Alabama
|
H 492
|
Judges and Justices
|
Failed - Adjourned
|
Relates to judges and justices, prohibits certain agencies from publicly posting or displaying a judge's personal information in certain circumstances, provides for penalties for violations.
|
Information Brokers
|
Alabama
|
S 329
|
Judges and Justices
|
Failed - Adjourned
|
Relates to judges and justices, prohibits certain agencies from publicly posting or displaying a judge's personal information in certain circumstances, provides for penalties for violations.
|
Information Brokers
|
Alaska
|
None
|
|
|
|
|
Arizona
|
H 2066
|
Banks and Financial Institutions Personal Information
|
Enacted
|
Provides that notwithstanding any other law and except as provided by an applicable law that requires a retention period that exceeds a specified number of years, a bank or financial institution shall destroy, in a manner prescribed by law, all personal information belonging to a former customer or client not later than a specified number of years after the business relationship ends.
|
Other Consumer Privacy
|
Arizona
|
S 1221
|
Unidentified Patients
|
Enacted
|
Allows a licensed hospital to request assistance from a criminal justice agency, for noncriminal justice purposes, to determine the identity of an unidentified patient who is either incapacitated or deceased.
|
Biometrics or Facial Recognition
|
Arizona
|
S 1228
|
Hospitals and Unidentified Patients and Fingerprints
|
Failed - Adjourned
|
Relates to hospitals, relates to unidentified patients, relates to fingerprints.
|
Biometrics or Facial Recognition
|
Arizona
|
S 1238
|
Biometrics Identifiers and Collection
|
Failed - Adjourned
|
Relates to biometrics identifiers, relates to collection, relates to retention, relates to disclosure.
|
Biometrics or Facial Recognition
|
Arizona
|
S 1503
|
Explicit Content and Age Verification
|
Failed - Adjourned
|
Provides that a commercial entity that intentionally or knowingly publishes or distributes material harmful to minors on the internet from a website that contains a substantial portion of such material shall verify that any person attempting to access material harmful to minors is at least a specified age, provides that verification may be made either using a commercially available database for the purposes of verification and through any other commercially reasonable method of verification.
|
Other Consumer Privacy
|
Arkansas
|
S 396
|
Social Media Safety Act
|
Enacted
|
Creates the Social Media Safety Act, requires age verification for use of social media, clarifies liability for failure to perform age verification for use of social media and illegal retention of data, requires parental consent, relates to liability for social media companies.
|
Other Consumer Privacy
|
California
|
A 127
|
State Government
|
Enacted
|
Relates to the California Age-Appropriate Design Code Act and the California Children's Data Protection Working Group. Specifies that the working group is within the office of the attorney general. Requires the Department of Finance to calculate the individual subvention amounts for each of the specified state programs and provide this information on an annual basis to the California State Association of Counties and the League of California Cities for distribution to local agencies. Appropriates funds.
|
Children’s Online Privacy
|
California
|
A 254
|
Confidentiality of Medical Information Act
|
Enacted
|
Revises the definition of medical information to include reproductive or sexual health application information means information about a consumer's reproductive or sexual health collected by a reproductive or sexual health digital service. Makes a business that offers a reproductive or sexual health digital service to a consumer for the purpose of allowing the individual to manage the individual's information a provider of health care subject to the Confidentiality of Medical Information Act.
|
Other Consumer Privacy
|
California
|
A 352
|
Health Information
|
Enacted
|
Require specified businesses that electronically store or maintain medical information on the provision of sensitive services on behalf of a provider of health care, health care service plan, pharmaceutical company, contractor, or employer to develop capabilities, policies, and procedures, on or before specified date, to enable certain security features, including limiting user access privileges and segregating medical information related to gender affirming care, abortion and abortion-related services.
|
Other Consumer Privacy
|
California
|
A 386
|
California Right to Financial Privacy Act
|
To governor
|
Relates to the California Right to Financial Privacy Act, which provides for the confidentiality of the financial records of people who transact business with, or use the services of, financial institutions or for whom a financial institution has acted as a fiduciary. Expands the period covered by the statement of information to a period of a specified number of days before, and up to a specified number of days following, the date of occurrence.
|
Other Consumer Privacy
|
California
|
A 677
|
Confidentiality of Medical Information Act
|
Pending - Carryover
|
Makes non-substantive changes to the title provision of the Confidentiality of Medical Information Act.
|
Health
|
California
|
A 793
|
Privacy: Reverse Demands
|
Pending – Carryover
|
Provides that existing law requires a state corporation that provides electronic communication services or remote computing services to the public to comply with a warrant issued by another state to produce specified records as if that warrant had been issued by a state court, with exceptions. Prohibits any government entity from seeking, or any court from enforcing, assisting, or supporting, a reverse-keyword or location demand issued by a government entity or court in the state or any other state.
|
Other Consumer Privacy
|
California
|
A 801
|
Student Privacy: Online Personal Information
|
Pending - Carryover
|
Relates to the California Consumer Privacy Act of 2018 (CCPA), the Early Learning Personal Information Protection Act and the Student Online Personal Information Protection Act. Provides that, when applied to K-12 students, covered information does not include official records, files, and data directly related to a student and maintained by the school or local educational agency, including information within records encompassing all the material kept in the student's cumulative folder.
|
Children’s Online Privacy
|
California
|
A 947
|
California Consumer Privacy Act of 2018
|
To governor
|
Defines sensitive personal information for purposes of the California Consumer Privacy Act to additionally include personal information that reveals a consumer's citizenship or immigration status. Authorizes the Legislature to amend the act to further the purposes and intent of the act by a majority vote of both houses of the Legislature.
|
Comprehensive
|
California
|
A 1011
|
Social Care: Data Privacy
|
Pending - Carryover
|
Relates to the Health Insurance Portability and Accountability Act and the Confidentiality of Medical Information Act. Prohibits a participating entity of a closed-loop referral system (CLRS) from selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, social care information stored in or transmitted through a CLRS in exchange for monetary or other valuable consideration, with specified exceptions.
|
Other Consumer Privacy
|
California
|
A 1027
|
Social Media Platforms: Drug Safety Policies
|
To governor
|
Provides that existing law requires a social media platform to create and post a policy statement regarding the use of the platform to illegally distribute controlled substances. Requires a platform to retain content it has taken down or removed for a violation of its policy related to controlled substances for a specified period, except when the platform has a good faith belief that the content is related to offering, seeking, or receiving of gender-affirming health care, mental care, or reproductive care.
|
Other Consumer Privacy
|
California
|
A 1102
|
Telecommunications: Privacy Protections
|
Pending - Carryover
|
Relates to telecommunications and privacy protections. Authorizes providing specified telephone numbers to those parties without consent for the purpose of responding to a 988 call or testing the systems that respond to 988 calls.
|
ISP Privacy
|
California
|
A 1194
|
California Privacy Rights Act: Exemptions
|
To governor
|
Requires a business, if the consumer's personal information contains information related to accessing, procuring, or searching for services regarding contraception, pregnancy care, and perinatal care, including, but not limited to, abortion services, to comply with the obligations imposed by the California Privacy Rights Act of 2020 unless the personal information is used for specified business purposes, as defined, is only retained in aggregated and deidentified form, and is not sold or shared.
|
Other Consumer Privacy
|
California
|
A 1546
|
CA Consumer Privacy Act of 2018: Statute of Limitations
|
Pending - Carryover
|
Requires an action by the attorney general to enforce the California Consumer Privacy Act to be commenced within a specified number of years after the cause of action accrued.
|
Comprehensive
|
California
|
S 127
|
State Government
|
Pending - Carryover
|
Specifies that the California Children's Data Protection Working Group is within the office of the attorney general. Requires the Department of Finance to calculate the individual subvention amounts for specified state programs and provide this information on an annual basis to the California State Association of Counties and the League of California Cities for distribution to local agencies. Establishes a Racial Equity Commission. Appropriates funds.
|
Children’s Online Privacy
|
California
|
S 296
|
In-Vehicle Cameras
|
To governor
|
Prohibits any images or video recordings collected through the operation of an in-vehicle camera from being used for any advertising purpose or being sold to any third party. Provides an exception to certain prohibitions to comply with a lawful subpoena, court order, search warrant, or preservation request.
|
Other Consumer Privacy
|
California
|
S 362
|
Data Broker Registration: Accessible Deletion Mechanism
|
To governor
|
Relates to the California Consumer Privacy Act of 2018, which grants a consumer various rights with respect to personal information that is collected or sold by a business. Requires the California Privacy Protection Agency to establish an accessible deletion mechanism that, allows a consumer, through a single verifiable consumer request, to request that every data broker that maintains any personal information delete any personal information related to that consumer held by the data broker or contractor.
|
Information Brokers
|
California
|
S 793
|
Insurance: Privacy Notices and Personal Information
|
Enacted
|
Provides that the Insurance Information and Privacy Protection Act requires an insurance institution or agent to provide a notice of information to applicants and policyholders in connection with specified insurance transactions. Codifies the requirement to annually provide a clear and conspicuous privacy notice to customers. States that an insurance institution or agent is in compliance with this requirement if specified criteria are met.
|
Other Consumer Privacy
|
California
|
S 845
|
Let Parents Choose Protection Act of 2023
|
Pending - Carryover
|
Requires large social media platform providers to create, maintain, and make available to specified third-party safety software providers a set of third party-accessible application programming interfaces to allow a third-party safety software provider, upon authorization by a child or a parent or legal guardian of a child, to monitor a child's online interactions, content, and account settings and initiate secure transfers of the child's user data for these purposes.
|
Children’s Online Privacy
|
California
|
SCR 9
|
Data Privacy Week and Day
|
Adopted
|
Designates specified week as Data Privacy Week. Designates specified date as Data Privacy Day.
|
Other Consumer Privacy
|
Colorado
|
None
|
|
|
|
|
Connecticut
|
H 5182
|
State Cause of Action
|
Failed
|
Creates a state cause of action for a violation of the federal health insurance portability and accountability act of 1996, creates a state cause of action for an individual to recover damages for violations of the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA).
|
Other Consumer Privacy
|
Connecticut
|
H 5429
|
Digital Privacy
|
Failed
|
Concerns minors and digital privacy, prohibits the collection and commercial use of certain digital information concerning minors.
|
Children’s Online Privacy
|
Connecticut
|
H 6249
|
Personal Data Privacy Standards
|
Failed
|
Applies the requirements of specified public act concerning personal data privacy to state agencies.
|
Comprehensive
|
Connecticut
|
H 6253
|
Age-Appropriate Design Code
|
Failed
|
Adopts a Connecticut Age-Appropriate Design Code that creates privacy and safety obligations for providers of online products and services accessed by children.
|
Children’s Online Privacy
|
Connecticut
|
H 6393
|
Data Privacy Protections for Minors
|
Failed
|
Establishes additional data privacy protections for minors.
|
Children’s Online Privacy
|
Connecticut
|
S 3
|
Online Privacy and Protections
|
Enacted
|
Concerns online privacy, data and safety protections.
|
Other Consumer Privacy
|
Connecticut
|
S 730
|
Disclosure of the Use of Facial Recognition Technology
|
Failed
|
Requires a clear disclosure in all public spaces where facial recognition technology is being used to identify customers and guests.
|
Biometrics or Facial Recognition
|
Connecticut
|
S 1058
|
Attorney Generals Recommendations
|
Enacted
|
Relates to charitable organizations, telecommunications and the attorney general's recommendations regarding consumer protection, provides that if a price is charged for admission to a place of entertainment, the operator of the place of entertainment shall print, endorse or otherwise disclose on the face of each ticket to an entertainment event at such place of entertainment the price established for such ticket or, if such operator sells or resells such ticket, including at auction, the final price.
|
Comprehensive
|
Connecticut
|
SJR 42
|
Right to Privacy
|
Failed - Adjourned
|
Proposes a state constitutional amendment concerning a right to privacy.
|
Constitutional Amendment
|
Delaware
|
H 154
|
Delaware Personal Data Privacy Act
|
Enacted
|
Relates to personal data privacy and consumer protection, provides that a consumer has the right to, among other things, confirm whether a controller is processing the consumer's personal data and access such personal data, unless such confirmation or access would require the controller to reveal a trade secret.
|
Comprehensive
|
District of Columbia
|
None
|
|
|
|
|
Florida
|
H 699
|
Student Online Personal Information Protection
|
Failed
|
Relates to student online personal information protection, prohibits operators from knowingly engaging in specified activities relating to students covered information, provides exception, specifies duties of operator, provides circumstances under which operator may disclose students covered information.
|
Children’s Online Privacy
|
Florida
|
H 1463
|
Childhood Mental Health Safety and Welfare
|
Failed - Adjourned
|
Relates to childhood mental health, safety, and welfare, revises array of services offered by child and adolescent mental health system of care, requires specified professionals to complete course on technology addiction and pornography addiction, requires warning label be affixed to packaging of certain digital devices, requires commercial entity to verify age of individuals attempting to access certain material online, prohibits entity from retaining personal identifying information, revises definition.
|
Other Consumer Privacy
|
Florida
|
H 1547
|
Technology Transparency
|
Failed
|
Relates to technology transparency, prohibits officers or salaried employees of governmental entities from using their positions or state resources to make certain requests of social media platforms, prohibits governmental entities from initiating or maintaining certain agreements or working relationships with social media platforms, provides exceptions, prohibits controller from collecting certain consumer information.
|
Comprehensive
|
Florida
|
S 262
|
Technology Transparency
|
Enacted
|
Prohibits officers or salaried employees of governmental entities from using their positions or state resources to make certain requests of social media platforms, prohibits governmental entities from initiating or maintaining agreements or working relationships with social media platforms under a specified circumstance, provides exceptions, prohibits certain conduct by an online platform that provides online services, products, games, or features likely to be predominantly accessed by children.
|
Comprehensive
|
Florida
|
S 472
|
Protection of Exploited Persons
|
Failed - Adjourned
|
Relates to protection of exploited persons.
|
Other Consumer Privacy
|
Florida
|
S 662
|
Student Online Personal Information Protection
|
Enacted
|
Relates to student online personal information protection, cites this act as the Student Online Personal Information Protection Act, prohibits operators from knowingly engaging in specified activities relating to students covered information, specifies the duties of an operator, provides circumstances under which an operator may disclose students covered information, provides for enforcement under the Florida Deceptive and Unfair Trade Practices Act.
