Consumer Privacy Update: What Organizations Need to Know About Impending State Privacy Laws Going into Effect in 2024 and 2025

Over the past several years, the number of states with comprehensive consumer data privacy laws has increased exponentially from just a handful—California, Colorado, Virginia, Connecticut, and Utah—to up to twenty by some counts.

Many of these state laws will go into effect starting Q4 of 2024 through 2025. We have previously written in more detail on New Jersey’s comprehensive data privacy law, which goes into effect January 15, 2025, and Tennessee’s comprehensive data privacy law, which goes into effect July 1, 2025. Some laws have already gone into effect, like Texas’s Data Privacy and Security Act, and Oregon’s Consumer Privacy Act, both of which became effective July of 2024. Now is a good time to take stock of the current landscape as the next batch of state privacy laws go into effect.

Over the next year, the following laws will become effective:

  1. Montana Consumer Data Privacy Act (effective Oct. 1, 2024)
  2. Delaware Personal Data Privacy Act (effective Jan. 1, 2025)
  3. Iowa Consumer Data Protection Act (effective Jan. 1, 2025)
  4. Nebraska Data Privacy Act (effective Jan. 1, 2025)
  5. New Hampshire Privacy Act (effective Jan. 1, 2025)
  6. New Jersey Data Privacy Act (effective Jan. 15, 2025)
  7. Tennessee Information Protection Act (effective July 1, 2025)
  8. Minnesota Consumer Data Privacy Act (effective July 31, 2025)
  9. Maryland Online Data Privacy Act (effective Oct. 1, 2025)

These nine state privacy laws contain many similarities, broadly conforming to the Virginia Consumer Data Protection Act we discussed here.  All nine laws listed above contain the following familiar requirements:

(1) disclosing data handling practices to consumers,

(2) including certain contractual terms in data processing agreements,

(3) performing risk assessments (with the exception of Iowa); and

(4) affording resident consumers with certain rights, such as the right to access or know the personal data processed by a business, the right to correct any inaccurate personal data, the right to request deletion of personal data, the right to opt out of targeted advertising or the sale of personal data, and the right to opt out of the processing sensitive information.

The laws contain more than a few noteworthy differences. Each of the laws differs in terms of the scope of their application. The applicability thresholds vary based on: (1) the number of state residents whose personal data the company (or “controller”) controls or processes, or (2) the proportion of revenue a controller derives from the sale of personal data. Maryland, Delaware, and New Hampshire each have a 35,000 consumer processing threshold. Nebraska, similar to the recently passed data privacy law in Texas, applies to controllers that that do not qualify as small business and process personal data or engage in personal data sales. It is also important to note that Iowa adopted a comparatively narrower definition of what constitutes as sale of personal data to only transactions involving monetary consideration. All states require that the company conduct business in the state.

With respect to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), Iowa’s, Montana’s, Nebraska’s, New Hampshire’s, and Tennessee’s laws exempt HIPAA-regulated entities altogether; while Delaware’s, Maryland’s, Minnesota’s, and New Jersey’s laws exempt only protected health information (“PHI”) under HIPAA. As a result, HIPAA-regulated entities will have the added burden of assessing whether data is covered by HIPAA or an applicable state privacy law.

With respect to the Gramm-Leach-Bliley Act (“GLBA”), eight of these nine comprehensive privacy laws contain an entity-level exemption for GBLA-covered financial institutions. By contrast, Minnesota’s law exempts only data regulated by GLBA. Minnesota joins California and Oregon as the three state consumer privacy laws with information-level GLBA exemptions.

Not least of all, Maryland’s law stands apart from the other data privacy laws due to a number of unique obligations, including:

  • A prohibition on the collection, processing, and sharing of a consumer’s sensitive data except when doing so is “strictly necessary to provide or maintain a specific product or service requested by the consumer.”
  • A broad prohibition on the sale of sensitive data for monetary or other valuable consideration unless such sale is necessary to provide or maintain a specific product or service requested by a consumer.
  • Special provisions applicable to “Consumer Health Data” processed by entities not regulated by HIPAA. Note that “Consumer Health Data” laws also exist in Nevada, Washington, and Connecticut as we previously discussed here.
  • A prohibition on selling or processing minors’ data for targeted advertising if the controller knows or should have known that the consumer is under 18 years of age.

While states continue to enact comprehensive data privacy laws, there remains the possibility of a federal privacy law to bring in a national standard. The American Privacy Rights Act (“APRA”) recently went through several iterations in the House Committee on Energy and Commerce this year, and it reflects many of the elements of these state laws, including transparency requirements and consumer rights. A key sticking point, however, continues to be the broad private right of action included in the proposed APRA but absent from all state privacy laws. Only California’s law, which we discussed here, has a private right of action, although it is narrowly circumscribed to data breaches.  Considering the November 2024 election cycle, it is likely that federal efforts to create a comprehensive privacy law will stall until the election cycle is over and the composition of the White House and Congress is known.

