Effective Jan. 1: California Regulatory Updates, New State Privacy Laws, and Opt-Out Signal Requirements
A significant set of U.S. state privacy law developments, all effective Jan. 1, will expand compliance obligations for companies operating nationwide. These developments fall into three principal categories: (1) new regulatory requirements adopted by the California Privacy Protection Agency (CPPA) under California‘s Consumer Privacy Act of 2018 (CCPA), which includes enforcement of privacy and security risk assessment requirements; (2) new comprehensive consumer privacy statutes in Indiana, Kentucky, and Rhode Island; and (3) statutory requirements in Delaware and Oregon mandating recognition of universal opt-out preference signals. Together, these changes reflect the continued maturation of state privacy regimes and reinforce the need for scalable, multi-jurisdictional privacy compliance programs, including clear risk assessment protocols. We start first with the CCPA Amendments and Regulatory Updates, given that many companies benchmark their compliance programs as a differential of ...