In 2023, five comprehensive state privacy laws go live: California’s CPRA (the updated CCPA), Virginia’s CDPA, Colorado’s CPA, Connecticut’s CTDPA, and Utah’s UCPA. Each law gives consumers new rights — the right to access their data, correct it, delete it, and opt out of its sale or use in targeted advertising.

The laws vary in scope and enforcement mechanisms, but they share a common thread: businesses that collect, process, or sell personal data now face real legal obligations, not just best-practice guidance. California’s law adds a new data minimization requirement and expands enforcement to the newly formed California Privacy Protection Agency.

For companies operating across state lines, the patchwork creates a compliance challenge. A business that is compliant in Virginia may not be compliant in Colorado. Legal teams are recommending a California-first approach: if you meet CPRA’s requirements, you are likely in reasonable shape for the others.

The trend is clear. The United States is moving toward a culture of enforceable data rights, one state at a time.