In 2023, five states will put new privacy legislation into effect, giving residents of CA, UT, CO, VA, and CT new ownership of their data footprint. 

Most important for you to understand is: Legislation like this will likely keep coming; 22 states in full have pending privacy legislation up for consideration.

With that said, it makes good operational sense to start planning like these policies are in place for all of the states instead of just a few. 

Ask yourself these things first:

• If a member of your audience (note: anyone on your email file, not just customers) sent a request to view any information you have recorded on them, could you easily fulfill that request? Easily meaning have you operationalized this process, or would it take a member of your staff a few days to hunt around for the information?
• Ask yourself the same for requests to delete data. Are you aggregating insights in such a way that the removal of customer and prospect records wouldn't impact what you know about your performance?
• Does your privacy policy reflect what audiences should expect about what information you'll release and the turnaround time to do so? If not, how can you look at this as an opportunity to enhance transparency and build audience trust in reflecting back clear standards?
• If someone asked you how your third-party vendors are using your audience's data, could you tell them? Would you know what you're liable for and not? 

While it may be tempting to put off addressing these needs or doing the bare minimum given other priorities, it's really in service to your future self to set up a solid process now rather than waiting.

Need some support or a crash course on what's needed? Let's talk.

P.S. Take a look at this state-by-state privacy matrix, meant to give you a breakdown at a glance of what's going into effect in Q1 and Q2 of 2023.