Tech
Scope of US state-level privacy laws expands rapidly in 2025 | Computer Weekly
The number of individual US states with local data privacy legislation on their statute books has expanded rapidly in 2025, with nine more state laws coming into effect this year and three more states – Indiana, Kentucky and Rhode Island – slated to start enforcing their own rules on 1 January 2026, according to a report compiled by the International Association of Privacy Professionals (IAPP).
Since the introduction of the landmark California Consumer Privacy Act in 2020, politicians in state capitals across the US have eagerly taken up the data protection baton, with Colorado, Connecticut, Utah and Virginia all introducing comprehensive privacy laws in 2023; Montana, Oregon and Texas in 2024; and Delaware, Iowa, Maryland, Minnesota, Nebraska, New Hampshire, New Jersey and Tennessee this year.
A further 16 states are currently deliberating comprehensive privacy bills, including economic powerhouse states such as Massachusetts and New York.
The resulting report captures an in-depth picture of each of the separate state privacy laws, with the overall goal being to outline the contours of each state to offer more meaningful guidance to organisations. The IAPP has been actively tracking amendments to state privacy laws – Connecticut, Montana and Oregon all made changes his year to expand the scope of applicability, enhance consumer rights and put in place more business obligations around control and processing of personal data, for example.
Where to start?
Müge Fazlioglu, IAPP principal researcher, privacy law and policy, has been tracking these developments. She described an increasingly complex patchwork of compliance for organisations working in the US.
“The applicability of each US state privacy law can be assessed through a multistep process as each state law has a unique scope based on variety of thresholds,” she told Computer Weekly. “These thresholds are related to entity’s jurisdiction, revenue, volume of personal data processing and revenue derived from the sale of personal data.”
To dig deeper into the extent to which the laws differ, five different thresholds in the US now exist for processing resident’s personal data. These include no threshold in Nebraska and Texas; 25,000 or more unique consumers in Montana; 35,000 in Connecticut, Delaware, Maryland, New Hampshire and Rhode Island; 100,000 in California, Colorado, Indiana, Iowa, Kentucky, Minnesota, New Jersey, Oregan, Utah and Virginia; and 175,000 in Tennessee. So, any organisation holding data on any Texas residents becomes subject to applicability, but they must hold data on 0.6% of the population of Maryland, or 3.3% of the population of tiny Delaware.
Then there are thresholds for the sale of personal data. Here, again, Nebraska and Texas are strictest, ruling that the control, processing or sale of any personal data is subject to state privacy laws, albeit with exemptions for small businesses. Meanwhile in California, organisations fall in scope if they control or process any personal data and derive 50% or more of their revenues from the sale of data. Colorado and New Jersey both include population thresholds again – 25,000 unique consumers or more, and in-scope organisations derive any revenue or discount on the price of any goods or services from the sale of personal data.
When it comes to exemptions, each of the 19 state laws excludes various entities and types of data held by them – most commonly, government agencies, non-profits and higher education institutions; and organisations already subject to national, sectoral legislation, such as the Health Insurance Portability and Accountability Act (HIPAA).
Differences again abound. For example, the laws of Colorado, Delaware, Minnesota, Montana, New Jersey and Oregon do not exempt non-profits. California and Maryland do exempt non-profits but do not exempt higher education institutions, and so on. Nuances exist even here – Delaware, for example, exempts only some non-profits and its laws don’t apply to those than handle data held by non-profits working with victims of child abuse, domestic violence, human trafficking or sexual assault. Neighbouring Maryland exempts those that process or share personal data to assist first responders in emergency situations, or law enforcement investigating fraud or insurance-related crime.
When it comes to business obligations under state privacy laws, all states require regulated entities to provide consumers with privacy practice disclosure notices – California asks for this at the point of collection, and all bar Rhode Island and Utah impose minimisation and purpose limitations on the collection or processing of data. This typically restricts the collection, use, retention and sharing of consumer data to what is adequate, relevant and reasonably necessary. Most states – bar Iowa and Utah – require data protection impact assessments (DPIAs), but in Delaware, Indiana and Virginia, DPIAs are specifically required for targeted advertising, the sale of personal data or individual profiling.
