Tech
Scope of US state-level privacy laws expands rapidly in 2025 | Computer Weekly
The number of individual US states with local data privacy legislation on their statute books has expanded rapidly in 2025, with nine more state laws coming into effect this year and three more states – Indiana, Kentucky and Rhode Island – slated to start enforcing their own rules on 1 January 2026, according to a report compiled by the International Association of Privacy Professionals (IAPP).
Since the introduction of the landmark California Consumer Privacy Act in 2020, politicians in state capitals across the US have eagerly taken up the data protection baton, with Colorado, Connecticut, Utah and Virginia all introducing comprehensive privacy laws in 2023; Montana, Oregon and Texas in 2024; and Delaware, Iowa, Maryland, Minnesota, Nebraska, New Hampshire, New Jersey and Tennessee this year.
A further 16 states are currently deliberating comprehensive privacy bills, including economic powerhouse states such as Massachusetts and New York.
The resulting report captures an in-depth picture of each of the separate state privacy laws, with the overall goal being to outline the contours of each state to offer more meaningful guidance to organisations. The IAPP has been actively tracking amendments to state privacy laws – Connecticut, Montana and Oregon all made changes his year to expand the scope of applicability, enhance consumer rights and put in place more business obligations around control and processing of personal data, for example.
Where to start?
Müge Fazlioglu, IAPP principal researcher, privacy law and policy, has been tracking these developments. She described an increasingly complex patchwork of compliance for organisations working in the US.
“The applicability of each US state privacy law can be assessed through a multistep process as each state law has a unique scope based on variety of thresholds,” she told Computer Weekly. “These thresholds are related to entity’s jurisdiction, revenue, volume of personal data processing and revenue derived from the sale of personal data.”
To dig deeper into the extent to which the laws differ, five different thresholds in the US now exist for processing resident’s personal data. These include no threshold in Nebraska and Texas; 25,000 or more unique consumers in Montana; 35,000 in Connecticut, Delaware, Maryland, New Hampshire and Rhode Island; 100,000 in California, Colorado, Indiana, Iowa, Kentucky, Minnesota, New Jersey, Oregan, Utah and Virginia; and 175,000 in Tennessee. So, any organisation holding data on any Texas residents becomes subject to applicability, but they must hold data on 0.6% of the population of Maryland, or 3.3% of the population of tiny Delaware.
Then there are thresholds for the sale of personal data. Here, again, Nebraska and Texas are strictest, ruling that the control, processing or sale of any personal data is subject to state privacy laws, albeit with exemptions for small businesses. Meanwhile in California, organisations fall in scope if they control or process any personal data and derive 50% or more of their revenues from the sale of data. Colorado and New Jersey both include population thresholds again – 25,000 unique consumers or more, and in-scope organisations derive any revenue or discount on the price of any goods or services from the sale of personal data.
When it comes to exemptions, each of the 19 state laws excludes various entities and types of data held by them – most commonly, government agencies, non-profits and higher education institutions; and organisations already subject to national, sectoral legislation, such as the Health Insurance Portability and Accountability Act (HIPAA).
Differences again abound. For example, the laws of Colorado, Delaware, Minnesota, Montana, New Jersey and Oregon do not exempt non-profits. California and Maryland do exempt non-profits but do not exempt higher education institutions, and so on. Nuances exist even here – Delaware, for example, exempts only some non-profits and its laws don’t apply to those than handle data held by non-profits working with victims of child abuse, domestic violence, human trafficking or sexual assault. Neighbouring Maryland exempts those that process or share personal data to assist first responders in emergency situations, or law enforcement investigating fraud or insurance-related crime.
