Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

In 2024, <a href="https://www.bakerlaw.com/services/digital-assets-and-data-management/privacy-governance-and-technology-transactions/" target="_blank" rel="noreferrer noopener">our team</a> at BakerHostetler worked with hundreds of clients on a wide range of challenging privacy and data protection compliance issues. As the year ends, we are once again highlighting some key areas that warrant particular attention moving into 2025 – new state privacy laws, data broker laws, children’s personal data, regulatory enforcement trends, tracking technology litigation and the regulation of nonpersonal data outside the United States.

core/paragraph

<em>Our Privacy Strategist CLE webinar series will kick off for 2025 on January 22 with more insights into what the year might hold for privacy professionals.</em>

Eight New State Privacy Laws Taking Effect in 2025 – What’s New?

core/heading

By 2026, about half of the U.S. population will be covered by a <a href="https://www.bakerdatacounsel.com/blogs/dsir-deeper-dive-state-comprehensive-privacy-laws/" target="_blank" rel="noreferrer noopener">state comprehensive privacy law</a>. In January 2025, new comprehensive privacy laws will take effect in <a href="https://delcode.delaware.gov/title6/c012d/index.html" target="_blank" rel="noreferrer noopener">Delaware</a>, <a href="https://www.legis.iowa.gov/docs/publications/iactc/90.1/CH17.pdf" target="_blank" rel="noreferrer noopener">Iowa</a>, <a href="https://nebraskalegislature.gov/laws/statutes.php?statute=87-1101" target="_blank" rel="noreferrer noopener">Nebraska</a>, <a href="https://www.gencourt.state.nh.us/rsa/html/NHTOC/NHTOC-LII-507-H.htm" target="_blank" rel="noreferrer noopener">New Hampshire</a> and <a href="https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM" target="_blank" rel="noreferrer noopener">New Jersey</a>. Later in the year, <a href="https://mgaleg.maryland.gov/2024RS/chapters_noln/Ch_455_sb0541E.pdf" target="_blank" rel="noreferrer noopener">Maryland</a>, <a href="https://www.revisor.mn.gov/laws/2024/0/Session+Law/Chapter/121/#:~:text=CONSUMER%20DATA%20POLICY" target="_blank" rel="noreferrer noopener">Minnesota</a> and <a href="https://publications.tnsosfiles.com/acts/113/pub/pc0408.pdf" target="_blank" rel="noreferrer noopener">Tennessee</a> will implement similar legislation. While these new privacy laws generally align with the now-familiar framework of the unpassed Washington Privacy Act, we have seen growing variation in newly passed laws. Companies should be alert for key differences, including:

Delaware, Maryland and New Jersey categorize status as transgender or nonbinary as sensitive personal data. Additionally, Maryland includes national origin in this category, New Jersey includes financial information and Delaware explicitly recognizes pregnancy.

core/list-item

Maryland introduces a data minimization requirement that limits personal data collection to that which is reasonably necessary and proportionate to provide a product or service requested by a consumer. The law additionally prohibits the collection and other processing of sensitive personal data unless that data is strictly necessary for a product or service requested by the consumer. Sensitive personal data may not be sold under Maryland’s law.

Minnesota expands consumers’ rights regarding profiling to permit consumers to question the results of profiling, review personal data used in profiling and correct it if needed, be told about the reasons for the profiling decision, and learn about actions that might have altered the outcome.

The <a href="https://www.bakerdatacounsel.com/blogs/and-new-jersey-makes-13/" target="_blank" rel="noreferrer noopener">New Jersey</a> Division of Consumer Affairs has rulemaking authority under its privacy law that it may exercise (but hasn’t yet).

Nebraska’s law, like Texas’, applies broadly without requiring that a minimum number of residents’ personal data is processed or sold for a company doing business in the state to fall within its scope.

