Analyzing 2023's New State Privacy Laws: Oregon and Delaware Join the Strictest Tier

Cybersecurity and privacy attorney Rachel Marmor spoke with Cybersecurity Law Report about new privacy laws passed by Oregon and Delaware. The Oregon Consumer Privacy Act (OCPA) and Delaware Personal Data Privacy Act (DPDPA) were both enacted in June and, like other state privacy laws, seek to control how companies collect, use and share consumer data. The OCPA requires companies to provide individuals, upon request, a list of all third parties that receive their personal data and what types of data are shared. Ms. Marmor commented that businesses may find it difficult to comply with the new requirements.

"Many of these disclosures occur via cookies. Companies don't necessarily track every click that you make in a way that's identifiable to you," she explained. "[If companies] now have to track every cookie that operates on their website, when the person visited their website and who it sold their data to, it will be not just a tough operational burden, but also a privacy-degrading experience for the consumer."

READ: Analyzing 2023's New State Privacy Laws: Oregon and Delaware Join the Strictest Tier (Subscription required)