If You Live in One of These States, You’ll Have New Privacy Protections in 2025

Residents of five states will be ringing in the new year with the best gift of all: new privacy rights.

This coming January will see consumer data privacy laws passed by state lawmakers in 2023 and 2024 take effect in Delaware, Iowa, Nebraska, New Hampshire, and New Jersey. It will bring the number of states with effective privacy laws up to 13.

The new rules regulate that businesses of certain sizes—size varies by state—managing sensitive consumer information and giving residents of those states various rights to know, correct, and delete data businesses hold about them. Here are some of the key principles in the new set of rules:

Delaware

Originally passed in 2023, the law applies to individuals and organizations that, in the preceding calendar year, processed the personal information of 35,000 Delaware residents or processed the personal information of 10,000 Delaware residents and generated more than 20 percent of their gross revenue from sales. of personal information.

Unlike many other state privacy laws, it applies to both nonprofit and for-profit businesses.

It gives citizens the right to know what personal information an organization holds about them, obtain a copy of that information, correct it, and opt out of having that information used for targeted advertising, sold to a third party, or used for automated decision-making. and important legal consequences.

The law will take effect on January 1.

Iowa

Also passed in 2023, the Iowa law applies to businesses that process the personal information of at least 100,000 residents or that process the information of 25,000 residents and make more than half of their total revenue from the sale of that data.

It is a smaller, more business-friendly law than many other state laws that have come into effect.

Although consumers are given the right to access and delete information a business has about them and to opt out of having it sold to a third party, they are not allowed to correct that information, opt out of using targeted advertising, or opt out of it. is used to make automatic decisions about them.

The law will take effect on January 1.

Nebraska

The country’s data privacy law does not contain a specific amount or customer count. It applies to any business that is not a small business, as defined by the Small Business Act (and applies to small businesses that sell sensitive data without first obtaining the consumer’s consent).

It gives consumers the right to access, correct, and delete personal information held by businesses and to opt out of using that data for targeted marketing, selling to third parties, or being used in certain automated decision-making programs.

The law will take effect on January 1.

New Hampshire

The law applies to businesses that process the personal information of 35,000 Granite Staters or that process the personal information of 10,000 Granite Staters and make 25 percent of their gross revenue from the sale of that information.

It gives citizens the right to access, correct, and delete personal data held by eligible entities and to opt out of such data being used for targeted advertising, sold to third parties, or used in certain automated decision-making systems.

The law will take effect on January 1.

New Jersey

The law applies to businesses that process the personal information of at least 100,000 residents (unless such processing is for the sole purpose of completing payments) or businesses that process the personal information of 25,000 residents and profit from the sale or sale of such information.

Like many of the previously mentioned laws, it gives users the rights to access, correct, and delete personal information and the rights to opt out of such data being used for targeted advertising, sold to third parties, or used in certain automated decision-making systems.

However, it will also allow consumers to indicate their desire to opt out using what is known as the universal opt-out method. Although not defined in the legal text, a universal opt-out mechanism could be something like a browser extension that informs every website a user visits about their privacy choices, rather than the user needing to communicate those choices with each entity.

The law will come into effect on January 15.