At Least 22 States Have Consumer Privacy Legislation Pending – Will 2022 Be the Year for More State Privacy Laws?

California is the gold standard for state privacy laws, having recently enacted the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). Virginia and Colorado also have enacted comprehensive privacy laws, which will take effect in 2023. Recently, the International Association of Privacy Professionals (IAPP) released its state privacy legislation tracker. The IAPP offers a map of the states that shows all the states and the status of any privacy legislation. The map shows the various stages of any privacy legislation, from bills introduced all the way through bills signed.

In addition, IAPP has compiled a  handy chart of pending comprehensive privacy legislation that provides the name of the bill, a link to the bill, and whether the bill provides various consumer rights, business obligations, and a private right of action, similar to the consumer privacy laws passed in California, Virginia, and Colorado.

At the current time, the IAPP Westin Research Center is tracking comprehensive consumer privacy bills in  22 states. Many states, including Alaska, Hawaii, Massachusetts, New York, Pennsylvania, Washington, Wisconsin, and New Jersey, have multiple privacy bills pending.  Most of the bills listed in the chart are described as “in committee,” and two states (Indiana and Oklahoma) have bills in cross- committee status. According to the IAPP, the focus of the bills selected for the tracker is on bills that provide legislative approaches “governing the use of personal information in a state.”

It remains to be seen whether other states will pass similar consumer privacy legislation. Lawmakers are paying close attention to privacy issues and consumers seem to be more aware that they can have some control over their data.

For those that still hold out hope of a federal privacy bill, the IAPP also has a federal privacy legislation tracker.