Advertising Law Blog

Privacy laws relating to the collection and use personal information continue to be a hot topic for 2024. While there is still no over-arching federal privacy law in the United States, several states have passed privacy laws that affect businesses that collect (whether online or off-line) and use personal information. California, Connecticut, Virginia, and Colorado already have privacy laws in effect. Utah’s privacy law goes into effect on December 31, 2023. Five more states’ privacy laws will become effective in 2024 – Washington (3/31/24), Oregon (7/1/24), Texas (7/1/24), Florida (7/1/24), and Montana (10/1/24). Additional state laws will become effective beyond 2024 – Delaware (1/1/25), Iowa (1/1/25), Tennessee (7/1/25), and Indiana (1/1/26). Beyond the laws that have been enacted, numerous state legislatures will be reviewing and debating proposed privacy legislation in 2024, namely: Missouri, Wisconsin, Michigan, Ohio, Pennsylvania, New Jersey, North Carolina, Maine, and Massachusetts.

While these laws are all somewhat different, the main provisions of the laws are fairly consistent. Namely, the laws apply to businesses that meet certain thresholds (typically $25 million in gross annual revenue), maintain a database with a certain number of residents from the states involved (typically 50,000 to 100,0000), or earn more than 50% of revenue from “selling” personal data. The laws also apply regardless of where a business is located if the business collects data from individuals residing in the states that have enacted privacy laws.

The laws require businesses to provide clear and concise notice to the individuals from whom data is collected detailing how the business collects, uses, and shares such information and allow such individuals to opt out of certain types of uses (typically use for advertising purposes). Businesses must also allow individuals access to the personal information maintained and must delete personal information upon request from such individuals. The laws also require that businesses enter into written agreements with service providers and third parties with whom personal information is shared, and the various laws contain specific provisions that must be included in such agreements.

The landscape of privacy laws is complex and ever-changing, and all businesses should look to review and update their privacy practices in 2024 to assure compliance with these developing laws.