--- title: A Big Year for Data Privacy Draws to a Close - TrueVault description: 2023 was slated to be an important year for data privacy, and it did not disappoint. Take a look back at the biggest developments over the last year. image: https://safe.truevault.com/hubfs/Pubmats/2023-comes-to-an-end.png --- - [CCPA](https://safe.truevault.com/learn/ccpa/what-is-the-ccpa) - [GDPR Compliance](https://safe.truevault.com/gdpr-guide) - [HIPAA](https://safe.truevault.com/learn/hipaa) - [HIPAA Compliance](https://safe.truevault.com/blog/hipaa-compliance-checklist-download.html) - [Personally Identifiable Information](https://safe.truevault.com/blog/what-is-pii) - [PHI](https://safe.truevault.com/protected-health-information) - [Resources](https://safe.truevault.com/learn/?hsLang=en) - Login [TrueVault Safe Log in to TrueVault Safe](https://console.truevault.com) [TrueVault Polaris Log in to TrueVault Polaris](https://polaris.truevault.com) - [Resources](https://safe.truevault.com/learn/?hsLang=en) - Login - Login - [TrueVault Safe Log in to TrueVault Safe](https://console.truevault.com) - [TrueVault Polaris Log in to TrueVault Polaris](https://polaris.truevault.com) - [Data Privacy Essentials](https://safe.truevault.com/learn/essentials/) # A Big Year for Data Privacy Draws to a Close ![2023-retrospective](https://safe.truevault.com/hubfs/images/2023-retrospective.jpg "2023-retrospective")   Every once in a while, the experts get it right. 2023 was widely predicted to be an inflection point for data privacy in the United States, the year when the issue finally achieved critical mass. It did not disappoint. New laws were passed, old laws were amended, and the pace is showing no signs of slowing in the coming year. It’s easy to forget everything that’s happened in the last 12 months, so here’s a brief look back at the biggest developments in privacy in 2023. ## Five New Laws Went into Effect Even before the year began, it was clear there would be a lot of work to do to stay privacy-compliant in 2023. Five privacy laws that had already been passed were set to go into effect this year.  - [**California Privacy Rights Act**](https://safe.truevault.com/learn/ccpa/5-biggest-changes-included-in-the-cpra?hsLang=en), *January 1, 2023* - [**Virginia Consumer Data Protection Act**](https://safe.truevault.com/resources/virginia/what-is-the-virginia-consumer-data-protection-act?hsLang=en), *January 1, 2023* - [**Colorado Privacy Act**](https://safe.truevault.com/resources/colorado/cpa-introduction?hsLang=en), *July 1, 2023* - [**Connecticut Data Privacy Act**](https://safe.truevault.com/learn/connecticut/does-it-apply?hsLang=en), July 1, 2023 - [**Utah Consumer Privacy Act**](https://safe.truevault.com/learn/utah/does-it-apply?hsLang=en), December 31, 2023 While the California Privacy Rights Act amended the existing [California Consumer Privacy Act](https://safe.truevault.com/ccpa-guide?hsLang=en), the other four laws were completely new. This means that multi-state privacy compliance finally became a reality in 2023. ## Health Data Gets Extra Protection Protecting the privacy of consumer health data became a big legislative priority in 2023. Following the Supreme Court’s *Dobbs* decision which overturned *Roe v. Wade*, there was concern that personal data that could reveal a person’s access to abortion services in states where it is legal could then be used as evidence in a criminal prosecution where abortion is illegal. This may have been the initial impetus, but legislation like Washington’s My Health My Data Act and [Connecticut’s SB 3](https://safe.truevault.com/learn/connecticut/connecticut-adds-new-privacy-rules-for-health-data?hsLang=en) go much further than simply protecting data related to reproductive health. Under these laws, any data that identifies a person’s health condition or diagnosis receives extra protection (if it is not already covered by HIPAA). The Washington law is particularly broad and grants consumers a private right of action, so it’s likely to serve as the basis for many future lawsuits. ## California Delete Act Online privacy advocates hailed the passage of [California’s Delete Act](https://safe.truevault.com/resources/ccpa/the-california-delete-act-quick-summary?hsLang=en), which regulates data brokers operating within the state. Among other things, the Delete Act calls for the creation of an opt-out registry for consumers by 2026, which will allow them to request the deletion of their personal data from all data brokers at once. Other states may join the effort in the future, but for now only California residents will be able to take advantage. ## Record-Breaking GDPR Fines Though official numbers are hard to find, total GDPR fines for 2023 are [estimated](https://www.enforcementtracker.com/?insights) to have exceeded 2 billion euros ($2,195,000USD), a dramatic increase over previous years. So who were the biggest winners? ### 1. Meta With nearly €1.6 billion in GDPR fines in 2023 alone, Facebook and Instagram’s parent company is the leader by far. After losing