Virginia and Colorado made headlines in 2021 for passing comprehensive privacy legislation, not long after California passed similar legislation. Utah just joined their ranks after Gov. Spencer Cox (R) signed the Utah Consumer Privacy Act into law on March 24, 2022.
As business leaders prepare to bring their operations into compliance with new privacy statutes, they must certainly familiarize themselves with the frameworks in California, Virginia, Colorado and Utah. Understanding the statutory similarities and differences in these states will be critical to an effective compliance program.
But businesses should also evaluate their exposure in other states — and not just in those states actively considering privacy legislation. State attorneys general can, and will in appropriate circumstances, invoke existing consumer protection laws to safeguard consumers’ privacy rights. The New York Attorney General’s settlement with Zoom in May 2020 is a perfect example of how AGs will often rely on existing laws to demand that companies devote sufficient resources to ensuring the privacy and security of consumer data.