This year, new data privacy laws will go into effect in California, Colorado and Virginia, with more states expected to follow this legislative trend. As businesses grapple with a myriad of compliance issues relating to these new laws, one requirement that many tend to underestimate is the creation of an external-facing privacy policy. In fact, some companies may be tempted to simply copy another’s policy, upload it to their websites, and call it a day.

Bolstering the protections afforded under the California Consumer Privacy Act (as amended by the California Privacy Rights Act, the CCPA), California has enacted the California Age-Appropriate Design Code Act (AADC), which expands the scope of online privacy protections for children under 18. The AADC will take effect on July 1, 2024 and apply to CCPA-regulated businesses. As such, those businesses are encouraged to begin conducting impact assessments now in light of the possibility that material design changes may be necessitated by the AADC.

Companies that sell data during the course of their business do not always realize that they are considered a “data broker” under some U.S. state laws, and that their data broker activities may require registration with some states. With increased attention being paid to individual privacy rights and the recent enactment of new state privacy laws in the U.S., it is an opportune time for companies to determine whether they are data brokers so that they can focus their compliance efforts on the various requirements, if applicable.