This site does not constitute legal advice. All research contained herein should be verified prior to reliance thereon, and a lawyer should be consulted to assess its applicability to any particular model of care. By accessing this site, you accept the terms of our privacy policy and you acknowledge your understanding that this tool is not a replacement for legal counsel. There is no guarantee that this research is up to date, as laws and regulations in this space continue to evolve.LAST UPDATED JUNE 2023.
A diverse, global network of industry-leading talent committed to you and your vision.
1/4
As you confront the challenges and consequences of appealing a trial court decision, you can turn to our appellate team for the highest quality briefing, oral advocacy and strategic counseling at every step of the process. Combining unparalleled constitutional litigation experience with creative legal solutions, we are always ready to roll up our sleeves and tackle the complexities of appeals courts of all levels across the country—including the Supreme Court—on behalf of leading companies, individuals, business associations and other litigants.
2/4
To help your business navigate the unique, complex regulations around alcohol beverage licensing, permitting, production, taxation and more, we tap into our premier team’s collective legislative and regulatory experience and deep market knowledge. As the only Tier 1 Alcohol Regulatory Practice in the United States, and with experience in jurisdictions around the world, we can provide you with practical solutions and strategic advice to promote and safeguard your interests and help fuel your success.
3/4
Steering your company through the energy market’s regulatory landscape requires constant attention and a deep understanding of the unique legal issues you encounter. We make it easier for you to focus on your business objectives, providing coordinated legal counsel in jurisdictions around the world and leveraging our broad industry knowledge to help propel your success. You can turn to us for support with any of your transactional and regulatory needs in the power, oil and gas, renewable energy biofuels, renewable energy, agriculture, metals or derivatives markets, at home or abroad.
4/4
Your organization faces increasing pressure to ensure customers’ data privacy and stay ahead of the curve on cybersecurity regulations and risks. Our global team brings you sophisticated guidance on the complex statutory, regulatory and enforcement regimes that govern the collection, use and disclosure of data around the world. To help you think ahead, we constantly monitor industry trends and provide proactive counsel on global privacy compliance, catastrophic cyber incident response, best practices for implementing cutting-edge data strategies and beyond.
Accolades & Rankings / June 29, 2023
McDermott Achieves 14th Consecutive Band 1 Healthcare National Ranking from Chambers USA
CALIFORNIA
Click below to download a full summary of the law.
At a glance:
Title of Law (and Acronym)
California Consumer Privacy Act of 2018 as amended by California Privacy Rights Act of 2020 (CCPA As Amended)
Statute Cite
CAL. CIV. CODE §§ 1798.100-1798.199.100 (West 2023).
Regulation Cite
Cal. Code Regs. tit. 11, §§ 7000-7304 (2023)
Effective Date
01/01/2023
Applicability Thresholds
For-profit entity that collects California consumers’ personal information, or on the behalf of whom such information is collected and that alone, or jointly with others, determines the purposes and means of the processing of consumers’ personal information, that does business in the State of California, and that:
(1) As of January 1 of the calendar year, had annual gross revenues in excess of $25,000,000 in the preceding calendar year; or
(2) Alone or in combination, annually buys, sells, or shares the personal information of 100,000 or more consumers or households; or
(3) Derives 50 percent or more of its annual revenues from selling or sharing consumers’ personal information.
Applicable to Employees and Business Contacts?
Yes
Statutory Penalties
Up to $7,500 for each intentional violation and each violation involving the personal information of minor consumers
Private Right of Action
Yes (limited to data breach claims)
McDermott Resources
State Regulators Step Up Enforcement of New Privacy Laws, August 8, 2023
Ruling Delays Enforcement of Latest CCPA Regulations, July 5, 2023
California Privacy Protection Agency Approves CCPA Regulations, February 10, 2023
California Privacy Rights Act Takes Effect…Sort Of, January 4, 2023
California Voters Approve the California Privacy Rights Act, November 4, 2020
COLORADO
Click below to download a full summary of the law.
