Part 6 of John's CIPP/US Privacy Materials

John Bandler’s CIPP/US and US Privacy Learning Part 6

State Privacy Laws, Including State Cybersecurity and Data Breach Laws, BoK V

by John Bandler

This is Part 6 of my U.S. Privacy and CIPP/US and privacy learning materials, aligning with CIPP/US BoK Domain V.

+ This page is greatly updated and mostly comprehensive after a recent revamp in August 2026 +

1. To navigate John's CIPP/US pages

2. Topics covered

Here we cover cover state privacy laws, state cybersecurity laws, and state data breach notification laws. States have lead the way with privacy laws, cybersecurity laws, and data breach notification laws. Think of them as "data laws", and many consider privacy laws to include cybersecurity and breach notification laws.

In Part 3 (Domain II) we covered federal privacy laws, now we look at the state versions. If you are assessing privacy and cybersecurity laws, you'll want to assess both federal and state laws, and prioritize which state laws to focus on.

This is a big domain, and it is heavily tested, so prioritize accordingly. Obviously, you cannot hope to master the nuances of the laws of fifty different states, so start with and focus on the basics.

3. Don't forget the overall references for CIPP/US and my courses

  • See my Part 1 webpage for the overall references and additional reading (including IAPP resources)
  • My online courses provide priority coverage of important areas, so if you are in my online course, listen to those first.
  • If you are taking one of my online courses and want to dig deeper into the materials, I provide resources and references here. Prioritize your time, start by learning the basics before digging into the weeds.
  • If you are not taking one of my online courses, that's OK too, I hope they help you, and please consider this.

4. Part 6 specific references

  • See my Part 1 course for the overall references and additional reading (including IAPP resources, the coursebook, etc.)
  • My courses provide priority coverage of important areas. If you want to dig deeper (or are not taking one of my courses) see these resources.

Part 6 prioritization: You guessed it, start with the basics. This is a heavily tested domain but no one expects you to memorize the details of every state's privacy, cybersecurity, and breach notification laws. This is the last domain in the BoK so hang in there and persevere. Know about California's laws because they have led the way (but it doesn't mean you have to read their entire law). Know about your state's laws because it's your state. Recap the basics on data law. See some of the state law trackers cited, and the some of the categories they use. Reconsider the federal vs. state issues. Achieve understanding and stay on top of current events. I researched some things heavily, but you should just get the basic takeaway (e.g. Geofencing, GIPA).

 

Key Cyberlaw book parts and chapters relating to this domain include:Cyberlaw by John Bandler front cover

4.1 Helpful summaries of state laws

IAPP - International Association of Privacy Professionals

NCSL -  National Conference of State Legislatures

Other

4.2 California laws

A special section for CA because they have led the way in state privacy, arguably U.S. privacy.

Some California laws

  • California AB 1950 (2003) (breach notification)
  • California Privacy Rights Act of 2020 (CPRA).
  • California Electronic Communications Privacy Act (2015)
  • California Consumer Privacy Act (CCPA) (2018, effective 2020)
  • California Privacy Rights Act (CPRA) (2020 ballot referendum effective 2023)
  • California Privacy Protection Agency (CPPA) (created by CPRA)
  • California Age-Appropriate Design Code Act (A.B. 2273) (2022)
  • Delete Act (SB 362) (2023) (see Delete Request and Opt-out Platform (DROP))

California regulators

Some links, websites, laws re CA

California Age-Appropriate Design Code Act and litigation

4.3 New York Laws

  • NYS SHIELD Act, a cybersecurity and breach notification law. The SHIELD Act of 2019 strengthened the existing breach notification law and added a new cybersecurity requirement.
  • In the NYS General Business Law (GBL, or GBS)

4.4 Your state’s laws and miscellaneous

Use the resources from 4.1 or your research skills to find the data laws of your state, and who enforces them (e.g., state attorney general) and their guidance.

The BoK periodically cycles on and off various newish data laws for various states, but unfortunately do not always tell you which year.

  • Pennsylvania SB 696 (2022)
  • Utah S.B. 127 Cybersecurity Amendments (2023)

4.5 Geofencing and health privacy and women’s health

A lot of links here, don’t go down the rabbit hole.

Background

  • 1973: Roe v. Wade, U.S. Supreme Court holds women have a Constitutional right to privacy in their bodies, allowing them to choose whether to have an abortion within certain periods of pregnancy. States cannot prohibit or criminalize those abortions.
  • 1992: Planned Parenthood v. Casey, U.S. Supreme Court agrees with Roe v. Wade about what the U.S. Constitution says about a woman’s right to choose about abortion
  • 2022: Dobbs v. Jackson Women's Health Organization, U.S. Supreme Court says the Constitution doesn’t say what they said it said before. Overturns Roe v. Wade and Planned Parenthood.
  • States can criminalize abortion
  • Some states start criminalizing abortion, and conducting criminal investigations into possible abortions, seeking women’s health data.

Links

4.6 Genetic Information Privacy Act (GIPA)

4.7 AI and AI Bias

5. Conclusion

Remember, don't let the size of this references page intimidate you, and you don't have to visit all the links nor read them all.

I'm just sharing my research for those who want to dive deeper in a particular area.

This lets you start your research where I left off. Do your own research and I don't promise to keep this updated.

 

This page is hosted at https://johnbandler.com/cippus/part6. Copyright John Bandler, all rights reserved. No claim to IAPP materials or legal references.

Page posted 3/22/2026, drawing upon my previous materials. This page updated 08/13/2026.

These pages will always remain a work-in-progress and I cannot guarantee to keep them accurate or updated. Please contact me if you have an update, suggestion, or correction, and if these free resources helped you, please consider this to give back.