New Data Privacy laws 2027: state data privacy laws taking effect in 2027

• 1 January 2027

  California AB 1159: Student personal information.

  Requires operators of websites, apps, and online services used for K-12, preschool, or higher education to protect student personal information and prohibits using student data to train artificial intelligence systems.

  Some duties start later: the text names an operative date.

• 1 January 2027

  California AB 1331: Workplace surveillance.

  Requires employers to prohibit workplace surveillance tools in bathrooms, locker rooms, changing areas, and lactation spaces, and allows workers to leave surveillance devices behind when entering these areas and public bathrooms or during off-duty hours.

• 1 January 2027

  California AB 1798: Genetic testing for life and disability insurance.

  Life and disability insurers cannot cancel, limit, deny, or base underwriting decisions on genetic information or test results, except under specified criteria.

• 1 January 2027

  California AB 1883: Workplace surveillance tools.

  Requires employers to stop using workplace surveillance tools with artificial intelligence that collect neural data, recognize emotional states, make inferences based on gait, or identify protected characteristics, with exceptions for federal defense and security purposes.

• 1 January 2027

  California AB 2448: Medical information: confidentiality.

  Requires businesses that electronically store medical information to limit access to and segregate records related to gender affirming care, abortion services, and contraception.

• 1 January 2027

  California AB 2561: Operating systems and applications: privacy settings.

  Prohibits operating systems and applications from reversing a user's privacy setting choices without the user's consent.

• 1 January 2027

  California AB 883: Data brokers: accessible deletion mechanism: deletion of personal information of elected officials and judges.

  Requires data brokers to process deletion requests from the California Privacy Protection Agency within 30 days and authorizes attorneys to sue data brokers on behalf of elected officials and judges for violations.

  Some duties start later: the text names an operative date.

• 1 January 2027

  California SB 1114: Data collection: sexual orientation, gender identity, and intersex status: disclosure.

  Requires state agencies and public universities to keep confidential information about sexual orientation, gender identity, and intersex status, prohibiting disclosure outside state government except under specified exceptions.

• 1 January 2027

  California SB 354: Insurance Information and Privacy Protection Act.

  Requires insurance licensees, surplus line insurers, reinsurers, and third-party service providers to provide privacy notices, obtain consumer consent, and allow consumers to access or delete personal information starting 1 July 2028.

  Some duties start later: the text names an operative date.

• 1 January 2027

  California SB 923: Consumer privacy requests: deletion request records and request submission methods.

  Requires businesses to let consumers request deletion of all personal information collected about them and permits businesses to retain records of deletion requests and minimum necessary data to prevent unauthorized reuse.

• 1 January 2027

  California SB 930: Student Test Taker Privacy Protection Act: end-to-end encryption.

  Requires businesses providing proctoring services to school districts, county offices of education, or charter schools for classroom or course-based exams to use end-to-end encryption beginning 1 July 2027.

• 1 January 2027

  South Carolina H 4591: Stop Harm from Addictive Social Media

  Requires covered social media platforms to estimate and verify user ages, establish default settings for young users, and obtain parental consent for certain account holders.

• 1 January 2027

  Utah HB 357: Amendments to Motor Vehicle Data Privacy

  Requires motor vehicle manufacturers to implement in-vehicle privacy controls and provide consumers data privacy information, and applies the Utah Consumer Privacy Act to motor vehicle data collection.

• 1 January 2027

  Vermont S 69: An act relating to an age-appropriate design code

  Requires covered online businesses to comply with age-appropriate design standards when their services are reasonably likely to be accessed by minors under 18 years old.

• 1 July 2027

  Georgia SB 540: Online Internet Safety; certain disclosures related to conversational AI services; require

  Requires operators of AI companion chatbots to disclose they are not natural persons, prevent deceptive claims to minors, restrict sexual content involving minors, and adopt protocols for detecting severe harm.

• 1 July 2027

  Illinois HB 5295: REPRODUCTIVE HEALTH PRIVACY

  Requires electronic health networks to prevent disclosure of patients' abortion-related and gender dysphoria health information to out-of-state entities without explicit patient consent.

• 1 July 2027

  Kentucky HB 692: AN ACT relating to data privacy.

  Requires businesses to include automatic content recognition data in the definition of sensitive data under Kentucky's consumer data protection law, effective 1 July 2027.

• 1 July 2027

  Utah HB 408: Data Sharing Amendments

  Requires social media platforms to allow users to select and transfer their data in real time to other platforms, with user consent for sharing comments and interactions from other users starting 1 July 2027.

Next year's data privacy laws are bills now. Follow them in every state with the Data Privacy Legislation Tracker.