Rule Atlas
GDPR: Beyond California: A Comparative Look at US State Comprehensive Privacy Laws
Under GDPR (FTC / HHS HIPAA / State Privacy / GDPR), beyond California: A Comparative Look at US State Comprehensive Privacy Laws establishes the authoritative rules tested on the IAPP CIPP/US. Provides an in-depth comparison of key provisions, scope, consumer rights, and business obligations under major state privacy laws including VCDPA, CPA, CTDPA, TDPSA, and BIPA, highlighting their distinctions from CCPA/CPRA. VoraPrep, verified against VoraPrep's IAPP CIPP/US blueprint.
Core Statutory Concepts
| Right | VCDPA (VA) | CPA (CO) | CTDPA (CT) | TDPSA (TX) |
|---|---|---|---|---|
| Access | Confirm processing & access personal data. | Confirm processing & access personal data. | Confirm processing & access personal data. | Confirm processing & access personal data. |
| Deletion | Delete personal data. | Delete personal data. | Delete personal data. | Delete personal data. |
| Correction | Correct inaccurate personal data. | Correct inaccurate personal data. | Correct inaccurate personal data. | Correct inaccurate personal data. |
| Opt-out | Targeted ads, sale of personal data. | Targeted ads, sale of personal data, profiling. | Targeted ads, sale of personal data. | Targeted ads, sale of personal data. |
| Opt-in Consent for Sensitive Data | Required (for processing). | Required (for processing). | Required (for processing). | Required (for processing, including PI of children under 18). |
| Data Portability | Obtain personal data in portable format. | Obtain personal data in portable format. | Obtain personal data in portable format. | Obtain personal data in portable format. |
| Appeal | Right to appeal controller's decision to AG. | Right to appeal controller's decision to AG. | Right to appeal controller's decision to AG. | Right to appeal controller's decision to AG. |
| Universal Opt-Out Mechanisms | No explicit requirement, but AG may develop technical specs. | Required recognition by July 1, 2024. | Required recognition by January 1, 2025. | No explicit requirement. |
A consumer in California has configured a browser setting to signal their preference to opt out of the sale of personal data and targeted advertising. A data broker, operating across multiple states, detects this signal when the consumer visits its website. Under the California Consumer Privacy Act (CCPA) as amended by the CPRA, what is the data broker legally obligated to do regarding this signal?
Practitioner Application: Beyond California: A Comparative Look at US State Comprehensive Privacy Laws
As the lead privacy counsel for 'GlobalGamer Corp.', an online gaming company with users across all 50 U.S. states, you are tasked with developing a unified privacy compliance strategy. Recent legislation has introduced a patchwork of comprehensive state privacy laws, including the Virginia CDPA, Colorado CPA, Connecticut CTDPA, and the Texas TDPSA. Your CEO needs to understand the key differences in applicability, consumer rights, and business obligations (especially regarding sensitive data and data protection assessments) across these laws compared to the more familiar CCPA/CPRA. Failing to identify crucial distinctions, such as varying consent requirements for sensitive data or the availability of a 'right to cure,' could expose GlobalGamer to significant compliance risks and penalties.
- While California's CCPA/CPRA laid significant groundwork, a growing number of U.S. states have enacted their own comprehensive privacy laws. These laws generally follow a similar framework to the EU's GDPR, focusing on consumer rights and data controller/processor obligations, but each contains unique nuances. Key examples include the Virginia Consumer Data Protection Act (VCDPA), Colorado Privacy Act (CPA), Connecticut Data Privacy Act (CTDPA), and the Texas Data Privacy and Security Act (TDPSA).
- Most of these laws apply to 'controllers' that conduct business in the state or produce products/services targeted to state residents and meet one of the following thresholds: 1. Control or process the personal data of a specific number of state residents (e.g., 100,000 residents for VCDPA, CPA, CTDPA; 50,000 residents for TDPSA if not 50%+ gross revenue from data sale). 2. Control or process the personal data of a specific, smaller number of residents AND derive a certain percentage of gross revenue from the sale of personal data (e.g., 25,000 residents and 50% of gross revenue for VCDPA, CPA, CTDPA; 25% of gross annual revenue from selling PI for TDPSA, without a fixed data subject threshold).
Common IAPP CIPP/US Distractors on GDPR
- 1Patchwork, Not Uniformity: Recognize that each state law (VCDPA, CPA, CTDPA, TDPSA, etc.) has unique applicability thresholds, definitions, and specific provisions.
- 2'Consumer' Definition: Most state comprehensive laws exclude employment/B2B data, unlike CCPA/CPRA.
- 3Sensitive Data = Opt-In: A critical distinction: processing 'Sensitive Data' generally requires opt-in consent in these states.
- 4Universal Opt-Out Mechanisms: Be aware of states (like Colorado and Connecticut) that specifically mandate recognition of universal opt-out signals, a feature not present in all laws.
- 5Data Protection Assessments (DPAs): Understand when DPAs are required, particularly for high-risk processing activities like targeted advertising or sensitive data processing.
Frequently Asked Questions: GDPR
What is the core rule under GDPR (Beyond California: A Comparative Look at US State Comprehensive Privacy Laws)?
Under GDPR (FTC / HHS HIPAA / State Privacy / GDPR), beyond California: A Comparative Look at US State Comprehensive Privacy Laws establishes the authoritative rules tested on the IAPP CIPP/US. Provides an in-depth comparison of key provisions, scope, consumer rights, and business obligations under major state privacy laws including VCDPA, CPA, CTDPA, TDPSA, and BIPA, highlighting their distinctions from CCPA/CPRA. VoraPrep, verified against VoraPrep's IAPP CIPP/US blueprint.
How is GDPR tested on the IAPP CIPP/US?
Patchwork, Not Uniformity: Recognize that each state law (VCDPA, CPA, CTDPA, TDPSA, etc.) has unique applicability thresholds, definitions, and specific provisions. 'Consumer' Definition: Most state comprehensive laws exclude employment/B2B data, unlike CCPA/CPRA.
Where can I practice IAPP CIPP/US questions on Beyond California: A Comparative Look at US State Comprehensive Privacy Laws?
Test yourself instantly with the free playable IAPP CIPP/US question on this page, or launch VoraPrep's full IAPP CIPP/US adaptive question bank, interactive lessons, and 1:1 exam simulator at voraprep.com/cipp.