On July 18, 2023, Oregon became the 12th state to enact a comprehensive consumer data privacy law. The Oregon Consumer Privacy Act (OCPA) goes into effect July 1, 2024, and becomes yet another state privacy law that interstate companies must account for in the absence of a national US privacy law. 

Concerning is a July 2023 report by Womble Bond Dickinson which finds that less than half of organizations are prepared to meet state data privacy requirements. For 59% of companies, tracking the status of legislation and differences between state laws poses the biggest hurdle, but it’s hardly the only one. 

The report found that only 4 in 10 companies have implemented measures to comply with state data privacy laws:

  • 42% have conducted comparisons of state privacy law frameworks 
  • 41% have updated privacy policies  
  • 41% have developed systems to process and respond to data privacy rights requests  
  • 39% have set metrics and specific goals 
  • 39% have drafted/updated agreements with third parties 
  • 36% have planned and conducted data assessments 

Most worrisome is the discovery that only 34% of survey respondents have conducted data mapping and understand data practices across their organization. Having a complete picture of what data a company holds and where it is located is an essential first step to complying with data privacy laws. 

To meet state privacy guidelines, companies need to quicken their pace. Privacy laws for California, Colorado, Connecticut, Utah and Virginia are already enacted, and other state privacy laws will soon go into effect, including: 

  • Florida, Oregon and Texas on July 1, 2024 
  • Montana on October 1, 2024 
  • Iowa on January 1, 2025 
  • Tennessee on July 1, 2025 
  • Indiana on January 1, 2026 

Rather than implementing multiple programs across an organization to address individual state privacy laws, companies should put in place one program that meets or exceeds the most restrictive state regulations, such as the California Consumer Privacy Act, and then create a privacy policy that rises to that level.  

California Consumer Privacy Act Training – Get an Instant Preview