|
Children’s Online Privacy
|
Florida
|
S 1620
|
Childhood Mental Health Safety and Welfare
|
Failed - Adjourned
|
Relates to childhood mental health, safety, and welfare, revises the array of services offered by the child and adolescent mental health system of care, requires specified mental health care professionals to complete a course on technology addiction and pornography addiction by a specified date, requires that a warning label be affixed to the packaging of certain digital devices.
|
Other Consumer Privacy
|
Georgia
|
H 798
|
Data Privacy Act
|
Pending - Carryover
|
Relates to selling and other trade practices, to prohibit a manufacturer of consumer electronic devices from allowing consumers to opt out of certain data collection by third parties unless the consumer can opt of the same data collection by the manufacturer, provides for a short title, provides for definitions, provides for enforcement, limitations, exclusions, construction, and applicability, provides for related matters, repeals conflicting laws.
|
Other Consumer Privacy
|
Guam
|
None
|
|
|
|
|
Hawaii
|
H 1497
|
Personal Consumer Data
|
Pending - Carryover
|
Provides for the Consumer Data Protection Act, which applies to persons that conduct business in the state or produce products or services that are targeted to state residents and, during the year, control or process personal data of at least a specified number of consumers and derive over a specified percent of gross revenue from the sale of personal data, provides that a consumer may invoke the consumer rights by submitting a request to a controller specifying the rights the consumer wishes to invoke.
|
Comprehensive
|
Hawaii
|
S 1
|
Abortion Out of State Actions
|
Enacted
|
Protects an individual's right to privacy and bodily autonomy within the boundaries of the state, including minors, and declares that the laws of other states authorizing civil actions and criminal prosecutions for receiving, seeking, providing, or aiding and abetting the provision of reproductive health care services are contrary to the state's public policy, prohibits recognition and enforcement of other states' laws that impose civil or criminal liability relating to reproductive health care services.
|
Other Consumer Privacy
|
Hawaii
|
S 21
|
Internet Privacy
|
Pending - Carryover
|
Proposes to amend the state constitution by establishing the right of each person to own and have an exclusive property right in the data they generate on the internet.
|
Constitutional Amendment
|
Hawaii
|
S 604
|
Reproductive Health Care Services Patient Information
|
Pending - Carryover
|
Prohibits state and county employees and officers from providing reproductive health care services patient information or expending state resources in furtherance of another state's investigation or proceeding that seeks to impose civil, criminal, or professional liability upon a person or entity related to reproductive health care services, prohibits any person from being compelled to provide reproductive health care services patient information.
|
Other Consumer Privacy
|
Hawaii
|
S 896
|
Reproductive Health Care Services
|
Pending - Carryover
|
Prohibits a covered entity from disclosing communication or information relating to reproductive health care services, prohibits the issuance of a subpoena in connection with an out-of- state proceeding relating to reproductive health care services legally performed in the state, prohibits agencies from providing information or expending resources in the furtherance of interstate investigations or proceedings relating to reproductive health care services.
|
Other Consumer Privacy
|
Hawaii
|
S 974
|
Consumer Data Protection Act
|
Pending - Carryover
|
Establishes a framework to regulate controllers and processors with access to personal consumer data, establishes penalties, establishes a new consumer privacy special fund, appropriates funds to the Department of the Attorney General.
|
Comprehensive
|
Hawaii
|
S 1085
|
Biometric Identifiers
|
Pending - Carryover
|
Establishes standards for the collection, storage, retention, and destruction of biometric identifiers and biometric information by private entities.
|
Biometrics or Facial Recognition
|
Hawaii
|
S 1110
|
Personal Consumer Data
|
Pending - Carryover
|
Establishes a framework to regulate controllers and processors with access to personal consumer data, establishes that a violation of the consumer data privacy act constitutes an unfair method of competition and unfair and deceptive acts or practices in the conduct of any trade of commerce, authorizes a person injured by a violation of the personal consumer data act to bring a civil action against a controller or processor.
|
Comprehensive
|
Hawaii
|
S 1180
|
Internet Privacy
|
Pending - Carryover
|
Prohibits the sale of geolocation information and internet browser information without consent.
|
ISP Privacy; Location Privacy
|
Idaho
|
None
|
|
|
|
|
Illinois
|
H 223
|
Biometric Information Privacy Act
|
Pending
|
Amends the Biometric Information Privacy Act, makes a technical change in a section concerning the short title.
|
Biometrics or Facial Recognition
|
Illinois
|
H 252
|
Biometric Information Privacy Act
|
Pending
|
Amends the Biometric Information Privacy Act, makes a technical change in a section concerning the short title.
|
Biometrics or Facial Recognition
|
Illinois
|
H 1168
|
Genetic Information Privacy Act
|
Pending
|
Amends the Genetic Information Privacy Act, provides that in accordance with the Sexual Assault Evidence Submission Act, genetic information derived from reference specimens of DNA from: a victim of a sexual assault crime or alleged sexual assault crime, knowns reference samples of DNA from any individual that were voluntarily provided for the purpose of exclusion: and any profiles developed from those samples, may be used only for purposes directly related to the investigation of the sexual assault.
|
Genetic Privacy
|
Illinois
|
H 1230
|
Biometric Information Privacy Act
|
Pending
|
Amends the Biometric Information Privacy Act, provides that nothing in the act shall be construed to apply to any health care employer that hires an employee under the Health Care Worker Background Check Act and the employee has submitted to a fingerprint-based criminal history records check, uses and stores biometric information or biometric identifiers exclusively for employment, human resources, compliance, payroll, identification, authentication, safety, security, or fraud prevention purposes.
|
Biometrics or Facial Recognition
|
Illinois
|
H 1381
|
Right to Know Act and Commercial Website
|
Pending
|
Creates the Right to Know Act, provides that an operator of a commercial website or online service that collects personally identifiable information through the internet about individual customers residing in Illinois who use or visit its commercial website or online service shall notify those customers of certain specified information pertaining to its personal information sharing practices.
|
Website Privacy
|
Illinois
|
H 1636
|
Banking Customer Financial Records and Confidentiality
|
Pending
|
Amends the Banking Act, provides that any person, corporation, or financial institution that conducts business or performs transactions on behalf of or at the direction of an executor or administrator with the will annexed shall be fully protected and released from liability to the same extent that the executor or administrator with the will annexed would be if the executor or administrator with the will annexed was lawfully authorized to conduct the business or perform the transaction.
|
Other Consumer Privacy
|
Illinois
|
H 2252
|
Biometric Information Privacy Act
|
Pending
|
Amends the Biometric Information Privacy Act, changes the term written release to written consent, provides that the written policy that is developed by a private entity in possession of biometric identifiers shall be made available to the person from whom biometric information is to be collected or was collected.
|
Biometrics or Facial Recognition
|
Illinois
|
H 2259
|
Biometric Privacy Information Act
|
Pending
|
Amends the Biometric Privacy Information Act, defines security purpose as the purpose of preventing retail theft, fraud, or any other misappropriation or theft of a thing of value, including protecting property from trespass, controlling access to property, protecting any person from harm, including stalking, violence, or harassment, and assisting a law enforcement investigation, allows a private entity to collect, capture, or otherwise obtain a person's or customer's biometric identifier or biometric.
|
Biometrics or Facial Recognition
|
Illinois
|
H 2335
|
Biometric Information Privacy Act
|
Pending
|
Amends the Biometric Information Privacy Act, changes the definitions of biometric identifier and written release, defines biometric lock, biometric time clock, electronic signature, in writing, and security purpose, provides that if the biometric identifier or biometric information is collected or captured for the same repeated process, the private entity is only required to inform the subject or receive consent during the initial collection.
|
Biometrics or Facial Recognition
|
Illinois
|
H 2571
|
Reproductive Health Act
|
Pending
|
Amends the Reproductive Health Act, provides that a health care professional who provides abortion-related care may submit to any governmental agency, person, business, or association a written request that the governmental agency, person, business, or association refrain from disclosing any personal information about the health care professional, provides that if a governmental agency receives a written request from a health care professional, the governmental agency shall not publicly post or display.
|
Other Consumer Privacy
|
Illinois
|
H 3199
|
Biometric Information Privacy Act
|
Pending
|
Amends the Biometric Information Privacy Act, changes the term written release to written consent, allows written consent to be obtained by electronic means, provides that a person aggrieved by a violation of the act may only commence an action after the aggrieved person provides a private entity 15 days' written notice identifying the specific provisions of the Act the aggrieved person alleges have been or are being violated.
|
Biometrics or Facial Recognition
|
Illinois
|
H 3204
|
Biometric Information Privacy Act
|
Pending
|
Amends the Biometric Information Privacy Act, requires an aggrieved person to commence an action for a violation of the act within a specified year of the date of the violation or the date on which the aggrieved person discovers the violation.
|
Biometrics or Facial Recognition
|
Illinois
|
H 3385
|
Data Privacy and Protection Act
|
Pending
|
Creates the Data Privacy and Protection Act, provides that a covered entity may not collect, process, or transfer covered data unless the collection, processing, or transfer is limited to what is reasonably necessary and proportionate, provides that a covered entity and a service provider shall establish, implement, and maintain reasonable policies, practices, and procedures concerning the collection, processing, and transferring of covered data, contains provisions concerning retaliation.
|
Comprehensive
|
Illinois
|
H 3438
|
Keep Internet Devices Safe Act
|
Pending
|
Creates the Keep Internet Devices Safe Act, provides that no private entity may turn on or enable a digital device's microphone unless the registered account holder or another user that is setting up or configuring the device first agrees to a consumer agreement or privacy notice meeting specified criteria.
|
Connected Devices
|
Illinois
|
H 3603
|
Protect Health Data Privacy Act
|
Pending
|
Amends the Protect Health Data Privacy Act, provides that a regulated entity shall disclose and maintain a health data privacy policy that, in plain language, clearly and conspicuously disclosures specified information, provides that a regulated entity shall prominently publish its health data privacy policy on its website homepage, provides that a regulated entity shall not collect, share, sell, or store categories of health data not disclosed in the health data privacy policy without first disclosing.
|
Other Consumer Privacy; Website Privacy
|
Illinois
|
H 3880
|
Childrens Privacy Protection and Parental Empowerment
|
Pending
|
Creates the Children's Privacy Protection and Parental Empowerment Act, provides that a business that provides an online service, product, or feature likely to be accessed by children shall take specified actions, including completing a data protection impact assessment for any online service, product, or feature likely to be accessed by children.
|
Children’s Online Privacy
|
Illinois
|
H 4093
|
Protect Health Data Privacy Act
|
Pending
|
Creates the Protect Health Data Privacy Act, provides that a regulated entity shall disclose and maintain a health data privacy policy that clearly and conspicuously discloses specified information, sets forth provisions concerning health data privacy policies, provides that a regulated entity shall not collect, share, or store health data, except in specified circumstances, provides that it is unlawful for any person to sell or offer to sell health data concerning a consumer.
|
Other Consumer Privacy
|
Illinois
|
H 4102
|
Biometric Information Privacy Act
|
Pending
|
Amends the Biometric Information Privacy Act, defines security purpose as a purpose to ensure that a person accessing an online product or service is who they person claims to be or a person identified as a safety concern or as a person violating the terms of use or service of the online product or service can be kept off of or denied access to the product or service.
|
Biometrics or Facial Recognition
|
Illinois
|
H 4142
|
Genetic Information Privacy Act
|
Pending
|
Amends the Genetic Information Privacy Act, provides that an insurer may not seek information derived from genetic testing for use in connection with a policy of life insurance, provides that an insurer may consider the results of genetic testing in connection with a policy of life insurance if the individual voluntarily submits the results and the results are favorable to the individual, amends the Insurance Code, provides that an insurer must comply with the provisions of the Genetic Information Privacy Act in connection with the amendment, delivery, issuance, or renewal of a life insurance policy; claims for or denial of coverage under a life insurance policy; or the determination of premiums or rates under a life insurance policy.
|
Genetic Privacy
|
Illinois
|
S 68
|
Genetic Information Privacy Act
|
Pending
|
Amends the Genetic Information Privacy Act, removes language exempting insurers that are issuing a long-term care policy from specified provisions, regards to any policy, contract, or plan offered, entered into, issued, amended, or renewed on or after Jan. 1, 2024, by a health insurer, life insurer, or long-term care insurer authorized to transact insurance in this state, a health insurer, life insurer, or long-term care insurer.
|
Genetic Privacy
|
Illinois
|
S 1365
|
Right to Know Act
|
Pending
|
Creates the Right to Know Act, provides that an operator of a commercial website or online service that collects personally identifiable information through the internet about individual customers residing in who use or visit its commercial website or online service shall notify those customers of certain specified information pertaining to its personal information sharing practices, requires an operator to make available certain specified information upon disclosing a customer's personal information.
|
Website Privacy
|
Illinois
|
S 1506
|
Biometric Information Privacy Act
|
Pending
|
Amends the Biometric Information Privacy Act, changes the definitions of biometric identifier and written release, defines biometric lock, biometric time clock, electronic signature, in writing, and security purpose, provides that if the biometric identifier or biometric information is collected or captured for the same repeated process, the private entity is only required to inform the subject or receive consent during the initial collection.
|
Biometrics or Facial Recognition
|
Illinois
|
S 1511
|
Biometric Privacy Information Act
|
Pending
|
Amends the Biometric Privacy Information Act, defines security purpose as the purpose of preventing retail theft, fraud, or any other misappropriation or theft of a thing of value, including protecting property from trespass, controlling access to property, protecting any person from harm, including stalking, violence, or harassment, and assisting a law enforcement investigation, allows a private entity to collect, capture, or otherwise obtain a person's or customer's biometric identifier or biometric.
|
Biometrics or Facial Recognition
|
Illinois
|
S 1601
|
Health Data Privacy Act
|
Pending
|
Creates the Health Data Privacy Act.
|
Other Consumer Privacy
|
Illinois
|
S 1739
|
Minor Online Data Privacy Act
|
Pending
|
Creates the Minor Online Data Privacy Act, contains only a short title provision.
|
Children’s Online Privacy
|
Illinois
|
S 1992
|
Banking Act
|
Pending
|
Amends the Banking Act, in provisions concerning customer financial records and confidentiality, provides that the language does not prohibit the furnishing of financial information to the executor, executrix, administrator, or other lawful representative of the estate of a customer, amends the Savings Bank Act, provides that the provisions do not prohibit the furnishing of financial information to the executor, executrix, administrator, or other lawful representative of the estate of a customer.
