New State Bills Inspired By The California Consumer Privacy Act May Re-Appear Next Year

Author:Ropes & Gray LLP
Profession:Ropes & Gray LLP

The California Consumer Privacy Act (CCPA) inspired legislators in several other states to attempt to pass similar legislation aimed at protecting the privacy rights of consumers. As the legislative calendars for most of those states have wound to a close before the recent election, this Alert reviews those bills as a preview to what we should expect in the next legislative session, particularly as several states will be returning a more progressive assembly.

Currently, only Nevada has passed a bill inspired by, but substantially narrower than, the CCPA. Unlike the CCPA, the Nevada law does not provide rights to access or erase personal information, and it provides opt-out rights to a significantly narrower set of disclosures of personal information. Of the currently outstanding bills, only Massachusetts, New Jersey, and Pennsylvania remain. Other bills in Connecticut, North Dakota, and Texas were passed only after they were amended to remove the CCPA-like provisions and replace them with clauses establishing commissions to study the privacy laws of other states. Even among the bills that did not pass this legislative session, many of these proposals may reemerge next year. We take a look at the contents of the proposed legislation in each of those states and discuss where each bill stands in the legislative process.

Passed Legislation: Nevada

Of all the states that proposed legislation similar to the CCPA, only Nevada managed to pass the bill through to enactment during this legislative term. The Nevada bill, SB 220, came into effect before the CCPA, on October 1, 2019. The act requires operators of commercial websites or online services (not all businesses) to allow Nevada resident consumers the opportunity to opt-out of the “sale” of personal information about them. The Nevada statute defines “sale” more narrowly than the CCPA's broad definition. Under SB 220, “sale” only encompasses the exchange of information for “monetary consideration.” Financial institutions subject to GLBA and entities subject to HIPAA are excluded from coverage by the Nevada statute.

CCPA Inspired Bills That Are Still Outstanding: Illinois, Massachusetts, New Jersey, and Pennsylvania

For four statesIllinois, Massachusetts, New Jersey, and Pennsylvaniathere is still a possibility of legislation related to the CCPA this term. The legislative sessions for Illinois, New Jersey, and Pennsylvania will remain open through the end of the year, while the Massachusetts formal legislative session will remain open through November (an informal session will continue through...

To continue reading