Extract from Exterro’s article “4 Tips for Keeping Up with State Privacy Laws”
Today’s privacy landscape is more complex than ever. As of the summer of 2025, nineteen states have privacy laws in effect or coming into effect in the near future. In addition, another ten states have bills actively moving through the legislative process. These laws have different provisions governing to whom they apply, what rights consumers have, and what businesses’ obligations are.
Complying with this fragmented patchwork of laws is rapidly becoming untenable—if it isn’t already impossible.
These forthcoming state frameworks may exert pressure on the US Congress to take action on federal privacy legislation soon. But while businesses wait for federal privacy legislation to pass, they must act proactively to ensure compliance with state privacy regulations. They should consider taking the following four steps.
Build a comprehensive data catalog.
You can’t possibly comply with privacy regulations if you don’t know what data you hold, where it is stored, how long you keep it, and how you share and use it. A comprehensive data catalog leverages both institutional knowledge and technology to determine what data your organization has and how it is stored, used, and shared across its lifecycle.
