Residents of five states will ring in the new year with the best gift of all: new privacy rights.

This coming January will see consumer data privacy laws enacted by state lawmakers in 2023 and 2024 that will take effect in Delaware, Iowa, Nebraska, New Hampshire, and New Jersey. This will bring the number of states with active privacy laws to 13.

The new laws govern how businesses of certain sizes operate—the extent varies by state—managing sensitive consumer information and giving residents of those states various rights to know, correct, and delete data that businesses hold about them. Here are some of the key provisions of the new set of laws:

Delaware

Originally passed in 2023, the law would apply to persons and organizations that, in the previous calendar year, processed personal information of 35,000 Delaware residents or processed personal information of 10,000 Delaware residents and did more than 20 percent of their gross income comes from sales. of personal information.

Unlike many other state privacy laws, it applies to both nonprofits and for-profit businesses.

It gives residents the right to know what personal information an organization holds about them, obtain a copy of that information, correct it, and opt out of using that information for targeted purposes. advertising, sold to a third party, or used to make automated decisions. with significant legal consequences.

The law took effect on January 1.

Iowa

Also passed in 2023, the Iowa law will apply to businesses that process personal information for at least 100,000 residents or that process information for 25,000 residents and make more than half of their gross revenue from to sell such data.

It is a narrower, more business-friendly law than many other state laws in effect.

While consumers are given the right to access and delete information that a business holds about them and does not sell it to third parties, they are not allowed to correct that information, opt out of its use for of targeted advertising, or opt out of it being used to make automated decisions about them.

The law took effect on January 1.

Nebraska

The state’s data privacy act does not contain a specific income or customer count basis. It applies to any business that is not a small business, as defined by the federal Small Business Act (and also applies to small businesses that sell sensitive data without first obtaining consumer consent).

It gives consumers the right to access, correct, and delete personal information held by businesses and to opt out of the use of that data for targeted advertising, sales by third parties. party, or used in certain automated decision-making systems.

The law took effect on January 1.

New Hampshire

The law applies to businesses that process the personal information of 35,000 Granite Staters or that process the personal information of 10,000 Granite Staters and make 25 percent of their gross revenue from the sale of that information.

It gives residents the right to access, correct, and delete personal data held by eligible businesses and to opt out of that data being used for targeted advertising, sold to third parties party, or used in certain automated decision-making systems.

The law took effect on January 1.

New Jersey

The law applies to businesses that process the personal information of at least 100,000 residents (unless the processing is only for the purpose of completing payments) or businesses that process the personal information of 25,000 residents and make a profit from sales or such information.

Like many of the laws previously mentioned, it gives consumers the rights to access, correct, and delete personal information and the right to opt out of data being used for targeted purposes. advertising, sold to third parties, or used in certain automated decision-making systems.

However, it will also allow consumers to communicate their desire to opt out of the uses through the so-called universal opt-out mechanism. While not defined in the text of the law, a universal opt-out mechanism could be something like a browser extension that informs every website a user visits about their privacy options, instead of the user having to inform the options of each business individually.

The law takes effect on January 15.