Will Hemp Save the World, Before the Government Kills It?

There is a great line in the wonderful film Charlie Wilson’s War, where Charlie Wilson (played remarkably by the inimitable Tom Hanks) describes the successful, if relatively covert, involvement of the United States government in the Soviet-Afghan War: “These things happened. They were glorious and they changed the world… and then we f***d up the endgame.”

With the next Farm Bill somewhere on the horizon, I believe we are approaching a similar moment for the future of hemp. I believe the future of hemp is glorious and that it can change the world. What will we do to the endgame?

This is an analysis about the current state of hemp and whether that industry will revolutionize the world before the government relegates it back to the ash heap of history. It just so happens to dovetail with my personal experience representing clients in connection with the hemp business.

In the Beginning…

Back in the “stone age” (circa 2017) when I decided I wanted to be a cannabis lawyer, I began with a focus on hemp. [As a brief aside, telling people in Alabama you practice cannabis law in 2017 must have been what Noah felt like when he was telling people it was about to start raining.]

The 2014 Farm Bill, which for the first time legalized “industrial hemp” as distinct from marijuana under the Controlled Substances Act and allowed state agricultural departments and universities to license the production of hemp, cracked the door for a nascent and limited hemp market, and it was a remarkable time to advise new hemp operators and investors about how to maximize this opportunity within the contours of the law.

At the same time, I was regularly receiving calls from existing clients, colleagues within the firm, and strangers about how their non-cannabis companies should conduct themselves when approached by hemp companies who wanted to do business with them. The latter category included banks, insurance companies, real estate companies, and myriad companies who had questions about how their employees’ use of hemp interplayed with the companies’ existing drug testing policies. Most of the time the companies were reluctant to have anything to do with hemp, but the conversations were interesting, and it was clear that most companies realized the landscape was changing. It was the Wild West, and I was having a ball.

Rocket Fuel

Enter the 2018 Farm Bill and the explosion of the hemp industry. The 2018 Farm Bill dropped the word “industrial” and defined “hemp” as:

the plant Cannabis sativa L. and any part of that plant, including the seeds thereof and all derivatives, extracts, cannabinoids, isomers, acids, salts, and salts of isomers, whether growing or not, with a delta-9 tetrahydrocannabinol concentration of not more than 0.3 percent on a dry weight basis.

In addition to removing the limitations from the 2014 Farm Bill licensing, the 2018 Farm Bill also moved oversight authority from the Department of Justice and DEA to the USDA and FDA.

The 2018 Farm Bill was a tectonic shift, and we recognized the new regime’s potential almost immediately, predicting the following:

  • Increased “smart” money and research. Because hemp has been a Schedule I substance along with marijuana for decades, many sophisticated sources of funding have abstained from financing the industry. This placed hemp at a competitive disadvantage to other commodities and prevented hemp from reaching its full potential. Now that hemp can be manufactured and sold without substantial legal risks, look for the money to flow toward this underserved sector. Publicly traded companies, private equity firms, venture capitalists and other investment groups will all take significant stakes in both the manufacturing and selling of hemp and hemp-derived products. In addition to traditional commercial development efforts, much of this cash is likely to be spent to hire top researchers to develop proprietary strands of hemp to meet a range of product applications and to take steps to protect the resulting intellectual property.
  • Explosion of hemp and hemp-derived products. Fueled in large part by this injection of financing from sophisticated investors, there is likely to be an explosion in the ways that hemp is used. Hemp already has hundreds — if not thousands — of known uses, and that number should grow substantially once the industry is exposed to the market forces that come with smart money and increased research. The biggest winner may be the hemp-derived CBD business. Hemp-derived CBD is a compound believed to have significant therapeutic benefits without an appreciable psychoactive component. The Washington Post has reported that “dozens of studies have found evidence that [CBD] can treat epilepsy as well as a range of other illnesses, including anxiety, schizophrenia, heart disease, and cancer.” One industry analysis predicts that the hemp-CBD market alone could hit $22 billion by 2022. The health and wellness sector should see particular hemp-related activity and growth in the coming years.
  • Increased ancillary services provided to hemp-related businesses. Because hemp has been included within the definition of marijuana under federal law for decades, most banks, law firms and other service providers have avoided providing services to hemp businesses to avoid the risk of charges of money laundering or conspiring to violate state and federal drug laws. The absence of such service providers has fostered a great deal of uncertainty in an area where certainty and clarity have been sorely needed. With hemp’s new legal status, look for professional service providers to enter the market in 2019 and beyond. Of course, entities looking to provide services to hemp-related businesses should take adequate precautions to ensure those businesses are only producing federally legal hemp.
  • Consolidation and integration. An interesting phenomenon in “legal” marijuana states has been the rapid consolidation and integration of marijuana growers, processors and dispensaries. Some states have mandated vertical integration (e.g., the growers are the sellers) through regulation. And a number of large cannabis companies have acquired grow operations or multi-unit dispensaries rather than establish a cannabis presence in a state from scratch. The hemp industry is likely to follow a similar path, both through government regulation and because larger companies are likely to seek to obtain sufficient quantities of hemp through consolidation and vertical integration. Accordingly, attorneys and investors should anticipate significant merger and acquisition activity in the coming years.
  • Federal regulations and state regimes. The 2018 Farm Bill does not create an entirely unregulated playing field for hemp. Over the coming months, the U.S. Department of Agriculture and Food and Drug Administration will issue regulations implementing the 2018 Farm Bill. State governments will also unveil plans governing the testing, labeling and marketing of hemp-related products, as well as the licensing and monitoring of hemp-related businesses.