Also like <a href="https://www.bakerdatacounsel.com/blogs/texas-data-privacy-and-security-act-decoding-the-small-business-exception/" target="_blank" rel="noreferrer noopener">Texas</a>, Minnesota and Nebraska offer small business exemptions for businesses meeting the U.S. Small Business Administration’s definition, with the caveat that small businesses are still subject to restrictions regarding sensitive personal data.

core/list

A few changes to existing state privacy laws should also be noted. Virginia’s Consumer Data Protection Act was <a href="https://legacylis.virginia.gov/cgi-bin/legp604.exe?241+ful+CHAP0840" target="_blank" rel="noreferrer noopener">amended</a> with new protections for children’s data. Both the Colorado Privacy Act and the California Consumer Privacy Act (CCPA) were modified to include <a href="https://www.bakerdatacounsel.com/blogs/colorado-and-california-get-ahead-of-neural-data-regulation/" target="_blank" rel="noreferrer noopener">neural data</a> as a type of sensitive personal data. Colorado also expanded <a href="https://leg.colorado.gov/bills/hb24-1130" target="_blank" rel="noreferrer noopener">biometric</a> and <a href="https://leg.colorado.gov/sites/default/files/2024a_041_signed.pdf" target="_blank" rel="noreferrer noopener">children’s</a> data protections, including through <a href="https://coag.gov/app/uploads/2024/09/2024.09.13-To-File-Proposed-Draft-Amendments-to-CPA-Rules.pdf" target="_blank" rel="noreferrer noopener">proposed rules</a>. Of note, employees, while generally excluded from the Colorado Privacy Act, are included within the scope of the new biometric data consent requirements. The California Privacy Protection Agency (CPPA) also continues <a href="https://cppa.ca.gov/announcements/2024/20241108_2.html" target="_blank" rel="noreferrer noopener">its rulemaking</a> for data brokers, automated decision-making, risk assessments and cybersecurity audits.

For additional information on state comprehensive privacy laws, please see our <a href="https://www.bakerlaw.com/services/comprehensive-state-privacy-acts/" target="_blank" rel="noreferrer noopener">Comprehensive State Privacy Laws</a> resources page.

Legislatures and regulators are increasingly aware of the privacy risks posed by data brokers. Currently, data brokers are largely unregulated, aside from a few state laws requiring data broker registries. Although definitions vary, the term “data broker” generally refers to any company that sells personal data collected from consumers with whom it does not have a direct relationship. Essentially, it is a broad definition that can apply to companies that do not traditionally think of themselves as data brokers.

California’s 2023 <a href="https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202320240SB362" target="_blank" rel="noreferrer noopener">Delete Act</a> amended its existing data broker registration law. The Delete Act places oversight of data brokers under the CPPA, which recently finalized its associated <a href="https://cppa.ca.gov/regulations/pdf/data_broker_reg_prop_text.pdf" target="_blank" rel="noreferrer noopener">regulations</a>. By 2026, the CPPA must create a portal for California residents to make opt-out and deletion requests to all registered data brokers. The Delete Act also requires data brokers to register, pay fees and disclose information about various topics, such as consumer requests, children’s data and sensitive personal data.

At the federal level, the <a href="https://www.congress.gov/bill/118th-congress/house-bill/815/text" target="_blank" rel="noreferrer noopener">Protecting Americans’ Data from Foreign Adversaries Act</a> (PADFA) was passed and took effect in 2024. PADFA <a href="https://www.adventures-in-law.com/blogs/the-protecting-americans-data-from-foreign-adversaries-act-what-digital-advertisers-publishers-and-ad-platforms-need-to-know/" target="_blank" rel="noreferrer noopener">prohibits data brokers</a> from transferring sensitive personal data to certain foreign countries deemed to be adversaries of the United States. The Consumer Financial Protection Bureau also recently <a href="https://www.consumerfinance.gov/about-us/newsroom/cfpb-proposes-rule-to-stop-data-brokers-from-selling-sensitive-personal-data-to-scammers-stalkers-and-spies/" target="_blank" rel="noreferrer noopener">proposed a rule</a> to “rein in data brokers that sell Americans’ sensitive personal and financial information.” The comment period for this proposed rule is open through March 3, 2025.