Naturally, all states require consent for processing of sensitive data, but again they define varying categories of data as sensitive. Most state laws cover a standard dataset that will be familiar to most, classing children’s data, data on ethnic background, religion, and sexual orientation as sensitive. However, some states go further, with Maryland and Oregon also recognising information on national origin as sensitive, while five states – Connecticut, Delaware, Maryland, New Jersey and Oregon – include data that might reveal an individual’s status as non-binary or transgender.
Maryland, meanwhile, has the only state level law that does not classify mental or physical health data as sensitive, whereas California ploughs a unique furrow and classes philosophical beliefs as a protected category, protecting existentialists, logical positivists, nihilists and stoics alike.
Finally, turning to consumer rights to access, correct and delete data held on them, things are a little simpler but there are still differences to account for. In all states consumers can access, correct and delete data – bar Iowa, where they cannot correct it; and Indiana, where they can correct it only if they have provided it in the first place.
Similarities to GDPR
Organisations operating out of the UK or European Union (EU), may be tempted to look to the practices and principles already established under the General Data Protection Regulation (GDPR) as a helpful guide to the growing labyrinth of rules, clauses and exceptions in the US.
However, Fazlioglu said that while the requirements of the various US regimes relating to consumer rights, data minimisation, purpose limitation of data collection and processing, and so on, might feel familiar to organisations that are already GDPR compliant at first glance, data privacy professionals should be wary of inferring too much from this, and it would be a grave error to rely too heavily on them.
“As we know in the world of privacy and digital governance, compliance work requires continuously mapping the current landscape, monitoring the changes, and making necessary updates and adjustments,” she said. “When it comes to the overlap of GDPR and the US state privacy laws, there’s a lot to identify, assess, translate and consider. There’s no simple checklist or formula to confirm alignment … Organisations need to examine the extent of each state privacy law and evaluate whether their existing practices are sufficient.”
Fazlioglu said that understanding the scope and specificity of each law, including the categories of sensitive data or how various terms such as “sale” are defined, is critical.
She said that while this may feel complex and daunting, the interaction between the various laws and domains and the GDPR may ultimately benefit consumers. “It encourages deeper attention to the crossroads of consumer protection and emerging technologies,” she said.
Federal laws a subject of debate
In parallel to the enacting of state-level legislation in the US, calls continue for Washington DC to introduce a federal privacy law. While British and European observers not steeped in US political tradition may naturally feel inclined to prefer a national data protection standard, this is not such a simple ask for the US federal system.
“It is preferable for some and not preferable for others,” said Fazlioglu. “For example, during discussions around the American Privacy Rights Act of 2024 and the American Data Privacy and Protection Act of 2023, we observed different reactions from various groups – some supported these bills to simplify the landscape, while others emphasised the risk of weakening the protections currently offered by state legislatures.”
The IAPP tracks developments in this regard, examining contentious issues such as bipartisanship, private right of action and preemption. Fazlioglu said it was difficult to predict whether or not a federal law could advance through US Congress, but by analysing prior attempts, it is possible to see that laws which include private right of action and preemption clauses can influence a bill’s ability to attract both Democrat and Republican support.
Fazlioglu added: “The question is not only whether federal privacy legislation is preferable, but also whether such a law should function as a ceiling or a floor. Proponents of preemption argue that a federal law should serve as a ceiling – setting a uniform standard that overrides state laws. In contrast, supporters of preserving state privacy laws believe a federal law should act as a floor – a minimum standard that states can build upon.”
This is why, Fazlioglu said, it’s important to consider both state and federal privacy law developments in order to see the full picture. “I believe the state-federal dynamics influence each other. So, while it’s uncertain whether we’ll see a federal privacy law enacted, I expect continued discussions at both the intra-state level and between state and federal frameworks. Together, these conversations will continue to shape the US approach to privacy law and policy in the coming years,” she said.
