Tom Runzo, CEO
03/09/2023

Introduction

We will see five new state privacy laws become effective in 2023 for businesses that operate or collect personal consumer information in California, Virginia, Colorado, Connecticut, and Utah. These new laws have surprising implications for your IR websites that could open you up to hidden liabilities for digital accessibility. In this paper, we’ll discuss how your IR website may be affected. 

Which new privacy laws went into effect?

So far, we have seen the introduction of five new state privacy laws:

  • California Privacy Rights Act (CPRA), an addendum to the CCPA, Effective date: January 1, 2023, with enforcement date: July 1, 2023
  • Virginia Consumer Data Protection Act (VCDPA), Effective date: January 1, 2023
  • Colorado Privacy Act (CPA), Effective date: July 1, 2023
  • Connecticut Data Privacy Act (CTDPA), Effective date: July 1, 2023
  • Utah Consumer Privacy Act (UCPA), Effective date: December 31, 2023

These laws regulate how businesses must handle consumer data and create consumer rights surrounding that data.

These new laws create certain rights for consumers. These rights* include:

  • Right to know and access the data collected
  • Right to delete data 2
  • Right to opt-out of sale or sharing personal information
  • Right to opt-out of targeted advertising
  • Right to correct inaccurate personal information
  • Right to opt-in to the sale of personal information of minors under 16 years old
  • Right to initiate a private cause of action for a data breach

* These are general rights. Specific wording around each right should be found on each state legislature’s website.

How might consumers access these rights?

Through these web pages and form:

  • Cookie consent form
  • Do not sell page
  • Contact page
  • Privacy Policy page

Practically speaking, in order to be in compliance with these five laws, the form and these four pages must be accessible to all consumers, including those with disabilities or using assistive technology.

Does the data collected on an IR website make me subject to these privacy laws?

The data collected below alone does not make you subject to these laws. Additionally, there are thresholds that need to be met, which vary from state to state. In general, these thresholds include with respect to how you disclose personal information of their residents, your annual revenue, and what percentage of revenue comes from the sale of data.

Some of the data collected include:

  • IP address information from site visitors
  • Cookies from site visitors
  • Personal information through the webcast registration
  • Personal information from email subscribers
  • Personal information from website analytics (if installed on the website)

If you collect this information from residents of California, Virginia, Colorado, Connecticut, or Utah, and are subject to these privacy laws, you may also be open to hidden liabilities related to website accessibility through your IR website.

What liabilities are you exposed to?

While most of these state privacy laws do not provide a private right of action for non-compliance with these regulations, each law does allow for enforcement by the Attorney General and district attorneys in the state.

In Virginia, California, and Utah, you could face up to $7,500 per violation. In Colorado, violations are subject to penalties under the Colorado Consumer Protection Act, which could result in penalties of up to $20,000. In Connecticut, you may face penalties of up to $5,000 per violation.

Conclusion

The era of web accessibility has arrived, and it is imperative that you prioritize accessibility for your IR website. In order to comply with the accessibility requirements of these state privacy and to prevent selective disclosure, your IR website must be accessible in real-time to all audiences, including those with disabilities or using assistive technologies.

Disclaimer

This paper has been prepared by Equisolve to provide general information on recent regulations and developments of interest to our readers. It

does not constitute legal advice, attorney advertising, a solicitation, or the formation of an attorney-client relationship. Equisolve and the authors assume no responsibility to update a white paper, such as for events subsequent to the date of its publication (e.g., new legislation, regulations, and judicial decisions). You should consult with a lawyer to determine applicable legal requirements to a specific fact situation.