The Five State Laws in Effect in 2023
This chapter focuses on the five state comprehensive laws in effect in 2023: California, plus the CPA (Colorado), CTDPA (Connecticut), UCPA (Utah), and VCDPA (Virginia). California is broadest; Utah is the narrowest outlier.
How this supports CIPP/US study
Use this lesson to compare state-law scope, rights, exceptions and enforcement before choosing an answer. Continue with the CIPP/US exam questions.
This chapter covers the five laws in effect in 2023: California, plus the CPA (Colorado), CTDPA (Connecticut), UCPA (Utah), and VCDPA (Virginia). Because the acronyms are confusingly similar, the chapter refers to each by state name instead.
Virginia was the second state to enact a law and was initially touted as the pro-business approach, contrasted with California's more privacy-protective, GDPR-like framework. As more states passed laws, that distinction became muddied. The frameworks overlap so heavily that commentators speak of interoperability among them.
| Grouping | Characterization |
|---|---|
| California | Broadest definitions; most GDPR-like; only state to regulate sharing and include employees |
| Colorado, Connecticut, Virginia | Similar frameworks; provide right to appeal and opt-in for sensitive data sale |
| Utah | Narrowest definition of business; fewest consumer rights; fewest business obligations |
The chapter warns that ranking the laws as strictest/weakest oversimplifies a complex web of requirements. Better to learn the trends and outliers - especially that California is broadest and Utah is narrowest.
Key terms - quick answers
What is “CPA”?
What is “CTDPA”?
What is “UCPA”?
What is “VCDPA”?
Sources and study method
This independent lesson uses active recall, spaced retrieval and scenario practice. Read the full study method.