James Sherer of BakerLaw recently sent out an interesting email update on state laws, which we are passing along to our readers:
- United States companies (and multinationals operating in the states) have three significant new state privacy laws going into effect in the second-half of 2025:
- Tennessee’s privacy law (“TIPA“) is effective July 1, 2025.
- Minnesota’s privacy law is effective July 13, 2025.
- Maryland’s privacy law (“MODPA“) is effective October 1, 2025.
- While these privacy laws share a number of key points with existing requirements (such as California, Virginia, Colorado, and others), they also have nuance – and regulators from some states are combing online sites and notices to make sure their very special state requirements are addressed. Among unique points in the new laws:
- Tennessee’s TIPA provides for an affirmative defense related to following the NIST Privacy Framework (similar to Colorado’s AI Act call-out for the NIST AI RMF).
- Maryland’s MODPA limits collection of personal data to that reasonably necessary and proportionate for providing specific products or services – and otherwise requires consumer consent.
- In the meantime, recently enacted laws are already being enforced – for example, the Delaware Department of Justice has been providing notices of violation regarding Delaware’s DPDPA (effective January 1, 2025), and New Jersey’s Office of Consumer Protection has been asserting violations of the NJDPL (effective January 15, 2025).
- Some clients we work with are taking this mid-year revision point to both update their privacy notices and to review website operations, as online technologies can (and often do) change over time. This aligns with the recent CPPA enforcement covered recently, which pointed to gaps in coverage for website operations.
If you would like to receive the firm’s CLE/weekend update emails, reach out to jsherer@bakerlaw.com.
