Comprehensive consumer privacy laws by state

HB 351: Data privacy; processing of data regulated, consumer actions related to data authorized

Amends Alabama data privacy law by revising definitions of key terms including biometric data, consumer, personal data, sensitive data, and sale of personal data, and clarifies exemptions for political subdivisions and public corporations.

Takes effect 1 May 2027

SB 1193: personal identifying information; disclosure; prohibition

The Department may not sell personal identifying information of individuals whom it licenses or certificates under Title 36 or Title 32. The Department may not sell or disclose personal identifying information of emergency medical care technicians, except with the technician's consent, or when de-identified, aggregated, or shared with regulatory entities or for disciplinary disclosures.

HB 1148: To create the arkansas privacy act; and to address certain images captured by unmanned aircraft systems.

This amendment modifies the Arkansas Privacy Act by expanding exceptions for unmanned aircraft systems used by emergency agencies, law enforcement, and search and rescue operations, and clarifies provisions related to image capture during official duties and crime scene investigation.

AB 2561: Operating systems and applications: privacy settings.

An operating system or an application must configure a user's default privacy setting to be the most privacy protective setting offered. An operating system or an application must not undo a user's affirmative configuration of a privacy setting without the user's consent.

Takes effect 1 January 2027

SB 354: Insurance Information and Privacy Protection Act.

Licensees, surplus line insurers, reinsurers, and third-party service providers must collect only personal information reasonably necessary for insurance transactions, provide clear privacy notices, obtain consumer consent for non-transaction uses, retain records per written policies, and prohibit retaliation against consumers exercising privacy rights.

Takes effect 1 January 2027

SB 923: Consumer privacy requests: deletion request records and request submission methods.

Businesses must delete any personal information about a consumer upon verifiable request, regardless of source. Businesses that obtained information from third parties may instead retain only a deletion request record and minimum data necessary to ensure deletion and prevent reuse. Businesses operating exclusively online with direct consumer relationships must provide both an email address and an online method like a web form for submitting deletion requests.

Takes effect 1 January 2027

AB 566: California Consumer Privacy Act of 2018: opt-out preference signal.

Beginning January 1, 2027, a business that develops or maintains a browser must include functionality configurable by a consumer that enables the browser to send an opt-out preference signal to businesses. The functionality must be easy for a reasonable person to locate and configure. The business must disclose in public materials how the opt-out preference signal works and its intended effect.

AB 656: Account cancellation.

Social media platforms generating more than one hundred million dollars per year in gross revenues must provide a clear and conspicuous "Delete Account" button in their settings menu accessible across all formats. Platforms must not obstruct account deletion using dark patterns and must process deletion requests as CCPA personal information deletion requests.

SB 446: Data breaches: customer notification.

An individual or business that owns or licenses computerized data including personal information must disclose a breach to affected California residents within 30 calendar days of discovery or notification, unless delayed for law enforcement needs or to determine breach scope. Businesses must notify the Attorney General within 15 calendar days if the breach affects more than 500 California residents.

SB 4: An act concerning consumer privacy and protection.

Appropriates additional dollars from the General Fund to the office of the Attorney General for the fiscal year ending June 30, 2027, to enforce the state's laws concerning consumer privacy.

SB 1295: An act concerning broadband internet, gaming, social media, online services and consumer contracts.

Qualified broadband internet access service providers must offer affordable broadband service costing no more than forty dollars monthly to eligible households by October 1, 2026, meeting minimum speed requirements of 100 Mbps downstream and 5-20 Mbps upstream depending on date. Providers must make commercially reasonable efforts to publicize availability and submit annual reports to the Department of Energy and Environmental Protection.

Took effect 1 July 2026

HB 380: An act to amend title 6 of the delaware code relating to personal data privacy.

Controllers must not disclose sensitive data in a sale of personal data unless the disclosure is strictly necessary to provide a requested product or service, the controller provides clear notice identifying the sensitive data categories and third parties, obtains consumer consent, and maintains a consent record for 5 years.