Children’s Privacy Remains Under Scrutiny

2024 witnessed a significant uptick in children’s online safety laws. Several new state laws address the processing of personal data about a child, social media networks, addictive feeds, targeted advertising and age-appropriate design. Although definitions, applicability standards and exemptions from compliance vary drastically across these newer children’s privacy laws, many have begun to rely on a definition of “child” that extends to age 18. While these laws reference the <a href="https://www.adventures-in-law.com/blogs/senate-passes-kosa-and-coppa-2-0/">federal</a> <a href="https://www.adventures-in-law.com/blogs/ftc-concerns-over-marketing-to-kids-its-not-just-about-coppa-anymore/" target="_blank" rel="noreferrer noopener">children’s privacy</a> <a href="https://www.adventures-in-law.com/blogs/ftc-to-examine-how-the-attention-economy-impacts-kids/">laws</a>, such as the Children’s Online Privacy Protection Act (COPPA), which remains subject to ongoing <a href="https://www.adventures-in-law.com/blogs/its-time-to-face-the-music-ftc-says-no-to-facial-recognition-based-consent-under-coppa/" target="_blank" rel="noreferrer noopener">updates</a>, <a href="https://www.adventures-in-law.com/blogs/an-update-on-kosa-and-coppa-2-0/" target="_blank" rel="noreferrer noopener">active legislation</a> and <a href="https://www.adventures-in-law.com/blogs/in-case-you-were-focused-on-the-holidays-and-not-the-ftc-its-coppa-and-facial-recognition-time/" target="_blank" rel="noreferrer noopener">rulemaking</a>, the state laws have requirements that extend beyond those of COPPA. These new laws not only embrace a broader definition of child but also encompass personal data about children, such as that collected through parents and others. Companies should be alert for rulemaking that could expand compliance obligations, the introduction of new legislation and increased enforcement in 2025, as children’s privacy remains a unified concern across parties in the United States.

One action companies can take now is to complete of a privacy impact assessment that specifically considers personal data related to children. This exercise can help clarify where a company’s legal obligations lie with respect to children’s personal data.

In 2024, Texas has been building a reputation as the most aggressive state privacy regulator in the United States. In June, ahead of the effective date of the Texas Data Privacy and Security Act, the Texas Attorney General <a href="https://www.texasattorneygeneral.gov/news/releases/attorney-general-ken-paxton-launches-data-privacy-and-security-initiative-protect-texans-sensitive" target="_blank" rel="noreferrer noopener">launched a major initiative</a>, establishing a team focused on enforcing privacy laws in the state. This year the Texas Attorney General completed a significant settlement with a <a href="https://www.nytimes.com/2024/07/30/technology/meta-texas-privacy-settlement.html" target="_blank" rel="noreferrer noopener">social media company</a> relating to <a href="https://www.texasattorneygeneral.gov/news/releases/attorney-general-ken-paxton-secures-14-billion-settlement-meta-over-its-unauthorized-capture" target="_blank" rel="noreferrer noopener">biometric data</a>, launched <a href="https://www.texasattorneygeneral.gov/news/releases/attorney-general-ken-paxton-opens-investigation-car-manufacturers-collection-and-sale-drivers-data" target="_blank" rel="noreferrer noopener">investigations</a> into the automotive industry for alleged surveillance and data sharing practices, <a href="https://www.texasattorneygeneral.gov/news/releases/attorney-general-ken-paxton-notifies-over-100-companies-their-apparent-failure-comply-texas-data" target="_blank" rel="noreferrer noopener">issued notices</a> to over 100 companies for failing to comply with the Texas data broker law, and began a <a href="https://texasattorneygeneral.gov/news/releases/attorney-general-ken-paxton-sues-tiktok-sharing-minors-personal-data-violation-texas-parental" target="_blank" rel="noreferrer noopener">lawsuit</a> and a <a href="https://www.texasattorneygeneral.gov/news/releases/attorney-general-ken-paxton-launches-investigations-characterai-reddit-instagram-discord-and-other" target="_blank" rel="noreferrer noopener">large-scale probe</a> into companies for suspected violations of the <a href="https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint/consumer-privacy-rights/securing-children-online-through-parental-empowerment" target="_blank" rel="noreferrer noopener">Securing Children Online through Parental Empowerment (SCOPE) Act</a> and the <a href="https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint/consumer-privacy-rights/texas-data-privacy-and-security-act" target="_blank" rel="noreferrer noopener">Texas Data Privacy and Security Act</a>.

