If You Live in One of These States, You’ll Have New Privacy Protections in 2025

Residents of five states will ring in the new year with the best gift of all: new privacy rights.

This coming January will see consumer data privacy laws that were enacted by state lawmakers in 2023 and 2024 go into effect in Delaware, Iowa, Nebraska, New Hampshire and New Jersey. This will bring up to 13 the number of states with active privacy laws.

New laws regulate businesses of certain sizes—size varies by state—manages sensitive consumer information and gives residents of that state various rights to know, correct, and delete data held by businesses. Here are some key provisions in the new suite of laws:

Delaware

Originally passed in 2023, the law applies to individuals and entities that, in the preceding calendar year, processed the personal information of 35,000 Delaware residents or processed the personal information of 10,000 Delaware residents and made more than 20 percent of their gross revenue from the sale of personal information.

Unlike many other state privacy laws, it applies to both nonprofit and for-profit businesses.

It gives residents the right to know what personal information an organization holds about them, to obtain a copy of that information, to correct it, and to opt out of that information being used for targeted advertising, sold to third parties, or used for automated decision-making. with significant legal implications.

The law will come into effect on January 1.

Iowa

Also passed in 2023, Iowa’s law applies to businesses that process the personal information of at least 100,000 residents or process information for 25,000 residents and make more than half of their gross revenue from the sale of such data.

It is a narrower, more business-friendly law than other state laws that have been enacted.

Although consumers are given the right to access and delete information held by a business and to opt out of having it sold to third parties, they are not allowed to correct that information, opt out of its use for targeted advertising, or opt out. It is used to make automatic decisions about them.

The law will come into effect on January 1.

Nebraska

State data privacy laws do not have a specific revenue or customer count threshold. This applies to any business that is not a small business as defined by the federal Small Business Act (and also applies to small businesses that sell sensitive data without first obtaining consumer consent).

It gives consumers the right to access, correct and delete personal data held by businesses and to opt out of that data being used for targeted advertising, sold to third parties or used in certain automated decision-making systems.

The law will come into effect on January 1.

New Hampshire

The law applies to businesses that process the personal information of 35,000 Granite Staters or that process the personal information of 10,000 Granite Staters and make 25 percent of their gross revenue from the sale of such information.

It gives residents the right to access, correct and delete personal data held by eligible businesses and to opt out of the data being used for targeted advertising, sold to third parties or used in certain automated decision-making systems.

The law will come into effect on January 1.

New Jersey

The Act applies to businesses that process the personal information of at least 100,000 residents (unless that processing is solely for the purpose of completing payments) or businesses that process the personal information of 25,000 residents and sell or profit from such information.

Like many of the previously mentioned laws, it provides consumers with the right to access, correct, and delete personal information and to opt out of data being used for targeted advertising, sales to third parties, or certain automated decision-making systems.

However, it will allow consumers to signal their desire to opt out of those uses through what is known as a public opt-out process. Although not defined in the text of the law, a universal opt-out mechanism could be something like a browser extension that notifies each website a user visits of their privacy preferences, rather than communicating those preferences to each business individually.

The law will come into effect on January 15.