The Patchwork Quilt of State Privacy Laws Continues to Expand
The patchwork quilt of state privacy laws continues expanding with no relief. With the New Jersey Privacy Statute signed into law on January 16, the list of states with privacy statutes now numbers 13. Five of them, CO, DE, IN, NJ, and OR, cover nonprofits, while the other eight states do not: CA, CT, IA, MT, TN, TX, UT, and VA. Privacy legislation that is limiting and costly for nonprofits’ commercial partners directly affects the nonprofit organizations that will ultimately bear the burden of less data and higher costs for the data they utilize to reach new supporters.
What’s on the Horizon for 2024?
At the top of the list is Oklahoma, where legislation was seriously considered on two occasions, first in 2021 and then again in 2023, to become the nation’s first state with an “opt-in” state privacy statute. We are in close contact with our Oklahoma members to monitor a likely third attempt by legislators in 2024.
Last year, New York considered privacy legislation covering nonprofits and commercial entities. New York is one of the few states whose legislature is in session all year, and there may not be movement on this until later in 2024. Nonetheless, given the size and importance of New York, we’re keeping a close watch on this situation.
Another significant recent development was last October in California when Governor Newsom signed legislation into law, creating a “delete my information” provision whereby consumers/donors could request removal from all 500+ California-registered data brokers with a single click. Despite the opposition of The Nonprofit Alliance (TNPA) and many organizations involved in third-party data, the California Legislature adopted this legislation (SB 362), and Governor Newsom signed it into law. This measure, which will harm nonprofits that fundraise in California, will take effect on January 1, 2026. If you want to work with TNPA regarding future rulemaking for this legislation or possible legislative amendments, please contact TNPA’s Vice President of Government Affairs, Mark Micali, at firstname.lastname@example.org.
Unfortunately, the ever-increasing list of state privacy laws has not created a sense of haste in Congress toward enacting comprehensive bipartisan national privacy legislation to pre-empt the state-by-state patchwork quilt. TNPA continues working with Republicans and Democrats on Capitol Hill on federal privacy legislation but expects it will likely take several years to pass. In the meantime, nonprofits and the data firms that manage and source data for nonprofits must continue to adapt to the ever-changing array of state-by-state mandates.
Read more about state legislation that has been proposed or enacted at the bottom of this page and also on our webpage Legislation in the States.
Data Privacy: Background & Current Situation
PRIVACY: What is the issue?
As Americans are sharing more personal data and as the internet has enabled companies to collect more personal data, it is important to ensure that nonprofit organizations are ethical custodians of the data with which they are entrusted, and also have access to the information to enable them to further their missions.
Why do nonprofits care?
- Donor trust is foundational to nonprofits’ ability to raise funds and provide services.
- Organizations use consumer data and third-party data providers to ensure our programmatic and fundraising marketing messages are delivered to those most likely to benefit – and, likewise, not to those who will not.
- At times we also use consumer data, including aggregated depersonalized data, to assess need, measure effectiveness, and better direct resources to the people and places that need it the most.
- Nonprofits rely on commercial data companies to maintain data in secure environments at a level that many nonprofits could not afford to maintain on their own, certainly not without significantly reducing the funds available to spend on direct mission-focused work.
What is the Ideal Policy?
TNPA calls upon Congress to enact a national privacy statute for the proper handling of data, to both protect consumers and allow for the legitimate use of data:
- Federal legislation to create a single, clear, uniform set of national standards and guidelines.
- Include a clear preemption of any current or future state privacy statutes to create national consistency of laws.
- Require litigation of federal privacy legislation be filed in only federal court (and not state courts), which would create greater national uniformity of enforcement.
- No Private Right of Action, which could result in a proliferation of class action lawsuits, many of which would be frivolous.
For an in-depth discussion of these points and policy proposals, read TNPA’s Discussion Points in Preparation for Drafting Federal Legislation Called The Individual Privacy Act.
What is the Current Situation?
U.S. Federal Law:
Over the years a number of federal laws have been passed dealing with portions of the handling of data, however there is no broad-based federal statute to address the overall question of how data should be handled to better protect the privacy of consumers, while setting out clear guidelines for the proper use of data by businesses.
On December 20, 2022, the Omnibus Spending Package to fund the federal government through the end of the fiscal year (September 30, 2023) did NOT include the language of H.R. 8152, the American Data Privacy and Protection Act, which was reported out of the House Energy & Commerce Committee earlier in 2022. As proposed in July, 2022 H.R. 8152 included fifteen “carveouts” which would allow current state privacy-related statutes to stay in force. The bill also allowed for a Private Right of Action, which could lead to frivolous class action lawsuits.
Since H.R. 8152 was not included in the “must pass” Omnibus Spending Package, it was thus not enacted into law before Congress officially closed out the 117th Congress at year end. Accordingly, H.R. 8152 “died,” as all legislation which has not passed does at the end of a two-year congressional cycle. With the new 118th Congress having convened in January, Congress starts over with a clean slate.
Far-reaching, highly impactful legislation — which comprehensive national privacy legislation clearly is — often takes several two-year Congresses to gain enactment.
