North Dakota Consumer Privacy Rights Act (House Bill 1330)

Proposed comprehensive privacy legislation modeled after Virginia's CDPA. Would establish consumer rights including access, deletion, and opt-out rights. Includes provisions for data protection assessments and processor obligations. Currently under consideration in state legislature.

JurisdictionNorth Dakota
CategoryPrivacy & Data Protection
StatusProposed
Latest development

Analysis

North Dakota’s HB 1330 (North Dakota Consumer Privacy Rights Act) was introduced as a comprehensive privacy bill but was rejected and did not become law; however, it is still a useful indicator of where North Dakota privacy policy may evolve and closely tracks concepts from Virginia’s CDPA and other state privacy laws.238

Below is an analysis structured as requested, with emphasis that HB 1330 is proposed / failed legislation, not a current binding requirement.

Key Requirements (as proposed in HB 1330)

Although HB 1330 did not pass, its text and legislative materials show the types of obligations lawmakers were considering for entities that collect and sell consumer data.153

  • Scope – “Covered entities” and “protected data”
  • HB 1330 applied to any “covered entity” defined as a partnership, LLC, corporation, or other legal entity, including social media companies, that collects and sells a user’s protected data and does business in North Dakota.1
  • “Protected data” was broadly defined to include categories such as location, screen name, website address, interests, hometown, professional history, friends or followers, shopping habits, test scores, health conditions, browsing history, purchase history, number of followers, socioeconomic status, and more.17
  • Opt‑in consent for sale of protected data
  • A covered entity could not sell a user’s protected data to another person unless the user opted in to allow the sale.15
  • Opt‑in required that the entity provide an opportunity to affirmatively click or select approval of the sale.1
  • Users had to be given the opportunity to opt in separately for each type of protected data by individual selection, and the categories of data had to be described clearly in plain language.15
  • Private right of action and statutory damages
  • A covered entity that violated the chapter would have been civilly liable to the user for a minimum of USD 10,000 plus reasonable attorney’s fees.13
  • For knowing violations, liability increased to a minimum of USD 100,000 per user, with attorney’s fees and potential punitive damages.13
  • The bill expressly allowed class action lawsuits for violations.1
  • Relationship to comprehensive privacy / consumer rights concepts
  • While HB 1330’s text is limited to sale of protected data, legislative commentary and external coverage describe it as part of the broader wave of state consumer privacy proposals inspired by laws like the California Consumer Privacy Act (CCPA) and Virginia Consumer Data Protection Act (CDPA), focusing on consumer control and opt‑in for data sales.381
  • Virginia’s CDPA, often cited as a model in discussions of comprehensive state privacy regimes, provides rights to access, delete, correct, and opt out of targeted advertising and sale of personal data, as well as data protection assessments and processor obligations, which align with the policy direction HB 1330 was part of, even if not all such rights appear in HB 1330’s text.38

Compliance Challenges (for organizations working under similar state privacy regimes)

Since HB 1330 never took effect, observed challenges come from industry testimony and analyses of similar state privacy laws (e.g., CCPA/CPRA and CDPA), which illuminate what North Dakota organizations would face under comparable requirements.793

  • Broad, unclear definitions and overlap with existing laws
  • Industry testimony argued that HB 1330’s definition of “protected data” is extremely broad and not clearly limited to personal data, potentially including de‑identified or non‑linkable data and lacking exclusions for publicly available information.7
  • CTIA’s submission noted that HB 1330 could clash with existing privacy protections, creating consumer confusion and overlapping obligations with other state and federal frameworks.7
  • Similar concerns have been raised under CCPA/CPRA, where businesses must distinguish “sale” and “sharing” and reconcile state rules with sectoral laws like HIPAA and GLBA.37
  • Operational burden of granular opt‑in
  • HB 1330’s requirement that users opt in separately for each category of protected data was criticized as “onerous” and difficult to implement at scale for digital services and advertising ecosystems.79
  • A joint advertising trade letter highlighted that such granular consent requirements could significantly disrupt ad‑supported business models and data‑driven services.9
  • High litigation exposure and class actions
  • The proposed statutory damages (USD 10,000–100,000 per user) plus class actions were viewed as creating substantial litigation risk, especially for smaller businesses lacking robust compliance programs.137
  • Real‑world challenge examples (analogous to HB 1330)

While specific enforcement under HB 1330 does not exist, comparable examples under other privacy laws show typical pitfalls:

  • Under California’s CCPA/CPRA, organizations have faced enforcement for failure to provide clear opt‑out mechanisms for data sale/sharing and inadequate disclosures, illustrating the difficulty of designing compliant consumer controls similar to HB 1330’s opt‑in.37
  • Industry studies have documented costs of implementing consent and preference management platforms, especially for mid‑market firms adapting to multi‑state privacy regimes that include restrictions on data sale and targeted advertising.39

Implementation Best Practices (for organizations preparing for similar North Dakota or state privacy laws)

Organizations in or targeting North Dakota can prepare by adopting state‑privacy and data governance best practices aligned with CDPA/CCPA‑style regimes, even though HB 1330 is not in force.137