|
Other Consumer Privacy
|
Illinois
|
S 2256
|
Student Online Personal Protection Act
|
Pending
|
Amends the Student Online Personal Protection Act, provides that covered information does not include de-identified or aggregate information from which all personally identifiable information of a student has been removed, makes conforming changes, provides that the covered information restrictions shall be included as part of the operator's terms of service agreement, privacy policy, or similar document, removes provisions requiring that if the school maintains a website.
|
Children’s Online Privacy
|
Illinois
|
S 2307
|
Commercial Data Collector Tax Act
|
Pending
|
Creates the Commercial Data Collector Tax Act, provides that there shall be a monthly excise tax on the collection of the consumer data of individual state consumers by commercial data collectors, which shall be paid to the Department of Revenue and deposited into the general revenue fund, sets forth details regarding the tax to be paid, who qualifies as a consumer for purposes of the tax and alternative methods for collecting the tax, contains provisions concerning required disclosures and rulemaking.
|
Information Brokers
|
Indiana
|
H 1554
|
Consumer Data Protection
|
Failed - Adjourned
|
Relates to consumer data protection, establishes in the Indiana Code a new article concerning consumer data protection, sets forth definitions of terms that apply throughout the article, sets forth exemptions for certain, persons, and types of information and data from the bill's requirements concerning the personal data of Indiana consumers, sets forth the rights of a consumer with respect to personal data relating to the consumer.
|
Comprehensive
|
Indiana
|
S 5
|
Consumer Data Protection
|
Enacted
|
Provides that a consumer may invoke specified rights by submitting to a controller of personal data a request specifying the rights the consumer wishes to invoke, provides that a known child's parent or legal guardian may invoke on behalf of the child one or more rights with respect to the processing of personal data belonging to the known child by submitting to a controller a request specifying the rights the consumer wishes to invoke on behalf of the child.
|
Comprehensive
|
Iowa
|
H 346
|
Consumer Data Protection
|
Failed
|
Relates to consumer data protection, provides civil penalties, includes effective date provisions.
|
Comprehensive
|
Iowa
|
H 489
|
Civil Liability for Material Harmful to Minors
|
Pending - Carryover
|
Relates to civil liability for commercial entities who publish or distribute material harmful to minors on the internet, provides penalties.
|
Other Consumer Privacy
|
Iowa
|
H 712
|
Social Media Data Collection Regarding Children
|
Pending - Carryover
|
Relates to social media data collection regarding children under 18 years of age, provides civil penalties, includes applicability provisions.
|
Children’s Online Privacy
|
Iowa
|
S 262
|
Consumer Data Protection
|
Enacted
|
Relates to consumer data protection, provides civil penalties, relates to consumer data rights, provides that a consumer may invoke the consumer rights at any time by submitting a request to the data controller specifying the consumer rights the consumer wishes to invoke, provides that a known child’s parent or legal guardian may invoke such consumer rights on behalf of the known child regarding processing personal data belonging to the child.
|
Comprehensive
|
Kansas
|
None
|
|
|
|
|
Kentucky
|
H 301
|
Consumer Data Privacy
|
Failed - Adjourned
|
Establishes consumer rights relating to personal data, includes the rights to confirm whether data is being processed, to delete personal data provided by the consumer, to obtain a copy of the consumer's personal data that was previously provided, and to opt out of targeted advertising and the sale of data, defines terms, sets forth the types of data and the persons or entities to which the statutory provisions do and do not apply.
|
Comprehensive
|
Kentucky
|
H 476
|
Protection of Minors
|
Failed - Adjourned
|
Defines terms, establishes a cause of action against any commercial entity that publishes matter harmful to minors on the internet without obtaining age verification, requires removal of personal data following review for access, establishes civil penalties for violations.
|
Other Consumer Privacy
|
Kentucky
|
H 483
|
Biometric Data
|
Failed - Adjourned
|
Defines terms, requires a private entity to develop a written policy and retention schedule for the biometric identifiers it collects, creates restrictions on the collection, capture, purchase, or trade of biometric identifiers, requires disclosure of biometric identifier information per individual request, creates a civil cause of action, clarifies statutory construction, acts may be cited as the Biometric Identifiers Privacy Act.
|
Biometrics or Facial Recognition
|
Kentucky
|
S 15
|
Consumer Data Privacy
|
Failed - Adjourned
|
Defines various consumer rights related to data collection, requires a data controller to comply with a consumer request to exercise those rights, including confirming whether or not a controller is processing the consumers data and providing the consumer access to his or her data, deleting his or her personal data, and providing a copy of the consumers data that he or she previously provided in a portable and usable format, provides for opting out.
|
Comprehensive
|
Kentucky
|
S 239
|
Violations of Privacy
|
Failed - Adjourned
|
Creates a cause of action for introduction of an identification device, restricts use of facial recognition technology and biometric identifiers, creates a cause of action for use of facial recognition technology or biometric identifiers, prohibits the use of facial recognition technology as evidence, proposes a new rule of evidence to make evidence gained from use of facial recognition inadmissible.
|
Biometrics or Facial Recognition
|
Louisiana
|
S 162
|
Commercial Regulations
|
Enacted
|
Creates the Secure Online Child Interaction and Age Limitation Act.
|
Children’s Online Privacy; Other Consumer Privacy
|
Louisiana
|
S 199
|
Consumers and Protection
|
Failed - Adjourned
|
Provides relative to the protection of data.
|
Comprehensive
|
Maine
|
H 445
|
Request for Information
|
Failed
|
Repeals the exception in current law that permits a financial institution or credit union authorized to do business in this state to disclose financial records about a customer without a lawful subpoena, summons, warrant or court order in response to a request for information related to establishing, modifying or enforcing tax liabilities, clarifies that a financial institution or credit union may not disclose records to any federal agency unless the records are disclosed.
|
Other Consumer Privacy
|
Maine
|
H 1094, Special Session
|
Consumer Control Over Sensitive Personal Data
|
Pending - Carryover
|
Provides for an individual's privacy regarding the collection and use of biometric identifiers of the individual and personal information connected to the biometric identifiers, requires a written release from an individual before a private entity may obtain or use biometric identifiers and requires the private entity to establish a policy for retention and destruction of the biometric identifiers.
|
Biometrics or Facial Recognition
|
Maine
|
H 1217, Special Session
|
Personal Health Data
|
Pending - Carryover
|
Protects personal health data.
|
Other Consumer Privacy
|
Maine
|
H 1270, Special Session
|
Data Privacy and Protection Act
|
Pending - Carryover
|
Enacts the data privacy and protection act, requires policies, practices and procedures for data privacy, prohibits retaliation for the exercise of a right relating to personal data and prohibits discriminatory practices in the collection, processing or transfer of personal data, relates to civil penalty.
|
Comprehensive
|
Maine
|
S 646, Special Session
|
Amendment to the Constitution
|
Failed
|
Proposes an amendment to the state constitution to recognize the right to personal privacy.
|
Constitutional Amendment
|
Maine
|
S 807, Special Session
|
Consumer Privacy Act
|
Pending - Carryover
|
Enacts the state consumer privacy act to entitle consumers to certain rights concerning the use of personal data.
|
Comprehensive
|
Maryland
|
H 33
|
Biometric Data Privacy
|
Failed - Adjourned
|
Relates to commercial law, concerns consumer protection, concerns biometric data privacy.
|
Biometrics or Facial Recognition
|
Maryland
|
H 720
|
Employers Prohibition on Facial Recognition Services
|
Failed - Adjourned
|
Defining the term "employer" to include state and local governments for the purposes of certain provisions of law that prohibit employers from using facial recognition technology for the purpose of creating a facial template during an applicant's interview for employment without the applicant's consent.
|
Biometrics or Facial Recognition
|
Maryland
|
H 807
|
Online Consumer Protection and Biometric Data Privacy
|
Failed - Adjourned
|
Establishes generally the manner in which a controller or a processor may process a consumer's personal data, authorizes a consumer to exercise certain rights in regard to the consumer's personal data, requires a controller of personal data to establish a method for a consumer to exercise certain rights in regards to the consumer's personal data, regulates the use of biometric data by a controller.
|
Comprehensive
|
Maryland
|
H 812
|
Legally Protected Health Care Information
|
Enacted
|
Regulates the disclosure of certain information related to legally protected health care by custodians of public records, health information exchanges, and electronic health networks, requires that the regulations adopted by the Maryland Health Care Commission regarding clinical information to be exchanged through the state-designated exchange restrict data of patients who have obtained legally protected health care, establishes the Protected Health Care Commission.
|
Other Consumer Privacy
|
Maryland
|
H 901
|
Online Products Child Privacy and Protections
|
Failed - Adjourned
|
Requires a business that offers an online product likely to be accessed by children to complete a certain data protection impact assessment under certain circumstances, prohibits a business from offering a certain online product before completing a data protection impact assessment, requires businesses to document certain risks associated with certain online products, requires certain privacy protections for certain online products, prohibits certain data collection and sharing practices.
|
Children’s Online Privacy
|
Maryland
|
H 995
|
Consumer Health Data Privacy
|
Failed
|
Regulates the collection and use of consumer health data by private entities, prohibits a private entity from certain collection and use of certain health data without the consent of the consumer, authorizes consumers to exercise certain rights in regards to the consumers' health data, requires private entities that collect consumer health data to make certain disclosures to consumers, prohibits a private entity that collects health data of a consumer from selling, leasing, or trading the data.
|
Other Consumer Privacy
|
Maryland
|
S 169
|
Consumer Biometric Data Privacy
|
Failed - Adjourned
|
Regulates the use of biometric data by private entities, including by requiring certain private entities in possession of biometric data to develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanent destruction of biometric data, authorizes an individual alleging a violation of the act to bring a civil action against the offending private entity, makes a violation of the act an unfair, abusive, or deceptive trade practice.
|
Biometrics or Facial Recognition
|
Maryland
|
S 698
|
Consumer Protection Online and Biometric Data Privacy
|
Failed - Adjourned
|
Establishes generally the manner in which a controller or a processor may process a consumer's personal data, authorizes a consumer to exercise certain rights in regard to the consumer's personal data, requires a controller of personal data to establish a method for a consumer to exercise certain rights in regards to the consumer's personal data, regulates the use of biometric data by a controller.
|
Comprehensive
|
Maryland
|
S 790
|
Consumer Health Data Privacy
|
Failed - Adjourned
|
Regulates the collection and use of consumer health data by private entities, prohibits a private entity from certain collection and use of certain health data without the consent of the consumer, authorizes consumers to exercise certain rights in regard to the consumer's health data, requires private entities that collect consumer health data to make certain disclosures to consumers, prohibits a private entity that collects health data of a consumer from selling, leasing, or trading the data.
|
Other Consumer Privacy
|
Maryland
|
S 844
|
Online Products Data Protection Impact Assessment
|
Failed - Adjourned
|
Requires a business that offers an online product likely to be accessed by children to complete a certain data protection impact assessment under certain circumstances, prohibits a business from offering a certain online product before completing a data protection impact assessment, requires businesses to document certain risks associated with certain online products, requires certain privacy protections for certain online products, prohibits certain data collection and sharing practices.
|
Children’s Online Privacy
|
Maryland
|
S 861
|
Scanning or Swiping Identification Cards
|
Failed - Adjourned
|
Prohibits a person from using a scanning device to scan or swipe an identification card or a driver's license of an individual to obtain personal information of the individual, prohibits a person from taking certain actions regarding information collected by scanning or swiping an individual's identification card or driver's license under certain circumstances, provides that a violation of the Act is an unfair, abusive, or deceptive trade practice under the Maryland Consumer Protection Act.
|
Other Consumer Privacy
|
Massachusetts
|
H 60
|
Information Privacy and Security Act
|
Pending
|
Relates to the security and the protection of personal information by establishing the Massachusetts Information Privacy and Security Act.
|
Comprehensive
|
Massachusetts
|
H 63
|
Biometric Information
|
Pending
|
Protects biometric information.
|
Biometrics or Facial Recognition
|
Massachusetts
|
H 80
|
Internet Privacy Rights for Children
|
Pending
|
Relates to internet privacy rights for children.
|
Children’s Online Privacy
|
Massachusetts
|
H 83
|
Data Privacy Protection Act
|
Pending
|
Establishes the Massachusetts Data Privacy Protection Act.
|
Comprehensive
|
Massachusetts
|
H 357
|
Sale of Cell Phone Location Information
|
Pending
|
Relates to banning the sale of cell phone location information.
|
Location Privacy
|
Massachusetts
|
H 386
|
Consumer Health Data
|
Pending
|
Relates to consumer health data.
|
Other Consumer Privacy
|
Massachusetts
|
H 395
|
Advertising on the Internet
|
Pending
|
Regulates advertising on the internet.
|
Website Privacy
|
Massachusetts
|
H 532
|
Student and Educator Data Privacy
|
Pending
|
Relates to student and educator data privacy.
|
Children’s Online Privacy
|
Massachusetts
|
H 1049
|
Mortgage Applications Privacy
|
Pending
|
Relates to mortgage applications privacy.
|
Other Consumer Privacy
|
Massachusetts
|
H 1555
|
Personal Data and the Free Movement of Personal Data
|
Pending
|
Provides for protections in the processing of personal data and the free movement of personal data.
|
Comprehensive
|
Massachusetts
|
H 1566
|
Certain Protected Judicial Officials and their Families
|
Pending
|
Relates to the public posting or displaying of the personal information of certain protected judicial officials and their family members.
|
Information Brokers
|
Massachusetts
|
H 3179
|
Internet Service Provider Data
|
Pending
|
Relates to internet service provider data.
|
ISP Privacy
|
Massachusetts
|
S 25
|
Data Privacy Protection Act
|
Pending
|
Establishes the Massachusetts Data Privacy Protection Act.
|
Comprehensive
|
Massachusetts
|
S 27
|
Private Electronic Communication
|
Pending
|
Protects private electronic communication, browsing and other activity.
|
ISP Privacy
|
Massachusetts
|
S 174
|
Patient Privacy
|
Pending
|
Protects patient privacy and prevent unfair and deceptive advertising of pregnancy-related services.
|
Other Consumer Privacy
|
Massachusetts
|
S 184
|
Consumer Health Data
|
Pending
|
Relates to consumer health data.
|
Other Consumer Privacy
|
Massachusetts
|
S 195
|
Personal Biometric Data
|
Pending
|
Protects personal biometric data.