When it comes to business obligations under state privacy laws, all states require regulated entities to provide consumers with privacy practice disclosure notices – California asks for this at the point of collection, and all bar Rhode Island and Utah impose minimisation and purpose limitations on the collection or processing of data. This typically restricts the collection, use, retention and sharing of consumer data to what is adequate, relevant and reasonably necessary. Most states – bar Iowa and Utah – require data protection impact assessments (DPIAs), but in Delaware, Indiana and Virginia, DPIAs are specifically required for targeted advertising, the sale of personal data or individual profiling.
Naturally, all states require consent for processing of sensitive data, but again they define varying categories of data as sensitive. Most state laws cover a standard dataset that will be familiar to most, classing children’s data, data on ethnic background, religion, and sexual orientation as sensitive. However, some states go further, with Maryland and Oregon also recognising information on national origin as sensitive, while five states – Connecticut, Delaware, Maryland, New Jersey and Oregon – include data that might reveal an individual’s status as non-binary or transgender.
Maryland, meanwhile, has the only state level law that does not classify mental or physical health data as sensitive, whereas California ploughs a unique furrow and classes philosophical beliefs as a protected category, protecting existentialists, logical positivists, nihilists and stoics alike.
Finally, turning to consumer rights to access, correct and delete data held on them, things are a little simpler but there are still differences to account for. In all states consumers can access, correct and delete data – bar Iowa, where they cannot correct it; and Indiana, where they can correct it only if they have provided it in the first place.
Similarities to GDPR
Organisations operating out of the UK or European Union (EU), may be tempted to look to the practices and principles already established under the General Data Protection Regulation (GDPR) as a helpful guide to the growing labyrinth of rules, clauses and exceptions in the US.
However, Fazlioglu said that while the requirements of the various US regimes relating to consumer rights, data minimisation, purpose limitation of data collection and processing, and so on, might feel familiar to organisations that are already GDPR compliant at first glance, data privacy professionals should be wary of inferring too much from this, and it would be a grave error to rely too heavily on them.
“As we know in the world of privacy and digital governance, compliance work requires continuously mapping the current landscape, monitoring the changes, and making necessary updates and adjustments,” she said. “When it comes to the overlap of GDPR and the US state privacy laws, there’s a lot to identify, assess, translate and consider. There’s no simple checklist or formula to confirm alignment … Organisations need to examine the extent of each state privacy law and evaluate whether their existing practices are sufficient.”
Fazlioglu said that understanding the scope and specificity of each law, including the categories of sensitive data or how various terms such as “sale” are defined, is critical.
She said that while this may feel complex and daunting, the interaction between the various laws and domains and the GDPR may ultimately benefit consumers. “It encourages deeper attention to the crossroads of consumer protection and emerging technologies,” she said.
Federal laws a subject of debate
In parallel to the enacting of state-level legislation in the US, calls continue for Washington DC to introduce a federal privacy law. While British and European observers not steeped in US political tradition may naturally feel inclined to prefer a national data protection standard, this is not such a simple ask for the US federal system.
“It is preferable for some and not preferable for others,” said Fazlioglu. “For example, during discussions around the American Privacy Rights Act of 2024 and the American Data Privacy and Protection Act of 2023, we observed different reactions from various groups – some supported these bills to simplify the landscape, while others emphasised the risk of weakening the protections currently offered by state legislatures.”
The IAPP tracks developments in this regard, examining contentious issues such as bipartisanship, private right of action and preemption. Fazlioglu said it was difficult to predict whether or not a federal law could advance through US Congress, but by analysing prior attempts, it is possible to see that laws which include private right of action and preemption clauses can influence a bill’s ability to attract both Democrat and Republican support.
Fazlioglu added: “The question is not only whether federal privacy legislation is preferable, but also whether such a law should function as a ceiling or a floor. Proponents of preemption argue that a federal law should serve as a ceiling – setting a uniform standard that overrides state laws. In contrast, supporters of preserving state privacy laws believe a federal law should act as a floor – a minimum standard that states can build upon.”
