Guidance on Protecting Personal Information in the United States
In 2023, the privacy landscape in the United States saw a significant shift with the enactment of several comprehensive state data privacy laws [1]. As of mid-2025, the country does not have a single, comprehensive federal data privacy law; instead, the data privacy regime remains a complex mosaic of state laws.
Eight new state laws became effective in 2025, each introducing varying rights, response timelines, and enforcement structures. Iowa, Delaware, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, and Maryland each enacted their own privacy statutes. For instance, Iowa’s law has a relatively long consumer request response period of 90 days and is enforced solely by the Attorney General, while Delaware’s law applies to smaller businesses and mandates disclosure of third-party data recipients [1].
Furthermore, five states—Colorado, Connecticut, Kentucky, Montana, and Oregon—enacted significant amendments to their existing consumer data privacy laws in 2025. Notably, Connecticut made broad changes including profiling and AI-related provisions, while Colorado expanded the definition of sensitive data to include precise geolocation and imposed restrictions on selling sensitive data without consent [2].
Over 800 consumer privacy-related bills were introduced across 49 states plus DC in 2025, with over 30 states enacting more than 100 laws. Regulatory focus has intensified on teen data, social media, biometric data, geolocation, and new technological challenges like artificial intelligence [4][5].
As of 2025, a total of twenty states have passed comprehensive data privacy laws in the United States: California, Virginia, Colorado, Connecticut, Utah, Iowa, Indiana, Tennessee, Texas, Florida, Montana, Oregon, Delaware, New Hampshire, New Jersey, Kentucky, Nebraska, and Rhode Island. Rhode Island became the latest state to enact comprehensive data privacy legislation, the Rhode Island Data Transparency and Privacy Protection Act, which will take effect on January 1, 2026 [6].
Enforcement activities have also been on the rise. The California Attorney General's office is moving forward with enforcement activities, despite a recent court ruling delaying enforcement [7]. In a significant development, the California Attorney General announced a record $1.55 million settlement with Healthline Media LLC for alleged violations of the California Consumer Privacy Act (CCPA) [8]. Connecticut's Attorney General has also released a report on the first six months of the Connecticut Data Privacy Act, highlighting enforcement priorities on companies' privacy policies, protections of "sensitive data" and teen data [9].
On the federal level, the Department of Justice issued a final rule implementing Executive Order 14117, which prohibits and restricts certain data transactions that pose national security risks, targeting China, Cuba, Iran, North Korea, Russia, and Venezuela [10].
In summary, the U.S. privacy regime in 2025 is characterized by a complex mosaic of state laws—with multiple new laws and amendments enhancing protections—but lacks a unified federal privacy law providing comprehensive nationwide coverage [1][2][3][4][5]. Businesses must navigate this evolving patchwork with divergent state-by-state requirements.
References: [1] https://www.privacynewsline.com/2023/04/24/2023-state-privacy-legislation-tracker [2] https://www.privacynewsline.com/2025/01/01/colorado-privacy-act-regulations-finalized [3] https://www.privacynewsline.com/2025/04/01/federal-efforts-focus-more-on-sector-specific-regulations-ai-cybersecurity-and-reporting-obligations [4] https://www.privacynewsline.com/2025/06/01/states-continue-to-introduce-privacy-bills-in-2025 [5] https://www.privacynewsline.com/2025/08/01/enforcement-activity-increases-across-states-in-2025 [6] https://www.privacynewsline.com/2025/12/01/rhode-island-enacts-comprehensive-data-privacy-legislation [7] https://www.privacynewsline.com/2025/07/01/california-ag-moves-forward-with-enforcement-activities [8] https://www.privacynewsline.com/2025/08/01/california-ag-announces-record-155-million-settlement-with-healthline-media-llc-for-alleged-violations-of-the-california-consumer-privacy-act-ccpa [9] https://www.privacynewsline.com/2025/10/01/connecticut-ag-releases-report-on-first-six-months-of-the-connecticut-data-privacy-act [10] https://www.privacynewsline.com/2025/02/01/doj-issues-final-rule-implementing-executive-order-14117
The shift in the privacy landscape in 2023 continued into 2025 with the enactment of additional state data privacy laws. The complex mosaic of state laws expanded as eight new laws were implemented in Iowa, Delaware, New Hampshire, New Jersey, Nebraska, Tennessee, Minnesota, and Maryland, each introducing varying rights, response timelines, and enforcement structures.
For example, Iowa’s law has a relatively long consumer request response period of 90 days and is enforced solely by the Attorney General, while Delaware’s law applies to smaller businesses and mandates disclosure of third-party data recipients. These new laws add to the existing comprehensive data privacy laws in California, Virginia, Colorado, Connecticut, Utah, Indiana, Tennessee, Texas, Florida, Montana, Oregon, and Rhode Island.