|
Biometrics or Facial Recognition
|
Massachusetts
|
S 218
|
Internet Security and Privacy
|
Pending
|
Ensures internet security and privacy.
|
ISP Privacy; Website Privacy
|
Massachusetts
|
S 227
|
Information Privacy and Security Act
|
Pending
|
Establishes the Massachusetts Information Privacy and Security Act.
|
Comprehensive
|
Massachusetts
|
S 280
|
Student and Educator Data Privacy
|
Pending
|
Relates to student and educator data privacy.
|
Children’s Online Privacy
|
Massachusetts
|
S 1368
|
Waiting Room Patient Identity and Privacy Protection
|
Pending
|
Relates to patient identity and privacy protection in waiting rooms.
|
Other Consumer Privacy
|
Massachusetts
|
S 1892
|
Mental Health Impacts of Social Media
|
Pending
|
Taxes the mental health impacts of social media.
|
Information Brokers
|
Massachusetts
|
S 1896
|
Accountability in the Sale of Personal Data
|
Pending
|
Increases accountability in the sale of personal data.
|
Information Brokers
|
Michigan
|
None
|
|
|
|
|
Minnesota
|
H 846
|
Geolocation and Smartphone Monitoring
|
Pending - Carryover
|
Relates to commerce, prohibits geolocation and smartphone monitoring of another in certain circumstances, provides a cause of action to individuals when geolocation information and other smartphone data has been recorded or shared.
|
Location Privacy
|
Minnesota
|
H 1367
|
Consumer Data Privacy
|
Pending - Carryover
|
Relates to consumer data privacy, gives various rights to consumers regarding personal data, places data transparency obligations on businesses, creates a private right of action, provides for enforcement by the attorney general.
|
Comprehensive
|
Minnesota
|
H 1520
|
Consumer Data Protection
|
Pending - Carryover
|
Provides that to safeguard the privacy, confidentiality, security, and integrity of a consumer's genetic data, a direct-to-consumer genetic testing company must take specified actions, including but not limited to providing easily accessible, clear, and complete information regarding the company's policies and procedures governing the collection, use, maintenance, and disclosure of genetic data by making available to a consumer all of the specified information written in plain language.
|
Genetic Privacy
|
Minnesota
|
H 1888
|
Genetic Information
|
Pending - Carryover
|
Relates to genetic information, modifies existing law on the use of genetic information by government entities, creates new consumer protection law regarding use of genetic information.
|
Genetic Privacy
|
Minnesota
|
H 1892
|
Consumer Data Privacy
|
Pending - Carryover
|
Relates to consumer data privacy, requires a consumer's consent prior to collecting personal information.
|
Comprehensive
|
Minnesota
|
H 1904
|
Data Privacy
|
Pending - Carryover
|
Relates to data privacy, establishes neurodata rights, modifies certain crimes to add neurodata elements, provides civil and criminal penalties.
|
Other Consumer Privacy
|
Minnesota
|
H 2257
|
Minnesota Age-Appropriate Design Code Act
|
Pending - Carryover
|
Provides that a business that develops and provides online services, products, or features that children are likely to access must consider the best interests of children when designing, developing, and providing that online service, product, or feature, provides for civil penalties.
|
Children’s Online Privacy
|
Minnesota
|
H 2309
|
Consumer Data Privacy
|
Pending - Carryover
|
Relates to consumer data privacy, gives various rights to consumers regarding personal data, places obligations on certain businesses regarding consumer data, provides for enforcement by the attorney general.
|
Comprehensive
|
Minnesota
|
H 2531
|
Data Privacy
|
Pending - Carryover
|
Relates to data privacy, requires consent before providers share audio or video data with third parties.
|
Other Consumer Privacy
|
Minnesota
|
H 2532
|
Private Data
|
Pending - Carryover
|
Relates to private data, establishes standards for biometric privacy, establishes a right of action.
|
Biometrics or Facial Recognition
|
Minnesota
|
S 165
|
Health Care
|
Pending - Carryover
|
Relates to health care, limits the release of health records in cases related to reproductive health, prohibits certain acts by certain health-related licensing boards, prevents the enforcement of certain judgments related to reproductive health, restricts the enforcement of subpoenas issued in cases related to reproductive health, creates a cause of action for penalties and court costs for lawsuits related to reproductive health.
|
Other Consumer Privacy
|
Minnesota
|
S 943
|
Geolocation and Smartphone Monitoring
|
Pending - Carryover
|
Relates to commerce, prohibits geolocation and smartphone monitoring of another in certain circumstances, provides a cause of action to individuals when geolocation information and other smartphone data has been recorded or shared.
|
Location Privacy
|
Minnesota
|
S 950
|
Consumer Data Privacy
|
Pending - Carryover
|
Relates to consumer data privacy, requires a consumer's consent prior to collecting personal information.
|
Comprehensive
|
Minnesota
|
S 954
|
Private Data
|
Pending - Carryover
|
Relates to private data, establishes standards for biometric privacy, establishes a right of action.
|
Biometrics or Facial Recognition
|
Minnesota
|
S 1110
|
Data Privacy
|
Pending - Carryover
|
Relates to data privacy, establishes neurodata rights, modifies certain crimes to add neurodata elements, provides civil and criminal penalties.
|
Other Consumer Privacy
|
Minnesota
|
S 1138
|
Consumer Data Protection
|
Pending - Carryover
|
Relates to consumer data protection, requires direct-to-consumer genetic testing companies to provide disclosure notices and obtain consent.
|
Genetic Privacy
|
Minnesota
|
S 1211
|
Genetic Information
|
Pending - Carryover
|
Relates to genetic information, modifies existing law on the use of genetic information by government entities, creates new consumer protection law regarding use of genetic information.
|
Genetic Privacy
|
Minnesota
|
S 1442
|
Data Privacy
|
Pending - Carryover
|
Relates to data privacy, requires consent before providers share audio or video data with third parties.
|
Other Consumer Privacy
|
Minnesota
|
S 1705
|
Health Care Records
|
Pending - Carryover
|
Relates to health care, limits the release of health records in cases related to reproductive health, prohibits certain acts by certain health-related licensing boards, prevents the enforcement of certain judgments related to reproductive health, restricts the enforcement of subpoenas issued in cases related to reproductive health, creates a cause of action for penalties and court costs for lawsuits related to reproductive health.
|
Other Consumer Privacy
|
Minnesota
|
S 2219
|
Insurance Discounts and Rate Reductions
|
Pending - Carryover
|
Relates to commerce, authorizes administrative rulemaking, prohibits price gouging, establishes notice requirements, prescribes penalties, modifies provisions governing emergency closures, eliminates certain examination requirements, modifies and adds provisions governing the sale of certain motor vehicles, regulates nonbank mortgage servicers, requires a report, modifies provisions governing life insurance, specifies provisions for third-party payers and dental providers.
|
Genetic Privacy
|
Minnesota
|
S 2744
|
Biennial Budget for the Department of Commerce
|
Enacted
|
Establishes a biennial budget for Department of Commerce and related activities, adds and modifies various provisions governing health, property, life, homeowners, and automobile insurance, regulates financial institutions, modifies provisions governing financial institutions, provides for certain consumer protections and privacy, establishes civil and criminal penalties, appropriates funds.
|
Genetic Privacy
|
Minnesota
|
S 2810
|
Consumer Data Privacy
|
Pending - Carryover
|
Relates to consumer data privacy, creates the Minnesota Age-Appropriate Design Code Act, places obligations on certain businesses regarding children's consumer information, provides for enforcement by the attorney general, provides that a business that develops and provides online services, products, or features that children are likely to access must consider the best interests of children when designing, developing, and providing that online service, product, or feature.
|
Children’s Online Privacy
|
Minnesota
|
S 2915
|
Consumer Data Privacy
|
Pending - Carryover
|
Relates to consumer data privacy, gives various rights to consumers regarding personal data, places obligations on certain businesses regarding consumer data, provides for enforcement by the attorney general.
|
Comprehensive
|
Minnesota
|
S 3245
|
Data Practices
|
Pending - Carryover
|
Relates to data practices, requires informed consent for collection, use, and dissemination of genetic information, authorizes civil remedies.
|
Genetic Privacy
|
Mississippi
|
H 73
|
Prohibit Use of Embedded Tech in Terminals to Scan Info
|
Failed
|
Prohibits certain retailers and retail establishments from using embedded technology programs in self-checkout terminals or self-service checkouts to scan information on a consumer's driver's license to verify the age of consumer attempting to purchase certain items, requires the age verification be performed by an employee of the retail establishment when age verification is necessary to complete a purchase.
|
Other Consumer Privacy
|
Mississippi
|
H 467
|
Biometric Identifiers Privacy Act
|
Failed
|
Creates the Biometric Identifiers Privacy Act, provides legislative findings, defines terms relating to biometric identifiers, requires private entities in possession of biometric identifiers to develop a policy that establishes a retention schedule and guidelines for destroying the biometric identifiers of individuals, provides certain requirements and restrictions for private entities that collect biometric identifiers.
|
Biometrics or Facial Recognition
|
Mississippi
|
HCR 32
|
Right to Personal Reproductive Decisions
|
Failed
|
Proposes to amend the state constitution of specified year by creating a new section establishing the right to personal reproductive decisions.
|
Constitutional Amendment; Other Consumer Privacy
|
Mississippi
|
S 2080
|
Consumer Data Privacy Act
|
Failed
|
Creates the State Consumer Data Privacy Act, authorizes consumers to request that businesses disclose certain information, authorizes consumers to request that businesses delete personal information collected by businesses, requires businesses to disclose certain information to consumers, to inform consumers of their right to request that personal information be deleted, and to delete personal information collected about consumers upon request.
|
Comprehensive
|
Mississippi
|
S 2346
|
Pornographic Media Exposure to Children
|
Enacted
|
Regulates pornographic media exposure to children, provides the legislative intent, provides definitions, requires commercial entities that provide such content to have age verification systems, provides liability for those commercial entities that do not provide an age verification.
|
Other Consumer Privacy
|
Missouri
|
H 1047
|
Biometric Information Privacy Act
|
Failed - Adjourned
|
Establishes the Biometric Information Privacy Act.
|
Biometrics or Facial Recognition
|
Missouri
|
H 1225
|
Biometric Information Privacy Act
|
Failed - Adjourned
|
Establishes the Biometric Information Privacy Act.
|
Biometrics or Facial Recognition
|
Missouri
|
H 1273
|
Protecting the Privacy of Online Customer Information
|
Failed - Adjourned
|
Establishes provisions relating to protecting the privacy of online customer information.
|
ISP Privacy
|
Missouri
|
S 683
|
Data Privacy in Public Elementary and Secondary Schools
|
Failed - Adjourned
|
Creates provisions relating to data privacy in public elementary and secondary schools.
|
Children’s Online Privacy
|
Montana
|
H 446
|
Health Digital Services and Applications Privacy
|
Failed
|
Revises health privacy laws, establishes confidentiality standards for digital health care, provides for remedies for noncompliance, provides additional requirements for a mental health digital service, provides definitions.
|
Other Consumer Privacy
|
Montana
|
H 690
|
Pupil Data Privacy Protections
|
Failed
|
Revises pupil data privacy protections, relates to communications, relates to information technology, relates to privacy, relates to schools and education.
|
Children’s Online Privacy
|
Montana
|
H 966
|
Providing Agricultural Data Collection Protections
|
Failed
|
Concerns the providing agricultural data collection protections, relates to privacy, relates to state revenue.
|
Information Brokers
|
Montana
|
S 154
|
Right to Privacy
|
Enacted
|
Defines the right to individual privacy, clarifies that the right of privacy does not include the right to abortion.
|
Other Consumer Privacy
|
Montana
|
S 351
|
Biometric Data
|
Enacted
|
Revises privacy laws related to biometric privacy, creates the genetic information privacy act, requires a company to provide consumer information regarding the collection, use, and disclosure of genetic data, provides for limitations and exclusions, provides for enforcement authority.
|
Genetic Privacy
|
Montana
|
S 384
|
Consumer Privacy Laws
|
Enacted
|
Establishes the consumer data privacy act, provides definitions, establishes applicability, provides for consumer rights to personal data, establishes requirements and limitations for a controller of personal data, establishes requirements and limitations for a processor of personal data, provides for data protection assessments, provides exemptions and compliance requirements, provides for enforcement.
|
Comprehensive
|
Montana
|
S 544
|
Internet Laws Related to Material Harmful to Minors
|
Enacted
|
Provides for liability for the publishing or distribution of material harmful to minors on the internet, provides for reasonable age verification, provides for individual rights of action, provides for attorney fees, court costs, and punitive damages, provides for exceptions, requiring a report by the Department of Justice for enforcement activity, provides for a fee, provides definitions.
|
Other Consumer Privacy
|
Nebraska
|
L 308
|
Genetic Information Privacy Act
|
Pending - Carryover
|
Adopts the Genetic Information Privacy Act.
|
Genetic Privacy
|
Nebraska
|
LR 20
|
Protect the Right of Individual Privacy
|
Pending - Carryover
|
Constitutional amendment to protect the right of individual privacy.
|
Constitutional Amendment
|
Nevada
|
A 320
|
Internet Privacy
|
Failed
|
Relates to internet privacy, imposes certain requirements on certain businesses that provide an online service, product or feature that is likely to be accessed by children, exempts certain information and entities from those requirements, provides a civil penalty for violations of those requirements, requires the attorney general to take certain actions before bringing a civil action against a business to recover such a civil penalty under certain circumstances.
|
Children’s Online Privacy; Other Consumer Privacy
|
Nevada
|
A 421
|
Consumer Data Collection
|
Failed
|
Establishes provisions governing the collection of the consumer data of Nevada consumers.
|
Information Brokers
|
Nevada
|
S 370
|
Consumer Health Data
|
Enacted
|
Relates to data privacy, requires certain entities to develop, maintain and make available on the internet a policy concerning the privacy of consumer health data, prohibits such an entity from collecting or sharing consumer health data without the affirmative consent of a consumer in certain circumstances, requires such an entity to perform certain actions upon the request of a consumer.
|
Other Consumer Privacy
|
New Hampshire
|
H 225
|
Privacy Rights
|
Pending
|
Provides that no currency, whether tangible, digital, or otherwise, which inherently compromises privacy by provision of transaction or usage details to any government agency or partner, allows programming of prohibited or mandatory uses, has the ability to block or refuse any lawful transactions, can be connected to any form of credit score, can be programmed with an expiration date, or can be programmed with non-market driven inflation, may be used as legal tender by any entity for any debts in the state.
