New State Data Privacy Laws Could Aect Your Marketing Strategy in 2025

In 2023 and 2024, several states implemented new data privacy laws:

• Iowa

• Delaware

• New Jersey

• Nebraska

• New Hampshire

If you operate a business or target consumers in any of the following states, you should be aware of these new laws. Many of them take effect in January 2025.

These laws require businesses to take steps to increase the transparency of their data collection, simplify their privacy disclosures, and implement easily accessible opt-out provisions for the collection and sale of personal data. This shift showcases the country’s trend toward aligning with Europe’s General Data Protection Regulation. It also demonstrates a commitment to privacy-conscious marketing tactics.

Here’s how new state data privacy laws could affect your marketing strategy in 2025:

Iowa Consumer Data Protection Act

In March 2023, Iowa enacted the Iowa Consumer Data Protection Act (ICDPA). Beginning Jan. 1, 2025, Iowa will require companies that conduct business in Iowa and/or target Iowa residents to follow the ICDPA’s rules. The ICDPA governs how companies collect, use and share data. It also requires businesses to fall in line with other state data privacy laws.

The ICDPA applies to large companies and companies that handle large amounts of data. The law extends to businesses that handle the personal data of either:

• 100,000 or more Iowans

or

• 25,000 or more Iowans if greater than 50% of the company’s revenue comes from selling personal data

Fast facts for ICDPA-covered businesses running targeted marketing campaigns:

• You must provide clear options for consumers to opt out of the sale of their data.

• You must process data only as necessary and in ways that are proportionate to the purpose you disclose in your privacy policy.

• You must familiarize your company with the ICDPA’s rules surrounding sensitive data, such as information about health, religious beliefs, race and minors.

Delaware Personal Privacy Act

In September 2023, Delaware enacted the Delaware Personal Data Privacy Act (DPDPA). Beginning Jan. 1, 2025, Delaware will require companies, institutions of higher learning and nonprofits to comply with rules mandating enhanced data transparency, limited data usage and respect for consumer rights.

The DPDPA applies to entities that either:

• Process the personal data of 35,000 or more Delaware residents (with an exception for data processed solely for payments)

or

• Process the personal data of at least 10,000 Delaware residents and derive greater than 20% of their revenue from the sale of said personal data

Fast facts for DPDPA-covered entities who process Delaware residents’ personal data:

• You must only collect and use personal data in line with the purposes you’ve disclosed in your privacy policy.

• You must implement appropriate security measures to protect personal data.

• You must obtain a consumer’s consent before you process their sensitive data, such as their genetic, health, or biometric data, or data about their precise geographic location, religious beliefs, sexual orientation, etc.

• You must be transparent about the sale and use of consumer data for targeted ad campaigns.

• You must conduct regular data protection assessments.

• You must provide clear opt-out options regarding the processing and sale of data online.

New Jersey’s Comprehensive Data Privacy Act

In January 2024, New Jersey enacted the New Jersey Data Privacy Act (NJDPA), making New Jersey the 13th state to enact comprehensive data privacy laws at a state level. Beginning Jan. 15, 2025, New Jersey will require companies to comply with data privacy rules similar to those of other U.S. states. This guarantees New Jersey residents and consumers broader rights surrounding their personal information.

The NJDPA applies to entities that either:

• Process the personal data of 100,000 or more New Jersey residents

or

• Process the personal data of at least 25,000 New Jersey residents and derive revenue or receive discounts from the sale of said personal data

Unlike many other states’ laws, the NJDPA does not set any revenue threshold for the applicability of its data privacy rules.

Fast facts for NJDPA-covered entities that process New Jersey consumers’ personal data:

• You must disclose if you sell or use personal data for advertising or profiling, including for marketing purposes.

• You must provide clear privacy notices detailing the types of data you collect, what you use that data for and the categories of third-party data-sharing you practice.

• Your privacy disclosures must be easily accessible and you must offer clear opt-out provisions.

• You must obtain consumer consent before processing sensitive data, including biometric, health, genetic, religious, financial and location data.

• You must conduct data protection assessments for processing activities associated with a high risk of consumer harm. These include targeted advertising, selling sensitive data and profiling.

Nebraska Data Privacy Act

Nebraska enacted the Nebraska Data Privacy Act (NDPA) in April 2024, making it the 17th state to enact a comprehensive data privacy law. Beginning Jan. 1, 2025, Nebraska will require companies that collect data on Nebraska consumers to follow strict regulations regarding how they collect and use data.

Unlike other state privacy laws, the NDPA applies to companies that

• Are not classified as small businesses under federal standards

and

• Target or collect data on Nebraska consumers, regardless of consumer count or revenue generated from data sales

The lack of a consumer count or revenue threshold makes the NDPA far broader than other statewide laws. If you market to Nebraska consumers, pay close attention to its mandates.

Fast facts for NDPA-covered entities that process Nebraska consumers’ personal data:

• You must disclose if you sell or use personal data for advertising or profiling, including for marketing purposes.

• You must provide clear privacy notices detailing the types of data you collect, what you use that data for and the categories of third-party data-sharing you practice.

• You must offer consumers the ability to opt out of the collection and sale of data, plus the right to delete data you keep on them.

New Hampshire’s Senate Bill 255

In March 2024, New Hampshire enacted Senate Bill 255 (SB255). This made New Hampshire the 15th state to enact a comprehensive data privacy law. Beginning Jan. 15, 2025, New Hampshire will require companies to comply with data privacy rules similar to those of other U.S. states.

SB255 applies to entities that either:

• Control or process the personal data of 35,000 or more consumers (with an exception for personal data collected solely for the purpose of payments)

or

• Control or process the personal data of at least 10,000 consumers and derive at least 25% of their revenue from the sale of consumer data

Fast facts for SB255-covered entities that process consumer personal data:

• You must create an accessible and transparent privacy notice if you are the controller of consumer personal data.

• You must limit your collection of consumer personal data to what is adequate, relevant and reasonably necessary for the purposes you’ve disclosed in your privacy policy.

• You must take reasonable measures to ensure the physical and technical protection of consumer personal data.

The bottom line for U.S. marketers

Gone are the days of inconspicuous, tracking-based approaches to consumer proling and marketing. In the wake of sweeping statewide legislation, marketers must develop approaches that do not rely on intrusive data collection. In doing so, companies will inevitably shift toward alternative marketing strategies, such as contextual advertising and consent-based advertising methods.