At a glance:
Title of Law (and Acronym)
Colorado Privacy Act of 2021 (CPA)
Statute Cite
COLO. REV. STAT. § 6-1-1301 to -1313 (2022).
Regulation Cite
Colo. Code Regs. Tit. 4, § 904-3 (2023)
Effective Date
07/01/2023
Applicability Thresholds
Applies to a business that: Conducts business in Colorado or produces or delivers commercial products or services that are intentionally targeted to residents of Colorado; and satisfies one or both of the following thresholds:
(1) Controls or processes the personal data of one hundred thousand consumers or more during a calendar year; or
(2) Derives revenue or receives a discount on the price of goods or services from the sale of personal data and processes or controls the personal data of 25,000 consumers or more.
Applicable to Employees and Business Contacts?
No
Statutory Penalties
Not more than $20,000 per violation
Private Right of Action
No
McDermott Resources
State Regulators Step Up Enforcement of New Privacy Laws, August 8, 2023
Colorado Finalizes Sweeping New Privacy Rules; Iowa Joins the Fray, March 21, 2023
Preparing for New Consumer Privacy Laws in Colorado, Connecticut, and Utah, February 3, 2023
‘Tis the Season: Colorado Attorney General Releases New Draft CPA Regulations, December 22, 2022
Colorado Attorney General’s Office Issues Draft Colorado Privacy Act Regulations, October 3, 2022
State Privacy Patchwork Spreads with Signing of Colorado Privacy Act, July 9, 2021
CONNECTICUT
Click below to download a full summary of the law.
At a glance:
Title of Law (and Acronym)
Connecticut Data Privacy Act of 2022 (CTDPA)
Statute Cite
CONN. GEN. STAT. §§ 42-515 to -525 (2022).
Regulation Cite
N/A
Effective Date
07/01/2023
Applicability Thresholds
Companies that conduct business in Connecticut or companies that produce products or services that are targeted to residents of this state and that during the preceding calendar year:
(1) Controlled or processed the personal data of not less than 100,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or
(2) Controlled or processed the personal data of not less than 25,000 consumers and derived more than 25 percent of their gross revenue from the sale of personal data.
Applicable to Employees and Business Contacts?
No
Statutory Penalties
Up to $5,000 per violation
Private Right of Action
No
McDermott Resources
Connecticut Steps Up to the Consumer Privacy Law Plate, May 2, 2022
DELAWARE
Click below to download a full summary of the law.
At a glance:
Title of Law (and Acronym)
Delaware Personal Data Privacy Act (DPDPA)
Statute Cite
Regulation Cite
N/A
Effective Date
01/01/2025
Applicability Thresholds
DPDPA applies to any person that conducts business in Delaware or provides products / services to Delaware residents and:
(1) Control or process personal data of 35,000 or more Delaware consumers (excluding data controlled or processed solely for the purpose of completing a payment transaction); or
(2) Control or process personal data of 10,000 or more Delaware consumers and derive over 20% of gross revenue from the sale of that data.
Applicable to Employees and Business Contacts?
No
Statutory Penalties
Up to $10,000 per violation
Private Right of Action
No
McDermott Resources
Baker’s Dozen: Delaware Becomes 13th State to Enact State Consumer Privacy Law, September 13, 2023
FLORIDA
Click below to download a full summary of the law.
At a glance:
Title of Law (and Acronym)
Florida Digital Bill of Rights (FDBR)
Statute Cite
S.B. 262, 125 Reg. Sess. (Fla. 2023) (to be codified at FLA. STAT. §§ 501.702-72 (2023)).
