The Oregon Consumer Privacy Act (OCPA) also introduces significant changes. What sets Oregon’s privacy law apart is the introduction of a new privacy right not found in other state comprehensive privacy laws: the right to request from a controller a list of specific third parties, excluding natural persons, to whom the controller has disclosed personal data. The controller can respond by naming the third parties that have received either the requesting consumer’s personal data or any personal data. This new right necessitates that companies keep a detailed list of specific third parties rather than merely describing categories of recipients. This emphasizes the importance of maintaining a comprehensive data inventory that includes the types of personal data collected, the reasons for collection, and the parties to whom it is disclosed.

The OCPA applies to entities controlling or processing data of 100,000 Oregon residents or 25,000 residents if over 25% of revenue comes from selling personal information. “Sensitive data”¹ includes the categories set forth in most other comprehensive data privacy laws. However, the OCPA introduces unique elements, such as including data revealing transgender or nonbinary status as part of a broader definition of sensitive, granting consumers the right to request a consumer-specific or general third parties their data is shared with, and including “derived data” within the definition of personal data.

 The OCPA, similar to the California Privacy Rights Act (CPRA), provides a narrower exemption for financial institutions compared to other states’ privacy laws, which generally provide a full exemption for entities considered financial institutions under the federal Gramm-Leach-Bliley Act (GLBA). As a result, financial institutions subject to the GLBA may now need to comply with the OCPA in addition to the CPRA.

The Florida Digital Bill of Rights (FDBR) differs from other US privacy laws by specifically targeting large tech platforms, focusing on businesses with global gross annual revenues exceeding $1 billion that are involved in activities such as selling ads online as a primary business model, operating smart speakers, or running a large app store.² The law emphasizes consumer opt-out rights for data collected via voice and facial recognition and includes specific provisions for children's online privacy. The FDBR also prohibits the use of certain device features for surveillance without active consumer authorization and mandates specific data retention schedules.

Violations of the FDBR, similar to those under the Colorado Privacy Act (CPA), are classified as deceptive trade practices. Once the Attorney General notifies an organization of violations in writing, a 45-day cure period may be granted, allowing the organization to address the issues and implement preventive measures without facing penalties. Unlike some of the other state privacy laws, the FDBR does not include a provision to sunset the cure period after a year or two. The cure period does not apply if a violation involves a known child.

Civil penalties under the law may be tripled for any violation involving a Florida child who the online platform has actual knowledge is under 18 years of age.

The Florida law also allows parents to exercise rights on behalf of their children (i.e., act as a child’s agent) and contains an age-appropriate design code for services predominantly accessed by children (those under 18). This is similar to Connecticut’s Data Privacy Act (CDPA), which allows a child's parent or legal guardian to exercise rights on the child's behalf when the child's personal data is being processed.

The FDBR provides that consumer opt-out out rights should be made available on the company’s website. The law gives consumers the right to confirm whether their data is processed, obtain a copy of their data, correct any inaccuracies related to their data, and delete their data. Under the FDBR, the data controllers are obligated to respond to the data subject requests within 45 days following the receipt of the request. If the request is complex, data controllers may extend this deadline by up to 15 days. 

How The Three New Privacy Laws Stack Up Against Existing Regulations

Unlike the California Privacy Rights Act, the definition of “consumer” under the three above laws excludes individuals acting in a commercial or employment context, so business to business personal data and employee personal data do not fall within the scope.

 The following chart highlights some of the other unique requirements under each of the new laws. 

Businesses operating in these states should review these regulations carefully to ensure compliance by July 1, 2024.  Also effective July 1, 2024, controllers subject to the Colorado Privacy Act (CPA) must recognize Colorado consumers' privacy preferences submitted through browser signals conforming to the Global Privacy Control (GPC) specification as requests to opt out of data sales or targeted advertising.

Looking ahead to the rest of the year, the Montana Consumer Data Privacy Act (MCDPA) and the Maryland Kids Code become effective on October 1, 2024.