SB 111: "Georgia Consumer Privacy Protection Act"; enact

Amends the definition of 'rural hospital organization' for tax credit purposes by revising eligibility criteria, including changing the indigent care threshold from 10 percent to 5 percent of annual net revenue and adding a requirement for three-year average patient margin performance.

HB 1753: Relating to social media.

Covered social media platforms with one million or more monthly active users nationwide or $25,000,000 or more in annual gross revenues must provide users an accessible method to request account deletion and must archive and delete all personal and sensitive personal information within ninety days of a confirmed deletion request. Platforms must not design interfaces or processes that obscure, delay, or make deletion requests more difficult.

HB 692: AN ACT relating to data privacy.

Amends Kentucky's data privacy law by adding definitions for biometric data, automatic content recognition, smart monitors, and sensitive data categories including automatic content recognition data, and reorders existing definitions. Takes effect July 1, 2027.

Takes effect 1 July 2027

HB 473: AN ACT relating to consumer data privacy.

Controllers that conduct business in Kentucky and control or process personal data of at least 100,000 consumers, or 25,000 consumers while deriving over 50% of gross revenue from selling personal data, must conduct and document data protection impact assessments for targeted advertising, selling personal data, profiling with reasonably foreseeable risks, sensitive data processing, and other heightened-risk processing.

SB 386: IDENTITY DATA: Provides for opting out of providing personal information on social media websites. (1/1/27)

HB 711: Data Privacy - Consumer Data, Public Records, and Message Switching System (Data Privacy Act)

Controllers may not sell personal data of consumers if they knew or should have known the purchaser seeks to use it for immigration enforcement. Custodians of public records must take reasonable steps to determine whether access is sought for immigration law enforcement and must deny access unless presented with a valid warrant. Entities operating message switching systems must deny access for immigration enforcement purposes without a valid warrant.

Took effect 1 July 2026

HB 264: Maryland Data Privacy and Protection Act of 2026

Units of State government must collect personal information only for legitimate government purposes, keep it accurate and current, and securely delete or de-identify it when no longer needed. Each unit must designate a Privacy Officer, post privacy notices on its website consistent with Department of Information Technology guidelines, and by July 1, 2026, develop procedures preventing sale and redisclosure of personal records and geolocation data.

Took effect 1 October 2026

HB 895: Food Retailers and Third-Party Delivery Service Providers - Dynamic Pricing and Personal Data (Protection From Predatory Pricing Act)

Food retailers and third-party food delivery service providers may not engage in dynamic pricing or use surveillance personal data to set higher prices for food exempt from sales tax. They may not use protected class data to offer, advertise, or sell goods or services in ways that withhold accommodations or advantages from consumers. Merchants using dynamic pricing or personal data to set prices must include a clear and conspicuous disclosure stating the price was set by algorithm or personal data. Food retailers may not diminish rights under existing collective bargaining agreements without negotiation and mutual agreement.

SB 297: Generally revise privacy laws

Controllers must limit personal data collection to what is adequate and necessary, establish data security practices, provide privacy notices disclosing categories of data and processing purposes, and comply with consumer requests to access, correct, delete, or port personal data within 45 days. Controllers must obtain consent before processing sensitive data or processing minors' data for targeted advertising, sales, or profiling.

A 5328: Regulates data brokers, data collectors, and collection and dissemination of certain sensitive information.

Controllers of commercial Internet websites or online services must not sell sensitive data. Data brokers and data collectors must annually register with the Division of Consumer Affairs, pay registration fees, and submit specified information including data collection practices, opt-out methods, breach history, and practices specific to persons under 18.

A 4070: Establishes "Privacy Protection Act"; concerns collection and sharing of certain personal information.

