Five years later: GDPR and the U.S. state privacy law boom

It’s hard to believe that half a decade has gone by since the General Data Protection Regulation (“GDPR”) first came into effect on May 25, 2018. Since its inception, the GDPR has resulted in billions of dollars in fines against companies for failing to adhere to the regulation’s strict data handling requirements.

As shown in the table below, ten U.S. states have passed privacy laws with some provisions similar to those found in the GDPR. In 2023 alone, five state privacy laws are becoming effective, and five more states passed new privacy laws with future effective dates. This is leading to a patchwork of privacy laws – making it difficult for interstate companies to comply with different states’ laws. No federal privacy law is currently on the horizon, but having one uniform standard that would preempt inconsistent state laws could ease compliance for many businesses.