Enforcement also has increased in California, due in part to the dual enforcement capabilities of the CPPA and the California Attorney General’s Office. To round out the year, in November, the CPPA announced <a href="https://cppa.ca.gov/announcements/2024/20241114.html#:~:text=Growbots%20will%20pay%20%2435%2C400%20to,1%20and%20July%2021%2C%202024." target="_blank" rel="noreferrer noopener">a settlement</a> with two data brokers for violating the Delete Act. This settlement came on the heels of the CPPA’s <a href="https://cppa.ca.gov/announcements/2024/20241030.html" target="_blank" rel="noreferrer noopener">investigative sweep</a> of data brokers earlier this year. The CPPA also devoted efforts to publishing two enforcement advisories. A September advisory focused on <a href="https://cppa.ca.gov/pdf/enfadvisory202402.pdf" target="_blank" rel="noreferrer noopener">dark patterns</a>, while the first advisory addressed <a href="https://cppa.ca.gov/pdf/enfadvisory202401.pdf" target="_blank" rel="noreferrer noopener">data minimization</a> as it relates to consumer requests. California’s other enforcer of the CCPA contributed to this year’s CCPA enforcement news, too. In June, the California Attorney General, together with the Los Angeles City Attorney, signaled its focus on children’s data through a <a href="https://www.bakerdatacounsel.com/blogs/third-ccpa-enforcement-settlement-with-california-attorney-general-and-los-angeles-city-attorney-announced-against-mobile-game-app/" target="_blank" rel="noreferrer noopener">joint settlement</a> against a mobile app developer for violations of both the CCPA and COPPA through the developers’ alleged collection and sharing of children’s data without parental consent. This was the second public settlement of the year from the California Attorney General, following the February announcement of <a href="https://oag.ca.gov/news/press-releases/attorney-general-bonta-announces-settlement-doordash-investigation-finds-company" target="_blank" rel="noreferrer noopener">a settlement</a> with a food delivery service company for violating the CCPA and the California Online Privacy Protection Act.