I’m proud to say that we were pretty much on the money with these projections, and countless studies and data confirm that hemp can be a viable product with countless form factors that help shape the global economy.

That is when I realized that I might be able to make a career as a cannabis lawyer.

The Good with the Bad

Of course, the development of the hemp industry has not been without controversy – in fact it may be the controversy that has spurred much of the development.

I would be lying to you if I told you that every hemp or hemp-derived product was designed with the best of intentions or contained appropriate mechanisms to ensure consumer safety. There are certainly hemp-derived products on the market that have not been subjected to sufficient product development and testing, and that are being marketed in ways that rightfully should concern policymakers and the public. Novel, psychoactive cannabinoids that fall within the bounds of the terms, if perhaps not the spirit, of the Farm Bill fill the shelves of stores around the country with little to no mechanisms for enforcement. That should change, and Americans should have confidence that the products made available to them are safe and effective.

In response to this proliferation, a number of states have enacted rules and regulations restricting the production and sale of certain hemp-derived cannabinoids. A number of those rules – for example, age and purity restrictions for psychoactive cannabinoids – seem well-intentioned, and we expect to see more of those unless and until the federal government takes further action.

On occasion, however, it appears that the motivations of policymakers may be less pure. It is no secret amongst those in the cannabis industry that marijuana licensees in states that have legalized marijuana are no fans of the unregulated hemp-derived psychoactive industry. After all, marijuana companies are subject to astronomical taxes and endure regulatory costs that make turning a profit far more difficult than if they were able to offer a product that offered a somewhat similar “high” without the institutional overhead and headwinds. Florida may be the clearest and most recent example. With adult-use marijuana widely expected to become law in Florida soon, the state legislature recently passed a law largely prohibiting delta-8 and delta-10.

On the other hand, it would be wrong, even lazy, to suggest that the development of hemp-based products has been without substantial benefits to society as a whole. Entrepreneurs are developing hemp-based substitutes for any number of the most common products used around the globe, meaning that the addressable market for hemp is everyone on earth and beyond.

A younger version of me once wrote, in comparing the addressable market for marijuana to that of hemp:

Hemp, on the other hand, has the potential to dwarf marijuana in the global market. Unlike its sister plant, hemp has the capacity to replace products we use every day without us even realizing it. For example, hemp can provide a substitute for concrete, plastic, fuel, automotive parts, clothes, etc. These are products nearly all consumers need but they neither realize nor care what the products are made of, as long as they work. In that way, while the market for marijuana is limited to consumers looking to purchase marijuana, the market for hemp includes anyone who purchases products that can be manufactured by hemp. In part for these reasons, experts predict four to five times growth in the industrial hemp market in the next five years.

I stand by those words. I am convinced that hemp can change the world.

But I am equally convinced that local, state, and federal governments can, without the appropriate consideration for hemp’s benefits, relegate the plant back to its prohibition era status and deny the world its many benefits. The policy choices made by state governments, and perhaps most importantly by the federal government during the next Farm Bill, could fundamentally alter the future of hemp. Will it be a soon-forgotten shooting star that dazzled the world for a decade and then burned out, or will we look back at the past decade as the renaissance of one of civilization’s oldest and most versatile plants?

Conclusion

I’ll end where I began because Philip Seymour Hoffman’s work is revered by the Budding Trends community (and anyone with taste), and because the film’s ominous conclusion is a message for anyone who wants to see the hemp industry thrive in the years ahead.

As Hanks’ character celebrates the Afghan defeat of the Soviets, the hardened CIA analyst played by Hoffman offers this parable:

On his sixteenth birthday the boy gets a horse as a present. All of the people in the village say, “Oh, how wonderful!”

The Zen master says, “We’ll see.”

One day, the boy is riding and gets thrown off the horse and hurts his leg. He’s no longer able to walk, so all of the villagers say, “How terrible!”

The Zen master says, “We’ll see.”

Some time passes and the village goes to war. All of the other young men get sent off to fight, but this boy can’t fight because his leg is messed up. All of the villagers say, “How wonderful!”

The Zen master says, “We’ll see.”

The message behind this story is pretty clear. We’re prone to jump to conclusions about whether something is “good” or “bad.” We are especially quick to label something as “bad.” The reality is that things can be either good or bad, both good and bad, or neither. When it comes to whether Congress and the states will recognize hemp’s great potential, I guess we’ll see.