Colorado, Connecticut data privacy laws go into effect July 1
Add Axios as your preferred source to
see more of our stories on Google.
Illustration: Aïda Amer/Axios
Data privacy laws in Colorado and Connecticut will go into effect Saturday.
Why it matters: If companies haven't finished their compliance work to abide by the rules, they could face civil penalties of up to $20,000 per violation in some states.
The big picture: Colorado and Connecticut add to an increasingly complex patchwork of state data privacy laws.
- California paved the way in 2018 after passing the country's first state-level privacy bill, while Virginia followed this year.
Details: The Colorado and Connecticut laws apply to entities that do business in those states, as well as businesses that process a certain amount of data about in-state customers.
- Under the new laws, residents of each state will have the right to request businesses delete their personal information, ask for a copy of the information businesses have collected about them, opt out of the sale of their personal data, and more.
- Both laws also require businesses to request opt-in permission from consumers before letting businesses process their sensitive information — differing from the opt-out mechanism consumers have in California.
- Colorado and Connecticut are leaving enforcement up to their attorneys general. Until enforcement begins, it's unclear how much each office will prioritize data privacy cases.
Between the lines: States are increasingly passing their own laws after watching Congress struggle for years to develop a national standard.
- Tech companies have long argued that a myriad of laws would place undue burden on their businesses, while privacy advocates have supported a national standard but worry it could undercut stronger state rules.
What's next: Utah's privacy bill, which state officials passed last year, is set to go into effect Dec. 31, 2023.
- Tennessee, Indiana, Iowa and other states also recently passed their own comprehensive privacy measures.
Sign up for Axios’ cybersecurity newsletter Codebook here
