Interested in training for your team? Click here to learn more

New State Data Privacy Laws in 2025: Corporate Counsel Compliance Guidance

A live 90-minute CLE video webinar with interactive Q&A

This program is included with the Strafford CLE Pass. Click for more information.
This program is included with the Strafford All-Access Pass. Click for more information.

Thursday, April 17, 2025

1:00pm-2:30pm EDT, 10:00am-11:30am PDT

or call 1-800-926-7926

This CLE webinar will brief corporate counsel on the compliance challenges and key differences with California's and other states' new privacy laws and regulations. The panel will also discuss effective strategies for managing the widening corporate data privacy risk landscape across territories.

Description

Currently, there is no omnibus federal privacy law in effect in the United States--only issue- or industry-related laws such as the Gramm-Leach-Bliley Act for financial institutions, HIPAA for healthcare, and COPPA for children online. Instead, privacy laws consist of a patchwork of myriad state laws with ever-growing complexity.

In 2025, new privacy laws in Delaware, Iowa, Nebraska, New Hampshire, and New Jersey became effective in January; and in Tennessee, Minnesota, and Maryland, comprehensive privacy laws are scheduled to go into effect later this year. Indiana, Kentucky, and Rhode Island join in 2026. These privacy laws define "personal data" broadly, and there are some material differences between them as to obligations and rights. Some states' laws borrow key terms and definitions from the EU General Data Protection Regulation and others from the California regime. All give residents more control over their personal data, especially regarding third-party disclosures and use for advertising.

Effective Jan. 1, 2023, the California Privacy Rights Act (CPRA) amended and broadened the California Consumer Privacy Act passed in 2020. The CPRA is the only one of the comprehensive state privacy laws in the U.S. to date that includes a limited private right of action. The CPRA also created a new enforcement and rulemaking body, the California Privacy Protection Agency. In October 2023, California also passed the Delete Act, which allows consumers to request the deletion of their personal information from all data brokers; and in February the public comment period closed on a draft of new generation of California regulations on automated decision making/profiling/AI, risk assessments, cybersecurity audits and amendments to the existing regulations.

Given the evolving patchwork of laws and regulations, there are significant differences that every enterprise and its counsel should be aware of in the event they meet applicable jurisdictional thresholds and process personal data in those states. It is critical to have thorough knowledge of which state privacy laws apply, how to comply, and ways to avoid regulatory investigations to minimize costly claims and business disruption.

Listen as our distinguished panel of attorneys guides counsel with respect to the requirements, similarities, and differences of recent state privacy laws. The panel will also offer best practices for minimizing data privacy and protection risks and proactive measures for data handling in anticipation of future corporate compliance obligations as additional state laws, and/or a federal law, may emerge.

READ MORE

Outline

  1. U.S. state data privacy laws and recent developments
    1. New data subject rights and company obligations and limitations
    2. Data minimization and retention limitations
    3. Advertising and cookies
    4. Data disclosures to vendors and others
    5. Security
  2. The game-changing nature of the new CA regulations
    1. ADMT/Profiling/AI,
    2. Evaluations and Assessments
    3. Cybersecurity Audits
    4. Material amendments to existing regulations
  3. Approaches and Best Practices for Compliance and Information Governance

Benefits

The panel will cover these and other important issues:

  • What are some of the similarities and differences between the new crop of U.S. state privacy laws and between the state laws?
  • What are the benefits of conducting a data protection impact assessment, and what is required and when?
  • The pros and cons of setting a highwater mark rather than treating residents based on what is required in their state
  • How to practically prioritize company data privacy compliance efforts to minimize risk

Faculty

Friel, Alan
Alan L. Friel

Partner, Chair Data Privacy, Cybersecurity & Digital Assets Practice
Squire Patton Boggs

Mr. Friel is a thought leader in digital media, IP, data privacy and protection, and consumer protection law, with over...  |  Read More

Jaworski, Myriah
Myriah V. Jaworski

Member, Data Privacy/Cyber Security Group
Clark Hill

Focusing her practice on the intersection of law and technology, Ms. Jaworski advises clients on enterprise-wide data...  |  Read More

Marticke, Samuel
Samuel E. Marticke

Associate
Squire Patton Boggs

Mr. Marticke is an Associate in the Data Privacy, Cybersecurity & Digital Assets Practice Group. He also represents...  |  Read More

Attend on April 17

Cannot Attend April 17?

You may pre-order a recording to listen at your convenience. Recordings are available 48 hours after the webinar. Strafford will process CLE credit for one person on each recording. All formats include course handouts.

To find out which recorded format will provide the best CLE option, select your state:

CLE On-Demand Video