In the absence of a national privacy law in the US, state legislatures are poised to continue advancing tech policy in the coming year, especially on issues like consumer privacy and artificial intelligence (AI).
- Quick 2023 Recap: A total of eight US states enacted comprehensive privacy laws in 2023, many of which were modeled after existing laws, primarily those in Connecticut and Virginia. A total of 13 US states had enacted comprehensive privacy laws entering this year.
More privacy laws in 2024: States are already considering at least 40 comprehensive privacy bills in 2024. Thirty–three have carried over from 2023, and four of those have already passed one legislative chamber. The early flurry of activity presages more state action on privacy in the year ahead.
Trends we’re watching: There are several key trends BSA is monitoring in 2024.
- Momentum in Northeast states: Several states in the US Northeast – including New Hampshire and Maine – could soon act on bills modeled after Connecticut’s privacy law. New Jersey enacted a comprehensive privacy bill on January 16, making the Garden State the 14th in the country to put a comprehensive consumer privacy law into place. A privacy bill in New Hampshire is also close to final passage pending a vote in the state Senate.
- More states look to get privacy over the finish line: States that made strong pushes to pass privacy legislation in past years could do so again. Hawaii, New Hampshire, New York, and Wisconsin passed bills out of one chamber in 2023, and other states like Kentucky, Minnesota, Ohio, and Pennsylvania have indicated they could act in 2024.
- Plenty of enforcement, implementation, and rulemaking: The five states with privacy laws on the books (California, Colorado, Connecticut, Utah, Virginia) could move to enforce their laws this year. Four other states (Oregon, Montana, Florida, and Texas) will see their laws take effect. California is engaged in detailed rulemaking efforts to implement its privacy law.
- Where do states depart from existing models? Some states could depart from existing privacy legislation models, which could pose challenges to how different state laws work in conjunction with one another should different requirements take effect.
- Consideration of privacy-adjacent issues: Some states could take on issues relevant to privacy, such as biometric privacy, consumer health privacy, and issues that converge AI and privacy.
What BSA is urging: BSA supports legislation that advances consumer privacy protections – both at the state and federal level in the United States. In particular, BSA has focused on ensuring laws reflect the different roles of controllers and processors of personal data, and give consumers clarity and confidence in how their data is used and protected.
Action on AI also likely: As BSA noted last fall, there was a 440% uptick in artificial intelligence legislation introduced last year. AI is likely to continue to be one of the top tech policy issues in play before US state lawmakers in 2024 as well.