Tech
An ‘Intimacy Crisis’ Is Driving the Dating Divide
In the US, nearly half of adults are single. A quarter of men suffer from loneliness. Rates of depression are on the rise. And one in four Gen Z adults—the so-called kinkiest generation, according to one study—have never had partnered sex.
In an age of endless connection, where hooking up happens with the ease of a swipe and nontraditional relationship structures like polyamory are celebrated, why are people seemingly so disconnected and alone?
Chalk it up to changing social norms or shifting generational attitudes around relationships. But the bigger issue at play, according to Justin Garcia, is that we just don’t crave intimacy in the same way we used to. “Our species is on the precipice of what I have come to think of as an intimacy crisis,” Garcia writes in his new book, The Intimate Animal: The Science of Sex, Fidelity, and Why We Die for Love. Garcia suggests in the book that intimacy—not sex—is the “the most powerful evolutionary motivator of modern relationships,” but that our hunger for it “has been stifled by and misdirected in today’s digital world.”
An evolutionary biologist and anthropologist who began his career studying hookup culture, Garcia is the executive director of the Kinsey Institute at Indiana University, a research lab known for its pioneering work on sexuality, online dating, and aging. (Sex may in fact improve with age, a recent report found). He’s held the position since 2019, and in that time he has also served as the chief scientific advisor to Match, where he provides expertise for its annual Singles in America survey. In 2023, Indiana lawmakers voted to block public funding from the institute—state senator Lorissa Sweet, a Republican, falsely claimed that Kinsey was studying orgasms in minors—but, the following year, the school’s Board of Trustees voted to abandon its plans to separate the institute into a nonprofit.
Garcia’s book covers a lot of ground—the “cognitive overload” of dating apps, why humans are wired to be socially monogamous but not sexually monogamous, the science of breakups—but its throughline is how “even in this bewildering era, where moments of human connection are becoming increasingly elusive, the search for intimacy remains the most human of human impulses.”
On a recent afternoon over Zoom, I spoke with Garcia about the biggest misconception about the sex recession among Gen Z, the attack on sexual literacy in the current political climate, and why an AI chatbot won’t save your relationship. It’s all connected, he says.
This interview has been edited for clarity and length.
WIRED: What is the intimacy crisis, and why, as you write in the book, are we on the verge of one?
Justin Garcia: We hear a lot about the loneliness epidemic. The research suggests that loneliness is as bad for your health as smoking a pack of cigarettes a day. Psychological loneliness gets embodied in physical and psychological health. At the same time, there are reports that suggest that the numbers haven’t increased all that much for psychological loneliness. But clearly its impact is more, and more people are paying attention to the impact.
For me, there’s a bigger umbrella. We are suddenly talking about loneliness at the same time that all of us have more connections than ever before. That’s why I call it an intimacy crisis. We have more people available to us, particularly through internet and social media platforms, but the depth of the connections, the quality of the connections, is not there.
You suggest that the intimacy crisis can lead to “unprecedented and stark biological consequences.” In what way?
We’re in a moment where the human brain is taking in so much information and so much of the information is threatening. It’s what’s going on in the news, in Gaza and Minnesota, with climate change, with global economics—I mean, pick any section of the paper, it’s bad news. That weighs on our nervous system. Just as humans’ romantic and sexualized lives respond to environments with how they form relationship structures, they’re also responding to this current environment, which is that there’s a lot of threat going on. When the nervous system gets tuned up into a threat response, that’s not conducive to social behavior and it’s most certainly not conducive to mating. If our nervous system is detecting threats from all this stuff in our environment, that has all sorts of effects on our relationships. And if we don’t have the safety net of deep intimacy, we can’t effectively weather these storms.
