Colorado Connecticut, and Virginia landed on requiring opt-in, prior consent before a business can collect sensitive personal information; while California and Utah landed on different forms of opt-out rights that allow initial collection without prior consent

As the calendar turns to a new year, the United States data protection law will also make a turn towards more states implementing and enforcing new data protection laws impacting a business’s collection, use, and disclosure of personal information; as well as the internal security and audit controls a business must have in place.