Data Privacy Laws: What You Need to Know in 2025

63% of organizations have limited the types of data that can be entered into GenAI tools. Recognizing these risks, many organizations are taking steps to limit the exposure of sensitive information. 5% of employees regularly post company data into ChatGPT, and over a quarter of that data is considered sensitive information. 48% of organizations are entering non-public company information into GenAI apps. Despite these concerns, employees can be careless with their company’s information https://dallasrentapart.com/businessware-technologies-strategic-partner-that-helps-its-clients-achieve-success-in-a-rapidly-changing-world.html in their use of GenAI apps.

18.1 How do businesses typically respond to foreign e-discovery requests, or requests for disclosure from foreign law enforcement agencies? Extraterritorial enforcement of a U.S. law would depend on a number of factors, including whether the entity is subject to the jurisdiction of the U.S. courts, the impact on U.S. commerce and the impact on U.S. residents, among other factors. The FTC may also prohibit a particular company from engaging in a particular processing activity through a negotiated consent decree as part of a settlement.

Additional, separate consent is required before disclosing that information to any third parties. It regulates how commercial websites and online services collect personal data from children under the age of 13. The FTC has pursued enforcement actions against companies for various data protection failures. While there have been several attempts to introduce a comprehensive national data privacy law, no such legislation has passed to date. The United States lacks a comprehensive federal data privacy law comparable to the GDPR. The overhauled Federal Act on Data Protection (FADP) came into effect on September 1, 2023, largely replacing Switzerland’s previous 1992 data privacy law.

How Americans View Data Privacy

However, some applications and platforms may exceed users’ expectations for data collection and usage, leaving users with less privacy than they realized. Websites, applications, and social media platforms often need to collect and store personal data about users in order to provide services. As Internet usage has increased over the years, so has the importance of data privacy. Just as someone may wish to exclude people from a private conversation, many online users want to control or prevent certain types of personal data collection.

• The topic remains in the national spotlight today, and it’s particularly relevant given the policy debates ranging from regulating AI to protecting kids on social media.
• Data privacy reinforces data security by defining the « right people » and « right reasons » for any set of data.
• 91% of organizations say they need to do more to reassure customers about how their data is used with generative AI.
• None of the most prevalent regulations (GDPR, CCPA, HIPAA etc) define precisely what is meant by data privacy and it is left to businesses to determine what they consider best practice in their own industry.
• As your data gets passed around between countless third parties, there aren’t just more companies profiting from your data, but also more possibilities for your data to be leaked or breached in a way that causes real harm.

To date Washington does not yet have a comprehensive https://darkside.ru/news/news-item.phtml?id=150528&dlang=en data privacy law, though legislation has been introduced several times. MODPA protects the privacy and personal data of Maryland’s roughly 6.2 million residents by setting rules for how businesses collect, process, and use that information. The Florida Digital Bill of Rights (FDBR) establishes data privacy protections for more than 23 million Florida residents and sets obligations for companies doing business in the state or offering goods and services to its residents.

US data privacy laws

More than 100 countries worldwide have enacted data privacy regulations. The EU AI Act went into effect in 2024 and was updated during its phased implementation process to more precisely regulate various kinds of AI-based systems, as well as provide greater clarity regarding AI practices, high-risk AI systems, and other AI systems and models. It grants consumers the right to access, correct, delete and post their personal data; mandates that businesses comply with data protection rules; and affects both government and nongovernment organizations that annually process specific quantities of personal data.

Data privacy vs data security vs data protection

The law also increased penalties for noncompliance with its data security and breach notification requirements. In fact, on February 10, 2025, the first class action lawsuit based on this law was filed against an online retailer. The MHMDA extends privacy protections to consumer health data collected by entities outside HIPAA’s scope, such as mobile apps, websites, and small businesses.

Overview of key EU data privacy laws

• The CCPA gives consumers a right to control how companies collect and use their personal data.
• Still, most users across age groups do take this security precaution.
• This is left to the discretion of the company, as the U.S. does not place restrictions on the transfer of personal data to other jurisdictions.
• 57% of global consumers view the use of AI in collecting and processing personal data as a significant threat to their privacy.
• However, this data sharing introduces additional risks, as businesses must ensure that their partners have adequate data privacy measures in place.

These include targeted advertising, data sale, profiling with foreseeable risks, processing of sensitive data, and other activities with heightened risk. In response to consumers exercising their rights, the law sets a 90-day timeline for responses and requires businesses to provide information free of charge up to twice annually per consumer. The ICDPA applies to businesses controlling or processing the personal data of at least 100,000 Iowa consumers or 25,000 consumers with over 50% of gross revenue from data sales. The Texas Data Privacy and Security Act (TDPSA), signed into law on June 18, 2023, by Texas Governor Greg Abbott, positions Texas as the second-largest state (after California) to enact a comprehensive data privacy law. The OCPA includes the usual items under the umbrella of sensitive data, but also includes data types like an individual’s status as transgender or nonbinary, citizenship or immigration status, and more. The law grants consumers the usual rights, including access, correction, deletion, and opt-out options for targeted advertising or profiling.