Data brokers and people-search laws by state

AB 883: Data brokers: accessible deletion mechanism: deletion of personal information of elected officials and judges.

Data brokers must access the accessible deletion mechanism at least once every 30 days, process all deletion requests within 30 days, and delete all personal information of consumers making requests. The Secretary of State, local filing officers, and Judicial Council must notify elected officials and judges they may request deletion of their personal information.

Takes effect 1 January 2027

SB 361: Data brokers: data collection and deletion.

Data brokers must register annually with the California Privacy Protection Agency and provide detailed information about personal data collected, including names, dates of birth, government IDs, biometric data, and whether data was shared with foreign actors, the federal government, law enforcement, or GenAI developers. Data brokers must access the accessible deletion mechanism at least every 45 days and process deletion requests within 45 days.

H.R. 2808: Homebuyers Privacy Protection Act

Consumer reporting agencies may not furnish a consumer report based on a prescreening request connected to a residential mortgage loan unless the recipient is a firm offer of credit or insurance and either has consumer authorization, originated or services the consumer's current mortgage, or is an insured depository institution or credit union holding the consumer's current account.

SB 32: An act to amend title 11 of the delaware code relating to privacy for correctional officers, and probation and parole officers.

Amends Senate Bill No. 32 to require intentional communication for prohibited conduct, limit restrictions to publicly posted or displayed personal information, remove prohibitions on transferring correctional officers' personal information, and narrow the private right of action to publicly posted or displayed information.

HB 199: Courts; protection of personally identifiable information of judges and their spouses; modify provisions

State or local government entities must restrict from public disclosure personally identifiable information of protected persons (current or former judges and justices of the United States, this state, or any county or municipality, and their spouses) upon written notice from the Administrative Office of the Courts or upon written request by the protected person, within 30 days of receipt.

HB 662: AN ACT relating to personally identifiable information.

Government agencies must not disclose personally identifiable information of covered persons (judicial officers and their immediate family members) if the covered person makes a written request. Upon receipt of such request, agencies must remove the information from publicly available content within seventy-two hours and must not subsequently post or release it unless the covered person voluntarily publishes it.

A 5328: Regulates data brokers, data collectors, and collection and dissemination of certain sensitive information.

Controllers of commercial Internet websites or online services must not sell sensitive data. Data brokers and data collectors must annually register with the Division of Consumer Affairs, pay registration fees, and submit specified information including data collection practices, opt-out methods, breach history, and practices specific to persons under 18.

HB 2289: Judicial and elected official security and privacy; creating the Oklahoma Elected Official and Judicial Security and Privacy Act of 2025; effective date; emergency.

State agencies must not publicly post or display covered information of at-risk individuals or their immediate families. Upon written request, state agencies must remove such covered information from publicly available content within seventy-two hours. At-risk individuals may file notice with state agencies to mark their covered information as private.

Took effect 1 July 2025

SB 1587: Relating to data brokers; and prescribing an effective date.

A public body may not disclose personally identifiable information to a data broker unless the data broker first provides written attestation that the information will not be sold or transferred to any entity that will use it to enforce federal immigration law. A public body must reject attestations it reasonably believes contain material misrepresentations, falsehoods, or omissions.

HB 7640: An act relating to courts and civil procedure--courts -- court administration

State, county, and municipal agencies must remove personal information of protected individuals and immediate family members from public content within 72 hours of written notice and cannot publicly post such information without written permission. Data aggregators and persons must remove such information from publicly available content within 10 business days and cannot sell, license, or provide it for consideration.

HB 5892: An act relating to courts and civil procedure -- courts -- court administration

State, county, and municipal agencies must remove and not publicly post personal information of protected individuals and immediate family members within 72 hours of receiving written notice. Data aggregators and other persons must not sell or provide such personal information and must remove it from public websites within 10 business days of written request.

Took effect 1 January 2026

S 126: Law Enforcement Personal Privacy Protection and Judicial Personal Privacy Protection

State and local government agencies must restrict personal contact information of active or former law enforcement officers and judges from publicly available internet websites upon submission of a designated form and notarized affidavit. Restricted information must remain in official records but not appear in indexes or images displayed online, with limited exceptions for subpoena, court order, or consent.

Took effect 1 January 2026

HB 5081: Relating to the protection of personal identifying information of certain individuals in the judicial system; creating a criminal offense.

A person may not knowingly sell, license, trade, transfer, or disseminate covered information of at-risk individuals or their immediate family members after receiving a written request to stop. A person may not publicly post or display such covered information on a publicly accessible Internet website after receiving a written request. A person other than a data broker must remove covered information from websites within 10 business days of receiving a removal request.

Took effect 1 September 2025

SB 1343: Relating to the notice requirements of a data broker registration statement and Internet website.

A data broker that maintains an Internet website or mobile application must post a conspicuous notice stating the entity is a data broker, clear and not misleading, readily accessible including to individuals with disabilities, containing language provided by rule of the secretary of state, and informing consumers how to exercise consumer rights under Chapter 541. A data broker's registration statement must include a link to a page providing consumers with prominent instructions on how to exercise consumer rights under Section 541.051 and other applicable data privacy rights under Chapter 541.

Took effect 1 September 2025

SB 2121: Relating to the regulation of certain business entities that act as data brokers.

Amends the definition of data broker to mean a business entity that collects, processes, or transfers personal data not collected directly from the individual to whom it is linked. A data broker is subject to this chapter if it derives more than 50 percent of revenue from processing or transferring such personal data, or processes personal data of more than 50,000 individuals, in a 12-month period.

Took effect 1 September 2025

SB 290: Victim and Witness Privacy Amendments

Law enforcement agencies and prosecuting agencies must establish policies ensuring nonpublic victim or witness data is used solely for legitimate law enforcement and prosecutorial purposes and maintained in a controlled environment protecting victim or witness privacy. Defendants' attorneys may access such data through virtual rooms, facility viewing, or court-ordered copies subject to protective orders and restrictions.

Took effect 6 May 2026

H 211: An act relating to data brokers and personal information

Providers of educational technology products must register with the Secretary of State and report the name and addresses of the provider, privacy policies and terms of conditions for each product, schools where products operate under paid contracts, product names and descriptions, and attestation that products meet student privacy standards and federal and state privacy laws.

SB 169: Relating to: privacy protections for judicial officers.

Government agencies, businesses, associations, and data brokers must not publicly post or display personal information of judicial officers who submit written requests, except as specified. Providers of public-facing land records websites must establish opt-out processes for judicial officers' names. Registers of deeds must shield electronic recorded documents specifically identified by judicial officers.