States Propose Bills with CCPA-Like Provisions

The U.S. data privacy landscape continues to evolve. Last year, the California Consumer Privacy Act ("CCPA") passed following the EU General Data Protection Regulation ("GDPR"). Nine additional states have since introduced bills modeled at least in part on the CCPA and would require companies to provide notice of the types of personal information they collect and the third parties to whom they disclose it. The bills also grant individuals the right to access or opt-out of the sale of their personal information. Six bills also permit individuals to request deletion of their information. Several other bills propose a private right of action for certain violations. Washington proposes requirements that mirror the GDPR, such as defined roles for controllers and processors and the right to correct information.

Although some states (e.g., Rhode Island) limit application to entities that exceed certain gross revenues or other thresholds, all of the bills would apply broadly to companies regardless of industry, and a majority of them define "personal information" as any information that identifies an individual, including physical characteristics, employment history, medical information, IP addresses, internet activity, biometrics, and geolocation data. With one exception (Mississippi's bill died in committee on February 5), all of these bills have been referred to committees for further consideration.

Next Steps

Companies should continue to monitor the legislative progress of these bills, as well as attempts at the federal level to pass preemptive legislation.

Implementing an effective CCPA compliance program would go a long way toward satisfying potential compliance obligations on the horizon in other states.



New Mexico (SB 176)


New York (S00224)


Massachusetts (SD 341)


North Dakota (HB 1485)


Hawaii (SB 418)


Mississippi (HB 1253)


Washington (SB 5376)


Rhode Island (S0234)


Maryland (SB0613)


Insights by Jones Day should not be construed as legal advice on any specific facts or circumstances. The contents are intended for general information purposes only and may not be quoted or referred to in any other publication or proceeding without the prior written consent of the Firm, to be given or withheld at our discretion. To request permission to reprint or reuse any of our Insights, please use our “Contact Us” form, which can be found on our website at This Insight is not intended to create, and neither publication nor receipt of it constitutes, an attorney-client relationship. The views set forth herein are the personal views of the authors and do not necessarily reflect those of the Firm.