|
Other Consumer Privacy
|
New Hampshire
|
S 255
|
Expectation of Privacy
|
Pending
|
Details a consumer expectation of privacy.
|
Comprehensive
|
New Jersey
|
A 505
|
Disclosure and Accountability Transparency Act
|
Pending
|
Relates to state Disclosure and Accountability Transparency Act (DATA), establishes certain requirements for disclosure and processing of personally identifiable information, establishes Office of Data Protection and Responsible Use in Division of Consumer Affairs.
|
Comprehensive
|
New Jersey
|
A 525
|
DNA Samples and Genetic Information Ownership
|
Pending
|
Makes DNA samples and genetic information resulting from DNA analysis property of the person sampled or analyzed.
|
Genetic Privacy
|
New Jersey
|
A 1399
|
Internet Subscribers Confidential Personal Information
|
Pending
|
Requires internet service providers to keep confidential subscriber's personally identifiable information unless subscriber authorizes internet service provider in writing to disclose information.
|
ISP Privacy
|
New Jersey
|
A 1544
|
Mobile Service Provider Third Party Restrictions
|
Pending
|
Prohibits providers of commercial mobile service and developers of mobile application from disclosing customers global position system data to third parties under certain circumstances.
|
Location Privacy
|
New Jersey
|
A 1954
|
Internet Service Providers
|
Pending
|
Requires internet service providers to keep confidential subscriber personally identifiable information unless subscriber authorizes internet service provider in writing or email to disclose information, prohibits subscriber penalty.
|
ISP Privacy
|
New Jersey
|
A 1971
|
Commercial Internet Websites Consumer Information
|
Pending
|
Requires online services to notify consumers of collection and disclosure of personally identifiable information and allows consumers to opt in.
|
Website Privacy
|
New Jersey
|
A 2029
|
Internet Service Providers Confidentiality Requirements
|
Pending
|
Requires internet service providers to keep confidential and prohibit any disclosure, sale, or unauthorized access to subscriber's personally identifiable information unless subscriber authorizes internet service provider in writing to disclose information.
|
ISP Privacy
|
New Jersey
|
A 2549
|
Consumer Personal Information Protection
|
Pending
|
Provides that every consumer reporting agency shall, to the extent it is technologically feasible, encrypt the personal information of consumers held by or transferred by the consumer reporting agency.
|
Other Consumer Privacy
|
New Jersey
|
A 2951
|
Microphone Enabled Devices Act
|
Pending
|
Creates the Microphone Enabled Devices Act, requires user consent before enabling device microphone.
|
Connected Devices
|
New Jersey
|
A 2952
|
Human Trafficking and Child Exploitation Prevention Act
|
Pending
|
Concerns the Human Trafficking and Child Exploitation Prevention Act, requires internet-connected devices to have blocking capability in certain circumstances.
|
Other Consumer Privacy
|
New Jersey
|
A 3741
|
Provision of Personal Health Information
|
Pending
|
Prohibits certain entities from requesting or requiring provision of personal health information.
|
Other Consumer Privacy
|
New Jersey
|
A 4723
|
Motor Vehicle Dealer and Personal Information
|
Pending
|
Requires motor vehicle dealer to delete personal information from motor vehicle computer system prior to resale or lease.
|
Other Consumer Privacy
|
New Jersey
|
A 4811
|
Data Broker Registry
|
Pending
|
Establishes data broker registry.
|
Information Brokers
|
New Jersey
|
A 4919
|
Childrens Data Protection Commission
|
Pending
|
Concerns social media privacy and data management for children and establishes New Jersey Children's Data Protection Commission.
|
Children’s Online Privacy; Studies, Task Forces, or Commissions
|
New Jersey
|
A 5075
|
Personal Health Information Acquisitions or Disclosures
|
Pending
|
Prohibits acquisitions or disclosures of personal health information without consent.
|
Biometrics or Facial Recognition; Other Consumer Privacy
|
New Jersey
|
A 5254
|
Data Brokers Registration
|
Pending
|
Requires registration of data brokers, prohibits brokering of certain health records.
|
Information Brokers
|
New Jersey
|
A 5351
|
Biometric Identifier Information Collection
|
Pending
|
Prohibits collection of biometric identifier information by public or private entity under certain circumstances.
|
Biometrics or Facial Recognition
|
New Jersey
|
A 5599
|
Business Biometric Surveillance System Prohibition
|
Pending
|
Prohibits use of biometric surveillance system by business entity under certain circumstances.
|
Biometrics or Facial Recognition
|
New Jersey
|
S 332
|
Online Services Consumer Notification
|
Pending
|
Requires online services to notify consumers of collection and disclosure of personally identifiable information and allows consumers to opt in, defines business as a sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners, that collects consumers' personal information.
|
Website Privacy
|
New Jersey
|
S 831
|
Personal Health Information
|
Pending
|
Prohibits certain entities from requesting or requiring provision of personal health information.
|
Other Consumer Privacy
|
New Jersey
|
S 1156
|
Information Technology System Protection Loan
|
Pending
|
Requires Economic Development Authority to establish program offering low interest loan to certain financial institutions and personal data businesses to protect business's information technology system from customer personal information disclosure.
|
Other Consumer Privacy
|
New Jersey
|
S 1262
|
Mercantile Merchandise Return Regulations
|
Pending
|
Prohibits retail mercantile establishments from requiring certain consumer identification for return of merchandise.
|
Other Consumer Privacy
|
New Jersey
|
S 1353
|
Consumer Reporting Agencies Information Protection
|
Pending
|
Requires consumer reporting agencies to increase protection of consumers' personal information.
|
Other Consumer Privacy
|
New Jersey
|
S 1550
|
Individually Identifiable Health Information
|
Pending
|
Prohibits teaching staff members from inputting information and conversations regarding individually identifiable health information into third party software applications managed by entities engaging in partisan political activity.
|
Other Consumer Privacy
|
New Jersey
|
S 2740
|
Motor Vehicle Computer System
|
Pending
|
Requires motor vehicle dealer to delete personal information from motor vehicle computer system prior to resale or lease.
|
Other Consumer Privacy
|
New Jersey
|
S 2953
|
Customers Global Position System Data
|
Pending
|
Prohibits providers of commercial mobile service and developers of mobile application from disclosing customer's global position system data to third parties under certain circumstances.
|
Location Privacy
|
New Jersey
|
S 3493
|
Children Data Protection Commission
|
Pending
|
Concerns social media privacy and data management for children and establishes the State Children's Data Protection Commission.
|
Children’s Online Privacy
|
New Jersey
|
S 3499
|
Facial Recognition Technology Uses
|
Pending
|
Prohibits use of facial recognition technology on consumer expect for legitimate safety purpose.
|
Biometrics or Facial Recognition
|
New Jersey
|
S 3714
|
Personal Identifiable Information Disclosures
|
Pending
|
Regards the New Jersey Disclosure and Accountability Transparency Act (NJ DATA), establishes certain requirements for disclosure and processing of personally identifiable information, establishes Office of Data Protection and Responsible Use in Division of Consumer Affairs.
|
Comprehensive
|
New Mexico
|
H 488
|
Dissemination of Health Data
|
Failed - Adjourned
|
Relates to dissemination of certain health data.
|
Other Consumer Privacy
|
New Mexico
|
S 319
|
Age Appropriate Design Code Act
|
Failed - Adjourned
|
Relates to the Age-Appropriate Design Code Act.
|
Children’s Online Privacy
|
New York
|
A 48
|
Multiple Dwelling Law
|
Pending
|
Relates to the multiple dwelling law and the multiple residence law, relates to the use of smart access systems and the information that may be gathered from such systems, provides that owners or their agents shall provide notice to a tenant or lawful occupant at the time the tenant or lawful occupant signs the lease, or when the smart access system is installed, of the provisions of subdivision two of this section.
|
Biometrics or Facial Recognition
|
New York
|
A 322
|
Use of a Facial Recognition System by Landlord
|
Pending
|
Prohibits the use of a facial recognition system by a landlord on any residential premises.
|
Biometrics or Facial Recognition
|
New York
|
A 417
|
Disclosure of Personal Information by Businesses
|
Pending
|
Restricts the disclosure of personal information by businesses, provides that a business that retains a customer's personal information shall make available to the customer free of charge access to, or copies of, all the customer's personal information retained by the business.
|
Comprehensive
|
New York
|
A 711
|
Consent To Collection of Personal Information
|
Pending
|
Requires express and affirmative consent prior to collection, storage or transmittal of any personal information obtained from the installation or use of a smart home connected system by certain persons.
|
Connected Devices
|
New York
|
A 936
|
Parental Disclosures by Internet Platforms
|
Pending
|
Provides that upon request from a verified parent of a minor, an operator service who collects or maintains personal information from or about the user of or visitors to an platform or online service shall, to the extent practicable provide the verified parent with digital or physical copies of all advertisements and other content which the minor was shown by the operator on the operator's platform that were shown solely based on the minor's identifiers.
|
Children’s Online Privacy
|
New York
|
A 1362
|
Biometric Privacy Act
|
Pending
|
Establishes the biometric privacy act, requires private entities in possession of biometric identifiers or biometric information to develop a written policy establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within three years of the individual's last interaction with the private entity, whichever occurs first.
|
Biometrics or Facial Recognition
|
New York
|
A 1366
|
Online Consumer Protection Act
|
Pending
|
Relates to establishing the online consumer protection act, defines terms, provides that an advertising network shall post clear and conspicuous notice on the home page of its own website about its privacy policy and its data collection and use practices related to its advertising delivery activities, makes related provisions.
|
Website Privacy
|
New York
|
A 1484
|
Disclosure of Personally Identifiable Information
|
Pending
|
Prohibits the disclosure of personally identifiable information by an internet service provider without the express written approval of the consumer.
|
ISP Privacy
|
New York
|
A 1731
|
Insurer Demands for Personal and Financial Information
|
Pending
|
Restricts insurers from demanding intrusive personal, financial and tax information from insureds as a standard practice in processing ordinary theft claims where no special circumstances warranting a demand for such information exists.
|
Other Consumer Privacy
|
New York
|
A 1766
|
Retailer Warning Signs of the Tracking of Customers
|
Pending
|
Requires retailers to post warning signs of the tracking of customers through cell phones or other electronic devices, provides for civil penalties.
|
Other Consumer Privacy
|
New York
|
A 2529
|
General Protection Data Regulation Study
|
Pending
|
Establishes a commission to study the European Union's general protection data regulation and the current state of cyber security in the state.
|
Studies, Task Forces, or Commissions
|
New York
|
A 2587
|
New York Data Protection Act
|
Pending
|
Establishes the New York Data Protection Act, requires government entities and contractors to disclose certain personal information collected about individuals.
|
Comprehensive
|
New York
|
A 2621
|
Use of Biometric Identity Verification Devices
|
Pending
|
Relates to the use of biometric identity verification devices for the purchase of alcoholic beverages and tobacco products, authorizes a licensee, its agent or employee to determine a person's age when purchasing alcoholic beverages or tobacco products by use of a biometric identity verification device, establishes where the use of the device indicates that the person is under the age of 21, the attempted purchase of the alcoholic beverage shall be denied.
|
Biometrics or Facial Recognition
|
New York
|
A 2642
|
Facial Recognition Technology Study Act
|
Pending
|
Enacts the "facial recognition technology study act" to study privacy concerns and potential regulatory approaches to the development of facial recognition technology.
|
Biometrics or Facial Recognition; Studies, Task Forces, or Commissions
|
New York
|
A 2853
|
Life Insurers
|
Pending
|
Authorizes life insurers to establish wellness programs, provides that with regard to life insurance, an insurer is prohibited from increasing premiums or charges stated in the policy as a result of participation or non-participation in the program, provides that a wellness program may include, but is not limited to, specified programs or services, including preventative care, screenings, or chronic disease management program and a meditation, sleep improvement or similar program or service.
|
Biometrics or Facial Recognition
|
New York
|
A 2896
|
Critical Energy Infrastructure Security
|
Enacted
|
Relates to critical energy infrastructure security and responsibility, provides that the Public Service Commission shall have power to provide for management and operations audits of gas corporations and electric corporations, provides that the audit shall include, but not be limited to, an evaluation of customer privacy protections, including but not limited to customer electrical and gas consumption data, provides that customer electric and gas consumption data shall be considered confidential.
|
Other Consumer Privacy
|
New York
|
A 3285
|
Privacy Standards for Electronic Health Products
|
Pending
|
Creates privacy standards for electronic health products and services, requires consent to be given for the collection and/or sharing of personal health information or other personal data.
|
Other Consumer Privacy
|
New York
|
A 3308
|
Digital Fairness Act
|
Pending
|
Enacts the Digital Fairness Act, requires any entity that conducts business in New York and maintains the personal information of 500 or more individuals to provide meaningful notice about their use of personal information, establishes unlawful discriminatory practices relating to targeted advertising.
|
Comprehensive
|
New York
|
A 3593
|
State Privacy Act
|
Pending
|
Enacts the State Privacy Act to require companies to disclose their methods of de-identifying personal information, to place special safeguards around data sharing and to allow consumers to obtain the names of all entities with whom their information is shared.
|
Comprehensive
|
New York
|
A 3959
|
Excise Tax on Collection of Consumer Data
|
Pending
|
Creates an excise tax on the collection of consumer data by commercial data collectors.
|
Information Brokers
|
New York
|
A 4374
|
Personal Information Collection
|
Pending
|
Grants a consumer a right to request a business to disclose the categories and specific pieces of personal information that it collects about the consumer, the categories of sources from which that information is collected, the business purposes for collecting or selling the information, and the categories of third parties with which the information is shared.
|
Comprehensive
|
New York
|
A 4967
|
Child Data Privacy Protection Act
|
Pending
|
Amends the General Business Law, enacts the State Child Data Privacy Protection Act to prevent the exploitation of children's data, requires data controllers to assess the impact of its products on children for review by the Bureau of Internet and Technology, bans certain data collection and targeted advertising.
|
Children’s Online Privacy
|
New York
|
A 5468
|
Use of Voice Recognition Features
|
Pending
|
Provides that a person or entity shall not provide the operation of a voice recognition feature within this state without prominently informing, during the initial setup or installation of a connected device, either the user or the person designated by the user to perform the initial setup or installation of the connected device of the functions of the device, that the device may be recording the user, and that the entity that makes the device may be retaining these recordings.
