Let\u2019s peer into the future and look at how the data privacy landscape is likely to continue to evolve in the coming year, where the best opportunities for your company may lie, and what challenges you should plan for now.<\/p>\n\n\n\n
2025 in global data privacy regulation<\/h2>\n\n\n\n
For the last several years, change has been the only constant in data privacy regulation around the world. Gartner predicted that 75 percent of the world\u2019s population<\/a> would be protected by data privacy law by the end of 2024. Were they right?<\/p>\n\n\n\n According to the International Association of Privacy Professionals (IAPP), as of March 2024, data privacy coverage was already close to 80 percent<\/a>. So the prediction had been exceeded even before we were halfway through the year.<\/p>\n\n\n The United States passed a record number of state-level data privacy regulations in 2024, with Kentucky, Maine, Maryland, Minnesota, Nebraska, New Hampshire, New Jersey, Rhode Island, and Vermont coming on board to bring the number of state-level US data privacy laws to 21. By contrast, six states passed laws in 2023, which was a record number to date then.<\/p>\n\n\n\n The privacy laws in Florida<\/a>, Montana<\/a>, Oregon<\/a>, and Texas<\/a> went into effect in 2024. The privacy laws in Delaware<\/a>, Iowa<\/a>, Maryland<\/a>, Minnesota<\/a>, Nebraska<\/a>, New Hampshire<\/a>, New Jersey<\/a>, and Tennessee<\/a> go into effect in 2025.<\/p>\n\n\n\n Since the majority of US states still don\u2019t have data privacy regulations, more of these laws are likely to be proposed, debated, and (at least sometimes) passed. It will be interesting to see if certain states that have wrangled with privacy legislation repeatedly, like Washington, will make further progress in that direction.<\/p>\n\n\n\n April 2024 saw the release of a discussion draft of the American Privacy Rights Act (APRA)<\/a>, the latest federal legislation in the US to address data privacy. It made some advances during the year, with new sections added addressing children\u2019s data privacy (\u201cCOPPA 2.0\u201d), privacy by design, obligations for data brokers, and other statutes. However, the legislation has not yet been passed, and with the coming change in government in January 2025, the future of APRA is unclear.<\/p>\n\n\n\n The European Union continues to be at the forefront of data privacy regulation and working to keep large tech platforms in check. Two recent regulations, particularly, will continue to shape the tech landscape for some time.<\/p>\n\n\n\n With the Digital Markets Act<\/a> in effect, the first six designated gatekeepers (Alphabet, Amazon, Apple, ByteDance, Meta, and Microsoft) had to comply as of March 2024. Booking.com was designated in May, and had to comply by November.<\/p>\n\n\n\n There is a good chance that additional gatekeepers will be designated in 2025, and that some current ones that have been dragging their metaphorical feet will start to accept the DMA\u2019s requirements. We can expect to see the gatekeepers roll out new policies and requirements for their millions of customers in 2025 to help ensure privacy compliance across their platforms\u2019 ecosystems.<\/p>\n\n\n\n More stringent consent requirements are also being accompanied by expanded consumer rights, including functions like data portability, which will further enhance competitive pressures on companies to be transparent, privacy-compliant, and price competitive while delivering great customer experiences.<\/p>\n\n\n\n While the entirety of the AI Act will not be in effect until 2026, some key sections are already in effect in 2024, or coming shortly, so we can expect to see their influence. These include the ban on prohibited AI systems in EU countries and the rules for general purpose AI systems.<\/p>\n\n\n\n Given that training large language models (LLMs) requires an almost endless supply of data, and organizations aren\u2019t always up front about getting consent for it, it\u2019s safe to say that there will continue to be clashes over the technology\u2019s needs and data privacy rights.<\/p>\n\n\n\n There was plenty in the news involving data privacy around the world in 2024, and the laws and lawsuits reported on will continue to make headlines and shape the future of privacy in 2025.<\/p>\n\n\n\n There have been complaints reported and lawsuits filed throughout 2024 regarding data scraping and processing without consent. Canadian news publishers<\/a> and the Canadian Legal Information Institute<\/a> most recently joined the fray. We don\u2019t expect these issues to be resolved any time soon, though there should be some influential case law resulting once these cases have made their way through the courts. (Unlikely that all of them will be resolved by settlements.) The litigation may have significant implications for the future of these AI companies as well, and not just for their products.<\/p>\n\n\n\n As noted, laws that dovetail with data privacy are also becoming increasingly notable. One recent interesting development is Australia passing a ban on social media<\/a> for children under 16. In addition to mental health concerns, some social media platforms \u2014 including portfolio companies of Alphabet, Meta, and TikTok parent company ByteDance \u2014 have run afoul of data privacy regulators, with penalties for collecting children\u2019s data without consent, among other issues. It will be very interesting to see how this ban rolls out, how it\u2019s enforced, and if it serves as inspiration elsewhere for comparable legislation.<\/p>\n\n\n\n The UK adopted its own customized version of the General Data Protection Regulation (GDPR)<\/a>, the UK GDPR<\/a>, upon leaving the EU. It has recently published draft legislation for the UK Data (Use and Access) Bill<\/a>, which is meant to further modernize the UK GDPR and reform the way data is used to benefit the economy. We will see if the law does get passed and what its practical effects may be.<\/p>\n\n\n\n Further to recent laws and updates for which we are likely to see the effects in 2025, in September 2024, Vietnam issued the first draft of its Personal Data Protection Law (PDPL)<\/a> for public consultation.<\/p>\n\n\n\n Malaysia passed significant updates to its Personal Data Protection Act (PDPA) via the Personal Data Protection (Amendment) Act<\/a>. The PDPA was first passed in 2010, so it was due for updates, and companies doing business in the country can expect the new guidelines to be enforced.<\/p>\n\n\n\n Also, the two-year grace period on Law No. 27 in Indonesia\u2019s Personal Data Protection law (PDP Law)<\/a> ended in October 2024, so we can expect enforcement to ramp up there as well.<\/p>\n\n\n\n Asia already has considerable coverage with data privacy regulation, as countries like China<\/a>, Japan<\/a>, South Korea<\/a>, and India<\/a> all have privacy laws in effect as well.<\/p>\n\n\n\n Just as the regulation of data privacy is reaching an inflection point of maturity and becoming mainstream, so are solutions for privacy compliance, consent, and preference management<\/a>.<\/p>\n\n\n\n Companies that are embracing Privacy-Led Marketing in their growth strategy want solutions that can meet several needs, support growth, and seamlessly integrate into their martech stack. Simply offering a cookie compliance solution will no longer be enough.<\/p>\n\n\n\n Managing data privacy will require solutions that enable companies to obtain valid consent \u2014 for requirements across international jurisdictions \u2014 and signal it to ad platforms and other important tools and services. In addition to consent, companies need to centralize privacy user experience to provide customers with clear ways to express their preferences and set permissions in a way that respects privacy and enables organizations to deliver great experiences with customized communications, offers, and more.<\/p>\n\n\n\n It may take some time for third-party cookie use and third-party data to go away entirely, but zero- and first-party data<\/a> is the future, along with making customers so happy they never want to leave your company. Rather than trying to collect every bit of data possible and preventing them from taking their business elsewhere.<\/p>\n\n\n\n We may see more strategies like Meta\u2019s \u201cpay or ok\u201d<\/a> attempt where users can pay a subscription fee to avoid having their personal data used for personalized ads, but given EU regulators\u2019 response to the scheme, similar tactics are likely to have an uphill battle, at least in the EU.<\/p>\n\n\n\n SMBs, particularly, also have a lot to do with limited resources, in addition to focusing on growing their core business. We can expect to see further deep integration of privacy compliance tools and services. These solutions will automate not only obtaining and signaling consent to third-party services, but also notifying users about data processing services in use and data handling, e.g. via the privacy policy<\/a>, responding to data subject access requests (DSAR)<\/a>, and other functions.<\/p>\n\n\n\n Further to international compliance requirements, as companies grow they are going to need data privacy solutions that scale with them, and enable them to easily handle the complexities of complying with the requirements of multiple privacy laws and other relevant international and\/or industry-specific polices and frameworks.<\/p>\n\n\n\n Frameworks like the IAB\u2019s Global Privacy Platform (GPP) are one way of achieving this, enabling organizations to select relevant regional privacy signals to include depending on their business needs.<\/p>\n\n\n\n Our keyword to encapsulate data privacy for 2024 was \u201cacceleration\u201d. For 2025 it\u2019s \u201cmaturity.\u201d Data privacy laws and other regulations that include data privacy (like AI). Companies\u2019 needs for solutions that enable multi-jurisdictional compliance and data management. The widespread embrace of data privacy as a key part of doing business, and strategizing Privacy-Led Marketing for sustainable growth and better customer relationships. The financial and operational risks of noncompliance moving beyond regulatory penalties to revenues from digital advertising, customer retention, and beyond.<\/p>\n\n\n\n The Usercentrics team is on it. We\u2019ll continue to bring you easy to use, flexible, reliable solutions to manage consent, user preferences, and permissions, and enable you to maintain privacy compliance and be transparent with your audience as your company grows. With world-class support at every step, of course. Plus we have a few other things up our sleeves. (Like this.<\/a>) Stay tuned! Here\u2019s to the Privacy-Led Marketing era. We can\u2019t wait to help your company thrive.<\/p>\n\n\n Regulatory compliance is just the beginning. Harness consented data to power your ad campaigns, deliver the best customer experiences, and more.<\/p>\n <\/div>\n <\/div>\n Data privacy regulation in the United States<\/h3>\n\n\n\n
![\"\"](\"https:\/\/usercentrics.com\/wp-content\/uploads\/sites\/7\/2024\/12\/uc_blog_770x450_data_priv_trends_121924_1.svg\")
<\/figure>\n\n\n\nData privacy regulation in Europe<\/h3>\n\n\n\n
The Digital Markets Act (DMA) and its evolution<\/h4>\n\n\n\n
![\"Map](\"https:\/\/usercentrics.com\/wp-content\/uploads\/sites\/7\/2024\/12\/uc_blog_770x450_data_priv_trends_121924_2-1.svg\")
<\/figure>\n\n\n\nThe AI Act and its implementation<\/h4>\n\n\n\n
Data privacy around the world<\/h3>\n\n\n\n
AI, privacy, and consent<\/h3>\n\n\n\n
Social media and data privacy<\/h3>\n\n\n\n
The latest generation of data privacy laws and regulatory updates<\/h3>\n\n\n\n
The future of privacy compliance and consent and preference management<\/h2>\n\n\n\n
Integrated solutions for compliance requirements and user experience<\/h3>\n\n\n\n
Customer-centric data strategies<\/h3>\n\n\n\n
Delivering peace of mind while companies to stay focused on their core business<\/h3>\n\n\n\n
Usercentrics in 2025<\/h2>\n\n\n\n