Privacy

State Privacy: Prioritizing Interoperability and Implementation

In the absence of federal action, seven states advanced comprehensive privacy laws forward in 2024, for a total of 20 that now have laws protecting the privacy and security of consumers’ data.

In its “2024 Models of State Privacy Legislation” document, BSA | The Software Alliance breaks down these laws based on the consumer rights they establish and the requirements they impose on businesses. This blog post recaps some of the key trends in state privacy from the past year and previews what lies ahead in 2025.

What Happened in 2024?
  • States are mostly passing legislation aligned with Connecticut and Virginia’s state privacy laws. As reflected in BSA’s “Models of State Privacy Legislation,” states have continued to adopt a similar structural model for protecting privacy, but have modified the model to provide greater or narrower substantive protections.
  • State lawmakers showed increased interest in adopting models of state privacy legislation that would “break the mold.” Some state legislatures considered state privacy models that would diverge from the consistency in interoperability seen up until now. This was most apparent on topics such as data minimization, which limits how companies collect, process, or use consumers’ personal data.
  • States are taking up topics at the center of the debate on federal privacy legislation. Topics like data minimization, private rights of action, and anti-discrimination provisions being debated in the context of federal privacy legislation in Congress have seeped into privacy bills in the states.
  • States that have enacted state privacy laws introduced bills amending those laws. California, Colorado, Tennessee, Delaware, Iowa, and Virginia all introduced bills that would amend their existing privacy laws in some fashion.
Future of State Privacy
  • In 2025, BSA expects to see significant activity in states that previously attempted to pass a comprehensive privacy law but failed to get it over the finish line. These states include Georgia, Hawaii, Maine, Wisconsin, and Vermont.
  • States will modify existing comprehensive privacy laws. States that have already enacted privacy laws may amend those laws to incorporate new protections for certain types of data.
  • Greater focus on protecting sensitive data. In the aftermath of the 2024 election, some states may take up legislation that protects sensitive data, such as children’s and consumers’ health data.
  • Fusing privacy and artificial intelligence (AI). Some states may attempt to merge privacy provisions with AI provisions into one bill.
  • Rulemaking and implementation. States will continue to set high-water marks on privacy through rulemaking, particularly in California. Additionally, multiple privacy laws will take effect in 2025. Eight new privacy laws will become effective in 2025, meaning a total of 17 state privacy laws will be in effect.

BSA anticipates that states will remain active on privacy and potentially consider new models of legislation that could impact interoperability across states. As state legislatures prepare for 2025, they are likely to set new trends that will shape privacy protections available to consumers in the future.

Artificial Intelligence

EU AI Update: New Rules for General-Purpose Models

As the European Union begins to implement its landmark Artificial Intelligence (AI) Act, it has initiated a process to develop a tailored, voluntary Code of Practice (CoP) for General-Purpose Artificial Intelligence (GPAI) models that can be adapted for a wide variety of uses. Read More >>

As the European Union begins to implement its landmark Artificial Intelligence (AI) Act, it has initiated a process to develop a tailored, voluntary Code of Practice (CoP) for General-Purpose Artificial Intelligence (GPAI) models that can be adapted for a wide variety of uses. Read More >>

Artificial Intelligence

2024 State Summary on AI

As state lawmakers develop, pass, and ultimately enforce technology policy in the absence of federal action, a recognizable pattern has emerged. While Congress has struggled to pass legislation on some major tech issues, state policymakers from coast to coast have moved to enact statutes addressing a range of technology policy concerns. Read More >>

As state lawmakers develop, pass, and ultimately enforce technology policy in the absence of federal action, a recognizable pattern has emerged. While Congress has struggled to pass legislation on some major tech issues, state policymakers from coast to coast have moved to enact statutes addressing a range of technology policy concerns. Read More >>

Artificial Intelligence

AI Standards Development: Why It Matters

Artificial intelligence has not just transformed businesses in every industry sector, provided new ways to solve intractable societal challenges, and created popular new tools to generate text and images. It has also ignited interest in an issue that usually doesn’t get much attention: global standards. Read More >>

Artificial intelligence has not just transformed businesses in every industry sector, provided new ways to solve intractable societal challenges, and created popular new tools to generate text and images. It has also ignited interest in an issue that usually doesn’t get much attention: global standards. Read More >>

Artificial Intelligence

Enhancing AI Accountability: Effective Policies for Assessing Responsible AI

As companies across industry sectors seek to leverage the benefits of AI, they are also exploring how best to manage its risks. To help identify and manage AI-related risks, companies are building internal AI governance or risk management programs that leverage important new resources. Read More >>

As companies across industry sectors seek to leverage the benefits of AI, they are also exploring how best to manage its risks. To help identify and manage AI-related risks, companies are building internal AI governance or risk management programs that leverage important new resources. Read More >>