|
Connected Devices
|
New York
|
A 6319
|
Consumers Foundational Data Privacy Rights
|
Pending
|
Establishes consumers' foundational data privacy rights, creates oversight mechanisms, establishes enforcement mechanisms, establishes the Privacy and Security Victims Relief Fund.
|
Comprehensive
|
New York
|
A 6427
|
Baby Monitors
|
Pending
|
Prohibits retailers and secondhand dealers from selling, offering for sale, leasing or otherwise making available a baby monitor that broadcasts audio or video through an internet connection unless it includes certain security features to prevent unauthorized access, requires a written warning label.
|
Connected Devices
|
New York
|
A 7423
|
New York Data Protection Act
|
Pending
|
Amends the general business law, in relation to the management and oversight of personal data, enacts the New York Data Protection Act.
|
Comprehensive
|
New York
|
A 7451
|
Genetic Testing Results
|
Pending
|
Requires genetic testing results only be received by patients and health care providers providing direct care while health insurance companies only receive a record that the genetic testing was performed, provides insurers cannot require access to genetic testing results and cannot take adverse action against someone for not providing genetic testing results.
|
Genetic Privacy
|
New York
|
A 7625
|
Use of Biometric Surveillance System
|
Pending
|
Prohibits the use of biometric surveillance system or biometric surveillance information in places of public accommodation, prohibits entering into any agreement that authorizes any third party to use any biometric surveillance system or biometric surveillance information, provides penalties for violations.
|
Biometrics or Facial Recognition
|
New York
|
S 158
|
New York Health Information Privacy Act
|
Pending
|
Providing for the protection of health information, provides definitions, provides that all notices, disclosures, forms, and other communications to individuals provided pursuant to this article shall comply with using plain, straightforward language, avoiding technical or legal jargon, and must be provided through an interface regularly used in conjunction with the regulated entity's product or service.
|
Other Consumer Privacy
|
New York
|
S 365
|
Privacy Act
|
Pending
|
Relates to the management and oversight of personal data, relates to enacting the New York Privacy Act.
|
Comprehensive
|
New York
|
S 1298
|
Use of Voice Recognition Features on Products
|
Pending
|
Provides that a person or entity shall not provide the operation of a voice recognition feature within this state without prominently informing, during the initial setup or installation of a connected device, either the user or the person designated by the user to perform the initial setup or installation of the connected device of the functions of the device, that the device may be recording the user, and that the entity that makes the device may be retaining these recordings.
|
Connected Devices
|
New York
|
S 2012
|
Excise Tax on Collection of Consumer Data
|
Pending
|
Creates an excise tax on the collection of consumer data by commercial data collectors.
|
Information Brokers
|
New York
|
S 2078
|
Use of Electronic or Computerized Entry Systems
|
Pending
|
Relates to the use of smart access systems and the information that may be gathered from such systems, limits to account information necessary to enable the use of such smart access system, or reference data any smart access system should gathered, prohibits location tracking, including but not limited to satellite location based services, shall be included in any equipment, key, or software provided to users as part of a smart access system.
|
Biometrics or Facial Recognition
|
New York
|
S 2277
|
Digital Fairness Act
|
Pending
|
Enacts the "Digital Fairness Act," requires any entity that conducts business in New York and maintains the personal information of 500 or more individuals to provide meaningful notice about their use of personal information, establishes unlawful discriminatory practices relating to targeted advertising.
|
Comprehensive
|
New York
|
S 2324
|
Parental Disclosures by Internet Platforms
|
Pending
|
Discloses to a parent the personal information and content about a minor collected by an operator of an internet platform when a parent requests such information.
|
Children’s Online Privacy
|
New York
|
S 2390
|
Use of Biometric Data for Advertising
|
Pending
|
Relates to prohibiting private entities from using biometric data for any advertising, detailing, marketing, promotion, or any other activity that is intended to be used to influence business volume, sales or market share or to evaluate the effectiveness of marketing practices or marketing personnel.
|
Biometrics or Facial Recognition
|
New York
|
S 2404
|
Retailer Warning Signs of Tracking of Customers
|
Pending
|
Requires retailers to post warning signs of the tracking of customers through cell phones or other electronic devices, provides for civil penalties.
|
Other Consumer Privacy
|
New York
|
S 2478
|
Use of a Facial Recognition System by a Landlord
|
Pending
|
Prohibits the use of a facial recognition system by a landlord on any residential premises.
|
Biometrics or Facial Recognition
|
New York
|
S 2661
|
Personal Information of a Credit or Debit Card Holder
|
Pending
|
Relates to the personal information of a credit or debit card holder, adds ZIP code, e-mail address and home, cell and work telephone numbers to the personal information protected.
|
Other Consumer Privacy
|
New York
|
S 2998
|
Online Consumer Protection Act
|
Pending
|
Establishes the Online Consumer Protection Act, defines terms, provides that an advertising network shall post clear and conspicuous notice on the home page of its own website about its privacy policy and its data collection and use practices related to its advertising delivery activities, makes related provisions.
|
Website Privacy
|
New York
|
S 3162
|
Consumer Right to Request Disclosure of Information
|
Pending
|
Grants a consumer a right to request a business to disclose the categories and specific pieces of personal information that it collects about the consumer, the categories of sources from which that information is collected, the business purposes for collecting or selling the information, and the categories of third parties with which the information is shared.
|
Comprehensive
|
New York
|
S 3163
|
Disclosure of Personal Information by Businesses
|
Pending
|
Restricts the disclosure of personal information by businesses, provides that a business that retains a customer's personal information shall make available to the customer free of charge access to, or copies of, all the customer's personal information retained by the business.
|
Other Consumer Privacy
|
New York
|
S 3164
|
Unlawful Use of Driver's License or ID Card
|
Pending
|
Relates to the unlawful use of a New York driver's license or identification card.
|
Other Consumer Privacy
|
New York
|
S 3281
|
State Child Data Privacy Protection Act
|
Pending
|
Enacts the New York Child Data Privacy Protection Act to prevent the exploitation of children's data, requires data controllers to assess the impact of its products on children for review by the bureau of internet and technology, bans certain data collection and targeted advertising.
|
Children’s Online Privacy
|
New York
|
S 4201
|
State Data Protection Act
|
Pending
|
Establishes the State Data Protection Act, requires government entities and contractors to disclose certain personal information collected about individuals.
|
Comprehensive
|
New York
|
S 4367
|
Disclosure of Personally Identifiable Information
|
Pending
|
Prohibits the disclosure of personally identifiable information by an internet service provider without the express written approval of the consumer.
|
ISP Privacy
|
New York
|
S 4377
|
Privacy Protection Policies on Internet Websites
|
Pending
|
Relates to privacy protection policies on internet websites, online services, online applications and mobile applications that collect Social Security numbers.
|
Website Privacy
|
New York
|
S 4457
|
Biometric Privacy Act
|
Pending
|
Establishes the Biometric Privacy Act, requires private entities in possession of biometric identifiers or biometric information to develop a written policy establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information when the initial purpose for collecting or obtaining such identifiers or information has been satisfied or within three years of the individual's last interaction with the private entity, whichever occurs first.
|
Biometrics or Facial Recognition
|
New York
|
S 4641
|
Sale of Personal Information by ISP
|
Pending
|
Relates to the sale of personal information by an internet service provider.
|
ISP Privacy
|
New York
|
S 4762
|
Unlawful Possession of a Patient Record
|
Pending
|
Relates to the unlawful possession of a patient record, makes such offense a class A misdemeanor.
|
Other Consumer Privacy
|
New York
|
S 4940
|
Inherent Right of Each Person to Personal Privacy
|
Pending
|
Provides that the inherent right of each person to personal privacy shall not be infringed.
|
Constitutional Amendment
|
New York
|
S 5555
|
It's Your Data Act
|
Pending
|
Establishes the It's Your Data Act for the purposes of providing protections and transparency in the collection, use, retention, and sharing of personal information.
|
Comprehensive
|
New York
|
S 5662
|
Data Economy Labor Compensation and Accountability Act
|
Pending
|
Enacts the "Data Economy Labor Compensation and Accountability Act," establishes the office of consumer data protection for the purpose of properly safeguarding personal data, imposes a tax on data controllers and data processors required to register with such office.
|
Information Brokers
|
New York
|
S 5890
|
Life Insurers
|
To governor
|
Authorizes life insurers to establish wellness programs in conjunction with the issuance of life insurance policies, provides for full or partial reimbursement for the cost of a device and associated subscription that can be used to track activity or biometric data, provides for discounts on life insurance and on products or services intended to incent positive behavioral changes.
|
Biometrics or Facial Recognition
|
New York
|
S 6224
|
Entities Providing Electronic Communications Services
|
Pending
|
Prohibits persons or entities headquartered or incorporated in New York that provide electronic communications services to the public, from producing records that would reveal the identity of the customers using those services, data stored by or on behalf of the customers, the customers' usage of those services, the recipient or destination of communications sent to or from those customers, or the content of those communications.
|
ISP Privacy
|
New York
|
S 6418
|
Regulation of Social Media Companies and Platforms
|
Pending
|
Relates to the regulation of social media companies and social media platforms, provides for age requirements for the use of social media and parental consent, prohibits certain data collection from social media accounts, limits the hours a minor can have access to social media, establishes penalties for violations.
|
Children’s Online Privacy
|
New York
|
S 6656
|
Use of Biometric Identity Verification Devices
|
Pending
|
Relates to the use of biometric identity verification devices for the purchase of alcoholic beverages and tobacco products, authorizes a licensee, its agent or employee to determine a person's age when purchasing alcoholic beverages or tobacco products by use of a biometric identity verification device, establishes where the use of the device indicates that the person is under the age of 21, the attempted purchase of the alcoholic beverage shall be denied.
|
Biometrics or Facial Recognition
|
New York
|
S 7135
|
Use of Biometric Surveillance Systems
|
Pending
|
Prohibits the use of biometric surveillance system or biometric surveillance information in places of public accommodation, prohibits entering into any agreement that authorizes any third party to use any biometric surveillance system or biometric surveillance information, provides penalties for violations.
|
Biometrics or Facial Recognition
|
North Carolina
|
H 534
|
Pornography Age Verification Enforcement Act
|
Pending
|
Creates liability for publishers and distributors of material harmful to minors, provides that any commercial entity that knowingly and intentionally publishes or distributes material harmful to minors on the internet from a website that contains a substantial portion of such material shall be subject to civil penalties if the entity fails to perform reasonable age verification methods.
|
Other Consumer Privacy
|
North Carolina
|
H 644
|
Social Media Addiction
|
Pending
|
Combats social media addiction by requiring that social media platforms respect the privacy of state users' data and not use a state minor's data for advertising or algorithmic recommendations and makes willful violations of data user privacy an unfair practice under General Statutes.
|
Children’s Online Privacy; Studies, Task Forces, or Commissions
|
North Carolina
|
H 754
|
Protected Health Information
|
Pending
|
Enhances protections against the use, disclosure, or sale of protected health information by requiring a notice of data sale or transfer.
|
Other Consumer Privacy
|
North Carolina
|
H 773
|
Let Parents Choose or Sammy's Law of 2023
|
Pending
|
Enacts the Let Parents Choose Protection Act of 2023 to facilitate management of the social media interactions of children.
|
Children’s Online Privacy
|
North Carolina
|
S 525
|
Consumer Privacy Act
|
Pending
|
Protects consumers by enacting the Consumer Privacy Act of the state.
|
Comprehensive
|
North Dakota
|
None
|
|
|
|
|
N. Mariana Islands
|
Not available
|
|
|
|
|
Ohio
|
None
|
|
|
|
|
Oklahoma
|
H 1030
|
Privacy of Computer Data
|
Pending - Carryover
|
Relates to privacy of computer data, enacts the State Computer Data Privacy Act, defines terms, provides for applicability of act to certain businesses that collect consumers' personal information, provides exemptions, prescribes compliance with other laws and legal proceedings, requires act to be liberally construed to align its effects with other laws relating to privacy and protection of personal information, provides for controlling effect of federal law.
|
Comprehensive
|
Oregon
|
H 2052
|
License Brokered Personal Data
|
Enacted
|
Provides that data broker may not collect, sell or license brokered personal data within this state unless data broker first registers with Department of Consumer and Business Services.
|
Information Brokers
|
Oregon
|
H 2370
|
Attorney General
|
Failed
|
Requires attorney general to study privacy.
|
Studies, Task Forces, or Commissions
|
Oregon
|
H 3114
|
Hotel Guest Personal Information Disclosure
|
Failed
|
Prohibits hotelkeeper or innkeeper from requiring qualified victim services program that facilitates reservation or rental of guest room in hotel or inn to disclose personal information of victim of domestic violence, sexual assault or stalking.
|
Other Consumer Privacy
|
Oregon
|
H 3327
|
Proprietors of Electronic Communications Network
|
Failed
|
Prohibits proprietor of electronic communications network from selling, sharing, transmitting, transferring or otherwise providing to any person information that reveals time and date at which or geographical location in this state from which mobile electronic communication device that resident individual owns, controls or possesses connected to or communicated with proprietor's electronic communications network.
|
ISP Privacy; Location Privacy
|
Oregon
|
H 3338
|
Protected Health Information of Individual
|
Failed
|
Requires health insurers, state health plans, health care providers and other covered entities to comply with request of individual or personal representative of individual to restrict or opt out of disclosure of protected health information of individual.
|
Other Consumer Privacy
|
Oregon
|
S 196
|
Online Products Services or Features
|
Failed
|
Requires business that provides online product, service or feature that child is reasonably likely to access to identify, evaluate and mitigate risks to child from online product, service or feature.
|
Children’s Online Privacy; Studies, Task Forces, or Commissions
|
Oregon
|
S 619
|
Consumer Personal Data Confirmation
|
Enacted
|
Permits consumers to obtain from a controller that processes consumer personal data confirmation as to whether controller is processing consumer's personal data and categories of personal data controller is processing, a list of specific third parties to which controller has disclosed consumer's personal data, and a copy of all of consumer's personal data that controller has processed or is processing.
|
Comprehensive
|
Oregon
|
S 1062
|
Personally Identifiable Information of Consumers
|
Failed
|
Requires person who operates website or online service for commercial purposes that collects consumers' personally identifiable information to develop, maintain and implement data management practices policy and post policy or link to policy prominently on website or online service home page.