This is why, Fazlioglu said, it’s important to consider both state and federal privacy law developments in order to see the full picture. “I believe the state-federal dynamics influence each other. So, while it’s uncertain whether we’ll see a federal privacy law enacted, I expect continued discussions at both the intra-state level and between state and federal frameworks. Together, these conversations will continue to shape the US approach to privacy law and policy in the coming years,” she said.
Much of the imagery is familiar from previous releases, and includes things like a photo of a stuffed tiger, a photo of a framed Times of London cover of Princess Diana placed at the back of a closet, photos of the many paintings of nude women in Epstein’s townhouse, and framed photos of Epstein associates like Trump and Woody Allen.
Volume 2
The second volume contains 574 photos and one four-second video. Many of the photos feature Epstein and Maxwell in various locations. Several celebrities and politicians also appear in the photos, including actors Chris Tucker and Kevin Spacey, singer Michael Jackson, and Rolling Stones guitarist Keith Richards—none of whom appear in suspicious or compromising positions.
However, Bill Clinton appears multiple times in the second batch of images. In one photo, he is shirtless in a pool with a woman whose identity has been redacted; a photo that appears to have been taken at the same location shows Clinton and Maxwell in the pool. Clinton also appears in multiple photos with women whose identities have been redacted.
Clinton took four trips with Epstein in 2002 and 2003, including a humanitarian trip to Africa and London. During a portion of that trip, he was accompanied by Tucker and Spacey, according to The New York Times.
(Clinton spokesperson Angel Ureña released a statement reading, in part, “They can release as many grainy 20-plus-year-old photos as they want, but this isn’t about Bill Clinton.”)
Dozens of photos feature Jean-Luc Brunel, a modeling agent and close friend of Epstein’s. The photos show Brunel with Epstein and Maxwell in multiple locations, as well as aboard what appears to be Epstein’s infamous private jet. In several images, Maxwell is seen massaging Brunel’s feet and sticking one foot between her breasts.
Brunel was arrested by French authorities in 2020 as part of a sex trafficking and sexual assault investigation into Epstein, and charged with rape of minors over 15 and sexual harassment. Brunel denied any wrongdoing. In 2022, Brunel was found dead, hanged in his jail cell.
Volume 3
The third volume contains several hundred photos. One of those, which appears to have been framed, shows a man who appears to be Prince Andrew posing on his side on the laps of at least four women, whose faces are all redacted. A smiling Maxwell, and a woman whose face is redacted, stand in the background.
Many of the photos, however, may have been printed out as they appeared in digital storage, since the individual photo names, the file extensions, and album names are all visible. Many images with those markers include Clinton, and several were seemingly taken on a group vacation to Thailand that Clinton is alleged to have taken with Epstein and Maxwell. Clinton also joined the couple for at least one leg of a multiple-destination vacation that stopped in China, Paris, and Stockholm, another that stopped in New York, Los Angeles, and London, another trip to Africa and London, and another trip to Morocco. In one photo, Clinton is shown with a woman, whose face is redacted, sitting on Clinton’s lap.
I don’t want to admit it, but I did spend a lot of money online this holiday shopping season. And unsurprisingly, some of those purchases didn’t meet my expectations. A photobook I bought was damaged in transit, so I snapped a few pictures, emailed them to the merchant, and got a refund. Online shopping platforms have long depended on photos submitted by customers to confirm that refund requests are legitimate. But generative AI is now starting to break that system.
A Pinch Too Suspicious
On the Chinese social media app RedNote, WIRED found at least a dozen posts from ecommerce sellers and customer service representatives complaining about allegedly AI-generated refund claims they’ve received. In one case, a customer complained that the bed sheet they purchased was torn to pieces, but the Chinese characters on the shipping label looked like gibberish. In another, the buyer sent a picture of a coffee mug with cracks that looked like paper tears. “This is a ceramic cup, not a cardboard cup. Who could tear apart a ceramic cup into layers like this?” the seller wrote.
