Georgia Consumer Data Protection Act (GCDPA)

The Georgia Consumer Data Protection Act (GCDPA) grants Georgia residents rights over their personal data, including the ability to access, correct, delete, and opt-out of the sale of their data. It also mandates data protection measures for businesses.

JurisdictionGeorgia
CategoryPrivacy & Data Protection
StatusActive
Latest development

Analysis

Key Requirements

The Georgia Consumer Data Protection Act (GCDPA) establishes several key requirements for businesses:

  • Consumer Rights: The GCDPA grants Georgia residents rights over their personal data, including:
  • Right to access personal data
  • Right to correct inaccuracies
  • Right to delete personal data
  • Right to opt-out of personal data sales
  • Right to data portability

Source: [Georgia General Assembly - SB 394]

  • Business Obligations: Businesses must:
  • Provide clear privacy notices detailing data collection and use practices
  • Obtain consent before processing sensitive data
  • Implement reasonable data security practices
  • Respond to consumer requests within specified timeframes
  • Conduct data protection assessments for high-risk processing activities

Source: [WilmerHale Privacy and Cybersecurity Law]

  • Scope: The GCDPA applies to businesses that:
  • Conduct business in Georgia or target Georgia residents
  • Control or process personal data of at least 25,000 Georgia consumers
  • Derive over 50% of gross revenue from selling personal data

Source: [DataGuidance News]

Compliance Challenges

Organizations face several challenges in complying with the GCDPA:

  • Regulatory Complexity: Keeping up with evolving privacy regulations across multiple jurisdictions

Source: [Sprinto Blog - Compliance Issues]

  • Data Management: Accurately identifying, categorizing, and managing consumer personal data across systems

Source: [Indusface Blog - Compliance Challenges]

  • Consumer Request Fulfillment: Efficiently responding to consumer data rights requests within required timeframes

Source: [BigID Blog - Data Privacy Governance]

  • Employee Training: Ensuring staff understand and follow data privacy practices

Source: [Lumenalta Insights - Data Privacy Best Practices]

Implementation Best Practices

To effectively implement GCDPA requirements:

  • Develop a Comprehensive Privacy Framework:
  • Create clear policies and procedures for data handling
  • Define roles and responsibilities for privacy management

Source: [IMPAACT Network - Good Documentation Practices]

  • Conduct Data Mapping and Inventory:
  • Identify all personal data collected, stored, and processed
  • Categorize data based on sensitivity and regulatory requirements

Source: [BigID Blog - Data Privacy Governance]

  • Implement Strong Data Security Measures:
  • Encrypt sensitive data in transit and at rest
  • Use access controls and authentication mechanisms
  • Regularly audit and monitor data access

Source: [Lumenalta Insights - Data Privacy Best Practices]

  • Establish Consumer Rights Request Processes:
  • Create efficient workflows for handling access, deletion, and opt-out requests
  • Implement identity verification procedures
  • Use automation tools to streamline request management

Source: [BigID Blog - Data Privacy Governance]

Recent Updates

As of February 2025, the GCDPA is still in the proposal stage:

  • The bill was introduced to the Georgia Senate on February 1, 2025
  • It is currently under review by the Senate Committee on Science and Technology
  • If passed, the law is expected to take effect on January 1, 2026

Source: [WilmerHale Privacy and Cybersecurity Law]

Related Regulations

The GCDPA shares similarities with other state and federal privacy laws:

  • California Consumer Privacy Act (CCPA): Similar consumer rights and business obligations

Source: [California Attorney General - CCPA]

  • Virginia Consumer Data Protection Act (VCDPA): Comparable scope and requirements

Source: [Virginia Legislative Information System - VCDPA]

  • General Data Protection Regulation (GDPR): Influenced many concepts in the GCDPA

Source: [European Commission - GDPR]

Industry Impact

The GCDPA is expected to have significant impacts across industries:

  • Technology Sector: Increased focus on privacy-enhancing technologies and data minimization practices
  • Financial Services: Enhanced data governance and consent management requirements
  • Healthcare: Stricter controls on sensitive health data processing and sharing

Source: [Centraleyes - Georgia Privacy Law]

Sources

Recent developments

  • — Byte Back reports that the Georgia Senate passed SB 111, the **Georgia Consumer Privacy Protection Act**, on March 3, 2025 by a 53–2 vote, and the bill crossed to the House shortly before the March 6 crossover deadline, positioning it as a leading comprehensive state privacy proposal.[6] (source)
  • — Consumer Reports and EPIC publish a joint opposition to Georgia’s SB 111, arguing that although the bill creates consumer rights, it “would do little to protect Georgia consumers’ personal information” without stronger data minimization, honoring browser privacy signals, improved targeted advertising rules, better enforcement, and removal of broad carve‑outs.[4] (source)
  • — The Georgia General Assembly’s official SB 111 text for the Georgia Consumer Privacy Protection Act sets out comprehensive consumer data rights (confirm, access, correct, delete, data portability), controller obligations, applicability thresholds, and an effective-date clause, indicating the legislature’s intent to enact a broad consumer data protection framework.[7] (source)
  • — A Georgia Senate floor amendment (Sen Floor Amend 1 AM 44 0291) to SB 111 clarifies that controllers may not process sensitive data without consumer consent and must follow COPPA requirements when processing children’s data, reinforcing children’s privacy protections within the Georgia Consumer Privacy Protection Act.[9] (source)
  • — WilmerHale’s state privacy law update analyzes SB 111 (Georgia Consumer Privacy Protection Act), noting it applies to entities with over $25M revenue meeting specified Georgia-resident thresholds, creates consumer rights (access, correction, deletion, opt-out/opt-in), restricts processing and sale of sensitive data, and uniquely grants a right to know if data will be used in AI systems.[3] (source)
  • — DataGuidance reports that SB 111 for the Georgia Consumer Privacy Protection Act was introduced in the Georgia Senate on February 5, 2025, with detailed definitions of consent, controller, processor, de‑identified data, pseudonymous data, precise geolocation data, sensitive data, and “sale of personal information,” marking a major step toward a Georgia-wide consumer data protection regime.[8] (source)
  • — Chambers notes that while comprehensive privacy legislation has stalled, Georgia enacted SB 351 (Protecting Georgia’s Children on Social Media Act) in April 2024, imposing age‑verification and parental consent requirements on social media platforms and creating civil liability for distributing harmful material to minors, indicating a broader state trend toward tighter regulation of digital businesses and data-related harms.[1] (source)
  • — The ACLU of Georgia highlights a report by EPIC and U.S. PIRG Education Fund giving Georgia’s earlier Consumer Privacy and Protection Act (SB 473) a “failing grade,” criticizing weak protections, enforcement, and loopholes—feedback that informs ongoing advocacy around SB 111 and future Georgia consumer data protection legislation.[2] (source)
  • — In reviewing earlier efforts, Byte Back notes that a prior Georgia Consumer Privacy and Protection Act (SB 473) had passed the Senate in February 2024 and cleared a House committee but ultimately died when the legislature adjourned without a House floor vote, highlighting legislative momentum and prior failure that shaped the current SB 111 approach.[6][1] (source)
  • — Chambers’ Data Protection & Privacy 2026 guide explains that the earlier Georgia Consumer Privacy Protection Act (SB 473) passed the Senate in February 2024 but failed in the House, and describes how the 2025 session’s SB 111 is a substantially similar comprehensive privacy measure aimed at entities with specified revenue and resident‑data thresholds, with civil penalties up to $7,500 per violation.[1] (source)

Read the full guide to Georgia Consumer Data Protection Act (GCDPA)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates