Chapter 6: State Comprehensive Privacy Laws
Rights Concerning Sensitive Data and Nondiscrimination
Sensitive-data handling splits sharply: Colorado, Connecticut, Virginia require opt-in consent; Utah requires only notice and opt-out; California uses a more complex self-restrict-or-opt-out model. All five forbid discrimination against consumers who exercise their rights.
| State | Mechanism | |
|---|---|---|
| Colorado, Connecticut, Virginia | Opt-in consent required to process sensitive data | - |
| Utah | Notice plus opportunity to opt out | |
| California | Complex - business may self-restrict uses OR give notice and opt-out |
The right to nondiscrimination prohibits businesses from punishing consumers who exercise privacy rights - examples include denying goods or services, charging different prices, or degrading quality. All five states provide this right.
Opt-in vs opt-out for sensitive data
Classic CIPP/US distinction: Colorado, Connecticut, and Virginia require OPT-IN consent for sensitive data; Utah only requires notice and OPT-OUT. California sits in between with a self-restrict-or-opt-out model.
Key terms - quick answers
What is “Right to nondiscrimination”?
The right not to be discriminated against (e.g., denied goods, charged different prices, given degraded quality) for exercising privacy rights; provided by all five states.