We’re up to seventeen states that have now passed data privacy laws! Five of those have passed their new laws so far in 2024!

Going into 2024, there were twelve states that had passed comprehensive data privacy laws to date. So far in 2024:

• New Jersey’s comprehensive data privacy law, Senate Bill 332, was signed into law by Governor Phil Murphy on January 16, 2024. The law is set to take effect on January 15, 2025​.
• New Hampshire’s Governor Chris Sununu signed Senate Bill 255, the state’s comprehensive data privacy law, into law on March 6, 2024. This law will become effective on January 1, 2025.
• Kentucky’s Andy Beshear Governor signed the Kentucky Consumer Data Protection Act into law on April 4, 2024​​. This law is set to take effect on January 1, 2026.
• On April 6, 2024, the Maryland Legislature passed a comprehensive privacy bill, sending the Maryland Online Data Privacy Act of 2024 (MODPA) to Governor Wes Moore’s desk for signature into law. If enacted, the law would take effect October 1, 2025.
• On April 11, 2024, the Nebraska legislature passed the Nebraska Data Privacy Act (LB 1074). It now heads to Nebraska Governor Jim Pillen for signature. If enacted, the law would take effect January 1, 2025.

So, that means seventeen states have now passed data privacy laws (two of them still to be enacted). The map above shows all seventeen states – green = five enacted and now in effect, blue = ten enacted but not yet in effect, purple = two passed, but not enacted). Here is a list of states with a link to each data privacy law (note: I’ve left off California’s CCPA since CPRA has now replaced it):

• California Privacy Rights Act (CPRA) (enacted in 2020; effective January 1, 2023)
• Colorado Privacy Act (SB 190) (enacted in 2021; effective July 1, 2023)
• Connecticut Data Privacy Act (SB 6) (enacted in 2022; effective July 1, 2023)
• Delaware Personal Data Privacy Act (HB 154) (enacted in 2023; effective January 1, 2025)
• Indiana Consumer Data Protection Act (SB 5) (enacted in 2023; effective January 1, 2026)
• Iowa Consumer Data Protection Act (SF 262) (enacted in 2023; effective January 1, 2025)
• Kentucky Consumer Data Protection Act (HB 15) (enacted in 2024; effective January 1, 2026)
• Montana Consumer Data Privacy Act (SB 384) (enacted in 2023; effective October 1, 2024)
• New Hampshire (SB 255) (enacted in 2024; effective January 1, 2025)
• New Jersey (SB 332) (enacted in 2024; effective January 15, 2025)
• Oregon Consumer Privacy Act (SB 619) (enacted in 2023; effective July 1, 2024)
• Tennessee Information Protection Act (HB 1181) (enacted in 2023; effective July 1, 2025)
• Texas Data Privacy and Security Act (HB 4) (enacted in 2023; effective July 1, 2024)
• Utah Consumer Privacy Act (SB 227) (enacted in 2022; effective December 31, 2023)
• Virginia Consumer Data Protection Act (SB 1392) (enacted in 2021; effective January 1, 2023)
• Maryland Online Data Privacy Act (SB 541) (passed in 2024, not yet enacted, proposed effective October 1, 2025)
• Nebraska Data Privacy Act (LB 1074) (passed in 2024, not yet enacted, proposed effective January 1, 2025)

At this recent rate, we could be close to half the states having passed comprehensive data privacy laws by the end of the year!

So, what do you think? Are you surprised we’re up to seventeen states that have now passed data privacy laws? Please share any comments you might have or if you’d like to know more about a particular topic.

Disclaimer: The views represented herein are exclusively the views of the authors and speakers themselves, and do not necessarily represent the views held by my employer, my partners or my clients. eDiscovery Today is made available solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscovery Today should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.