States Leading the Charge in Data Privacy Regulation

Data privacy regulation is becoming increasingly important as states start to take steps to protect their citizens’ personal information. Kentucky, Rhode Island, and Tennessee are leading the way, earning high marks from security experts and resulting in lower rates of data breaches.

A Dual Approach to Data Privacy

The success of these three states can be attributed to a dual approach of drafting smart data privacy legislation and enforcing those laws when necessary, according to Anonta Khan, who conducted a study on state data privacy. This approach has yielded positive results, with South Dakota and Alaska ranking at the bottom due to weaker laws and more cyber threats.

Strong Laws Don’t Guarantee Safety

Despite having strong laws, states like California and Delaware still struggle with high rates of cybercrime and data breaches. Khan emphasizes that having strong laws is not enough; enforcement is key. "Having strong laws doesn’t always mean a state is safe," she stresses.

Higher Safety Scores Don’t Mean Less Cybercrime

The study’s findings suggest that states with weaker data breach regulation tend to have higher rates of cybercrime. Nevada, for example, has a safety score of 77.64 but logged 309.7 cyber incidents per 100,000 people, more than triple the national average. However, other factors contribute to these rates, such as the presence of businesses that are attractive targets for hackers, like casinos.

New State-Led Data Privacy Efforts

States are taking proactive steps to address data privacy concerns. Delaware has implemented a new Data Privacy Protection Act, and other states like Iowa, Nebraska, New Hampshire, and New Jersey are adding fresh data privacy laws and increasing enforcement budgets. Texas has also set a model for aggressive data privacy regulation enforcement, as exemplified by its attorney general’s recent lawsuit against Allstate for allegedly collecting and using personal data without consent.

Emerging Technology and Future Challenges

As emerging technologies like Artificial Intelligence (AI) become more prevalent, states are starting to consider new laws and regulations. Colorado’s Anti-Discrimination in AI Law is set to start in 2026, and other states are considering similar rules. Lawsuits over website tracking, biometric data, and online privacy will also continue to be a challenge in the future.

Opportunity for Companies

Regardless of state of residence, companies should view this new era of data privacy protection as an opportunity. Ojas Rege, senior vice president and general manager of privacy and data governance at OneTrust, advises organizations to take proactive steps to comply with current and future state privacy laws. By doing so, companies can minimize risk and adopt AI responsibly.