The merchants reported that there are a few product categories where AI-generated damage photos are being abused the most: fresh groceries, low-cost beauty products, and fragile items like ceramic cups. Sellers often don’t ask customers to return these goods before issuing a refund, making them more prone to return scams.
In November, a merchant who sells live crabs on Douyin, the Chinese version of TikTok, received a photo from a customer that made it look like most of the crabs she bought arrived already dead, while two others had escaped. The buyer even sent videos showing the dead crabs being poked by a human finger. But something was off.
“My family has farmed crabs for over 30 years. We’ve never seen a dead crab whose legs are pointing up,” Gao Jing, the seller, said in a video she later posted on Douyin. But what ultimately gave away the con was the sexes of the crabs. There were two males and four females in the first video, while the second clip had three males and three females. One of them also had nine instead of eight legs.
Gao later reported the fraud to the police, who determined the videos were indeed fabricated and detained the buyer for eight days, according to a police notice Gao shared online. The case drew widespread attention on Chinese social media, in part because it was the first known AI refund scam of its kind to trigger a regulatory response.
Lowering Barriers
This problem isn’t unique to China. Forter, a New York-based fraud detection company, estimates that AI-doctored images used in refund claims have increased by more than 15 percent since the start of the year, and are continuing to rise globally.
“This trend started in mid-2024, but has accelerated over the past year as image-generation tools have become widely accessible and incredibly easy to use.” says Michael Reitblat, CEO and cofounder of Forter. He adds that the AI doesn’t have to get everything right, as frontline retail workers and refund review teams may not have the time to closely scrutinize each picture.
All of Apple’s processors are scattered throughout different MacBook models. While Apple only currently sells M4 MacBooks, you can find older models at specific third-party retailers online, either completely new or refurbished. If you do stumble upon its older chips (which came out four years ago), you might be wondering how they compare to other options. We break down the differences between each one.
M5 Series
M5: The rollout of the M5 line of chips has just started. The base M5 still has up to a 10-core CPU and 10-core GPU, although there’s also a lower-tier 9-core CPU that’s available in the iPad Pro—and presumably, that’ll also be offered in the M5 MacBook Air at some point. The M5 is around 10 to 15 percent faster in CPU performance, but also takes a significant step up in GPU, AI workloads, and even storage speed.
M4 Series
M4: The M4 originally launched in 2024. It has a 10-core CPU and a 10-core GPU. Apple claims it delivers 1.8 times faster CPU performance and 2.2 times faster GPU performance than the M1. Meanwhile, the neural engine is over three times faster than the original and twice as fast as the M3. It also starts with 16 GB of unified memory, which will help power Apple Intelligence (the company’s suite of artificial intelligence features) a lot more smoothly. It’s available on the 14-inch MacBook Pro (2024), iMac (2024), and MacBook Air (13-inch and 15-inch, 2025).
M4 Pro: The M4 Pro has a 14-core CPU (which Apple claims is up to 1.9 times faster than the M1 Pro) and up to a 20-core GPU, with up to 64 GB of unified memory. Built on a second-generation 3-nanometer process, it also supports enhanced GPU features like mesh shading and ray tracing—the latter of which is now twice as fast as on M3 chips. You’ll find it on the latest MacBook Pro (14-inch and 16-inch) and Mac Mini (2024).
M4 Max: This chip has a 16-core CPU and up to a 40-core GPU with support for up to 128 GB of unified memory. Apple says the CPU is up to 2.2 times faster than the M1 Max, while the GPU is up to 1.9 times faster. As with the M4 Pro, it packs support for mesh shading and ray tracing. The M4 Max is currently the most powerful chip you can get in a MacBook, and is available on the latest 14-inch and 16-inch MacBook Pro. You can also get it as an option in the current Mac Studio.
