Proposed State Privacy Law Update: April 28, 2025

Keypoint: Last week, Alabama’s House passed a consumer data privacy bill, the Colorado Senate passed a bill to amend the Colorado Privacy Act, Oklahoma’s consumer data privacy bill advanced in the House, several bills advanced out of California committees, and the Texas and California Senates passed bills to amend their state’s data broker laws.

Below is the sixteenth weekly update on the status of proposed state privacy legislation in 2025. As always, the contents provided below are time-sensitive and subject to change.

Table of Contents

1. What’s New
2. AI Bills
3. Bill Tracker Chart

1. What’s New

It was a busy week across a broad range of topics and states.

First, the Alabama Personal Data Protection Act (HB 283) unanimously passed the state House on April 22. The bill is now with the Senate Committee on Fiscal Responsibility and Economic Development. The Alabama legislature closes May 15.

In Colorado, an amended SB 276 passed the Senate on April 21. As currently drafted, the bill amends the Colorado Privacy Act’s (CPA) definition of sensitive data to include precise geolocation data. The CPA is the only Washington Privacy Act model bill that does not include precise geolocation data in its definition of sensitive data. The bill also amends the CPA to provide that a controller cannot sell a consumer’s sensitive data without first obtaining consent.

Oklahoma’s consumer data privacy bill (SB 546) advanced out of the House Commerce and Economic Development Oversight committee on April 24 by a 15-2 vote. The bill already passed the Senate in late March.

In Pennsylvania, HB 78 (consumer data privacy) was amended and recommitted to the Appropriations committee.

In Tennessee, the legislature closed without passing SB 663 / HB 630. Those companion bills would have amended the state’s consumer data privacy law to require controllers to recognize universal opt out mechanisms.

There was also a flurry of activity with California bills last week:

• SB 361 (data broker registration amendments) unanimously passed the Senate on April 24 and is now with the Assembly.
• AB 566 (opt-out preference signal) passed out of the Assembly Appropriations committee, was read for a second time, and ordered to a third reading.
• AB 1043 (age verification signals) passed out of the Privacy and Consumer Protection committee. The bill was then amended and re-referred to the Judiciary committee.
• SB 44 (brain-computer interfaces; neural data) passed out of the Senate Judiciary committee and was re-referred to the Appropriations committee.
• AB 1355 (location privacy) passed out of the Assembly Privacy and Consumer Protection committee and was re-referred to the Judiciary committee where it is set for an April 29 hearing.

Turning to children’s privacy bills, Arkansas Governor Huckabee Sanders signed the three children’s privacy-related bills that passed the legislature last week into law – HB 611, HB 612, and HB 1717. You can read our summary of HB 1717 – the Arkansas Children and Teens’ Online Privacy Protection Act – here.

On the other hand, Colorado Governor Polis vetoed SB 86 (social media). The Senate voted 29-6 to override the veto on April 25.

In Florida, SB 868 (social media use by minors) passed the Senate on April 24 while, in South Carolina, two social media bills were favorably reported out of a Senate committee – S268 and H3431. H3431 previously passed the House.

We also saw three bills advance in Texas. An amended SB 2420 (app store age verification) passed out of a House committee. The bill already passed the Senate. SB 2881 and SB 1860 passed the Senate on April 24. The bills amend the SCOPE Act.

Finally, turning to data broker bills, Texas SB 2121 unanimously passed the Senate on April 24. The bill changes the definition of “data broker” to broaden its applicability. Specifically, it removes the requirement that the business entity’s principal source of revenue come from transferring personal data it did not collect directly from the individual.

2. AI Bills

Our latest edition of Byte Back AI is now available to subscribers. Subscriptions start as low as $50/month. In this edition, we provide:

• Updates on new laws enacted in Maryland, Arkansas, North Dakota, and West Virginia, bills passing out of the legislatures in Montana and Tennessee, and bills crossing chambers in Nevada, South Carolina, Florida, Montana, and Texas.
• A summary of last week’s hearing from the California Assembly’s Privacy and Consumer Protection committee.
• Our special feature this week – a summary of the Texas Responsible AI Governance Act (HB 149).
• Our “three things to know this week.”
• An updated state AI bill tracker chart.

Click here for more information on paid subscriptions.

3. Bill Tracker Chart

For more information on all of the privacy bills introduced to date, including links to the bills, bill status, last action, and hearing dates, please see our bill tracker chart.