The State Privacy Wave: What the Comprehensive Consumer Statutes Actually Require
By Casey Scott McKay ·
Twenty-odd states now have comprehensive consumer privacy statutes that share a common architecture and differ in the places that cost money. This article sets out that architecture - applicability thresholds, the controller and processor roles, the rights set, the sensitive-data consent rule, and the assessment obligation - then works the divergences that actually change a compliance program. It explains why the opt-out regime rather than the rights regime consumes most of the budget, why universal opt-out signal support is the requirement most companies fail, and how the Maryland minimization standard breaks the assumption that one program satisfies every state. It covers the sector carve-outs that exempt less than clients hope, and the wiretap and video-privacy theories that generate far more litigation than the privacy statutes themselves. It closes with what a defensible program looks like.
IP and Technology > Privacy Data Security | Article | Published 16 January 2025 - Updated 21 April 2025 | Casey Scott McKay - marksy.us
Summary. Twenty-odd states now have comprehensive consumer privacy statutes that share a common architecture and differ in the places that cost money. This article sets out that architecture — applicability thresholds, the controller and processor roles, the rights set, the sensitive-data consent rule, and the assessment obligation — then works the divergences that actually change a compliance program. It explains why the opt-out regime rather than the rights regime consumes most of the budget, why universal opt-out signal support is the requirement most companies fail, and how the Maryland minimization standard breaks the assumption that one program satisfies every state. It covers the sector carve-outs that exempt less than clients hope, and the wiretap and video-privacy theories that generate far more litigation than the privacy statutes themselves. It closes with what a defensible program looks like.
Keywords: comprehensive state privacy laws · applicability thresholds · controller and processor · consumer rights · right to delete · right to correct · opt out of sale · targeted advertising · universal opt-out signals · sensitive data consent · data protection assessments · processor contract terms · purpose limitation · data minimization · cure periods · attorney general enforcement · private right of action · pixel and session replay claims · sector carve-outs · records of processing
This is premium Marksy content — the full document is available to subscribers.