Tech
Republicans Are All In on Boosting Fraud Allegations in California
A month after the Trump administration began its immigration enforcement operation in Minneapolis, right-wing creators are turning their attention to a new target in search of fraud: California.
Over the last few weeks, right-wing creators who were instrumental in boosting the Minnesota fraud allegations that predated the administration’s surge of federal immigration agents have been going after a number of California’s social welfare programs, making unsubstantiated accusations of fraud—and potentially laying the groundwork for a similar federal crackdown in the nation’s largest Democrat-run state. They’re already getting support from some of President Donald Trump’s key allies too.
Nick Shirley, the right-wing influencer whose viral YouTube video claimed to uncover a purported $100 million fraud scheme involving Somali childcare centers in Minnesota, posted to Instagram over the weekend announcing his arrival in California. “Secrets out,” Shirley wrote in an Instagram story set to Katy Perry’s “California Gurls.” It’s unclear what exactly Shirley plans to do, but he claims to be “investigating” Somali-run childcare centers in California as well, according to posts that circulated on X over the weekend.
Shirley is working with Amy Reichert, a private investigator and failed politician who claims to be investigating “ghost daycares” in California. In his Minnesota video, Shirley “investigated” the fraud by showing up to daycares asking to see children. He appears to be applying the same method in San Diego. Reichert posted a picture with Shirley to X on Saturday, writing “California, here we come! When @nickshirlye drops the video, it’s going to be 🔥.” (Local Minnesota outlets published multiple stories covering childcare fraud years before Shirley’s video came out.)
On Sunday, Benny Johnson, a pro-Trump creator and Turning Point USA contributor, published his own “documentary,” in a similar vein to what Shirley filmed in Minnesota. In it, he claimed to reveal a multimillion-dollar “homeless industrial complex” in California. Johnson teamed up with two Republican gubernatorial candidates, Riverside County Sheriff Chad Bianco and Steve Hilton, a former adviser to UK prime minister David Cameron, in the video, which they claimed was an attempt to uncover fraudulent uses of federal funding to support California’s unhoused. Johnson also claimed that the state was “using these federal dollars to rig national elections.”
California governor Gavin Newsom’s office rejected the claims Johnson made in an X post on Sunday, calling the video “literally the conspiracy theory meme in real life.”
Johnson’s most recent video attempts to claim that California’s homeless shelters are primarily filled with undocumented immigrants. His main piece of evidence is a phone call with a purported “whistleblower” whose identity was concealed. (Newsom’s office responded to this claim, calling it “as real as our Free Unicorn for all undocumented people program.”)
The same week Johnson announced that he would be traveling to California to uncover “fraud,” Trump called California “more corrupt” than Minnesota in a post on Truth Social. “Fraud Investigation of California has begun,” Trump wrote. Last week, Trump named a new assistant attorney general, Colin McDonald, to focus on fraud investigations at the Justice Department.
Other large pro-Trump accounts and news outlets, like Real America’s Voice, are boosting Johnson’s recent video. Larry Elder, talk radio host and former presidential candidate, reposted the video on X on Tuesday, writing “Fraud in California makes that of Minnesota look like a starter kit.”
Elon Musk, who Shirley thanked for initially boosting his December Minnesota video, has also been elevating news coverage related to California fraud. “Truly insane levels of fraud!” Musk said, reposting a story from Fox News earlier this week.
Tech
Ransomware gangs focus on winning hearts and minds | Computer Weekly
The tried-and-tested ‘business models’ favoured by some of the world’s most adept, and dangerous, ransomware gangs are scaling rapidly as cyber criminals increasingly adopt structured affiliate models and actively seek out new recruits, including malicious insiders and even cyber pros themselves, according to NCC Group’s latest monthly round-up of the threat environment.
That cyber criminal gangs operate as an organised industry is of course nothing new, and is well-known and understood across the security industry and these days, beyond its confines.
