Physical Address
304 North Cardinal St.
Dorchester Center, MA 02124
Residents of five states will ring in the New Year with the best gift of all: new privacy rights.
Next January will see consumer data privacy laws that were enacted by state legislatures in 2023 and 2024 go into effect in Delaware, Iowa, Nebraska, New Hampshire and New Jersey. Bringing the number of states with active privacy laws up to 13.
The new laws regulate how companies of certain sizes– size varies by state – manages sensitive consumer information and grants residents of those states various rights to know, correct and delete data that companies hold on them. Here are some of the key provisions in the new suite of laws:
Delaware
Originally approved in 2023, the law applies to individuals and organizations that, during the previous calendar year, processed the personal information of 35,000 Delaware residents or processed the personal information of 10,000 Delaware residents and did more than 20 percent of their gross revenue from sales. of personal information.
Unlike many other state privacy laws, it applies to both nonprofit and for-profit businesses.
It grants residents the right to know what personal information an organization has about them, obtain a copy of that information, correct it, and opt out of having that information used for targeted advertising, sold to a third party, or used to make automated decisions. with significant legal ramifications.
The law goes into effect on January 1.
Iowa
Also passed in 2023, the Iowa law applies to companies that processed personal information for at least 100,000 residents or that processed information for 25,000 residents and made more than half of their revenue gross from the sale of such data.
It is a stricter, more business-friendly law than many other state laws that have taken effect.
While consumers are granted the right to access and delete information that a company holds about them and to choose not to have it sold to a third party, they are not allowed to correct that information, to opt out of its use for targeted advertising, or to disable. is used to make automated decisions about them.
The law goes into effect on January 1.
Nebraska
The state’s data privacy act does not contain a specific revenue or customer limit. Applies to any business that is not a small business, as defined by the federal Small Business Act (and also applies to small businesses that sell sensitive data without first obtaining consumer consent) .
It grants consumers the right to access, correct and delete personal information held by companies and to opt out of the use of that data for targeted advertising, being sold to third parties, or used in certain automated decision-making systems.
The law goes into effect on January 1.
New Hampshire
The law applies to companies that process the personal information of 35,000 Granite Staters or that process the personal information of 10,000 Granite Staters and make 25 percent of their gross revenue from the sale of such information.
It gives residents the right to access, correct and delete personal data held by qualified companies and to opt out of such data being used for targeted advertising, sold to third parties, or used in certain automated decision-making systems.
The law goes into effect on January 1.
New Jersey
The law applies to companies that process the personal information of at least 100,000 residents (unless the processing is only for the purpose of completing payments) or companies that process the personal information of 25,000 residents and benefit from the sale or such information.
Like many of the laws mentioned earlier, it grants consumers the rights to access, correct, and delete personal information and the rights to opt out of having that data used for targeted advertising, sold to third parties, or used in certain automated decisions. make systems.
However, it will also allow consumers to signal their desire to disable those uses through what is known as a universal opt-out mechanism. While not defined in the text of the law, a universal opt-out mechanism could be something like a browser extension that informs every website a user visits about their privacy choices, rather than the users who need to communicate these choices to each business individually.
The law will come into effect on January 15.