M3 Series
M3: The M3 is available on the 14-inch MacBook Pro (late 2023), 13-inch MacBook Air (2024), 15-inch MacBook Air (2024), and 24-inch iMac (2023). It packs an 8-core CPU and up to a 10-core GPU with 24 GB of unified memory. When compared to the M1, Apple claims CPU performance is up to 35 percent faster, and GPU performance is up to 65 percent faster. The company says the CPU and GPU are both 20 percent faster than the M2. As with the M1 and M2, it’s great for basic tasks like word processing, sending emails, using spreadsheets, and light gaming. With the 13-inch and 15-inch MacBook Air, you also have support for two external displays (one display with up to 6K resolution at 60 Hz and another with up to 5K resolution at 60 Hz).
M3 Pro: With a 12-core CPU and an 18-core GPU, Apple claims the M3 Pro’s GPU is only up to 10 percent faster than the M2 Pro—making this a marginal upgrade from its predecessor. Compared to the M1 Pro, however, the M2 Pro is up to 40 percent faster in GPU performance and 20 percent faster in CPU performance. It’s available on the 14-inch and 16-inch MacBook Pro from 2023. It’s the ideal in-between for those who need a chip that’s more powerful than the M3 but won’t utilize the full power of the M3 Max.
M3 Max: This is the next step up from the M2 Max and the most powerful of the three chips (but still not as powerful as the M2 Ultra). It has a 16-core CPU, 40-core GPU, and up to 128 GB of unified memory. According to Apple, the CPU performance is up to 80 percent faster than the M1 Max and up to 50 percent faster than the M2 Max. As for GPU performance, it’s said to be up to 50 percent faster than the M1 Max and 20 percent faster than the M2 Max. The M3 Max is available on the 14-inch and 16-inch MacBook Pro (late 2023).
M3 Ultra: While the M3 lineup was introduced in 2023, Apple announced an M3 Ultra in 2025. Confusingly, it remains the most powerful chip in the M-series lineup—even better than the latest M4 Max and M5. It has an up to 32-core CPU (with 24 performance cores) and a GPU with up to 80 cores. Apple claims it’s up to 2.5 times faster than the M1 Ultra. It also comes with 96 GB of unified memory, with the option to upgrade up to 512 GB, while SSD storage can be increased to 16 GB. This chip is currently only available on the 2025 Mac Studio.
M2 Series
M2: You might think the M2 is better than the M1 Pro or M1 Max, but you’d be wrong. It’s an entry-level chip like the M1, with slightly more processing power. It packs an 8-core CPU and up to a 10-core GPU (two more GPU cores than its predecessor), along with support for up to 24 GB of unified memory. Apple says the second-generation chip has an 18 percent faster CPU and a GPU that’s 35 percent more powerful. The M2 is great for daily tasks like word processing and web browsing, but tasks like editing multiple streams of 4K footage and 3D rendering should be reserved for the M1 Pro or M1 Max (or the next two chips). It’s available in the MacBook Air (13-inch, 2022), MacBook Air (15-inch, 2022), and MacBook Pro (13-inch, 2022).
M2 Pro: The M2 Pro is the next step up from the M2. It has up to 12 cores in the CPU and up to a 19-core GPU, with up to 32 GB of unified memory. Apple claims performance is up to 20 percent faster than the 10-core M1 Pro and graphics are 30 percent faster. We recommend this chip for intermediate video and photo editors. It’s a marginal upgrade compared to the M1 Pro, but it’s the best option for those who want a more future-proof processor. You’ll find it in the MacBook Pro (14-inch and 16-inch) from early 2023 and the Mac Mini (2023).
M2 Max: The M2 Max packs up to a 12-core CPU and up to a 38-core GPU (with support for up to 96 GB of unified memory). According to Apple, graphics are 30 percent faster than the M1 Max. The M2 Max is an excellent choice for those who work with graphics-intensive content, including graphic design, 3D modeling, and heavy-duty video footage. But as with the M2 Pro, it’s an incremental upgrade if you’re coming from an M1 Max. It’s available in the MacBook Pro (14-inch and 16-inch) that came out early in 2023 and the Mac Studio (2023).