The Federal Trade Commission (FTC) has been <a href="https://www.bakerdatacounsel.com/blogs/deeper-dive-ftc-in-2024-continues-aggressive-privacy-path-but-dont-forget-about-that-rulemaking/" target="_blank" rel="noreferrer noopener">active</a> in the privacy space in 2024, <a href="https://www.adventures-in-law.com/blogs/ftc-releases-privacy-and-data-security-update/" target="_blank" rel="noreferrer noopener">focusing</a> on sensitive personal data such as <a href="https://www.ftc.gov/news-events/news/press-releases/2024/07/ftc-order-will-ban-ngl-labs-its-founders-offering-anonymous-messaging-apps-kids-under-18-halt" target="_blank" rel="noreferrer noopener">children’s data</a>, <a href="https://www.bakerdatacounsel.com/blogs/ftc-continues-focus-on-disclosure-of-health-information-to-third-party-technologies/" target="_blank" rel="noreferrer noopener">health data</a>, <a href="https://www.ftc.gov/news-events/news/press-releases/2024/12/ftc-takes-action-against-gravy-analytics-venntel-unlawfully-selling-location-data-tracking-consumers" target="_blank" rel="noreferrer noopener">location data</a> and <a href="https://www.ftc.gov/news-events/news/press-releases/2024/06/ftc-finalizes-order-avast-banning-it-selling-or-licensing-web-browsing-data-advertising-requiring-it" target="_blank" rel="noreferrer noopener">browsing data</a>. The FTC targeted data brokers under its unfair practices authority as well as other types of data sharing, such as through <a href="https://www.adventures-in-law.com/blogs/how-did-the-ftc-get-16-million-in-a-recent-ftc-act-privacy-case/" target="_blank" rel="noreferrer noopener">tracking technologies</a> <a href="https://www.bakerdatacounsel.com/blogs/dsir-deeper-dive-tracking-the-crackdown-on-tracking-pixel-technologies-web-litigation-and-regulatory-landscape-part-1/" target="_blank" rel="noreferrer noopener">online</a> and <a href="https://www.ftc.gov/business-guidance/blog/2024/01/how-location-location-location-can-lead-enforcement-enforcement-enforcement" target="_blank" rel="noreferrer noopener">in apps</a>. FTC privacy enforcement actions addressed practices that implicate undisclosed <a href="https://www.ftc.gov/news-events/news/press-releases/2024/09/ftc-staff-report-finds-large-social-media-video-streaming-companies-have-engaged-vast-surveillance" target="_blank" rel="noreferrer noopener">uses of data</a>; make <a href="https://www.bakerdatacounsel.com/blogs/we-talkin-about-security-or-are-we-another-look-at-the-ftcs-recent-settlement-with-security-firm-verkada/" target="_blank" rel="noreferrer noopener">misleading disclosures</a>; create an unfair sale of sensitive data, such as <a href="https://www.ftc.gov/news-events/news/press-releases/2024/05/ftc-finalizes-order-inmarket-prohibiting-it-selling-or-sharing-precise-location-data" target="_blank" rel="noreferrer noopener">geolocation data</a> connected to <a href="https://www.ftc.gov/news-events/news/press-releases/2024/04/ftc-finalizes-order-x-mode-successor-outlogic-prohibiting-it-sharing-or-selling-sensitive-location" target="_blank" rel="noreferrer noopener">sensitive locations</a>; result in the <a href="https://www.ftc.gov/news-events/news/press-releases/2024/12/ftc-takes-action-against-mobilewalla-collecting-selling-sensitive-location-data" target="_blank" rel="noreferrer noopener">collection and use</a> of personal data without consumer consent; and result in the <a href="https://www.ftc.gov/news-events/news/press-releases/2024/02/ftc-order-will-require-blackbaud-delete-unnecessary-data-boost-safeguards-settle-charges-its-lax" target="_blank" rel="noreferrer noopener">excessive retention</a> of personal data. We’ve also seen the FTC steadily expand its oversight of artificial intelligence (AI) throughout 2024, including through its <a href="https://www.adventures-in-law.com/blogs/ftcs-operation-ai-comply-lets-discuss-dissents/" target="_blank" rel="noreferrer noopener">Operation AI Comply</a>, which launched in the fall. With the <a href="https://www.adventures-in-law.com/blogs/what-does-the-election-mean-for-the-ftc/" target="_blank" rel="noreferrer noopener">change of administration</a> and the <a href="https://www.adventures-in-law.com/blogs/supreme-court-overrules-chevron-deference-to-agencies/" target="_blank" rel="noreferrer noopener">overturn</a> of <a href="https://www.adventures-in-law.com/blogs/the-chevron-decision-will-create-some-challenges-for-ftc-law-enforcement-and-rulemaking/" target="_blank" rel="noreferrer noopener"><em>Chevron</em> deference</a> <a href="https://www.bakerdatacounsel.com/blogs/the-future-for-healthcare-is-so-loper-bright-i-gotta-wear-shades/" target="_blank" rel="noreferrer noopener">by the Supreme Court</a>, privacy in the federal agency space remains an important area to watch in 2025.

