If You Live in One of These States, You’ll Have New Privacy Protections in 2025

Residents of five states will be ringing in the new year with the best gift of all: new privacy rights.

This upcoming January will see consumer data privacy laws that were enacted by state lawmakers in 2023 and 2024 go into effect in Delaware, Iowa, Nebraska, New Hampshire, and New Jersey. It will bring the number of states with active privacy laws up to 13.

The new laws govern how businesses of certain sizes—the size varies by state—handle sensitive consumer information and grant residents of those states various rights to know, correct, and delete the data that businesses hold about them. Here are some of the key provisions in the new suite of laws:

Delaware

Originally passed in 2023, the law applies to people and organizations who, during the preceding calendar year, processed the personal information of 35,000 Delaware residents or processed the personal information of 10,000 Delaware residents and made more than 20 percent of their gross revenue from the sale of personal information.

Unlike many other state privacy laws, it applies to nonprofits and for-profit businesses.

It grants residents the right to know what personal information an organization holds about them, obtain a copy of that information, correct it, and opt out of having that information used for targeted advertising, sold to a third party, or used to make automated decisions with significant legal ramifications.

The law goes into effect January 1.

Iowa

Also passed in 2023, Iowa’s law applies to businesses that processed personal information for at least 100,000 residents or that processed information for 25,000 residents and made more than half of their gross revenue from the sale of such data.

It is a narrower, more business-friendly law than many of the other state laws that have taken effect.

While consumers are granted the right to access and delete information a business holds about them and opt out of it being sold to a third party, they are not allowed to correct that information, opt out of its use for targeted advertising, or opt out of it being used to make automated decisions about them.

The law goes into effect January 1.

Nebraska

The state’s data privacy act doesn’t contain a specific revenue or customer count threshold. It applies to any business that isn’t a small business, as defined by the federal Small Business Act (and also applies to small businesses that sell sensitive data without first obtaining consumer consent).

It grants consumers the right to access, correct, and delete personal information held by businesses and to opt out of the use of that data for targeted advertising, being sold to third parties, or used in certain automated decision-making systems.

The law goes into effect January 1.

New Hampshire

The law applies to businesses that process the personal information of 35,000 Granite Staters or that process the personal information of 10,000 Granite Staters and make 25 percent of their gross revenue from the sale of such information.

It gives residents the right to access, correct, and delete personal data held by qualifying businesses and to opt out of that data being used for targeted advertising, being sold to third parties, or being used in certain automated decision-making systems.

The law goes into effect January 1.

New Jersey

The law applies to businesses that process the personal information of at least 100,000 residents (unless that processing is only for the purpose of completing payments) or businesses that process the personal information of 25,000 residents and profit from the sale or such information.

Like many of the laws previously mentioned, it grants consumers the rights to access, correct, and delete personal information and the rights to opt out of that data being used for targeted advertising, being sold to third parties, or used in certain automated decision-making systems.

However, it would also allow consumers to signal their desire to opt out of those uses through what’s known as a universal opt-out mechanism. While not defined in the law’s text, a universal opt-out mechanism could be something like a browser extension that informs every website a user visits about their privacy choices, rather than the user needing to communicate those choices to each business individually.

The law goes into effect on January 15.