Privacy in the West
Under California’s consumer privacy laws, residents have this right if their personal data is inaccurate.
What is the right to correct inaccurate personal information?
This state's 2016 privacy law, known as DAPA, requires websites to post and follow a comprehensive privacy policy.
What is Delaware?
The VCDPA applies to businesses processing data from 100,000 Virginia residents—or just 25,000 if over half of revenue comes from this.
What is selling personal information?
What states have in common, privately.
While most states only allow the Attorney General to enforce breach laws, this type of legal provision allows individuals to sue directly.
Unlike similar privacy laws in California, Colorado's privacy act does not exempt these types of organizations.
What are nonprofit organizations?
Under FDBR, Florida consumers can request corrections, deletions, or details about their data—and businesses must respond within this number of days.
What is 45 days?
A privacy law in Montana applies to companies handling data of 50,000+ individuals or 25,000 if over 25% of revenue comes from this activity.
What is selling personal data?
Washington’s 2017 law prohibits collecting biometric identifiers like fingerprints or iris scans without doing this first.
What is providing notice and obtaining consent?
The CTDPA does not apply to entities like nonprofits, educational institutions, or these federally regulated health organizations.
What are HIPAA-covered entities?
Texas’s privacy law is enforced by this state official and includes a 30-day cure period before penalties up to $7,500 per violation can be imposed.
Who is the Texas Attorney General?
Utah’s privacy law applies to businesses earning over $25 million annually or processing data of this number of Utah residents.
What is 100,000 (or 25,000 if selling personal data)?
Under New York’s cybersecurity rule, covered entities must designate this person to oversee cybersecurity programs and report annually to the board.
Who is the Chief Information Security Officer (CISO)?
If a breach affects over 1,000 individuals in Pennsylvania, businesses must notify these third-party agencies in addition to affected consumers.
What are consumer reporting agencies?
Under OCPA, Oregon residents can access, delete, correct, and opt out of data processing—and businesses must respond within this many days.
What is 45 days?
New Jersey’s privacy law includes a private right of action and allows civil penalties of this amount for a second violation.
What is $5,000?
Illinois’ biometric privacy law requires consent for collecting data like fingerprints and facial scans—and allows individuals to sue over violations.
What is the Biometric Information Privacy Act (BIPA)?