Keypoint: Last week, the Utah and Virginia governors took action on bills while bills crossed chambers in Montana, Oklahoma, New Hampshire, Vermont, and West Virginia.
Below is the twelfth weekly update on the status of proposed state privacy legislation in 2025. As always, the contents provided below are time-sensitive and subject to change.
Table of Contents
- What’s New
- AI Bills
- Bill Tracker Chart
1. What’s New
It was a busy week with governors signing bills into laws and multiple bills crossing chambers.
We begin in Utah where the governor signed both SB 142 (App Store Accountability Act) and HB 418 (right to correct; social media) into law. The governor also signed several AI-related bills, which we cover in Byte Back AI.
In Virginia, Governor Youngkin approved SB 754, which amends Virginia’s Consumer Protection Act (a different law than the VCDPA) to prohibit “obtaining, disclosing, selling, or disseminating any personally identifiable reproductive or sexual health information without the consent of the consumer.” The bill defines “consent” by reference to the VCDPA’s definition. Virginia’s consumer protection statute allows “any person who suffers loss as the result of a violation of this chapter . . . to initiate an action to recover actual damages, or $500, whichever is greater. If the trier of fact finds that the violation was willful, it may increase damages to an amount not exceeding three times the actual damages sustained, or $1,000, whichever is greater.” A litigant also may recover reasonable attorneys’ fees and court costs. The law goes into effect July 1, 2025. (Thanks to Keir Lamont for pointing out the PRA connection.)
The governor also made a governor’s recommendation on SB 854 (social media). The bill is now back with the legislature to consider that recommendation.
In Montana, an amended SB 297 unanimously passed through a House committee on March 27. The bill amends Montana’s existing data privacy law. Meanwhile, an amended SB 163 unanimously passed the House on March 26. The bill amends Montana’s Genetic Information Privacy Act to add neurotechnology data.
In Oklahoma, SB 546 unanimously passed the Senate on March 26. It is a Virginia-style consumer data privacy bill. The House passed HB 1275 (social media) on March 25. That bill contains a private right of action. Oklahoma’s cross over deadline was March 27. The remaining bills we have been tracking did not meet that deadline.
In New Hampshire, an amended HB 195 passed the House on March 26. The bill creates privacy obligations for “third party providers of information and services.”
The West Virginia Consumer Credit and Protection Act (HB 2987) passed the House on March 26. It is now with the Senate Judiciary committee.
Finally, Vermont‘s consumer data privacy bill (S.71) passed the Senate on March 27. This is a correction as we reported two weeks ago that this bill had crossed chambers.
Looking forward, the Georgia legislative session will close on April 3. The Georgia Consumer Privacy Protection Act (SB 111), which previously passed the Senate, is currently pending in the House.
In California, several bills were are tracking were amended last week. Of note, AB 1043 was amended and now deals with the receipt of age signals. AB 1137 no longer deals with generative AI disclosures and instead now deals with reporting CSAM on social media platforms. Meanwhile, AB 940 was amended and no longer relates to privacy.
In Minnesota, SF 2940 and HF 2700 were introduced to modify Minnesota’s recently-passed data privacy law. Among other changes, the bills include health data as a category of sensitive data (and define the term), modify the sensitive data opt-in and sale provisions, modify the applicability requirements around sensitive data, and remove the small business exemption.
In North Carolina, a group of senators introduced the North Carolina Consumer Privacy Act (SB 757). The bill is similar to Utah’s pre-amended law. Two other groups of Senators introduced the Children’s Online Safety Act (SB 722) and the Social Media Algorithmic Control in Information Technology Act (SB 514).
Wisconsin is once-again considering a consumer data privacy law with the introduction of SB 166. Last year’s bill passed the Assembly but failed in the Senate.
Finally, another consumer data privacy bill was introduced in Maine (LD 1224).
Turning to data broker bills, Texas’ SB 1343 passed the Senate on March 26. The bill amends the disclosure obligations in Texas’ data broker law to require data brokers to provide information on how consumers can exercise their rights.
Finally, the Kentucky legislature closed on March 28. HB 12 (social media) did not pass this year.
2. AI Bills
- Updates on new laws enacted in Mississippi, Kentucky, South Dakota, and Utah, a bill passing the Montana legislature, and bills crossing chambers in Georgia, North Carolina, Oklahoma, Texas, and New York.
- A summary of the California Senate Governmental Operations committee covering SB 53 (whistleblower protections) and SB 579 (AI in mental health workgroup).
- Our special feature this week – a summary of New York’s AI Companion Models bill, which passed the New York Assembly this week.
- Our “three things to know this week.”
- An updated state AI bill tracker chart.
3. Bill Tracker Chart
For more information on all of the privacy bills introduced to date, including links to the bills, bill status, last action, and hearing dates, please see our bill tracker chart.
