State privacy laws hit the mainstream in 2024: Reasonable security and the training expectation

For a long time, privacy law in the United States was mostly a California story, with the CCPA standing nearly alone. By 2024, that had changed completely. A wave of comprehensive state privacy laws had either taken effect or was about to, and organizations that once ignored privacy compliance as a California problem suddenly had obligations in a growing list of states. Most of those laws shared a quiet but important provision: a duty to implement reasonable security safeguards, which regulators and courts read to include workforce training.

The growing list of state laws

The map of state privacy law expanded rapidly. California's CPRA amended and strengthened the CCPA. Virginia, Colorado, Connecticut, and Utah all had laws in effect by 2024, with more states, including Texas, Oregon, and Montana, bringing laws online through 2024 and 2025. While the laws differed in thresholds and specifics, they shared a common architecture: consumer rights over personal data, obligations on businesses that control it, and a baseline requirement for reasonable security.

The reasonable security standard

Nearly every comprehensive state privacy law requires businesses to implement and maintain reasonable security procedures appropriate to the nature of the data they hold. The word reasonable is doing a lot of work, but the practical meaning has become clear through enforcement and guidance. Reasonable security means controls that reflect the sensitivity of the data, including access controls, encryption where appropriate, and a workforce that understands how to protect it. It is not a specific checklist, but it is also not nothing.

How training satisfies reasonable security

Security awareness training sits at the center of the reasonable security analysis. Regulators consistently treat a trained workforce as a foundational safeguard, because most data incidents begin with human error. A business that can demonstrate it trains employees on data handling, phishing, and incident reporting is in a far stronger position to argue its security was reasonable. Conversely, a business that cannot show any training has a hard time claiming it took the steps the law expects. Training is, in effect, one of the clearest pieces of evidence that reasonable security exists.

The data minimization and access angle

State privacy laws also imposed obligations that go beyond security, including data minimization, purpose limitation, and honoring consumer access and deletion requests. These obligations are procedural, and they fail when employees do not know how to execute them. A workforce that understands what personal data the business holds, where it lives, and how to respond to a consumer request is essential to compliance. Training that covers these operational duties, not just security awareness, is what turns the law's requirements into working processes.

Compliance across a patchwork

The most common mistake organizations made in 2024 was treating each state law as a separate project. The smarter approach was to build a single, documented privacy and security program that met the highest common denominator, then layer state-specific requirements on top. A consistent training program, covering both security awareness and privacy obligations, delivered to all employees with clean documentation, is exactly the kind of foundation that scales across a patchwork. It satisfies reasonable security in every state at once and avoids the trap of maintaining a different program for each jurisdiction.

Why this trend is not slowing down

The state privacy law movement is following the same trajectory as data breach notification laws did two decades earlier: starting with a few states, then spreading until a federal baseline becomes inevitable. Organizations that build their privacy and security programs now, with training as a core, documented component, will find each new state law an incremental adjustment rather than a scramble. The reasonable security standard is not going away, and neither is the expectation that a trained workforce is part of it.