  • Map data and identify “sale” / “sharing” activities
  • Conduct a data inventory to identify categories equivalent to HB 1330’s “protected data” (location, browsing history, purchase history, etc.) and where those are sold or shared with third parties.1
  • This approach mirrors obligations under Virginia CDPA and other state laws to understand personal data processing and relationships with processors.3
  • Implement robust consent and preference management
  • Design granular consent interfaces that allow users to opt in or opt out by data category and purpose, consistent with HB 1330’s requirement for individual selection of data types and clear, plain‑language descriptions.15
  • Many organizations use consent management platforms (CMPs) or privacy preference centers that support multi‑state compliance (e.g., CCPA/CPRA and CDPA) and could be configured for an HB 1330‑type regime.37
  • Strengthen contracts and processor oversight
  • Although HB 1330 itself focused on sale rather than processor obligations, comprehensive state privacy frameworks influenced by CDPA typically require contracts with processors specifying instructions, confidentiality, and security measures.3
  • Organizations should ensure vendor contracts prohibit unauthorized sale or further sharing of consumer data and align with any existing North Dakota obligations (e.g., for ISPs) to protect personally identifiable information.10
  • Use established privacy frameworks and guidance
  • NIST Privacy Framework and similar models provide structured methodologies for identifying privacy risks, implementing controls, and preparing for evolving state privacy laws that emphasize consumer rights and data governance.3
  • The IAPP and other professional bodies offer implementation guidance for CDPA‑style requirements (access, deletion, opt‑out, data protection assessments), which is relevant because HB 1330 was part of that legislative trend.38

Recent Updates (status and legislative progress)

HB 1330 as introduced in the 67th Legislative Assembly (2021) did not pass and currently there is no consumer privacy law of this type in force under that bill number.283

  • Legislative history for HB 1330 (2021 session – data protection)
  • HB 1330 was introduced January 13, 2021, to prohibit covered entities from selling users’ protected data without consent and provide penalties.21
  • The House Industry, Business and Labor Committee voted against advancing HB 1330 (12–1 with one abstention) on February 9, 2021.3
  • On February 18, 2021, the bill failed on second reading in the House (19 yeas, 75 nays) and thus was rejected.28
  • No effective date or compliance deadline
  • Because HB 1330 did not pass, no effective date, transition period, or compliance deadline applies.28
  • Other uses of “HB 1330” in later sessions are unrelated
  • In the 69th Legislative Assembly (2025–2026), HB 1330 is instead an investment‑related bill amending the prudent investor rule and addressing legacy fund investments and divestment from Chinese companies, not consumer privacy.46
  • This later HB 1330 has different subject matter and requirements and does not create consumer privacy rights or obligations regarding data sale.46

Related Regulations and Standards

While HB 1330 itself never became law, several related regulations and standards overlap or interact conceptually with what HB 1330 aimed to achieve.37[10](https://ndlegis.gov/api/assembly/58-2003/regular/bill-text/DAMD

Recent developments

  • — OneTrust DataGuidance’s North Dakota jurisdiction profile explains that the state still has no general consumer privacy law in effect and notes that HB 1330, which would have prohibited sale of user data without consent, was halted in committee, leaving breach-notification rules as the primary statewide data protection mechanism.[1] (source)
  • — Byteback Law’s status report on CCPA-like state privacy bills notes that North Dakota’s HB 1330, modeled as a strong opt-in consumer privacy measure, has “died” in the legislature alongside a similar Mississippi bill, indicating no further legislative action.[4] (source)
  • — Byteback Law observes that, after HB 1330’s failure, North Dakota fell behind other states in pursuing comprehensive consumer privacy legislation, signaling limited immediate impact on industry practices beyond avoiding the stringent opt-in and liability structure the bill had proposed.[4] (source)
  • — North Dakota House Bill 1330, titled the North Dakota Consumer Privacy Rights Act and aimed at prohibiting the sale of users’ protected data without consent, was rejected on second reading in the House (19 yeas, 75 nays), effectively killing the bill.[7][8] (source)
  • — Digital Policy Alert notes the formal rejection of HB 1330, a data protection measure that would have barred entities from selling users’ protected data without consent and imposed penalties, confirming that the proposal will not move forward.[8] (source)
  • — Mintz’s overview of state privacy legislation reports that North Dakota’s HB 1330, a broad opt-in consumer data sale restriction with a private right of action and significant statutory damages, failed to pass committee and is no longer advancing.[3] (source)
  • — The IAPP details that the North Dakota House Industry, Business and Labor Committee voted 12–1 (with one abstention) against advancing HB 1330, an opt-in consumer data sale bill, making it the first confirmed cut among 2021 state privacy proposals.[5] (source)
  • — Testimony from CTIA before the North Dakota House Committee outlines industry opposition to HB 1330, arguing its broad “protected data” definition, onerous opt-in requirements, and high per-user statutory damages could create confusion and impose severe compliance and litigation burdens, especially on smaller businesses.[9] (source)
  • — The IAPP article highlights broader industry reaction, indicating that HB 1330’s strict opt-in regime and expansive private right of action were viewed as outliers compared to other state proposals and raised concerns about potential chilling effects on data-driven business models.[5] (source)
  • — The introduced text of HB 1330 establishes a new chapter in the North Dakota Century Code to prohibit covered entities from selling users’ “protected data” without opt-in consent, defines broad categories of protected data, and creates a private right of action with minimum damages of $10,000 per violation and $100,000 for knowing violations.[6] (source)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates