On March 6, 2024, New Hampshire Governor Chris Sununu signed SB 255 into law, making the Granite State the latest to enact a comprehensive privacy law—the 15th state, if you count Florida’s privacy law of narrower applicability.

New Hampshire’s privacy law goes into effect January 1, 2025 and applies to persons that conduct business in

Oregon has joined 10 other states in enacting a comprehensive data privacy law.1 On July 18, 2023, Governor Tina Kotek signed the Oregon Consumer Privacy Act (the “Oregon Privacy Law”) into law. The law imposes a range of new data privacy requirements on non-exempt controllers and processors of Oregon consumer personal data. The Oregon

On July 10, 2023, the European Commission (“Commission”) adopted an adequacy decision for the EU-US Data Privacy Framework (“DPF”). The DPF is the successor to the EU-US Privacy Shield, which the Court of Justice of the European Union (“CJEU”) declared invalid in 2020.

This adequacy decision reflects agreement by the Commission that the DPF offers

There has been a whirlwind of activity over the past year as states enact and implement comprehensive consumer privacy laws. Starting with the passage of the California Consumer Privacy Act (CCPA) in 2018, which became effective in 2020, the US state privacy legal landscape has continued to develop rapidly. New comprehensive privacy frameworks are set

On September 8, 2022, the Federal Trade Commission (FTC) held a virtual public forum on the agency’s release last month of an Advance Notice of Proposed Rulemaking (ANPR) to regulate the protection of consumers’ privacy and data security, which we covered in a prior Legal Update. In addition to allowing the public the opportunity

On August 11, 2022, the Federal Trade Commission (FTC) voted 3-2 on partisan lines to file an Advance Notice of Proposed Rulemaking (ANPR) that would regulate the protection of consumers’ privacy and data security in a rulemaking titled “Trade Regulation Rule on Commercial Surveillance and Data Security.”

The release of this ANPR—in the midst of

Connecticut has become the fifth state to pass comprehensive consumer data privacy legislation. Connecticut Governor Ned Lamont signed the bill into law on May 10, 2022, and the Connecticut Data Privacy Act” (CTDPA) will take effect on July 1, 2023. This Legal Update discusses the CTDPA’s scope; compares it with the other state privacy laws

Following in the footsteps of California, Virginia and Colorado, Utah has become the fourth state to pass comprehensive consumer data privacy legislation. Utah Governor Spencer Cox signed Utah Consumer Privacy Act (“UCPA”) into law on March 24, 2022—the first major state law domino to fall in 2022 and the first comprehensive data privacy legislation since

New comprehensive privacy frameworks in California, Virginia and Colorado are set to come into effect in 2023, and in recent days attention has turned to Utah, where a privacy bill closely resembling Virginia’s is on the governor’s desk for signature. The rulemaking processes for the enacted laws are in their early stages. To the chagrin