In addition to the new state laws, five states—Colorado, Connecticut, Kentucky, Montana, and Oregon—enacted significant amendments to their existing consumer data privacy laws. Notably, Connecticut made broad changes including profiling and AI-related provisions, while Colorado expanded the definition of sensitive data to include precise geolocation and imposed restrictions on selling sensitive data without consent.
The regulatory focus has intensified on teen data, social media, biometric data, geolocation, and new technological challenges like artificial intelligence. Over 800 consumer privacy-related bills were introduced across 49 states plus DC in 2025, with over 30 states enacting more than 100 laws.
Enforcement activities have also been on the rise. The California Attorney General's office is moving forward with enforcement activities, despite a recent court ruling delaying enforcement. In a significant development, the California Attorney General announced a record $1.55 million settlement with Healthline Media LLC for alleged violations of the California Consumer Privacy Act (CCPA). Connecticut's Attorney General has also released a report on the first six months of the Connecticut Data Privacy Act, highlighting enforcement priorities on companies' privacy policies, protections of "sensitive data" and teen data.
On the federal level, the Department of Justice issued a final rule implementing Executive Order 14117, which prohibits and restricts certain data transactions that pose national security risks, targeting China, Cuba, Iran, North Korea, Russia, and Venezuela.
The privacy landscape in the United States in 2025 is characterized by a complex mosaic of state laws—with multiple new laws and amendments enhancing protections—but lacks a unified federal privacy law providing comprehensive nationwide coverage. Businesses must navigate this evolving patchwork with divergent state-by-state requirements.
Attorneys specializing in the regulatory practice at Whitecase are dedicated to providing insights, news, and publications related to privacy, litigation, and compliance matters. They offer services in corporate acquisitions, mergers, and partnerships, and work with clients to address various legal and industry-specific challenges.
The team at Whitecase understands the significance of health and wellness, and they have published articles on topics like sleep, workspace wellness, medical conditions, chronic diseases, cancer, respiratory conditions, digestive health, eye health, hearing, and a variety of health-related issues. They emphasize the importance of fitness and exercise, sexual health, autoimmune disorders, climate change, mental health, men’s health, skin care, and therapies and treatments.
Moreover, Whitecase attorneys offer insights and advice on nutrition, aging, women’s health, parenting, weight management, cardiovascular health, and industry-specific laws such as Medicare, CBV, and environmental science. They also provide relevant information on finance, cybersecurity, lifestyle, fashion and beauty, food and drink, investing, wealth management, home and garden, business, personal finance, gadgets, data and cloud computing, technology, artificial intelligence, relationships, pets, travel, cars, education and self-development, personal growth, shopping, learning, and more.
In the realm of science and technology, Whitecase offers insights on space and astronomy, as well as emerging trends in AI, cybersecurity, and data privacy. They provide valuable information on the latest research and developments, helping clients navigate complex issues and make informed decisions.
Whitecase's team of attorneys is deeply committed to promoting health and wellness in the workplace and beyond. They regularly publish articles and insights on topics like workplace wellness, medical conditions, chronic diseases, nutrition, fitness and exercise, sleep, mental health, aging, women's health, and more. They believe that a healthy workforce is essential for the overall success and well-being of organizations.
The firm's attorneys also offer guidance on various science-related topics such as understanding skin conditions, exploring therapies and treatments, providing insights into the latest research on cancer, chronic diseases, respiratory conditions, digestive health, eye health, hearing, and numerous other health issues. Additionally, they publish insights on environmental science, climate change, and neurological disorders.
In the realm of finance and business, Whitecase offers a wealth of knowledge and insights on various topics, including investing, wealth management, home and garden, and personal finance. They provide information on the latest trends in the industry, focusing on areas like gadgets, data and cloud computing, technology, artificial intelligence, relationships, pets, and travel.
Moreover, Whitecase attorneys offer valuable insights into the world of luxury and lifestyle, covering topics like fashion and beauty, food and drink, and cars. They publish informative articles and insights on the latest trends and developments in these areas, helping clients make informed decisions and stay ahead of the curve.
Whitecase's team of attorneys is also actively engaged in the areas of education and self-development, personal growth, and shopping. They offer insights on topics like learning, shopping, and online resources to help clients navigate the complex world of e-learning and personal growth.
In conclusion, the privacy landscape in the United States in 2025 is complex and continues to evolve, with multiple new laws and amendments enhancing protections, but lacking a unified federal privacy law. Businesses must navigate this patchwork with divergent state-by-state requirements. Whitecase's team of attorneys is committed to providing valuable insights, news, and publications related to privacy, litigation, and compliance matters, and offers a wide range of services to help clients address their legal needs and challenges.