|
Website Privacy
|
Pennsylvania
|
H 708
|
Protection of Certain Personal Data of Consumers
|
Pending
|
Provides for protection of certain personal data of consumers, imposes duties on controllers and processors of personal data of consumers, provides for enforcement, prescribes penalties, establishes the Consumer Privacy Fund.
|
Comprehensive
|
Pennsylvania
|
H 739
|
Insurance Data Security
|
Enacted
|
Relates to regulation of insurers and related persons generally, provides for insurance data security, relates to reserve liabilities, repeals provisions relating to small company exemption and provides for adoption of exemption standards of the NAIC Valuation Manual.
|
Other Consumer Privacy
|
Pennsylvania
|
H 800
|
Sharing of Reproductive Health Information
|
Pending
|
Amends the act known as The Insurance Company Law, provides for sharing of reproductive health information.
|
Other Consumer Privacy
|
Pennsylvania
|
H 812
|
Privacy Transparency
|
Pending
|
Provides for privacy, transparency and compensation regarding the disclosure of information collected by genetic material testing entities.
|
Genetic Privacy
|
Pennsylvania
|
H 926
|
Biometric Identifier Information
|
Pending
|
Provides for a requirement for commercial establishments to disclose the use and collection of biometric identifier information, provides for a private cause of action.
|
Biometrics or Facial Recognition
|
Pennsylvania
|
H 964
|
Smart Technology Devices
|
Pending
|
Provides for transparency and disclosure of information collected by smart technology devices, establishes the Smart Technology Disclosure Fund, provides for powers and duties of the Office of Attorney General.
|
Connected Devices
|
Pennsylvania
|
H 1201
|
Consumer Data Privacy
|
Pending
|
Provides for consumer data privacy, for duties of controllers and for duties of processors, imposes penalties.
|
Comprehensive
|
Pennsylvania
|
H 1589
|
Protection of Pregnant Individuals Information
|
Pending
|
Provides for protection of pregnant individuals' information, for authorization for disclosure, for data breach and for violation.
|
Other Consumer Privacy
|
Pennsylvania
|
S 22
|
Protection of Minors on Social Media
|
Pending
|
Amends Title 50 Mental Health of the Pennsylvania Consolidated Statutes, provides for protection of minors on social media, imposes penalties.
|
Children’s Online Privacy
|
Pennsylvania
|
S 117
|
Sale of Malt or Brewed Beverages
|
Pending
|
Amends the act known as the Liquor Code, in licenses and regulations and liquor, alcohol and malt and brewed beverages, provides for sale of malt or brewed beverages by liquor licenses, for wine expanded permits and for retail dispensers' restrictions on purchases and sales.
|
Other Consumer Privacy
|
Pennsylvania
|
S 129
|
Spirit Expanded Permits
|
Pending
|
Amends the act known as the Liquor Code, in preliminary provisions, provides for definitions, relates to licenses and regulations and liquor, alcohol and malt and brewed beverages, provides for spirit expanded permits.
|
Other Consumer Privacy
|
Pennsylvania
|
S 565
|
Student Data Privacy and Protection
|
Pending
|
Provides that the secretary of education shall designate an individual to serve as the chief data privacy officer within the Department of Education to assume primary responsibility for student data privacy and security policy, provides that an educational entity shall adopt and implement reasonable security policies and procedures to protect educational records and student data to protect information from unauthorized access, destruction, use, modification or disclosure.
|
Children’s Online Privacy
|
Puerto Rico
|
H 129
|
Charter of Digital Sphere Rights
|
Pending
|
Establishes the Charter of Digital Rights of Puerto Rico to safeguard the human rights of people in the digital sphere.
|
|
Puerto Rico
|
H 262
|
Cyber Privacy Protection Law
|
Pending
|
Creates the Law for the Protection of Cyber Privacy of Our Children and Young People in order to prohibit any operator, employee or agent of an internet page classified as a social network, as defined herein, from publishing and or disclose personal information of underage users residing in Puerto Rico, beyond the name and city where they reside, without the express consent of the father, mother or guardian with parental authority.
|
Children’s Online Privacy
|
Puerto Rico
|
H 655
|
Electronic Information Privacy Law
|
Pending
|
Establishes the Electronic Information Privacy Law to protect the right to privacy of individuals regarding information stored on an electronic device or transmitted to a remote computer service provider.
|
ISP Privacy
|
Puerto Rico
|
H 1548
|
Protection of Data
|
Pending
|
Relates to Law for the Protection of Data and Information of the Consumer, in order that the consumer must give his informed consent on the collection, use and access of the information that he provides, by virtue of a request by any resident individual of Puerto Rico who establishes a business, legal entity incorporated or organized under the laws of Puerto Rico or of any jurisdiction of the United States, or a foreign corporation that has an office or other fixed location and that operates.
|
|
Puerto Rico
|
S 882
|
Law for the Protection of Digital Privacy
|
Pending
|
Relates to Law for the Protection of Digital Privacy, protects the personal information of consumers and guarantee the right to privacy in the digital age.
|
|
Rhode Island
|
H 5354
|
State Data Transparency and Privacy
|
Pending
|
Requires online service providers and commercial websites that collect, store and sell personally identifiable information to disclose what categories of personally identifiable information they collect and to what third parties they sell the information, provides that this would not prohibit the collection or sale of personally identifiable information and would not require the retention or disclosure of personally identifiable information by online service providers or commercial websites.
|
Website Privacy
|
Rhode Island
|
H 5687
|
Disclosure of Confidential Healthcare Information
|
Pending
|
Amends provisions of law relative to the disclosure of confidential healthcare information and records and the disclosure thereof occurring through electronic means.
|
Other Consumer Privacy
|
Rhode Island
|
H 5745
|
Personal Data and Online Privacy Protection Act
|
Pending
|
Establishes the Rhode Island Personal Data and Online Privacy Protection Act, provides for the protection of personal data of individuals which is collected by certain commercial enterprises, including persons and enterprises that conduct business in the state, provides that the attorney general would be charged with enforcement of this act.
|
Comprehensive; Studies, Task Forces, or Commissions
|
Rhode Island
|
H 6236
|
Data Transparency and Privacy Protection Act
|
Pending
|
Provides data privacy protections for the personal identifiable information of State residents.
|
Comprehensive
|
Rhode Island
|
S 146
|
Use of Facial and Biometric Recognition Technology
|
Pending
|
Relates to state affairs and government, relates to video lottery games, table games and sports wagering, relates to the Rhode Island consumer protection gaming act, prohibits the use of facial recognition technology and biometric recognition technology in video lottery terminals at pari-mutuel licensees in the state or in online betting applications.
|
Biometrics or Facial Recognition
|
Rhode Island
|
S 754
|
Data Transparency and Privacy Protection
|
Pending
|
Provides data privacy protections for the personal identifiable information of Rhode Islanders.
|
Comprehensive
|
A. Samoa
|
Not available
|
|
|
|
|
South Carolina
|
H 3424
|
Pornographic Website Provision
|
Pending - Carryover
|
Provides definitions, provides that it is unlawful for an operator to make a pornographic website available to persons under the age of 18, provides that the attorney general shall create certain procedures, provides for a private right of action.
|
Other Consumer Privacy
|
South Carolina
|
H 3547
|
Personal Information Collection Prohibition
|
Pending - Carryover
|
Prohibits the collection of personal information from children by operators of websites, online services, and online or mobile applications and to establish penalties.
|
Children’s Online Privacy
|
South Carolina
|
S 156
|
Public Utilities Customer Information Disclosure
|
Pending - Carryover
|
Prohibits natural gas or electric public utilities from disclosing customer information to a third party without the express consent of the customer.
|
Other Consumer Privacy
|
South Dakota
|
H 1240
|
Guardianships and Conservatorship
|
Enacted
|
Provides that the court must grant an interested person access to some or all of a protected person's medical or financial records if, on the motion of the interested person, the court finds access is in the best interest of the protected person, provides that if the court does not grant access, the court must issue written findings of fact and conclusions of law as to why the medical or financial records access was not granted.
|
Other Consumer Privacy
|
South Dakota
|
S 192
|
Harmful Material to Minors
|
Failed - Adjourned
|
Provides liability for the publishing or distributing of material harmful to minors on the internet and the wrongful retention of individually identifiable information.
|
Other Consumer Privacy
|
South Dakota
|
S 198
|
Medical Cannabis Establishments and Cardholder Data
|
Enacted
|
Allows medical cannabis establishments to maintain certain cardholder data, provides that a cardholder may, in writing, authorize an establishment to maintain the cardholder's name and other personally identifiable information, for the limited purpose of receiving direct communication regarding the cardholder's individual medical needs or use of a specific product.
|
Other Consumer Privacy
|
Tennessee
|
H 932
|
Consumer Biometric Data Protection Act
|
Pending - Carryover
|
Enacts the Consumer Biometric Data Protection Act.
|
Biometrics or Facial Recognition
|
Tennessee
|
H 965
|
Banks and Financial Institutions
|
Pending - Carryover
|
Prohibits a financial institution from releasing or providing the account balance or transaction activity of an account to a person without first obtaining the account holder's express permission or without a warrant issued by a judicial officer located in the state.
|
Other Consumer Privacy
|
Tennessee
|
H 1181
|
Consumer Protection
|
Enacted
|
Enacts the Tennessee Information Protection Act, provides that a consumer may invoke the consumer rights at any time by submitting a request to a controller specifying the consumer rights the consumer wishes to invoke, provides that a controller shall comply with an authenticated consumer request to exercise the right to confirm whether a controller is processing the consumer's personal information and to access the personal information.
|
Comprehensive
|
Tennessee
|
H 1310
|
Genetic Information Privacy Act
|
Enacted
|
Provides that a direct-to-consumer genetic testing company shall provide to a consumer essential information about the company's collection, use, and disclosure of genetic data and a prominent, publicly available privacy notice that includes information about the company's data collection, consent, use, access, disclosure, transfer, security, retention, and deletion practices and obtain a consumer's initial express consent for collection, use, or disclosure of the consumer's genetic data.
|
Genetic Privacy
|
Tennessee
|
H 1486
|
Consumer Protection
|
Pending - Carryover
|
Prohibits a business entity from retaining a copy, in an electronic or other format, of a person's identification unless the retention of that copy is specifically required by federal or state law, or the business entity obtains the express consent of the holder of that identification, prohibits a business entity from refusing to transact business with a person solely on the basis that the person refuses to provide express consent to the business entity or its agent, employee, or contractor.
|
Other Consumer Privacy
|
Tennessee
|
S 73
|
Consumer Protection
|
Pending - Carryover
|
Relates to Consumer Protection, enacts the Tennessee Information Protection Act.
|
Comprehensive
|
Tennessee
|
S 339
|
Consumer Protection
|
Pending - Carryover
|
Enacts the Consumer Biometric Data Protection Act.
|
Biometrics or Facial Recognition
|
Tennessee
|
S 1294
|
DNA and Genetic Testing
|
Pending - Carryover
|
Prohibits a life insurance provider from canceling a life insurance policy based on genetic information, from requesting or requiring genetic testing as a condition of insurability, and from accessing the genetic data of an individual without consent.
|
Genetic Privacy
|
Tennessee
|
S 1295
|
Consumer Protection
|
Pending - Carryover
|
Enacts the Genetic Information Privacy Act.
|
Genetic Privacy
|
Tennessee
|
S 1353
|
Consumer Protection
|
Pending - Carryover
|
Prohibits a business entity from retaining a copy, in an electronic or other format, of a person's identification unless the retention of that copy is specifically required by federal or state law, or the business entity obtains the express consent of the holder of that identification, prohibits a business entity from refusing to transact business with a person solely on the basis that the person refuses to provide express consent to the business entity or its agent, employee, or contractor.
|
Other Consumer Privacy
|
Tennessee
|
S 1379
|
Banks and Financial Institutions
|
Pending - Carryover
|
Prohibits a financial institution from releasing or providing the account balance or transaction activity of an account to a person without first obtaining the account holder's express permission or without a warrant issued by a judicial officer located in this state.
|
Other Consumer Privacy
|
Texas
|
H 4
|
Regulation of Personal Data Collection and Use
|
Enacted
|
Relates to the regulation of the collection, use, processing, and treatment of consumers' personal data by certain business entities, imposes a civil penalty.
|
Comprehensive
|
Texas
|
H 18
|
Protection of Minors
|
Enacted
|
Relates to the protection of minors from harmful, deceptive, or unfair trade practices in connection with the use of certain digital services and electronic devices, including the use and transfer of electronic devices to students by a public school.
|
Children’s Online Privacy; Other Consumer Privacy
|
Texas
|
H 896
|
Use of Social Media Platforms by Children
|
Failed - Adjourned
|
Relates to prohibiting use of social media platforms by children.
|
Children’s Online Privacy; Other Consumer Privacy
|
Texas
|
H 1181
|
Restricting Access to Pornographic Materials
|
Enacted
|
Relates to the publication or distribution of sexual material harmful to minors on an internet website, provides a civil penalty.
|
Other Consumer Privacy
|
Texas
|
H 1844
|
Processing and Treatment of Consumers' Personal Data
|
Failed - Adjourned
|
Relates to the regulation of the collection, use, processing, and treatment of consumers' personal data by certain business entities, imposes a civil penalty.
|
Comprehensive
|
Texas
|
H 2545
|
Use of an Individuals Genetic Data
|
Enacted
|
Relates to an individual's genetic data, including the use of that data by certain genetic testing companies for commercial purposes and the individual's property right in DNA, authorizing a civil penalty.
|
Genetic Privacy
|
Texas
|
H 3570
|
Restricting Access to Sexual Material Harmful to Minors
|
Failed - Adjourned
|
Relates to restricting access to sexual material harmful to minors on an internet website.
|
Other Consumer Privacy
|
Texas
|
H 3585
|
Restricting Access to Sexual Material Harmful to Minors
|
Failed - Adjourned
|
Relates to restricting access to sexual material harmful to minors on an Internet website.
|
Other Consumer Privacy
|
Texas
|
H 4412
|
Minors and Digital Service Provider Agreements
|
Failed - Adjourned
|
Relates to online agreements between certain minors and certain digital service providers.
|
Children’s Online Privacy
|
Texas
|
H 4705
|
Collection and Use of Biometric Identifiers
|
Failed - Adjourned
|
Relates to collection and use of biometric identifiers and biometric information.