M2 Ultra: This is the successor to the M1 Ultra. It’s available on the second-generation Mac Studio and the Mac Pro (2023). Composed of two M2 Max chips, using Apple’s UltraFusion technology, the M2 Ultra has a 24-core CPU and a GPU configurable with 60 or 76 cores. Apple claims the CPU delivers up to 20 percent faster performance and a 30 percent faster GPU than the M1 Ultra. This is the chip to get if you’re working with extremely heavy-duty content that you believe the M1 Ultra, M2 Pro, or M2 Max simply won’t be able to handle. You’ll know if you need a chip this robust.
M1 Series
M1: Shockingly, Apple continues to sell the M1 MacBook Air through Walmart for just $599, which is a killer price for this laptop. This was the first custom silicon Apple debuted for its MacBook Air in 2020. It has an 8-core CPU and up to an 8-core GPU. Originally, there was support for up to 16 GB of unified memory (RAM) at an extra cost, but nowadays you can only purchase the 8-GB model. It’s much faster than any previous Intel-powered MacBook Pro, and it is the practical choice for most people, as it’s inside the most affordable MacBook Air you can buy (from third-party retailers). It packs more than enough processing power to get you through common day-to-day tasks, even light gaming, and it can handle more intense jobs like photo editing.
M1 Pro: From there, the next step up was the M1 Pro. It has up to 10 cores in the CPU and up to a 16-core GPU, with up to 32 GB of unified memory. Apple says performance and graphics are both twice as fast as on the M1. We found it to be considerably more capable than the base chip, ideal for anyone who works heavily on MacBooks for music production or photo and video editing. Only the MacBook Pro (14-inch and 16-inch) from 2021 uses this chip.
M1 Max: Like the M1 Pro, the M1 Max has a 10-core CPU but a heftier 32-core GPU (with support for up to 64 GB of unified memory). Apple says it’s four times faster than the M1 in terms of graphics. As proven in testing, this chip is extremely powerful and handles every heavy-duty task with ease. It was the go-to choice if you needed a computer that could handle multiple streams of 8K or 4K video footage, 3D rendering, or developing apps and running demos. You probably already know whether you need this much power. It’s available in the MacBook Pro (14-inch and 16-inch) from 2021.
M1 Ultra: The M1 Ultra was the most powerful of them all. It’s two M1 Max chips connected with a technology called UltraFusion. It packs a 20-core CPU, 64-core GPU (which can be configured with up to 128 GB of unified memory), and a 32-core neural engine—complete with seven times more transistors than the base M1. Even with the M3 Ultra now available, the M1 Ultra remains powerful and a solid option for anyone who needs a heavy-duty processor for working with intense visuals and graphics. It was available only on the first-generation Mac Studio.
Anthony Joshua knocks out Jake Paul in boxing spectacle
Bank Holiday Today: Are Banks Open Or Closed On December 20, 2025? Find Out
US brand Levi Strauss appoints H&R Block CEO Jeffrey Jones to board
-
Business6 days agoHitting The ‘High Notes’ In Ties: Nepal Set To Lift Ban On Indian Bills Above ₹100
-
Business1 week agoIPO Explained: Meaning, Process, Benefits, Risks
-
Business5 days agoKSE-100 index gains 876 points amid cut in policy rate | The Express Tribune
-
Business5 days agoStudying Abroad Is Costly, But Not Impossible: Experts On Smarter Financial Planning
-
Sports5 days agoJets defensive lineman rips NFL officials after ejection vs Jaguars
-
Tech1 week agoCursor Launches an AI Coding Tool For Designers
-
Tech6 days agoFor the First Time, AI Analyzes Language as Well as a Human Expert
-
Entertainment5 days agoPrince Harry, Meghan Markle’s 2025 Christmas card: A shift in strategy