Regulation Cite
N/A
Effective Date
12/31/2023
Applicability Thresholds
Most of the FDBR applies to for-profit entities that conduct business in Florida and collect personal data about Florida consumers (or are the entity on behalf of which such information is collected) that meet the following requirements:
(1) Make in excess of $1 billion in global gross annual revenues; and
(2) Satisfy at least one of the following:
(a) Derive 50% or more of its global gross annual revenues from the sale of advertisements online, including providing targeted advertising or the sale of ads online;
(b) Operate a consumer smart speaker and voice command component service with an integrated virtual assistant connected to a cloud computing service that uses hands-free verbal activation. For purposes of this sub-subparagraph, a consumer smart speaker and voice command component service does not include a motor vehicle or speaker or device associated with or connected to a vehicle that is operated by a motor vehicle manufacturer or a subsidiary or affiliate thereof; or
(c) Operate an app store or a digital distribution platform that offers at least 250,000 different software applications for consumers to download and install.
However, under § 501.715(1), even companies that do not meet the requirements of (1) and (2) are required to obtain consent before selling sensitive data if they are a for-profit entity conducting business in Florida and collecting personal data from Florida residents.
Applicable to Employees and Business Contacts?
No
Statutory Penalties
Up to $15,000 per violation, with the possibility of treble damages for any of the following violations:
Private Right of Action
No
McDermott Resources
Florida Adds a New Twist to Consumer Privacy Patchwork, May 10, 2023
INDIANA
Click below to download a full summary of the law.
At a glance:
Title of Law (and Acronym)
Indiana Consumer Data Protection Act of 2023 (Indiana CDPA)
Statute Cite
S.B. 5, 123d Gen. Assemb., Reg. Sess. (Ind. 2023) (to be codified at IND. CODE § 24-15 (2023)).
Regulation Cite
N/A
Effective Date
01/01/2026
Applicability Thresholds
A company that conducts business in Indiana or produces products or services that are targeted to residents of Indiana and that during a calendar year:
(1) controls or processes personal data of at least 100,000 consumers who are Indiana residents; or
(2) controls or processes personal data of at least 25,000 consumers who are Indiana residents and derives more than 50 percent of gross revenue from the sale of personal data.
Applicable to Employees and Business Contacts?
No
Statutory Penalties
Up to $7,500 per violation
Private Right of Action
No
McDermott Resources
And Then There Were Seven: Indiana Passes Consumer Privacy Bill, April 14, 2023
IOWA
Click below to download a full summary of the law.
At a glance:
Title of Law (and Acronym)
Iowa Consumer Data Protection Act of 2023 (Iowa CDPA)
Statute Cite
S.F. 262, 89th Gen. Assemb., Reg. Sess. (Iowa 2023) (to be codified at IOWA CODE § 715D.1-9 (2023)).
Regulation Cite
N/A
Effective Date
01/01/2025
Applicability Thresholds
A company conducting business in Iowa or producing products or services that are targeted to consumers who are residents of Iowa and that during a calendar year does either of the following:
(1) Controls or processes personal data of at least 100,000 consumers
(2) Controls or processes personal data of at least 25,000 consumers and derives over 50 percent of gross revenue from the sale of personal data.
Applicable to Employees and Business Contacts?
No
Statutory Penalties
Up to $7,500 per violation
Private Right of Action
No
McDermott Resources
MONTANA
Click below to download a full summary of the law.
At a glance:
Title of Law (and Acronym)
Montana Consumer Data Privacy Act of 2023 (MCDPA)
Statute Cite
S.B. 384, 68th Leg., Reg. Sess. (Mont. 2023) (to be codified at MONT. CODE ANN. § 30-14 (2023)).
Regulation Cite
N/A
Effective Date
10/01/2024
Applicability Thresholds
Companies that conduct business in Montana or persons that produce products or services that are targeted to residents of Montana and:
(1) control or process the personal data of not less than 50,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or
(2) control or process the personal data of not less than 25,000 consumers and derive more than 25% of gross revenue from the sale of personal data.
Applicable to Employees and Business Contacts?
No
Statutory Penalties
Up to $10,000 per willful violation per Mont. Code Ann. § 30-14-142, Unfair Trade Practices
Private Right of Action
No
McDermott Resources
Consumer Privacy Law Comes to Big Sky Country as Montana Passes New Law, April 25, 2023
OREGON
Click below to download a full summary of the law.