Throughout 2024, plaintiffs’ counsel continued to pursue claims alleging violations of the <a href="https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=PEN&amp;part=1.&amp;title=15.&amp;chapter=1.5" target="_blank" rel="noreferrer noopener">California Invasion of Privacy Act</a> (CIPA) and <a href="https://www.bakerdatacounsel.com/blogs/the-new-look-song-beverly-credit-card-act-web-tracker-edition/" target="_blank" rel="noreferrer noopener">other state laws</a> based on the use of <a href="https://www.bakerdatacounsel.com/blogs/the-next-chapter-of-cipa-litigation-the-pen-register-and-trap-and-trace-device/" target="_blank" rel="noreferrer noopener">cookies, pixels</a> and other website tracking technologies. Plaintiffs’ theories and the technologies to which they relate have continued to expand. From claims alleging that pixels <a href="https://www.bakerdatacounsel.com/blogs/the-long-arm-of-cipa-and-its-newfound-pen-trap-claims/">function as a</a> <a href="https://www.bakerdatacounsel.com/blogs/the-next-chapter-of-cipa-litigation-the-pen-register-and-trap-and-trace-device/">pen register or trap and trace device</a> to claims involving website search features to claims based on pixels included in emails, it seems that few aspects of companies’ digital services are immune from these threats.

While decisions in California courts remain a mixed bag and plaintiffs’ counsel continue to keep many cases out of court by threatening mass arbitration, courts in some other states, such as <a href="https://law.justia.com/cases/massachusetts/supreme-court/2024/sjc-13542.html" target="_blank" rel="noreferrer noopener">Massachusetts</a>, have started to reject the application of decades-old wiretapping laws to today’s website tracking technologies. Nonetheless, the ongoing <a href="https://www.bakerdatacounsel.com/blogs/dsir-deeper-dive-tracking-the-crackdown-on-tracking-pixel-technologies-web-litigation-and-regulatory-landscape-part-2/" target="_blank" rel="noreferrer noopener">onslaught</a> of these claims means that businesses should continue to take proactive steps to mitigate litigation risks relating to tracking technologies.

International Data Protection – Nonpersonal Data

While the EU has long protected the <a href="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32018R1807" target="_blank" rel="noreferrer noopener">free flow of data</a> within its borders, transferring personal data outside the EU continues to be challenging. Newer legislation under the <a href="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A52020DC0066" target="_blank" rel="noreferrer noopener">European strategy for data</a> focuses on restricting nonpersonal, including anonymized, data flows outside the EU. Companies receiving data from the EU should be aware of the currently applicable <a href="https://digital-strategy.ec.europa.eu/en/policies/data-governance-act" target="_blank" rel="noreferrer noopener">Data Governance Act</a> and the <a href="https://digital-strategy.ec.europa.eu/en/factpages/data-act-explained" target="_blank" rel="noreferrer noopener">Data Act</a>, effective September 2025. Broadly, these laws aim to safeguard personal data and other types of data, such as intellectual property; preserve fair competition; and boost the EU’s global economic competitiveness. The <a href="https://digital-strategy.ec.europa.eu/en/policies/data-governance-act-explained" target="_blank" rel="noreferrer noopener">Data Governance Act</a> regulates public sector data use, requiring similar levels of protection for outbound data transfers. The Data Act applies to data obtained from connected products offered in the EU market, restricting transfers of data that could violate fundamental rights, such as through unlawful or illegitimate government access, or to protect commercially sensitive data. The Data Act additionally allows customers in the EU to obtain access to their data, even from companies established outside the EU.

On the other side of the world, China is implementing <a href="https://www.hankunlaw.com/en/portal/article/index/cid/8/id/14672.html" target="_blank" rel="noreferrer noopener">new regulations</a> on <a href="https://www.fangdalaw.com/articles/chinas-new-regulation-on-network-data-security-management-what-companies-should-know/" target="_blank" rel="noreferrer noopener">network data security management</a> under its Cybersecurity Law, Data Security Law and Personal Information Protection Law early in 2025. These regulations address personal information and also “important data,” including data related to national security, critical infrastructure and cybersecurity, addressing data localization requirements and outbound data transfers.

