New data privacy rules take effect in three states

The regulations span consumer rights, business obligations, and enforcement mechanisms. They generally grant individuals the right to know what data is collected, request deletion, and opt out of certain processing activities. Coverage applies to businesses meeting size or data-handling thresholds, not small operations or non-profits.

Businesses must update privacy policies, implement streamlined opt-out mechanisms, and maintain internal processes to verify and respond to consumer requests within defined timeframes. Many rules align with broader trends like the GDPR, yet each state retains unique requirements around scope and penalties.

Enforcement begins immediately, with state attorneys general or designated agencies empowered to investigate complaints and impose fines. Violations may also trigger private rights of action in some cases, increasing legal exposure for non-compliant entities.

Preparation remains critical as businesses adjust operations across multiple jurisdictions. Many adopt unified compliance strategies to serve all users, even outside regulated states. This reduces complexity while meeting the strictest standards nationwide.