Compliance Stuff

Privacy law evolved at a dizzying pace in 2025. Regulators brought headline-making enforcement actions, courts continued to shape the boundaries of existing statutes, and state legislatures advanced new laws. Much of that activity centered on familiar pressure points: privacy notices and opt-out mechanisms, telemarketing and text messaging practices, and the collection and use of sensitive data, particularly biometric information, health data (such as the Healthline CCPA enforcement), and children’s and teen’s personal information (including actions against Roku in multiple jurisdictions). Newly effective laws echoed those same priorities. For example, Maryland’s comprehensive privacy law and several children’s privacy statutes in states like New York and Colorado place new limits on how children’s data may be used for advertising and related purposes, while Colorado also expanded consent requirements for certain biometric processing affecting both consumers and employees. In parallel,...

As state-level privacy laws continue to expand in the absence of federal legislation, businesses must prepare to meet a growing patchwork of requirements or risk penalties and reputational harm. In 2025, eight additional states' comprehensive privacy laws will come into effect, further increasing the complexity of compliance. By the end of next year, approximately 150 million Americans—43% of the U.S. population—will be covered by comprehensive state-level privacy regulations. Most of the activity next year will take place in January, when five states (Iowa, Delaware, Nebraska, New Hampshire, and New Jersey) have privacy laws going into effect, with three more following later in the year. Why This Matters Navigating this evolving landscape of state privacy laws is critical for most companies doing business within the United States. Non-compliance could lead to regulatory penalties, legal liabilities, and loss of consumer trust. The good news is that if your business is already in ...