However, said NCC, amid a 13% rise in recorded ransomware attacks during December 2025, the growing financial ‘success’ of ransomware gangs is enabling them to offer stronger financial incentives – including larger commissions – to their new recruits, and improved operational security (OpSec) measures, both signs of growing professionalisation in the ecosystem/
NCC’s Matt Hull said that ransomware-as-a-service (RaaS) gangs now view employees, contractors, and trusted partners as gateways into victim organisations, and enthusiastically target them in order to gain legitimate access to credentials, systems and processes. This allows them to both bypass security controls and dial back their reliance on the use of vulnerabilities that may be discovered and patched at any moment, which in turn reduces the risk of discovery and exposure prior to executing a cyber attack
He cited a well-reported incident in which the Medusa ransomware gang unwisely targeted the BBC by approaching its cyber security correspondent, Joe Tidy. The gang messaged Tidy on the encrypted Signal application to offer him 15% of a future ransomware payment if he gave them access to his PC. When this was rebuffed, Medusa’s recruiter upped the offer to a quarter of 1% of the BBC’s revenues, and promised Tidy he would never have to work again.
“Targeting high-profile organisations like the BBC is both financially attractive and commercially strategic,” said Hull. “Even limited success against a well-known brand can generate notoriety and credibility, helping groups attract future affiliates and opportunities. Well-resourced groups like Medusa and Qilin can afford to use financial incentives to attract insiders, but smaller gangs often lack the means to compete.
“For organisations, this shifts the focus from purely technical defence to human risk management. Insider threat programmes, strong access governance and robust offboarding processes are critical to reducing the risk that current or former employees become part of the ransomware supply chain.”
But employees are not the only ones being targeted. In November 2025, the US authorities indicted three men accused of extorting a total of five known victims using the ALPHV/BlackCat ransomware. The sting in the tale was that all three worked in the cyber security field, specialising in incident response and ransomware negotiations. The Department of Justice (DoJ) said that one of the men became involved in the scheme because he was in debt.
Two of the accused, named as Ryan Goldberg and Kevin Martin, pled guilty to obstruction of commerce through extortion at the end of December 2025 and are due to be sentenced in March.
“Ransomware has evolved into an organised business model. These groups now think in terms of recruitment, incentives, scale and growth, rather than just attacks,” added Hull.
“What’s striking is that these tactics aren’t new. Trust, deception, social engineering and financial pressure have always worked, they’re just being organised and scaled in new ways. The recruitment of cyber security professionals shows how far this has gone: ransomware groups are exploiting expertise, access and human trust to operate like structured criminal enterprises.”
Qilin remains most active gang
During December 2025, NCC’s telemetry observed 170 Qilin ransomware attacks, approximately double the volume of the gang’s closest rival Akira, which managed 78. LockBit 5.0, Safepay and Sinobi rounded out the top five with 68, 67 and 54 observed attacks to their names, respectively.
NCC said an end-of-the-year rise in ransomware attacks was a well-documented event, as cyber criminals target organisations left understaffed during the holiday period.
As usual, North America remained the most targeted geography, accounting for 50% of the attacks seen by NCC, with Europe accounting for another quarter, and Asia 12%. Approximately 30% of attacks targeted the industrials sector, followed by 22% of attacks targeting the consumer discretionary vertical, and 10% targeting IT companies.
-
Sports1 week agoPSL 11: Local players’ category renewals unveiled ahead of auction
-
Sports1 week agoCollege football’s top 100 games of the 2025 season
-
Entertainment1 week agoClaire Danes reveals how she reacted to pregnancy at 44
-
Business1 week agoBanking services disrupted as bank employees go on nationwide strike demanding five-day work week
-
Politics1 week agoTrump vows to ‘de-escalate’ after Minneapolis shootings
-
Sports1 week agoTammy Abraham joins Aston Villa 1 day after Besiktas transfer
-
Tech1 week agoBrighten Your Darkest Time (of Year) With This Smart Home Upgrade
-
Entertainment1 week agoK-Pop star Rosé to appear in special podcast before Grammy’s
