469 articles · page 8 of 8
Utah requires data breach notification without unreasonable delay. Learn about the 2024 AG/Cyber Center reporting requirement at 500+, $2,500 per-consumer penalties, and investigation obligation.
Learn about Utah data privacy laws including the UCPA, consumer rights, business obligations, penalties up to $7,500 per violation, and data breach notification rules.
Utah's Digital Choice Act (HB 418) is now in force as of July 1, 2026, requiring social media data portability and interoperability. What the law requires.
Step-by-step VCDPA compliance checklist: applicability thresholds, sensitive data opt-in consent, data protection assessments, processor contracts, and AG enforcement rules for Virginia businesses.
Virginia residents have five VCDPA rights: access, correct, delete, portability, and opt-out. Learn how to submit requests, appeal denials, and escalate to the VA AG.
The $100M Verizon administrative charge settlement is paid. Real payouts were $2.37 to $14, not the promised $15 to $100. Claims closed April 2024.
Vermont's comprehensive biometric privacy bill H.121 was vetoed in 2024. Learn about current protections under breach notification and data broker laws.
Vermont requires data breach notification within 45 days plus a 14-day preliminary AG notice. Learn who must comply, protected data types, penalties, and reporting rules.
Vermont data privacy laws explained: first-in-the-nation data broker registry, 45-day breach notification rules, student privacy protections, and consumer rights.
Complete guide to Vietnam data privacy laws. Covers Law No. 91/2025/QH15 (effective January 1, 2026), Decree 356, cross-border transfers, data subject rights, and penalties.
Learn how Virginia's VCDPA protects biometric data like fingerprints and iris scans. Opt-in consent required, AG enforcement, up to $7,500 per violation.
Virginia requires data breach notification to the Attorney General and affected residents without unreasonable delay. Learn about the $150,000 penalty cap and private right of action for direct economic damages.
Learn about Virginia data privacy laws including the VCDPA, consumer rights, business obligations, penalties up to $7,500, and data breach notification rules.
Guide to Washington biometric privacy laws under RCW 19.375, including notice and consent rules, penalties up to $7,500 per violation, government biometric restrictions, and My Health My Data Act overlap.
Washington requires data breach notification within 30 days and has one of the broadest PI definitions in the U.S. Learn reporting rules, AG notification, and private right of action.
Learn about Washington data privacy laws including the My Health My Data Act, biometric privacy protections, and breach notification rules under state law.
West Virginia has no biometric privacy law, and its breach notification statute excludes biometric data. Learn about proposed HB 5567 and current protections.
West Virginia requires data breach notification without unreasonable delay. Learn its narrow PI definition, no AG reporting requirement, encryption safe harbor, and $150K penalty cap.
Learn about West Virginia data privacy laws including breach notification requirements, identity theft penalties, credit freeze rights, and pending consumer data protection legislation.
The CCPA gives California residents the right to know, delete, and opt out of the sale of personal data. Learn about scope, penalties, enforcement, and how CPRA expanded the law.
GDPR is the EU data protection law. Learn the 7 principles, your data subject rights, who must comply, and fines up to EUR 20M or 4% of global turnover.
Washington's My Health My Data Act (ch. 19.373 RCW) took effect in 2024, has no size threshold, bans health-facility geofencing, and allows private lawsuits.
MODPA (Md. Com. Law 14-4601 et seq.) took effect Oct 1, 2025, the strictest US state privacy law: hard data minimization and a ban on selling sensitive data.
Colorado Privacy Act (2023): 5 consumer rights, mandatory GPC opt-out, up to $20,000/violation. Learn who it covers, 2025-26 amendments, and enforcement rules.
The CTDPA (Conn. Gen. Stat. § 42-515 et seq.) is Connecticut's comprehensive data privacy law, effective July 1, 2023. Learn who it covers, consumer rights, the universal opt-out deadline, and penalties.
