There has been a lot of momentum building at the state level for states to adopt comprehensive privacy bills. The vast majority of data collected from products people use frequently is not regulated. Most companies are free to use the data they collect unless a state has a comprehensive privacy law. As of October 2022, only a handful of states (California, Colorado, Connecticut, Utah, Virginia, and Nevada) have enacted comprehensive consumer data privacy laws. No national law standardizes when a company must notify a consumer when their data has been breached or exposed to third parties. In 2022, state legislatures made several efforts to pass comprehensive data privacy bills. Lawmakers in 29 states and the District of Columbia either introduced privacy legislation or had bills carry over from 2021 into 2022. Washington and Florida tried to pass legislation but failed. Despite the immense amount of legislative activity, just two states, Connecticut and Utah, enacted laws in 2022.

---

Utah

In March 2022, Governor Spencer Cox signed the Utah Consumer Privacy Act into law. The Utah Consumer Privacy Act, otherwise known as the UCPA, will go into effect on December 31st, 2023. The UCPA is similar to consumer privacy laws enacted in California, Virginia, and Colorado. The UCPA draws heavy influence from the Virginia Consumer Data Protection Act and the Colorado Privacy Act. The Utah law assesses several duties on businesses that manage or process a consumer’s private data in Utah. However, in contrast to the laws of California and Colorado, the UCPA takes a comparatively business-friendly approach, making it the most market-orientated consumer privacy law to be enacted in the United States.

---

Florida

The issue of consumer privacy legislation has been contentious within the Florida legislature. Although Democrats and Republicans have both supported the legislation, the House and Senate have been unable to agree on enforcement rights, particularly whether enforcement should be left to Florida’s Attorney General. Additionally, many businesses are weary of data privacy legislation’s additional costs and have been vocal about their concerns. In 2022, the Florida House passed HB 9 but the Senate failed to advance the measure. Persisting disagreements and leadership changes make the enactment of such privacy legislation unlikely within the next two years.

---

Connecticut

In May 2022, Governor Ned Lamont signed Public Act 22-15. Like the Utah law, the measure closely resembles privacy laws already passed in California, Colorado, and Virginia. Many provisions mirror or closely resemble those in the Colorado and Virginia laws. Connecticut’s Public Act 22-15 requires businesses to publicly share a privacy policy that informs consumers about what data is being collected and how it is being used. Additionally, the law requires consumers under 16 years of age to consent to data collection. Furthermore, companies are prohibited from discriminating against consumers who choose to exercise their privacy rights.

---

Washington

The Washington Privacy Act, initially proposed in 2019, was poised to make Washington the second state, after California, to enact comprehensive data privacy legislation. Nevertheless, after numerous attempts over the past few years, the state of Washington ended another legislative session failing to pass data privacy legislation. The bill HB 1850 passed two House committees but was never able to garner enough support for a floor vote. A key figure in the state’s battle for privacy, Senator Reuven Carlyle retired from the Washington legislature in January. While Washington has many privacy advocates, it remains unclear whether lawmakers will continue to put privacy legislation at the forefront after Carlyle’s retirement.

---