Twelve states have generally applicable privacy laws that impose affirmative obligations and substantive restrictions on what covered businesses must and cannot do with personal data. Several other privacy laws are under consideration across New England, including Maine, Massachusetts, New Hampshire, Rhode Island, and Vermont.
