IAPP: 8 States Updated Comprehensive Privacy Laws in 2025
No states have enacted new comprehensive privacy laws in 2025, so far, but “half of those with laws already on the books have made significant amendments to their scopes and requirements,” IAPP said Monday in releasing its revised report on state privacy laws. The report found that eight states updated their privacy laws in 2025: Colorado, Connecticut, Kentucky, Montana, Oregon, Texas, Utah and Virginia.
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
“While 2025 has been a relatively inactive year, passage of new state privacy laws has outpaced prior years in terms of further expanding the remit of existing state privacy laws through legislative amendments,” the privacy association said. “With no signs of slowing down, it remains as crucial as ever for privacy pros to understand the evolving contours of U.S. state privacy law.”
Connecticut twice updated its 2022 privacy law, in 2025 and the year before. State Sen. James Maroney (D) said last week that he plans to propose more revisions in 2026 (see 2510220015).