Government entities and health care facilities must not request or collect immigration status, citizenship status, place of birth, social security number, or individual taxpayer identification number except when necessary to assess eligibility for or administer public services, benefits, programs, or professional qualifications or licenses, or as required by state or federal law. Government entities must not sell, share, or transfer automated license plate recognition information except to other government entities, pursuant to judicial order or warrant, or to law enforcement agencies for criminal investigations under specified conditions.

SB 36: Sensitive personal information nondisclosure

State agency employees shall not intentionally disclose sensitive personal information acquired through their position outside the state agency, except when necessary to carry out agency functions, comply with court orders or subpoenas, comply with public records law, comply with federal statute, made in judicial proceedings, made to contractors with written restrictions, made under whistleblower protection, permitted by HIPAA, or made with written consent.

SB 546: Data privacy; establishing consumer rights; appeal process; privacy notice; data protection assessments; penalties; liability. Effective date.

Controllers must limit personal data collection to what is adequate and necessary, establish reasonable data security practices, provide accessible privacy notices, and comply with authenticated consumer requests to access, correct, delete, port, or opt out of personal data processing. Controllers must not process sensitive data without consent or discriminate against consumers exercising these rights.

Takes effect 1 January 2027

SB 626: Security Breach Notification Act; requiring notice of security breach of certain information; modifying provisions. Effective date.

Took effect 1 January 2026

SB 1121: Relating to the disclosure of private information; and declaring an emergency.

Persons conducting business in Oregon that control or process personal data of 100,000 or more consumers annually, or 25,000 or more consumers while deriving 25 percent or more annual revenue from selling personal data, must comply with ORS 646A.570 to 646A.589. Numerous exemptions apply to public bodies, health information, financial institutions, insurers, and media entities.

SB 111: require that social media companies provide collected personal data of a user at the user's request and maintain transparent interoperability interfaces.

Social media companies operating services with more than one hundred million active monthly users and whose primary focus is not charity or religion must provide users' personal data in portable, readily usable format upon request and implement transparent, third-party-accessible interoperability interfaces allowing users to export social graph data in machine-readable format using publicly available technical standards free from licensing fees and patent restrictions.

Took effect 1 July 2026

HB 261: Electronic Information Privacy Act Amendments

Law enforcement agencies may obtain, use, copy, or disclose electronic information or records only through procedures specified in this chapter, including search warrants for location information, stored data, transmitted data, and subscriber records. Law enforcement agencies must not contract with third parties to obtain such information in ways prohibited for direct access.

Took effect 6 May 2026

HB 450: Data Privacy Amendments

Governmental entities must initiate a data privacy program by December 31, 2025, obtain only minimum necessary personal data, comply with Part 4 duties, and identify non-compliant processing activities by July 1, 2027. Governmental entities may not establish undisclosed surveillance, sell personal data unless required by law, or share personal data unless permitted by law.

Took effect 6 May 2026

HB 444: Data Privacy Amendments

Governmental entities must initiate a data privacy program by December 31, 2025, obtain only minimum necessary personal data, and comply with privacy requirements for new processing activities immediately and existing activities by July 1, 2027. State agencies must create privacy annotations for record series containing personal data by July 1, 2027. Employees with personal data access must complete data privacy training within 30 days of employment and annually.

S 71: An act relating to consumer data privacy and online surveillance

Controllers must limit personal data collection to what is reasonably necessary, establish data security practices, and provide consumers rights to access, correct, delete, and port their data. Controllers must obtain consent before selling consumer health data and cannot use geofences within 1,750 feet of health care facilities to track consumers.

Took effect 1 July 2026

SB 338: Consumer Data Protection Act; data controller responsibilities, precise geolocation data.

HB 2606: Concerning performance measures, duties, and reporting requirements for the office of privacy and data protection.

The office of privacy and data protection must prepare and submit to the legislature a report by December 1, 2016, and every four years thereafter evaluating its performance using specified measures including improvement of privacy policies by state agencies, coordination with experts, public contacts data, training results, technical assistance requests, staff continuing education, and privacy analyses completed.