New comprehensive privacy laws in California, Virginia and Colorado are set to take effect in 2023. In multiple other states, lawmakers are motivated to pass similar legislation. These laws will require businesses to contend with a growing patchwork of privacy regulations that, despite the common themes of expanding consumer rights to control their data, also include variations that will likely frustrate compliance efforts.

There are a few key dates in the coming months that all companies should be aware of:

  • July 1: deadline for the new California Privacy Protection Agency to draft and adopt certain regulations for the California Privacy Rights Act (CPRA), which amended the California Consumer Privacy Act (CCPA).
  • Dec. 22: deadline for retrofitting contracts and data transfer agreements related to data transfers from the European Economic Area to conform with the new Standard Contractual Clauses published by the European Commission in June 2021.
  • Jan. 1, 2023: the Virginia Consumer Data Protection Act (CDPA) becomes effective. Also, the CPRA and its changes to the CCPA become effective.
  • July 1, 2023: the Colorado Privacy Act (CPA) becomes effective.

Overview of New Laws