In a previous article (The “California Effect,” Again), we observed the sudden rise in states making changes to their privacy laws: recently, California became the first in the nation to impose severe restrictions on internet companies’ interactions with minors. Although it will not go into effect until 2024, this law requires companies to account for the well-being of children in their platform designs as well as restricts eight common practices for data collection.
However, it turns out that California is just the tip of the iceberg. State privacy laws have gotten off to a fast start in 2023, and Montana and Tennessee have joined a growing number of governments that have introduced comprehensive privacy legislation. Modeled after Connecticut’s consumer privacy law, each of these bills require data protection assessments and the rights for consumers to access, correct and delete their personal data. Here is what you need to know from both bills:
- Montana provides several important rights to consumers, including the ability to confirm whether a business with more than 50,000 consumers has their personal data and is processing it. This allows individuals to correct any inaccuracies as well as delete this information to guard against future use. Beginning January 1, 2025, these businesses must allow consumers to opt out of targeted advertising as well as the sale of their personal data via a clearly highlighted opt-out preference signal. Additionally, individuals can opt out of automated decisions that produce legal effects.
- Tennessee’s bill has a slightly smaller threshold for application (e.g., it applies to certain businesses that exceed $25 million in revenue), though it still allows for consumer confirmation as to whether businesses are processing their personal information. It also allows individuals to obtain a copy of whatever information they previously shared with a business in a format that allows them to share it with a different business if they so choose. Perhaps most importantly, it gives consumers the active ability to opt out of businesses processing their personal data when it comes to selling, targeted advertising or producing legal effects.
As it stands, only five states have comprehensive privacy laws on the books. However, that number is set to increase with eight states having introduced privacy bills last year to address several important privacy concerns. With the Montana and Tennessee bills set to hit their respective governors’ desks, it seems like we are standing on the precipice of a privacy protection revolution at the state level. Watch this space for more information as these privacy efforts unfold.