After a strong effort to pass the federal <a href="https://crsreports.congress.gov/product/pdf/LSB/LSB11161" target="_blank" rel="noreferrer noopener">American Privacy Rights Act</a> in 2024, we do not expect a similar push in 2025. However, if the new Republican-controlled Congress agrees on preemption and private rights of action, a comprehensive federal privacy law could be in play. In the meantime, expect more state privacy laws.

In January, the Federal Communications Commission’s <a href="https://www.fcc.gov/document/fcc-closes-lead-generator-robocall-loophole-adopts-robotext-rules" target="_blank" rel="noreferrer noopener">new rules</a> under the Telephone Consumer Protection Act take effect. Notably, the FCC implemented a rule to eliminate the so-called “lead generator loophole” by barring companies from obtaining consent to telemarketing calls and texts from multiple marketing partners through a single consent mechanism. Although this always has been an unlawful practice, the FCC has now has explicitly stated that call consent language must clearly and conspicuously authorize calls or texts from only one entity per given consent. Further, despite the nickname, the new requirements may apply various types of companies that do not consider themselves to be “lead generators” – to the extent their current processes purport to obtain consent for multiple callers through one opt-in.  

AI laws <a href="https://www.osborneclarke.com/insights/regulatory-outlook-November-2024-artificial-intelligence" target="_blank" rel="noreferrer noopener">continue to progress</a>, with the <a href="https://www.bakerdatacounsel.com/blogs/an-introduction-to-the-basics-of-the-eu-ai-act/" target="_blank" rel="noreferrer noopener">EU AI Act</a> poised to remain a global focal point in 2025, but the <a href="https://www.edpb.europa.eu/news/news/2024/edpb-opinion-ai-models-gdpr-principles-support-responsible-ai_en" target="_blank" rel="noreferrer noopener">European Data Protection Board</a> has been quick to remind companies not to lose sight of General Data Protection Regulation principles, which also support <a href="https://www.edpb.europa.eu/news/news/2024/edpb-opinion-ai-models-gdpr-principles-support-responsible-ai_en">responsible AI</a>. In the United States, the state-level introduction of AI legislation has reached a fever pitch. In 2025, we anticipate that more states will follow Colorado’s lead by passing comprehensive AI laws, while others may opt for relatively minor updates to existing laws or the enactment of narrowly focused AI laws, such as the flurry that <a href="https://www.gov.ca.gov/2024/09/29/governor-newsom-announces-new-initiatives-to-advance-safe-and-responsible-ai-protect-californians/" target="_blank" rel="noreferrer noopener">passed in California</a> in September.

Consumer complaints remain an easy way to land in front of a regulator. Make sure you have processes in place for responding to consumer privacy rights requests promptly, completely and accurately. Also, make sure your public-facing disclosures, including any choices offered to consumers, are clear, correct, available and functional.

Keep an eye on <a href="https://www.dacbeachcroft.com/en/What-we-think/Key-developments-in-data-protection-and-privacy-in-2024" target="_blank" rel="noreferrer noopener">privacy reforms</a> in <a href="https://www.ashurst.com/en/insights/australias-first-tranche-of-privacy-reforms-a-deep-dive-and-why-they-matter/" target="_blank" rel="noreferrer noopener">Australia</a>, <a href="https://www.osler.com/en/insights/reports/2024-legal-outlook/privacy/" target="_blank" rel="noreferrer noopener">Canada</a> and the <a href="https://www.twobirds.com/en/insights/2024/uk/uk-data-reform-whats-proposed" target="_blank" rel="noreferrer noopener">United Kingdom</a> as well as India’s <a href="https://fpf.org/blog/the-digital-personal-data-protection-act-of-india-explained/" target="_blank" rel="noreferrer noopener">new privacy law</a>, which has the potential to affect many companies outsourcing data processing in that country.

Year-End Review – Data Privacy Insights to Take into 2025