Proposed State Privacy Law Update: January 13, 2025
Keypoint: The 2025 state legislative cycle begins with lawmakers introducing twenty-three bills, including five state consumer data privacy bills.
We are back for our sixth year of tracking proposed state privacy legislation and fifth year of providing weekly updates. As in past years, we will track proposed state privacy legislation through these weekly updates and our forthcoming state privacy law tracker map.
In this year’s weekly updates, we will continue to track proposed bills concerning consumer data, children’s data, biometric data, consumer health data, and data brokers.
With the explosion of AI-related state bills (nearly 500 bills filed last year) and the significant resources necessary to track those bills, we have moved our coverage of those bills to a separate paid weekly newsletter – Byte Back AI. In Part 2, below, we provide more information on this week’s newsletter, which includes updates on dozens of new bills introduced last week and a summary of a new algorithmic discrimination bill with a private right of action.
We also made one structural change to our bill tracker charts this year. We combined our various tracker charts into a single chart and added a column identifying the bill’s category.
Now to our first weekly update. As always, the contents provided below are time-sensitive and subject to change. If you are not already subscribed to our blog, consider doing so to stay updated.
Table of Contents
- What’s New
- AI Bills
- Bill Tracker Chart
____________
1. What’s New
Last week, the legislatures in over twenty states opened or reconvened while another fifteen state legislatures will open this coming week. As legislatures have opened across the country, we have quickly seen lawmakers in several states introduce bills.
With respect to consumer data privacy bills, lawmakers have already filed bills in five states: Massachusetts (SD 267), New Hampshire (HB 195), New York (A257 and A974), Oklahoma (HB 1012), and Pennsylvania (HB 78).
The New Hampshire bill is of note given that New Hampshire’s consumer data privacy law just went into effect on January 1. This bill prohibits third party providers from disclosing personal information of individuals to anyone unless the individual consented, the disclosure is necessary to prevent criminal or fraudulent conduct, it is an emergency, or the disclosure is made to government entities (under certain conditions). Third party providers include entities such as utilities, streaming services, social media services, banks and financial institutions, insurance companies, and credit card companies. New Hampshire’s legislature opened January 8.
In Oklahoma, Representative Josh West has again filed the Oklahoma Computer Data Privacy Act. A version of this bill has been filed each year we have tracked state data privacy legislation with the bill originally being co-authored by Collin Walke. Oklahoma’s legislature opens February 3.
In Pennsylvania, Representative Ed Neilson’s bipartisan HB 78 is likely a refiling of last year’s HB 1201, although the text of this year’s bill is not yet available to confirm. Last year’s bill passed the Democrat-controlled House but failed to make it out of the Republican-controlled Senate. Each party retained control of its chamber during the 2024 election. Pennsylvania’s legislature opened January 7.
As noted, to date, two consumer data privacy bills have been introduced in New York. For reference, last year, Senator Thomas’ New York Privacy Act (S365) passed the Senate but did not make it out of the Assembly. Senator Thomas is no longer a member of the Senate. A257 is this year’s “right to know” act, which allows New York residents to obtain certain information regarding their personal information. A version of this bill has been filed in every session since 2015. A974 is this year’s version of the New York Data Protection Act. A version of this bill was filed last session and died in committee. That bill is a broader consumer data privacy bill with data broker registration provisions. Last year we tracked ten consumer data privacy bills filed in New York so it is probable that we will see more bills filed in New York in the coming weeks. The New York legislature opened January 8.
Given that this is our first post of the year, it is also worth discussing the potential for forthcoming bills.
In Vermont, Representative Priestley has publicly-stated that she intends to refile her consumer data privacy bill. Last year’s bill failed after the Senate refused to override the governor’s veto. The Vermont legislature opened January 8.
In Michigan, Democrat Senator Bates’ SB 659 passed the Senate in December but could not make it out of the House before the legislature closed. The Republicans flipped the Michigan House during last year’s election, breaking the state’s Democrat trifecta.
We also will be keeping a close eye on Maine and Georgia to see if lawmakers refile bills this year. The Maine legislature is already in session while the Georgia legislature opens January 13. Of note, Democrats still control the Maine House and Senate but their majority narrowed in both chambers as a result of the last election.
Turning from new bills to amendments, Virginia lawmakers introduced four bills seeking to amend the VCDPA. Delegate Maldonado’s HB 2250 would make numerous amendments to the VCDPA, including modifications to the definition of sensitive data and biometric data and changes to the children’s privacy and opt-out provisions. The bill also creates a new chapter of Virginia law called the Artificial Intelligence Training Data Transparency Act. In addition, lawmakers introduced SB 783 (children’s privacy amendments), HB 2043 (adding a private right of action), and SB 769 (requiring express consent for cookies).
Finally, Virginia lawmakers introduced three bills seeking to regulate social media companies – companion bills HB 1624 and SB 854 and, separately, HB 1817. Virginia’s legislative session started January 8. These bills will need to move quickly as the session lasts only around six-and-a-half weeks, closing February 22.
Moving on, in South Carolina, lawmakers introduced two children’s privacy bills (H 3402 and H 3400) and a social media bill (H 3431). South Carolina’s legislature opened January 8.
Turning to biometric privacy bills, Missouri lawmakers introduced two identical bills (H 407 and H 500). A biometric privacy bill also was filed in New York (S1422).
Finally, New York lawmakers introduced three health privacy bills – S555, A1415, and S929. A prior version of S929 passed the Senate last year.
2. AI Bills
Our latest edition of Byte Back AI is now available to subscribers. Subscriptions start as low as $50/month. In this edition, we provide:
- A huge update on dozens of new AI bills filed last week across fifteen states, including New York, California, Illinois, Massachusetts, Washington, Connecticut, and Virginia.
- Our latest AI state bill tracker chart. We are now tracking over 100 state AI bills.
- Our special feature of the week – a summary of the New York AI Act. The Act, which was filed last week, is the most-consumer friendly algorithmic discrimination bill proposed to date and includes a private right of action.
Click here for more information on paid subscriptions.
3. Bill Tracker Chart
For more information on all of the privacy bills introduced to date, including links to the bills, bill status, last action, and hearing dates, please see our bill tracker chart.
