In 2023, a number of state data protection laws will be coming into effect and a number of entities who previously were not subject to data security and data privacy obligations will soon be within the scope of these laws. Below, please find (1) a count down clock to the new state data protection law effective dates; and (2) a chart outlining when an entity is in the applicable state data protection law's scope.
Countdown to Effective Date:
State Law |
Countdown |
Effective Date |
California Privacy Rights Act |
T-Minus 3 Months |
January 1, 2023 |
Virginia Consumer Data Protection Act |
T-Minus 3 Months |
January 1, 2023 |
Colorado Privacy Act |
T-Minus 9 Months |
July 1, 2023 |
Connecticut Act Concerning Personal Data Privacy and Online Monitoring |
T-Minus 9 Months |
July 1, 2023 |
Utah Consumer Privacy Act |
T-Minus 14 Months |
December 31, 2023 |
State |
Avenue. Global Gross Revenue |
Processing of Personal Information (State Residents) |
Sale of Personal Information |
California |
OVER $25 million OR |
Buying, selling, or sharing 100,000 or more California consumers' personal information OR |
50% of annual gross revenue from selling California consumers' personal information |
Colorado |
N/A |
Processing 100,000 or more Colorado consumers' personal information OR |
25,000 Colorado consumers and receiving any profit |
Virginia |
N/A |
Processing 100,000 or more Virginia consumers' personal information OR |
25,000 Virginia consumers and deriving 50% of annual, gross revenue from selling |
Connecticut |
N/A |
Processed 100,000 or more Connecticut consumer' personal information OR |
25,000 Connecticut consumers and deriving 25% of annual, global gross revenue from selling |
Utah |
$25,000,000 or more & |
Processing 100,000 or more Utah consumers' personal information OR |
25,000 Utah consumers and deriving 50% of annual, global gross revenue from selling |
Businesses that are possibly in the scope of any of the below referenced laws should begin the front-end compliance work soon (if they have not already) and the Benesch Data Protection Team stands by to assist for any such needs. If you would like to discuss the applicability and / or requirements of the state data protection laws, do not hesitate to reach out.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.