Key Dates to Note for Upcoming State Privacy Laws

In addition to the looming demise of the cookie, myriad incoming state privacy laws will be a challenge for advertisers. Five states—California, Virginia, Colorado, Connecticut and Utah—will begin enforcing privacy laws in the new year. Last month, Sephora was hit with a $1.2 million fine for allegedly violating California’s privacy laws and sharing people’s data with third-party analytic tools without informing them. Meanwhile, the indefinite stall of a national privacy bill is a sigh of relief to ad-tech players. Here’s a timeline of key 2023 dates for advertisers to note: Why a Privacy Framework Backed by Meta and Mozilla Is Gaining Traction California Jan. 1, 2023: California Privacy Rights Act (CPRA) becomes operative Aligned more closely to Europe’s GDPR, CPRA will amend the California Consumer Privacy Act (CCPA). Jan. 1, 2023: Sunset of CCPA Data Exemption At the same time, the CCPA b-to-b dispensation, exempted under the law, expires next year. Vendors, partners and staffers of b-to-b services will have the right to access or request to delete personal information collected from their relationship. July 1, 2023: CPRA enforcement begins Consumer rights: Under the CPRA, California residents can request businesses to correct their inaccurate information. Meanwhile, businesses must inform people if they plan to collect and use any sensitive personal information, and people can ask businesses to stop using, selling and sharing their data. Opt out: People can opt out of the sale and sharing of their personal information to third parties. Sensitive data: Businesses must disclose how they collect, use and disclose people’s sensitive data. Data minimization: Companies will be subjected to data minimization and can only use, retain and share information deemed as reasonable to achieve the purpose of doing so. Fine: Automatic fines of $7,500 for violations of children’s privacy (under 16 years old). Cure period: Businesses will lose the 30-day cure period under CCPA. Enforcement: California Privacy Protection Agency Personalization and Privacy Can Live Under One Roof Virginia Jan. 1, 2023: Consumer Data Protection Act Following in California’s footsteps, Virginia passed its privacy law, called the Consumer Data Protection Act, which appears be to a watered-down version of CCPA. A key difference between Virginia and California is there is no gross revenue threshold in Virginia where companies that control more than 100,000 Virginians’ personal data annually. Those that control the data of 25,000 people with more than 50% of their revenue coming from selling the data must also comply with the law. Consumer rights: People in Virginia do not have the private right to action, which would allow them to sue companies for data breaches. Opt out: People are allowed to opt out of having their data collected and sold. Sensitive data: People must opt into the collection and use of their sensitive data for processing. Meanwhile, businesses need to seek people’s permission to collect such data (including racial, ethnic, geographic and genetic data). Data minimization: Businesses must practice data minimization, collecting and retaining only data that is reasonably necessary, and must convey the same to consumers. Fine: Up to $7,500 per violation Cure period: Businesses found in violation get a 30-day cure period. Enforcement: Virginia Attorney General's Office Flo’s Anonymous Mode Is a Small Win in Protecting People’s Privacy Colorado July 1, 2023: Colorado Privacy Act (CoPA) CoPA applies to any businesses that: control or process personal data of 100,000 or more Colorado residents, or get their revenue or receive a discount on the price of goods or services from the sale of personal data of 25,000 consumers or more. Nonprofit organizations are not exempted from the law. Consumer rights: Businesses must notify consumers with a privacy notice that includes the types and purposes of personal data collected or processed by them, and which third parties that data is shared with. Opt out: Consumers have the right to opt out of targeted ads, the sale of their personal data or being profiled. Sensitive data: Like California and Virginia, Colorado too must seek consumer consent before collecting and processing their sensitive data. Data minimization: Businesses must be transparent about why they are collecting and processing people’s data, with the caveat of data minimization or limiting data collection to what the law deems as reasonably necessary. Fine: CoPA has a higher penalty for violations, up to $20,000. Cure period: The Colorado Privacy Act provides a 60-day cure period for alleged violations, in effect until Jan. 1, 2025. Enforcement: Colorado Attorney General July 1, 2024 — Consumers can exercise the right to opt out of sales or targeted ads through a universal opt-out mechanism. Jan. 1, 2025 — The notice of violation and right to cure provision expires. Google Is Backing Cookieless ID Solution Seller-Defined Audiences Connecticut July 1, 2023: Connecticut Data Privacy Act (CDPA) CDPA impacts businesses that hold the data of more than 100,000 Connecticut residents or derive 25% of their gross revenue from the sale of data of more than 25,000. Unlike California, the CDPA does not have an annual revenue threshold for companies, meaning a business will not be subject to the law merely based on its annual revenues. Consumer rights: Connecticut residents have the right to access, collect and delete their data collected by businesses. Opt out: The CDPA gives consumers the option to opt-out of data sales, targeted ads and profiling. The law also encompasses protections for children and biometric data. Sensitive data: CDPA requires opt-in consent for the collection and processing of sensitive data by businesses. Data minimization: Businesses are required to practice data minimization, limiting the collection of personal data to what is relevant and reasonably necessary. Fine: Fines up to $5,000 per violation can be levied. Cure period: For any violations, companies are given a 60-day cure period if a cure is possible, from July 1, 2023 until Dec. 31, 2024. Enforcement: Connecticut Attorney General Jan. 1, 2025 — The right to cure will expire. However, the attorney general has the discretion to grant a cure period if needed. To that, in 2025, people can opt out of sales or targeted ads through what the law states as an “opt-out preference signal.” How UK Wine Brand Gusbourne Is Figuring Out Its Post-cookie Future Utah Dec. 1, 2023: Utah Consumer Privacy Act (UCPA) The fifth state to join the privacy bandwagon is Utah. However, the legislation appears to be somewhat business-friendly compared to other states, where the law protects small and medium-sized businesses. The UCPA only applies to companies with an annual revenue threshold of $25 million, process data for at least 100,000 consumers or get 50% of gross revenue from the sale of such data of at least 25,000 residents. Consumer rights: The law emulates Virginia’s privacy rulebook, which gives people the right to access and delete personal information from businesses, as well as receive a copy of their data. Businesses are also required to provide people with a reasonable privacy notice that includes the categories of personal data processed; the purposes for which the personal data is processed; how and where consumers may exercise a right; and the categories of personal data that they share with third parties while disclosing all said third parties. However, the Utah law does not require a business to seek people’s consent before processing such data, and only requires providing consumers with an opt-out notification. Opt out: People can opt out of sharing data that is repurposed as third-party data for targeted ads. Sensitive data: People are required to explicitly opt in when sensitive information is being collected. Data minimization: Businesses can only collect data that is relevant and necessary. Fine: $7,500 per violation in civil penalties. Cure period: Businesses will be given 30 days to fix any violations. Enforcement: Utah Attorney General