a €1.2 billion case related to international data transfers, Meta shattered the record for highest single GDPR fine, which previously had been held by Amazon (€746 million in 2021). On a side note, the decision against Meta appears to have spurred U.S. and EU officials to finally approve the [Data Privacy Framework](https://safe.truevault.com/resources/gdpr/the-eu-us-data-privacy-framework-your-questions-answered?hsLang=en), an international agreement which allows for the lawful transfer of Europeans’ personal data to the United States. ### 2. TikTok TikTok was no stranger to controversy this year. Besides drawing the ire and suspicion of U.S. lawmakers, the Chinese social media giant also racked up a €345 million fine for failing to properly handle the personal data of children. Despite having a minimum user age of 13, European regulators found that TikTok had failed to properly enforce that standard. The UK also got in on the action, levying its own fine of £12.7 million. ### 3. Criteo The French ad tech company was fined €40 million this year for a number of GDPR violations, including for failure to properly gather consent and grant data subjects access to their personal data. ## Simplified Privacy Compliance Privacy laws are here to stay, and the list of legislation is only growing. In 2024, at least 4 new privacy laws will take effect, making compliance more and more complicated for businesses. TrueVault simplifies the process of getting compliant with [privacy laws](https://safe.truevault.com/privacy-laws-covered-by-truevault-products?hsLang=en) from across the United States through a guided software experience. Within hours, you can complete your company’s data map, post all required notices, and be ready to respond to consumer privacy requests. As new state privacy laws are passed, they are added to your Privacy Center at no extra cost! To learn more about how TrueVault works, [contact our team](https://safe.truevault.com/contact-us?hsLang=en) today. [![Schedule Call](https://hubspot-no-cache-na2-prod.s3.amazonaws.com/cta/default/4693513/949d85da-b649-4822-b380-0922b22c3b60.png)](https://hubspot-cta-redirect-na2-prod.s3.amazonaws.com/cta/redirect/4693513/949d85da-b649-4822-b380-0922b22c3b60) **Disclaimer:** This content is provided for general informational purposes only and does not constitute legal or other professional advice. Without limiting the foregoing, the content may not reflect recent developments in the law, may not be complete, and may not be accurate or relevant in an applicable jurisdiction. This content is not a substitute for obtaining legal advice from a qualified licensed attorney in the applicable jurisdiction. The content is general in nature and may not pertain to specific circumstances, so it should not be used to act or refrain from acting based on it without first obtaining advice from professional counsel qualified in the applicable subject matter and jurisdictions. - ON THIS PAGE - [Five New Laws in Effect](https://safe.truevault.com/resources/essentials/a-big-year-for-data-privacy-draws-to-a-close#five-new-laws) - [Health Data Takes Priority](https://safe.truevault.com/resources/essentials/a-big-year-for-data-privacy-draws-to-a-close#health-data) - [The Delete Act](https://safe.truevault.com/resources/essentials/a-big-year-for-data-privacy-draws-to-a-close#delete-act) - [Record GDPR Fines](https://safe.truevault.com/resources/essentials/a-big-year-for-data-privacy-draws-to-a-close#gdpr-fines) - [Simplified Privacy Compliance](https://safe.truevault.com/resources/essentials/a-big-year-for-data-privacy-draws-to-a-close#compliance) ##### Get compliant today Our attorney-designed software will step-by-step guide you through the compliance process from start to finish. [Request a Demo](https://www.truevault.com/contact-us?hsLang=en) ### Company - [Blog](https://safe.truevault.com/blog) - [Contact Us](https://safe.truevault.com/contact-us-2019) - [Careers](https://truevault.workable.com) - [HIPAA Compliance Checklist](https://safe.truevault.com/blog/hipaa-compliance-checklist-download.html) - [PDF: Developers Guide to HIPAA compliance](https://my.leadpages.net/leadbox/14472b173f72a2%3A131fd12f8b46dc/5760820306771968/) ### Developers - [Patterns](https://safe.truevault.com/patterns) - [Documentation](https://docs.truevault.com/) - [Quick Start Guide](https://safe.truevault.com/quick-start-guide) - [Secure Infrastructure](https://safe.truevault.com/secure-infrastructure) - [API Overview](https://safe.truevault.com/api-overview) ### Latest Posts ### Contact Us 201 Mission Street, 12th Floor San Francisco, CA 94105 Email: [hello@truevault.com](mailto:hello@truevault.com) 2024 © All Rights Reserved.  [Privacy Policy](https://privacy.truevault.com/privacy-policy)  |  [Terms of Use](https://www.truevault.com/legal/truevault-terms-of-use?hsLang=en)  |  [Supplemental Terms](https://www.truevault.com/legal/truevault-supplemental-terms-of-use?hsLang=en) | [California Privacy Notice](https://privacy.truevault.com/privacy-policy#california-privacy-notice)