The DPDPA (Del. Code tit. 6, ch. 12D) took effect Jan 1, 2025, covers many nonprofits and colleges, and carries AG penalties up to $10,000 per violation.
The FDBR (Fla. Stat. 501.701 et seq.) took effect July 1, 2024, with the narrowest controller test in the US: over $1B revenue plus a big-tech prong.
The Iowa Consumer Data Protection Act (Iowa Code 715D) took effect Jan. 1, 2025. Its limited rights make it the most business-friendly U.S. state privacy law.
The Indiana Consumer Data Protection Act (IC 24-15) takes effect Jan. 1, 2026, the longest runway of any state privacy law. A Virginia-style INCDPA explainer.
The KCDPA (KRS 367.3611 to 367.3629) takes effect January 1, 2026, a close clone of Virginia's law with a 100,000-consumer threshold and opt-in sensitive data.
The Montana Consumer Data Privacy Act (Mont. Code Ann. 30-14-2801) took effect Oct 1, 2024 and now carries the nation's lowest thresholds: 25,000/15,000.
The Minnesota Consumer Data Privacy Act (Minn. Stat. ch. 325M) took effect July 31, 2025, with a unique right to question profiling decisions.
The Nebraska Data Privacy Act (Neb. Rev. Stat. 87-1101) took effect Jan 1, 2025 and uses the Texas-style federal small-business test, with no numeric threshold.
The NHDPA (RSA 507-H) took effect January 1, 2025, with a low 35,000-consumer threshold and opt-in sensitive data. AG enforces; no private right of action.
The NJDPA (N.J.S.A. 56:8-166.4 et seq.) took effect Jan 15, 2025, treats financial data as sensitive, and carries AG penalties up to $10,000 per first violation.
The OCPA (ORS 646A.570 to 646A.589) took effect July 1, 2024, with no dollar threshold and a rare specific-third-party-list right. AG penalties up to $7,500.
The RIDTPPA (R.I. Gen. Laws 6-48.1) takes effect Jan 1, 2026, with a 35,000-customer threshold, opt-in sensitive data, and a unique third-party disclosure duty.
The TDPSA (Tex. Bus. & Com. Code ch. 541) took effect July 1, 2024. Learn who it covers, consumer rights, and up to $7,500 per-violation AG enforcement.
The TIPA (Tenn. Code Ann. 47-18-3201 et seq.) took effect July 1, 2025, with a $25M revenue gate and a unique NIST Privacy Framework affirmative defense.
The Utah Consumer Privacy Act (Utah Code 13-61-101) took effect Dec. 31, 2023. Its $25M AND-gated threshold makes Utah's coverage the narrowest U.S. state law.
The VCDPA (Va. Code Ann. § 59.1-575) is Virginia's comprehensive data privacy law, effective Jan 1, 2023. Learn who it covers, consumer rights, and penalties.
Got a data breach letter? Verify it's real, freeze your credit free at all three bureaus, then enable free monitoring, in that order, before anything else.
The Willow TV VPPA settlement closed claims July 21, 2026. The final approval hearing was reset to October 22, 2026; the $850,000 fund pays pro rata.
Wisconsin's breach notification law covers biometric data and DNA profiles with a 45-day notice rule. Learn about protections and proposed legislation.
Wisconsin requires data breach notification within 45 days. Learn its PI definition covering biometric data and DNA, no AG reporting requirement, and $10,000 per violation penalty.
Wisconsin requires 45-day breach notification under Wis. Stat. 134.98, protects student records through Wis. Stat. 118.125, and has pending comprehensive privacy legislation.
Wyoming protects biometric data only through breach notification law Wyo. Stat. 40-12-501. Learn about requirements, penalties, and gaps.
Wyoming requires data breach notification without unreasonable delay for private sector entities. Learn its broad PI definition including biometric data, enforcement rules, and safe harbors.
Wyoming has no comprehensive consumer privacy law but enforces data breach notification under Wyo. Stat. 40-12-501 to 502, the Genetic Data Privacy Act, and federal protections.