Current as of October 1, 2025.

 

---

 

¹ The Florida Digital Bill of Rights is arguably a comprehensive privacy law, but it applies under narrow circumstances (e.g., among other things, companies that have over $1 billion in global gross annual revenues).

² The Minnesota Consumer Data Privacy Act extends the right to opt-out of profiling by affording consumers the right to access and question the results of a controller's profiling. Also, Minnesota's law only exempts non-profit organizations established to detect and prevent fraudulent acts in connection with insurance. Other non-profits may fall within the scope of the law, but further guidance is necessary.

³ The Maryland Online Data Privacy Act has a number of idiosyncrasies. For one, Maryland's law prohibits a controller from selling sensitive data. Maryland's law affords consumers the right to obtain a list of the categories of third parties to which the controller has disclosed the consumer's personal data or to which the controller has disclosed any consumer's personal data. Also, there is a "strictly necessary" data minimization requirement for processing sensitive data. Regarding the non-profit exemption, Maryland's law only exempts non-profit controllers that process personal data solely for the purposes of assisting (i) law enforcement investigating criminal or fraudulent insurance acts, or (ii) first responders for catastrophic events. Other non-profits may fall within scope of the law, but further guidance is necessary.

⁴ For this field, New Jersey was not included in the same company as Colorado and California for financial incentive notices because New Jersey does not require the extensive level of detail that we see for such notices under the privacy laws of Colorado and California. However, New Jersey does require providing "clear and conspicuous" notice.

⁵ These reflect some of the common exemptions under these laws, but there are others available under the comprehensive privacy laws. Companies should consult with counsel to learn more.