At a glance:
Title of Law (and Acronym)
Oregon Consumer Privacy Act (OCPA)
Statute Cite
Regulation Cite
N/A
Effective Date
07/01/2024
Applicability Thresholds
OCPA applies to any person that conducts business in Oregon or provides products / services to Oregon residents and:
(1) Controls or processes personal data of 100,000 or more Oregon consumers (excluding personal data controlled or processed solely for the purpose of completing a payment transaction); or
(2) Controls or processes personal data of 25,000 or more Oregon consumers and derive over 25% of gross revenue from the sale of that data.
Applicable to Employees and Business Contacts?
No
Statutory Penalties
Up to $7,500 per violation
Private Right of Action
No
McDermott Resources
TENNESSEE
Click below to download a full summary of the law.
At a glance:
Title of Law (and Acronym)
Tennessee Information Protection Act of 2023 (TIPA)
Statute Cite
Regulation Cite
N/A
Effective Date
07/01/2025
Applicability Thresholds
Companies that conduct business in Tennessee or target products or services to residents of Tennessee and:
(1) Have more than $25,000,000 in “revenue;” and
(2) Control or process personal information of 175,000 or more Tennessee consumers; or
(3) Control or process personal information of 25,000 or more Tennessee consumers and derive over 50 percent of gross revenue from the sale of that data.
Applicable to Employees and Business Contacts?
No
Statutory Penalties
Up to $15,000 per violation
Private Right of Action
No
McDermott Resources
Tennessee Joins the Fray as Legislature Passes Consumer Privacy Law, April 25, 2023
TEXAS
Click below to download a full summary of the law.
At a glance:
Title of Law (and Acronym)
Texas Data Privacy and Security Act (TDPSA)
Statute Cite
H.B. 4, 88 Reg. Sess. (Tex. 2023).
Regulation Cite
N/A
Effective Date
03/01/2024
Applicability Thresholds
TDPSA applies to for-profit businesses or persons that:
(1) Does business in Texas or produces a product or service consumed by a Texas resident;
(2) Processes or engages in the sale of personal data; and
(3) Is not considered a “small business” by the US Small Business Administration (except to the extent that the small business sells sensitive personal data).
Applicable to Employees and Business Contacts?
No
Statutory Penalties
Up to $7,500 per violation
Private Right of Action
No
McDermott Resources
Texas Consumer Privacy Law Nears Governor’s Signature, May 31, 2023
UTAH
Click below to download a full summary of the law.
At a glance:
Title of Law (and Acronym)
Utah Consumer Privacy Act of 2022 (UCDPA)
Statute Cite
Regulation Cite
N/A
Effective Date
12/31/2023
Applicability Thresholds
A company that conducts business in Utah or produces a product or service that is targeted to consumers in Utah and that:
(1) has annual revenue of $25,000,000 or more; and satisfies one or more of the following thresholds:
(a) during a calendar year, controls or processes personal data of 100,000 or more consumers; or
(b) derives over 50% of the entity’s gross revenue from the sale of personal data and controls or processes personal data of 25,000 or more consumers.
Applicable to Employees and Business Contacts?
No
Statutory Penalties
Up to $7,500 per violation
Private Right of Action
No
McDermott Resources
VIRGINIA
Click below to download a full summary of the law.
At a glance:
Title of Law (and Acronym)
Virginia Consumer Data Protection Act of 2021 (VCDPA)
Statute Cite
VA. CODE ANN. §§ 59.1-571 to -585 (West 2023).
Regulation Cite
N/A
Effective Date
01/01/2023
Applicability Thresholds
Companies that conduct business in Virginia or produce products or services that are targeted to residents of Virginia and that:
(1) during a calendar year, control or process personal data of at least 100,000 consumers or
(2) control or process personal data of at least 25,000 consumers and derive over 50 percent of gross revenue from the sale of personal data.
Applicable to Employees and Business Contacts?
No
Statutory Penalties
Up to $7,500 per violation
Private Right of Action
No
McDermott Resources