Dealers in Delaware, Iowa, Nebraska, New Hampshire, and New Jersey Should Be Ready
By Mark Sanborn
Senior Product and Regulatory Counsel
The New Year will bring significant changes to the privacy landscape, with five new comprehensive state privacy laws taking effect in early 2025. These new laws reflect a growing trend toward enhancing consumer privacy rights and increasing obligations for businesses handling personal data. Delaware, Iowa, Nebraska, and New Hampshire’s privacy laws become effective on January 1, 2025, closely followed by New Jersey’s law on January 15, 2025.
Each of these states’ privacy laws has its own unique nuances but generally follows the framework established by other state laws, such as those in Colorado and Virginia. Key provisions include expanded consumer rights, such as access, deletion, opt-out, and correction of personal data, as well as stricter rules on certain data processing activities. These laws place obligations on businesses to have specific provisions in privacy policies, obtain consent from consumers for certain uses of certain types of data, and honor these consumer rights when requested. This can be highly complicated and nearly impossible to do manually.
Businesses in these states should assess their current data processing practices and identify gaps in compliance with these new laws.
Key actions include
1. Review and Update Privacy Policies
Ensure your privacy notices clearly outline the rights available to consumers in these states, as well as your data collection, use, and sharing practices. This is generally done by displaying this policy on your websites.
- It must be consistent across all your sites.
- It must be yours! We have seen many instances where OEMs, websites, or other vendors will seek to place their own privacy policy on a dealer website. That can lead to problems and potential noncompliance for the dealer.
2. Enhance Data Management Practices
Implement processes to handle consumer requests for data access, correction, and deletion efficiently and within the mandated timelines.
- This means you must understand where consumer data is stored and with whom it is shared.
3. Audit Third-Party Data Practices
Review and update contracts with vendors and partners to ensure their data practices align with these new state laws. This includes verifying data-sharing agreements, ensuring proper safeguards are in place, and confirming that third parties can support consumer requests as required by the regulations.
4. Train Staff
Provide targeted training for employees to ensure they understand the new laws and their role in compliance efforts.
5. Work with A Reputable Vendor
Compliance with these different laws can be highly complicated, and managing policies and consumer requests is difficult using only manual processes.
Conclusion
Organizations operating across state lines may need to carefully navigate the nuances of various states’ laws to avoid potential compliance challenges. As more states enact their own privacy regulations, the already complex regulatory patchwork is expected to become even more intricate. And we are not done yet! Three more states (Tennessee, Minnesota, and Maryland) will have comprehensive privacy laws go into effect later in 2025, with six additional states’ privacy laws set to take effect by 2026.
You can see that there is a lot to do, but we can help! ComplyAuto helps thousands of dealers with state privacy law compliance, and we can help you too. We provide a comprehensive software suite that completely automates compliance with all current state privacy laws – including these five new states – and assists dealers in managing their policies and accurately responding to consumer requests. ComplyAuto has worked with many of the state associations in these five new states to conduct webinars and other training for dealers. If you are a current ComplyAuto customer and need assistance navigating these new laws or enhancing your compliance efforts, contact your CSM. If you are not a customer yet, get in touch with us.