(See below for individual states)
In the States:
What to keep an eye on
California State Law:
California Consumer Privacy Act (CCPA) of 2018
- It does exempt nonprofit organizations from its restrictions.
- However, the burdens placed on corporate providers of data to nonprofits have stopped many small- to mid-sized data providers from doing business in California, creating obstacles and extra expense for nonprofits communicating with supporters in California.
According to the California Attorney General’s website:
The California Consumer Privacy Act of 2018 (CCPA) gives consumers more control over the personal information that businesses collect about them and the CCPA regulations provide guidance on how to implement the law. This law secures new privacy rights for California consumers, including:
- The right to know about the personal information a business collects about them and how it is used and shared;
- The right to delete personal information collected from them (with some exceptions);
- The right to opt-out of the sale of their personal information; and
- The right to non-discrimination for exercising their CCPA rights.
California Privacy Rights Act (CPRA) of 2020
- Modified the CCPA (above) when approved via ballot initiative Proposition 24 in November 2020.
- Creation of a new California Privacy Protection Agency.
- The key provisions of the CPRA will NOT go into effect until January 1, 2023.
Colorado State Law:
Colorado SB 190 , the Protect Personal Data Privacy Act, was signed into law on July 7, 2021, and will take effect on July 1, 2023. Major provisions include:
- Enable a consumer to opt-out of the processing of their personal information.
- Confirm whether or not a controller is processing personal data concerning the consumer and to provide access to that information.
- The right to correct inaccurate personal information.
- The right to have personal information deleted.
- Controllers would be required to provide a meaningful privacy notice to consumers detailing their various rights
- Does not contain a private right of action.
Nonprofit organizations are NOT exempted from the requirements of the law.
- The statute does not prescribe fundraising, but unlike other states, registering to solicit in the state is considered “doing business” in Colorado.
- To fall under the jurisdiction of the statute, an organization must have personal data on 100,000 or more Coloradans; or receive revenue or discounts from the sale of data (e.g., list rental and exchange) and have data for 25,000 or more Coloradans.
Connecticut State Law:
Connecticut SB 6/Public Act 22-15, sponsored by Senate President Pro Tempore Martin Looney, D-New Haven, was signed on May 10, 2022, and takes effect July 1, 2023. The law will grant consumers various rights including:
- The right to confirm whether or not a controller is processing the consumer’s personal data.
- The right to correct inaccuracies in their personal data.
- The right to delete personal data provided by or obtained about the consumer.
- The right to obtain a copy of the consumer’s personal data processed by the controller.
- The right to opt out of the processing of the personal data for the purposes of targeted advertising, the sale of personal data or profiling in furtherance of decisions that produce legal or similarly significant effects.
Controllers will be required to respond to verified consumer requests within 45 days but could request an extension of an additional 45 days. Controllers will also be prohibited from processing the sensitive data of a consumer without their affirmative consent. The law will not apply to nonprofit organizations, does not provide a private right of action and will grant controllers a right to cure at the discretion of the attorney general. The law will also specify that a controller is not required to authenticate an opt-out request but will be able to deny a request if the controller has reasonable and documented belief that the request is fraudulent. Controllers will be required to send notice to the person making the request that they believe the request is fraudulent.
Utah State Law:
Utah SB 227 was signed March 24, 2022, and takes effect December 31, 2023. The law will grant consumer’s various rights including:
- The right to confirm whether a controller is processing the consumer’s personal data and to access their data.
- The right to correct inaccurate personal data.
- The right to delete the consumer’s personal data.
- The right to obtain their personal data in an easily portable format.
- The right to opt-out of the processing of their data for the purposes of targeted advertising or the sale of personal data.
The law does not apply to nonprofit organizations and does not contain a private right of action.
Virginia State Law:
Virginia SB 1392, the Virginia Consumer Data Protection Act, was signed into law on March 2, 2021, and will take effect on January 1, 2023. The CDPA grants consumers the right to confirm, correct, and delete personal data and opt-out of use of data for advertising or sale. It includes an opt-in consent requirement for sensitive data. Nonprofits are largely exempt.
Other states have considered their own new state privacy statutes over the past few years, risking the creation of a “patchwork quilt” of varying, and often conflicting, state privacy laws.
Click here for more information about privacy legislation being proposed in state legislatures.
Who are key players?
IN THE U.S. SENATE
- Senator Maria Cantwell (D-WA) as Chair of the Commerce Committee.
- Senator Ted Cruz (R-TX) as Ranking Republican on the Commerce Committee.
- Senator Jerry Moran (R-KS) as a senior member of the Commerce Committee.
- Senator John Thune (R-SD) as the former Chair of the Commerce Committee and Senate Republican Whip.
IN THE U.S. HOUSE OF REPRESENTATIVES
- Congresswoman Cathy McMorris Rodgers (R-WA) as the Chair of the Energy & Commerce Committee.
- Congressman Frank Pallone (D-NJ) as the Ranking Democrat on the Energy & Commerce Committee.