|
Biometrics or Facial Recognition
|
Texas
|
H 4849
|
Notice of Facial Recognition Technology
|
Failed - Adjourned
|
Relates to notice of facial recognition technology used by business entities in publicly accessible spaces.
|
Biometrics or Facial Recognition
|
Texas
|
H 4854
|
Personal Identifying Information
|
Failed - Adjourned
|
Relates to the authority of individuals over the personal identifying information collected, processed, or maintained about the individuals and certain others by certain businesses.
|
Other Consumer Privacy
|
Texas
|
H 4948
|
Regulation of Internet Products Services and Features
|
Failed - Adjourned
|
Relates to the regulation of internet products, services, and features accessed by children, provides a civil penalty.
|
Children’s Online Privacy; Studies, Task Forces, or Commissions
|
Texas
|
H 5300
|
Smart Devices Collection of Personal Data
|
Failed - Adjourned
|
Relates to requiring operators of smart devices to provide information to users about the collection of personal data.
|
Connected Devices
|
Texas
|
S 704
|
Capture and Use of an Individuals Biometric Identifiers
|
Failed - Adjourned
|
Relates to the capture and use of an individual's biometric identifiers, specimen, or genetic information by a governmental body or peace officer or by a person for commercial purposes, authorizes civil penalties.
|
Genetic Privacy
|
Texas
|
S 928
|
Protection of Identifiable Student Information
|
Failed - Adjourned
|
Relates to the protection of personally identifiable student information and the use of covered information by an operator or educational entity, authorizes a civil and administrative penalty.
|
Children’s Online Privacy
|
Texas
|
S 1637
|
Prohibited Report or Disclosure by Health Care Provider
|
Failed - Adjourned
|
Relates to the prohibited report or disclosure by health care providers of certain health information.
|
Other Consumer Privacy
|
Texas
|
S 1691
|
Smart Devices Collection of Personal Data
|
Failed - Adjourned
|
Requires operators of smart devices to provide information to users about the collection of personal data.
|
Connected Devices
|
Texas
|
S 2021
|
Websites Containing Sexual Material Harmful to Minors
|
Failed - Adjourned
|
Relates to requirements for certain internet websites containing sexual material harmful to minors.
|
Other Consumer Privacy
|
Texas
|
S 2064
|
Dissemination of Patient Information
|
Failed - Adjourned
|
Relates to the dissemination of patient information through a telemedicine, telehealth, or tele-dentistry service.
|
Other Consumer Privacy
|
Texas
|
S 2105
|
Regulation of Third-Party Data Collection Entities
|
Enacted
|
Relates to the regulation of third-party data collection entities, provides that a data broker that maintains an internet website or mobile application shall post a conspicuous notice on the website or application that, among other things, states that the entity maintaining the website or application is a data broker and is clear, not misleading, and readily accessible by the general public, including individuals with a disability, provides for civil penalties.
|
Information Brokers; Website Privacy
|
Texas
|
S 2164
|
Restricting Access to Sexual Material Harmful to Minors
|
Failed - Adjourned
|
Relates to restricting access to sexual material harmful to minors on an internet website.
|
Other Consumer Privacy
|
Texas
|
SJR 23
|
Free from Governmental Intrusion
|
Failed - Adjourned
|
Proposes a constitutional amendment establishing the right to be free from governmental intrusion or interference into an individual's private life.
|
Constitutional Amendment
|
Utah
|
H 492
|
Abuse of Personal Identity Act Amendments
|
Enacted
|
Amends provisions of the Abuse of Personal Identity Act, allows an individual's lawfully obtained personal information or public data to be used to preview, advertise, or promote the sale of a product, service, or subscription, provided that the use of the personal information or public data does not imply that the individual endorses or approves of the product, service, or subscription.
|
Other Consumer Privacy
|
Utah
|
S 130
|
Information Privacy Requirements
|
Failed
|
Creates requirements for a governmental entity that uses a closed loop referral system, enacts requirements that certain entities must follow when obtaining consent to access or share individually identifiable social care information, requires consent to share an individual's individually identifiable social care information, requires a person who collects, processes, shares, or provides individually identifiable social care information to meet certain information privacy and security requirements.
|
Other Consumer Privacy
|
Utah
|
S 139
|
Motor Vehicle Consumer Data Protection
|
Failed
|
Enacts provisions related to motor vehicle consumer data protection.
|
Other Consumer Privacy
|
Utah
|
S 152
|
Social Media Regulation Amendments
|
Enacted
|
Enacts the Utah Social Media Regulation Act, requires a social media company to verify the age of state residents, requires a social media company to obtain the consent of a parent or guardian before a state resident under a specified age may maintain or open an account, prohibits a social media company from permitting a person to open an account if that person does not meet age requirements under state or federal law, provides for a private right of action.
|
Children’s Online Privacy; Other Consumer Privacy
|
Utah
|
S 265
|
Education Data Privacy Amendments
|
Enacted
|
Amends provisions regarding the sharing of student data, prohibits the sharing of certain student data, extends a deadline for the state board regarding data integration with a local education agency, prohibits an education entity from sharing student data with a federal agency, except as required by federal law.
|
Children’s Online Privacy
|
Utah
|
S 287
|
Online Pornography Viewing Age Requirements
|
Enacted
|
Creates obligations and liabilities for a commercial entity that provides pornography or other materials harmful to minors, provides that a commercial entity that knowingly and intentionally publishes or distributes material harmful to minors on the internet from a website that contains a substantial portion of such material shall be held liable if the entity fails to perform reasonable age verification methods to verify the age of an individual attempting to access the material.
|
Other Consumer Privacy
|
Utah
|
S 299
|
Family Planning Data Privacy Amendments
|
Failed
|
Amends and enacts provisions related to reproductive health data.
|
Other Consumer Privacy
|
Vermont
|
H 89
|
Legally Protected Health Care Activity
|
Enacted
|
Relates to civil and criminal procedures concerning legally protected health care activity, exempts cases involving tortious interference with legally protected health care activity from the SLAPP statute, prohibits civil arrest of a person for purposes of abusive litigation concerning legally protected health care activity, establishes a new cause of action regarding tortious interference with legally protected health care activity, prohibits a court from ordering a person to give testimony or statement.
|
Other Consumer Privacy
|
Vermont
|
H 121
|
Consumer Privacy
|
Pending - Carryover
|
Relates to enhancing consumer privacy.
|
Comprehensive; Studies, Task Forces, or Commissions
|
Vermont
|
H 159
|
State Broadband Internet Access Service Privacy Act
|
Pending - Carryover
|
Relates to the Vermont Broadband Internet Access Service Privacy Act.
|
ISP Privacy
|
Vermont
|
H 343
|
Genetic Information Privacy and Consumer Health
|
Pending - Carryover
|
Relates to protecting genetic information privacy and consumer health information.
|
Genetic Privacy
|
Vermont
|
H 344
|
Minimum Security Standards for Connected Devices
|
Pending - Carryover
|
Relates to adopting minimum security standards for connected devices.
|
Connected Devices
|
Vermont
|
S 49
|
Protects Genetic Information Privacy
|
Pending - Carryover
|
Relates to protecting genetic information privacy and consumer health information.
|
Genetic Privacy
|
Virginia
|
H 1688
|
Consumer Data Protection Act
|
Failed
|
Relates to Consumer Data Protection Act, relates to protections for children, requires an operator, defined in the bill, to obtain verifiable parental consent prior to registering any child with the operator's product or service or before collecting, using, or disclosing such child's personal data and prohibits a controller from knowingly processing the personal data of a child for purposes of targeted advertising, the sale of such personal data.
|
Children’s Online Privacy
|
Virginia
|
H 2219
|
Health Records Privacy
|
Failed
|
Relates to health records privacy, relates to consumer-generated health information, requires certain entities that collect, gather, or use consumer-generated health information, defined in the bill, to take reasonable measures to safeguard the such aggregated health data, including adopting technical and organizational measures to ensure that consumer-generated health information is not linked to any individual, household, or device used by an individual or a household.
|
Other Consumer Privacy
|
Virginia
|
H 2382
|
Virginia Consumer Protection Act
|
Failed
|
Relates to Virginia Consumer Protection Act, relates to personal reproductive or sexual health information, adds obtaining, disclosing, selling, or disseminating certain enumerated personal reproductive or sexual health information without the consent of the consumer as a prohibited practice under the Virginia Consumer Protection Act.
|
Other Consumer Privacy
|
Virginia
|
S 1026
|
Consumer Data Protection Act
|
Failed
|
Relates to Consumer Data Protection Act, relates to protections for children, requires an operator, defined in the bill, to obtain verifiable parental consent prior to registering any child with the operator's product or service or before collecting, using, or disclosing such child's personal data and prohibits a controller from knowingly processing the personal data of a child for purposes of targeted advertising, the sale of such personal data, or profiling in furtherance of decisions.
|
Children’s Online Privacy
|
Virginia
|
S 1243
|
Abortion or Other Reproductive Health Care Services
|
Failed - Adjourned
|
Relates to abortion or other reproductive health care services, relates to prohibitions on extradition for certain crimes, relates to prohibited practices under Virginia Consumer Protection Act, provides that no demand for extradition of a person charged with a criminal violation of law of another state shall be recognized by the governor if such alleged violation involves the receipt of or assistance with reproductive health care services unless the alleged violation would also constitute a criminal.
|
Other Consumer Privacy
|
Virginia
|
S 1432
|
Health Records Privacy
|
Failed
|
Relates to health records privacy, relates to consumer-generated health information, requires certain entities that collect, gather, or use consumer-generated health information, defined in the bill, to take reasonable measures to safeguard the such aggregated health data, including adopting technical and organizational measures to ensure that consumer-generated health information is not linked to any individual, household, or device used by an individual or a household.
|
Other Consumer Privacy
|
U.S. Virgin Islands
|
None
|
|
|
|
|
Washington
|
H 1155
|
Consumer Health Data
|
Enacted
|
Addresses the collection, sharing, and selling of consumer health data.
|
Genetic Privacy
|
Washington
|
H 1616
|
Charter of Peoples Personal Data Rights
|
Pending - Carryover
|
Creates a charter of people's personal data rights.
|
Comprehensive
|
Washington
|
H 1799
|
Data Brokers
|
Pending - Carryover
|
Concerns the registration of business entities that qualify as data brokers.
|
Information Brokers
|
Washington
|
HR 4607
|
Digital Privacy Day
|
Adopted
|
Recognizes digital privacy day.
|
Other Consumer Privacy
|
Washington
|
S 5351
|
Collection Sharing and Selling of Consumer Health Data
|
Pending - Carryover
|
Addresses the collection, sharing, and selling of consumer health data.
|
Genetic Privacy
|
Washington
|
S 5643
|
Charter of Peoples Personal Data Rights
|
Pending - Carryover
|
Creates a charter of people's personal data rights.
|
Comprehensive
|
West Virginia
|
H 2004
|
Governmental Access to Financial Records Act
|
Enacted
|
Provides that a financial institution is prohibited from disclosing a customer’s protected financial information and a governmental entity is prohibited from accessing or obtaining said information, with specified exceptions, provides that a financial institution may disclose a customer’s protected financial information if the customer provides the financial institution with written authorization for said disclosure, provides that the written authorization must contain certain information.
|
Other Consumer Privacy
|
West Virginia
|
H 2460
|
Online Privacy Protection Laws for Children
|
Failed - Adjourned
|
Provides online privacy protection laws for children.
|
Children’s Online Privacy
|
West Virginia
|
H 2964
|
Online Privacy Protection for Minors
|
Failed - Adjourned
|
Relates to online privacy protection for minors.
|
Children’s Online Privacy
|
West Virginia
|
H 3184
|
Information Confidentiality and Anti Discrimination Act
|
Failed - Adjourned
|
Relates to the State Medical Information Confidentiality and Anti-Discrimination Act.
|
Other Consumer Privacy
|
West Virginia
|
H 3260
|
Genetic Information Privacy Act
|
Failed - Adjourned
|
Relates to the Genetic Information Privacy Act.
|
Genetic Privacy
|
West Virginia
|
H 3339
|
Protection of Minors from Harmful Material on Internet
|
Failed - Adjourned
|
Relates to the protection of minors from harmful material on internet.
|
Other Consumer Privacy
|
West Virginia
|
H 3453
|
Consumer Data Protection Act
|
Failed - Adjourned
|
Relates to consumer data privacy, requires privacy for certain identifying personal information, establishes a consumer right to request copy of personal data collected, establishes a consumer right to have personal information deleted or corrected, establishes a consumer right to request personal data sold or shared, establishes a consumer right to opt-out of the sale or sharing of personal information to third parties.
|
Comprehensive
|
West Virginia
|
H 3480
|
West Virginia Consumer Privacy Act
|
Failed - Adjourned
|
Relates to the enactment of the West Virginia Consumer Privacy Act, providing definitions, provides prohibitions on disclosures or sales of certain consumer financial information, provides for civil remedies, provides for enforcement actions of the attorney general.
|
Other Consumer Privacy
|
West Virginia
|
H 3498
|
Consumer Data Protection Act
|
Failed - Adjourned
|
Relates to the Consumer Data Protection Act and establishing a framework for controlling and processing personal data in the state.
|
Comprehensive
|
West Virginia
|
S 470
|
Adoption Records Accessible for Medical Purposes
|
Failed - Adjourned
|
Relates to adoption and parental rights, establishes a procedure for adopted children to obtain a copy of their original birth certificate and certain personal identifying information regarding their biological parents, establishes a process by which biological parents can consent to providing personal identifying information and medical history to children who have been adopted, allows biological parents to designate a contact preference.
|
Other Consumer Privacy
|
Wisconsin
|
None
|
|
|
|
|
Wyoming
|
H 86
|
Disclosure of Private Cryptographic Keys
|
Enacted
|
Prohibits the compelled production of a private key that relates to a digital asset, digital identity or other interest or right, except under specified conditions, defines private key as a unique element of cryptographic data, or any substantially similar analogue, which is held by a person, paired with a unique, publicly available element of cryptographic data, and associated with an algorithm that is necessary to carry out an encryption or decryption required to execute a transaction.
|
Other Consumer Privacy
|
Wyoming
|
SJR 9
|
Right of Individual Privacy
|
Failed
|
Provides for the right of individual privacy.
|
Constitutional Amendment
|