By: Jessica Woodbridge, Senior Consultant
“U.S. must lead on privacy. Businesses need it, Americans want it, AI accelerates harms.” – U.S. Senator Maria Cantwell, Chair of the Senate Committee on Commerce, Science and Transportation and author of the bipartisan American Privacy Rights Act (September 2024)
It’s been a year since my colleague Michele Borucki and I presented our session “Data Compliance: The Who, What, Where, When, Why, and How” at the 2024 NEDRA conference. It was also this time last year we published Data Privacy: Where We’ve Been and Where We are Going and Data Privacy (Part 2): Practical Tips and Better Practices to the Intelligent Edge. Since then, we’ve seen an uptick in data privacy enforcement as well as a need for more clarity by both organizations and the individuals whose privacy is being protected.
According to the International Association of Privacy Professionals (IAPP), 144 countries have enacted national data privacy laws, covering 6.64 billion people or 82% of the world’s population under the protection of some form of national data privacy legislation. Unfortunately, as of 2025 there is still no comprehensive federal data privacy law in the U.S. Rather, we see 20 states (5 more than this time last year) that have signed their own versions into law. The main themes among many of these state laws include individuals as consumers’ rights to their data, policies to opt-in for sensitive data as well as to opt-out of advertising and data sales, global privacy controls (a universal opt-out mechanism), a data protection impact acceptance process, as well as an automated decision-making policy. A growing focus appears to be on sensitive data and how it is processed as well as on data minimization. Maryland’s Online Data Privacy Act, which will go into effect in October 2025, has been noted as one of the strictest privacy laws in the country partly due to it imposing the strictest data minimization obligations and use restrictions.
It’s important to note that although many of these laws pertain mostly to for-profit entities, states such as Colorado, Delaware, Maryland, Minnesota, New Jersey, and Oregon do not exempt nonprofits in their privacy laws, and it is likely there will be more to come. Additionally, even if these laws are not applicable, nonprofits should be as diligent as ever in data hygiene and maintenance. Whether it be adding a donor’s email to a CRM system so they can receive the nonprofit’s messaging or sharing their intention of adding a nonprofit in their estate plans, our donors, volunteers, and other key stakeholders trust that we as data controllers will keep their personal data safe. It’s important for you to be aware of your organization’s protocol for who has access to prospect research and to make sure you are practicing data minimization.
While more than 40% of the country falls under these state privacy laws, it can be difficult to maintain compliance given that each state has its own version. In April 2025, the bipartisan “Consortium of Privacy Regulators” was formed between seven attorney generals and the California Privacy Protection Agency (CPPA). Through collaboration and pooled resources, the consortium’s main goal is to protect consumers’ privacy. Additionally, according to Connecticut Deputy Associate Attorney General Michele Lucan, “there is ‘a benefit’ for companies to deal with a group of regulators versus answering to individual complaints.”
We cannot discuss data compliance and privacy in the nonprofit sector without mentioning Artificial Intelligence (AI). In addition to not having a comprehensive federal data privacy law, no federal law exists currently for AI privacy. There are a few states that have incorporated “automated decision making” regulations into their privacy laws, including Colorado, Utah, and California. According to the New York-based law firm, White & Case LLP, “automated decision making can be understood to mean the use of AI, machine learning systems, and/or algorithms to make decisions with or without minimal human input and control.” Nonprofits may be using AI to increase operational efficiency, such as helping put together messaging for a marketing eblast, finding new donor trends, or assisting with prospect research. With this also comes the need to make sure the use of AI tools is in compliance with any pertinent laws. Some great resources for AI in the nonprofit sector include IAPP’s US State AI Governance Legislation Tracker, The Fundraising.AI collaborative, and APRA’s Ethics in AI for Fundraising Toolkit.
Looking ahead, it will be interesting to follow the “Consortium of Privacy Regulators” as it is just getting started. Also, staying abreast of the different comprehensive data privacy laws will be crucial as there are currently 12 more states with statutes/bills in committee. Data is an essential tool in our toolkit. Let’s continue to be good stewards of data through increasing our knowledge, collaborating with colleagues, and continually fine-tuning policies and procedures.