of SB 5 a near-certainty.
The bill is very similar to Virginia’s Consumer Data Protection Act, and would enter into force on January 1, 2026.
Montana
Montana’s SB 384, which if enacted will be titled the “Consumer Data Privacy Act”, has seen universal support since introduced in February 2023. Through multiple readings across both legislative chambers, no Montana lawmaker has yet to vote against the advancement of the bill. The bill is very likely to be on Governor Greg Gianforte’s desk soon, with its enactment a near-certainty.
The bill most closely resembles the Virginia Consumer Data Protection Act, the Connecticut Data Privacy Act, and the Colorado Privacy Act, and may go into effect on October 1, 2024.
Tennessee
Tennessee’s companion privacy bills, HB 1181 and SB 73, are in a similar position as Montana’s SB 384. At its most recent floor vote in the house, HB 1181 passed by a vote of 90-0. Barring an unexpected development, the bill, which would constitute the Tennessee Information Protection Act, may be signed by Governor Bill Lee in the very near future.
Similar to the Indiana and Montana bills, Tennessee’s bill is similar to the Virginia Consumer Data Protection Act, the Connecticut Data Privacy Act, and the Colorado Privacy Act, but would go into effect sooner, on July 1, 2024.
Our team is experienced in helping businesses make sense of the patchwork of US privacy laws and implementing robust compliance frameworks. Reach out to McGrath North’s Privacy and Cybersecurity Team to talk through what steps your organization can take today to prepare for the future of the ever-shifting US privacy landscape.
Related Attorneys
