In an era dominated by digital connectivity and information exchange, privacy is a paramount concern for individuals and businesses alike. With the exponential rise of technology, especially in the realms of social media, e-commerce and data analytics, legislative frameworks have had to adapt to safeguard individual privacy effectively.

The United States is not alone in recognizing the need for robust safeguards and there have been significant developments in privacy laws in 2023, with this trend set to continue in 2024. These changes mirror the approach taken in the UK and Europe and aim to strike a delicate balance between protecting personal data and fostering innovation in an increasingly interconnected world.

What is the current privacy landscape?

California has led the charge with the California Consumer Privacy Act (CCPA) in 2018 and has since strengthened its commitment to privacy with the California Privacy Rights Act (CPRA) which was enacted last year and becomes enforceable in March 2024. Since 2018, other states have followed California’s lead and we now have privacy rules either passed or drafted in most states, although these do vary significantly in scope and stringency. This year has already seen New Jersey and New Hampshire introduce privacy bills, and it is expected that the rest of 2024 will see more US states catch up and introduce or pass bills in this area, particularly on the East Coast.

The global landscape of data protection also cannot be ignored. The UK and European approach set a benchmark for privacy standards worldwide. As transnational data flows continue to increase, US businesses are increasingly subject to international regulation, necessitating alignment with GDPR principles and other global standards. The US is also seeing the fragmented implementation of more “European” style principles, including the requirement for controllers to disclose the identity of third-party vendors with whom data is shared (including through online tracking technologies) and the introduction of “opt in” consent for processing of sensitive data and the need to have a “warning label” for the sale of such data.

What about federal legislation?

However, the lack of a federal privacy law in the US remains a notable gap. While proposals for a comprehensive federal privacy law have circulated for years, political gridlock and differing ideological perspectives have hindered significant progress. In the absence of federal legislation, companies operating across state lines must navigate a patchwork of regulations, leading to compliance challenges and inconsistencies.

The quest for privacy is still a dynamic and multifaceted challenge, but the tide certainly seems to be turning. In response to mounting pressure from consumers, advocacy groups, and international counterparts, momentum for federal privacy legislation has been building. We have also seen greater federal enforcement action, particularly in relation to health data, which may push forward the agenda for a unified framework of privacy standards.

What does that mean for businesses operating in the US?

The current privacy landscape reflects progress and evolution, but significant challenges persist and the patchwork of rules are here for the immediate future. As rules develop and technology continues to advance, staying informed and proactive in addressing privacy concerns will be key for businesses on both sides of the pond. Privacy protection is not going away as an area of concern and increased regulation, so businesses should take privacy rules seriously and start taking steps now to comply.