If You Live in One of These States, You’ll Have New Privacy Protections in 2025

Residents of five states will ring in the new year with the best gift of all: new privacy rights.

This coming January, consumer data privacy laws passed by state legislatures in 2023 and 2024 will take effect in Delaware, Iowa, Nebraska, New Hampshire and New Jersey. This would bring the number of states with active privacy laws to 13.

The new laws regulate how businesses of certain sizes are run—size varies by state—manage sensitive consumer data and give residents of those states various rights to know, correct, and delete information that businesses hold about them. Some of the key provisions of the new package of laws are:

Delaware

Originally enacted in 2023, the law applies to individuals and entities that processed the personal data of 35,000 Delaware residents or processed the personal data of 10,000 Delaware residents and generated more than 20 percent of the total revenue from sales during the previous calendar year. from personal information.

Unlike many other state privacy laws, it applies to nonprofit organizations and for-profit businesses.

It gives residents the right to know what personal information an organization holds about them, to obtain a copy of that information, to correct it, and to opt out of that information being used for targeted advertising, sold to a third party, or used for automated decision-making. with significant legal consequences.

The law enters into force on January 1.

Iowa

Also passed in 2023, the Iowa law applies to businesses that process personal information for at least 100,000 residents or that process information for 25,000 residents and derive more than half of their gross revenue from the sale of such information.

It is a narrower, more business-friendly law than many other state laws that have been enacted.

While consumers are given the right to access and delete the information a business has about them and to opt out of selling it to a third party, they are not given the right to correct that information, opt-out or opt-out of its use for targeted advertising. used to make automated decisions about them.

The law enters into force on January 1.

Nebraska

There are no specific revenue or customer number limits in the state’s data privacy act. This applies to any business that is not a small business as defined by the federal Small Business Act (and also to small businesses that sell sensitive information without first obtaining consumer consent).

It gives consumers the right to access, correct, and delete personal information held by businesses, and to opt out of the use of that information for targeted advertising, sales to third parties, or use in certain automated decision-making systems.

The law enters into force on January 1.

New Hampshire

The law applies to businesses that process the personal information of 35,000 Granite Staters or that process the personal information of 10,000 Granite Staters and generate 25 percent of the gross revenue from the sale of such information.

It gives residents the right to access, correct, and delete personal information held by eligible businesses, and to opt out of having that information used for targeted advertising, sold to third parties, or used in certain automated decision-making systems.

The law enters into force on January 1.

New Jersey

The Act applies to businesses that process the personal data of at least 100,000 residents (unless such processing is solely for the purpose of completing payments) or to businesses that process the personal data of 25,000 residents and derive a profit from the sale or use of such data.

Like many of the laws previously mentioned, it gives consumers the right to access, correct, and delete personal information and to opt out of having that information used for targeted advertising, sold to third parties, or used in certain automated decisions. creating systems.

However, it will also allow consumers to indicate their wish to opt out of these uses, known as the universal opt-out mechanism. Although not defined in the text of the law, a universal opt-out mechanism could be something like a browser extension that informs each website the user visits about their privacy preferences, rather than the user needing to communicate those choices to each business individually.

The law enters into force on January 15.