New Hampshire’s data privacy law went into effect this year. Other states are following suit.

This year, comprehensive privacy laws are going into effect in eight states to regulate how businesses handle digital information and to give consumers more protections over their personal data.

The laws in Delaware, Iowa, Minnesota, Nebraska, New Hampshire, New Jersey and Tennessee have taken effect already this year, according to a database from the International Association of Privacy Professionals’ Westin Research Center. Maryland’s privacy law, signed by Democratic Gov. Wes Moore last year, will go into effect Oct. 1.

Privacy laws enacted in Indiana, Kentucky and Rhode Island will go into effect next year.

Several other states are considering comprehensive privacy bills during this year’s legislative sessions. They include Massachusetts, Michigan, North Carolina, Pennsylvania and Wisconsin.

When a person visits a website, applies to a job or logs into an online portal, they may be sharing their personal information. Comprehensive privacy laws can apply to a wide range of companies that participate in this kind of data collection.

These laws generally include two types of provisions — those related to consumer rights and those that establish business obligations, according to the association.

Under each of the new laws, consumers have the right to control when and how their data is collected and shared. Some of those provisions include the right to delete data from a company’s database, the ability to opt out of sharing sensitive information and the right to prohibit a company from selling their data.

New Hampshire’s law, which went into effect in January, allows a consumer to take action to prevent their data from being stored by companies and businesses and gives them tools to remove or amend that data.

The new measures also require businesses to ask consumers if they want to opt in to data collection. In some states, businesses are required to complete consumer data risk assessments and identify ways in which discrimination could take place. Some companies also may be required to limit how consumer data is processed.

In 2018, California became the first state to enact comprehensive privacy legislation for residents; the law went into effect in 2020. Virginia and Colorado enacted laws in 2021. Connecticut, Montana, Oregon, Texas and Utah also have comprehensive laws that have taken effect, the database shows.

Other states have passed measures with more specific data protections this year. California, Colorado and Montana, for instance, passed legislation that aims to protect sensitive brain data collected by devices outside of medical settings, KFF Health News reported earlier this year.

One bill under consideration in New York would establish data privacy protections for children. And another measure in Pennsylvania aims to improve consumer data protections with genetic testing companies.

Without comprehensive federal protections, state lawmakers are driving the push to protect consumers from having their personal information shared without their knowledge.

Stateline reporter Madyson Fitzgerald can be reached at [email protected].

Stateline is part of States Newsroom, a nonprofit news network supported by grants and a coalition of donors as a 501c(3) public charity. Stateline maintains editorial independence. Contact Editor Scott S. Greenberger for questions: [email protected].