Proposed State Privacy Law Update: March 17, 2025

Keypoint: It was a busy week with the Kentucky legislature passing a bill to amend the state’s consumer data privacy law, bills crossing chambers in Vermont, Washington and Arkansas, and movement with bills in numerous other states.

Below is the tenth weekly update on the status of proposed state privacy legislation in 2025. As always, the contents provided below are time-sensitive and subject to change.

Table of Contents

1. What’s New
2. AI Bills
3. Bill Tracker Chart

1. What’s New

Kentucky is well on its way to tweaking its consumer data privacy law. HB 473 unanimously passed the Senate on March 12 and was delivered to the governor. The bill amends Kentucky’s law to add a healthcare-related exemption and make technical changes.

In Vermont, an amended version of S.71 passed the Senate prior to the deadline for bills to cross chambers. However, prior to passing, the bill’s text was struck and replaced with the text in S.93.

Maine lawmakers will again try to pass a consumer data privacy law with the introduction of the Maine Consumer Data Privacy Act (LD 1088 / HP 710). The bill is now with the House Judiciary committee. Last year’s legislation failed to pass with the Senate voting down a controversial House-passed bill.

In Texas, Democrat Representative Bhojani introduced a bill (HB 5495) to amend the Texas Data Privacy and Security Act to require controllers to treat a global privacy control as a valid request to “not sell, share, or disclose the consumer’s personal data.” It also requires controllers that operate Internet web browsers to enable the browser to automatically recognize and comply with a consumer’s global privacy control choices.

In California, AB 364 was amended to add data localization provisions. The bill now requires businesses to keep consumers’ personal information in the United States unless the business has informed a consumer of the risks associated with maintaining their personal information outside the United States, the consumer has “explicitly consented” (undefined) to the transfer, and the personal information is not health care information, financial information, or geolocation data. The bill also prohibits businesses from maintaining personal information that is health care information, financial information, or geolocation data in the custody of a foreign government or a third party that is owned or controlled by a foreign government.

Turning to children’s privacy bills, Arkansas’ HB 1717 (the Arkansas Children and Teens’ Online Privacy Protection Act) unanimously passed the House on March 13. It is now with the Senate Judiciary committee. Meanwhile, two bills were with withdrawn (HB 1082 and HB 1083).

Moving north, Vermont’s Age-Appropriate Design Code Act (S.69) passed the Senate on March 13. On that same day, the United States District Court for the Northern District of California issued an Order granting NetChoice’s second motion for preliminary injunction, concluding that the remainder of California’s Age-Appropriate Design Code Act is unconstitutional.

In Washington, the deadline for bills to cross chambers passed on March 12. Only one of the four bills we have been tracking – SB 5708 (children’s privacy) – made the deadline. Prior to being voted out of the Senate, that bill was significantly amended to restrict its application to addictive internet-based services or applications.

In Tennessee, HB 825 (Teen Social Media and Internet Safety Act) was recommended for passage by a House subcommittee.

In Connecticut, HB 6857 (social media) was unanimously voted out of the General Law Committee on March 12.

Last, three new bills were introduced in Texas. Senator Hughes introduced a bill (SB 2881) to amend the Texas SCOPE Act. Meanwhile, companion bills were introduced in the Senate (SB 2420) and House (HB 4901) to require app stores to verify users’ age.

Turning to data broker bills, Texas SB 2121 was introduced on March 10. The bill changes “data broker” to “business entity” in the law’s applicability standard.

Moving to health data privacy bills, a group of Rhode Island Senators introduced the Reproductive Freedom and Gender-Affirming Care Health Data Privacy Act (S 824) on March 14. The bill appears to be a companion bill to H 5857.

Finally, a new location data privacy bill was introduced in Rhode Island (HB 6062).

2. AI Bills

Our latest edition of Byte Back AI is now available to subscribers. Subscriptions start as low as $50/month. In this edition, we provide:

• A rundown of the status of the Maryland AI bills as we hit the March 17 deadline for bills to cross chambers.
• Updates on AI bills in numerous states, including bills passing the legislatures in South Dakota and Kentucky and crossing chambers in Arizona, Kansas, Maryland, New York, and Texas.
• Summaries of hearings on bills in Maryland (name, image, likeness) and Georgia (government).
• Our “three things to know this week.”
• An updated state AI bill tracker chart.

Click here for more information on paid subscriptions.

3. Bill Tracker Chart

For more information on all of the privacy bills introduced to date, including links to the bills, bill status, last action, and hearing dates, please see our bill tracker chart.