Three new state laws will go into effect in 2023 that largely follow the footsteps of the California Consumer Privacy Act (CCPA). The main provisions of the California Privacy Rights Act include the categorization and regulation of sensitive personal information, the right for an individual to limit a business’s use of sensitive personal information, data minimization standards, restrictions on the use of cookies for cross-contextual behavioral advertising, annual cybersecurity review and audit requirements, the creation of the California Privacy Protection Agency and the expansion of a limited private right of action. Main provisions of the Colorado Privacy Act include individual rights, the implementation of a “controller” and “processor” regime, contractual standards and floors that must be met in controller and processor relationships, opt-in consent requirements for the collection and processing of Sensitive Data, risk assessment, and audit requirements, and individual opt-out rights for the selling of personal information, targeted advertising, and profiling in furtherance of legal (or similar decisions). And finally, Virginia’s Consumer Data Protection Act includes individual rights, the implementation of a “controller” and “processor” regime, contractual standards and floors that must be met in controller and processor relationships, opt-in consent requirements for the collection and processing of Sensitive Data, risk assessment and audit requirements and individual opt-out rights from the selling of personal information, targeted advertising and profiling in furtherance of legal (or similar) decisions.
