States Shift From Privacy Lawmaking to Enforcement, Experts Say
States increased enforcement and coordination this year, privacy experts said Thursday during a webinar hosted by compliance vendor Ketch.
Sign up for a free preview to unlock the rest of this article
Export Compliance Daily combines U.S. export control news, foreign border import regulation and policy developments into a single daily information service that reliably informs its trade professional readers about important current issues affecting their operations.
"State privacy regulators have been so active in 2025,” said Kelley Drye privacy attorney Laura Riposo VanDruff. “What we're seeing is a shift from states just passing laws ... to states really coordinating and enforcing them in meaningful ways."
For example, states’ formation last April of a Consortium of Privacy Regulators was "a big development,” said the lawyer. The group added two more states earlier this month, so it now includes 10 enforcers from nine states (see 2510080008). "Their goal is simple but powerful, said VanDruff: “Collaborating on enforcement and sharing intelligence so that companies face more consistent and coordinated oversight across the states."
Dave Cohen, a privacy consultant with Myna Partners, noted that enforcement “is expanding beyond the big companies.” Some companies formerly thought that regulators wanted to "make splashy headlines and go after the larger brands,” he said. "While that is still happening, it is not only larger companies that are being targeted."
Regulators are now using tech tools to scan websites, potentially putting everyone in the crosshairs, said Cohen: The enforcers are showing themselves to be "sector-agnostic,” with no company “too small.”
"Previously, it might have sufficed" to have a consent management platform and a privacy policy up," so that "it looked like you were doing reasonable due diligence,” the consultant said. However, based on this year's state privacy enforcement actions, "that's no longer sufficient." Not only must companies regularly update their privacy policies, he said, but opt-out and other privacy mechanisms "need to actually work."