The Privacy Law Network editorial team tracks privacy and data protection developments across US federal and state law. We report from primary sources: statutes and bill text, agency press releases and guidance, regulator enforcement orders, and court filings and opinions. Every article links the underlying documents so readers can verify what we report rather than take our word for it. We are not attorneys and we do not provide legal advice. Our coverage describes what laws and regulators say; it does not assess how any of it applies to a particular person or business. For that, consult a licensed attorney.
Breach Notification
November 9, 2026
Arizona's breach article opens with a duty to investigate any security incident, then gives the data owner 45 days from the determination that a breach occurred. Above 1,000 individuals, filings go to three credit bureaus, the Attorney General and the state homeland security director. Only the Attorney General may enforce, under a penalty ceiling of $500,000.
Read more →
Genetic Privacy
November 9, 2026
Arizona protects genetic test results through a small chapter in its civil procedure title, not through a single privacy act. A.R.S. 12-2802 makes the results privileged to the person tested and lists who may receive them. Title 20 adds an insurer consent rule, and a separate consumer testing chapter borrows 12-2802 as its disclosure standard.
Read more →
GLBA
November 9, 2026
Arizona has no statute based on the NAIC data security model, but Chapter 11 of Title 20 governs how insurers, producers and support organizations handle personal information. It sets notice duties in section 20-2104, gives individuals access and correction rights, limits disclosure under section 20-2113 and provides limited private remedies.
Read more →
Breach Notification
November 9, 2026
Louisiana's breach chapter imposes a reasonable security duty and a record destruction duty before it reaches notice. Residents are told within 60 days of discovery, unless written reasons for delay reach the Attorney General inside that window. A separate regulation requires the Attorney General's copy within 10 days of resident notice, and R.S. 51:3075 allows a suit for actual damages.
Read more →
Employee Privacy
November 9, 2026
Louisiana's 2014 Personal Online Account Privacy Protection Act stops employers and educational institutions from asking for the login credentials to a personal online account. The definition of personal account is tightly drawn, the employer exceptions are longer than the school ones, and the chapter's only liability section limits exposure.
Read more →
Genetic Privacy
November 9, 2026
La. R.S. 22:1023 is a health insurance statute with reach beyond underwriting. It restricts insurers' use of genetic information, requires detailed signed authorizations, treats an insured's genetic information as property, and creates statutory damages of at least $50,000 or $100,000. A 2015 appellate decision read it to reach a diagnostic code inside an insurer's own systems.
Read more →
Genetic Privacy
November 9, 2026
North Carolina's genetic employment statute is one short section enacted in 1997. It forbids refusing employment or discharging someone because of requested genetic testing or counseling, or genetic information about the person or family. It reaches any public or private entity, but says nothing about remedies and does not regulate testing itself.
Read more →
Breach Notification
November 9, 2026
North Carolina's Identity Theft Protection Act does not limit its breach duty to computers: section 75-65 reaches personal information in any form. Every business that notifies a person also reports to the Attorney General's Consumer Protection Division, with no minimum count, and a violation is an unfair practice under G.S. 75-1.1, with private suits reserved for those injured.
Read more →
Data Security Rules
November 9, 2026
Article 2A of Chapter 75, the Identity Theft Protection Act, goes further than breach notice. Section 75-62 limits how a business may display, transmit, mail or sell Social Security numbers, section 75-64 sets rules for destroying records, and each section makes a violation a violation of G.S. 75-1.1. The two differ on private suits and on treble damages.
Read more →
Breach Notification
November 9, 2026
South Carolina's private-sector breach statute names the Department of Consumer Affairs, not the Attorney General. Section 39-1-90 sends filings above 1,000 persons to that Department, gives it power to set a per-resident fine, and lets an injured resident sue. Its text reaches computerized or other data, though its definition of a breach mentions only computerized data.
Read more →
Genetic Privacy
November 9, 2026
South Carolina's Chapter 93 of Title 38 regulates genetic information in health coverage, but two of its sections are written without limiting them to insurers. It bars issuers from using genetic information in coverage decisions and requires informed consent for genetic tests. Violations can draw department fines, unfair trade practice exposure and a private action.
Read more →
Data Security Rules
November 9, 2026
South Carolina added Chapter 99 to Title 38 through 2018 Act No. 171, signed May 3, 2018 and effective January 1, 2019, and its Department of Insurance describes it as the first enactment of the NAIC data security model. The chapter tracks the model closely, so its interest lies in the places where the wording, the timing and the later amendments part from it.
Read more →
Consent Management
November 2, 2026
Maine's chapter 94 of Title 35-A is one section long. Since July 1, 2020 it has barred broadband providers from using, selling or sharing customer personal information without express, affirmative consent, and from pricing that choice. Four industry groups sued in 2020; the federal court's published orders rejected their preemption claims and declined to strike the law on the pleadings.
Read more →
Breach Notification
November 2, 2026
Maine's breach chapter, the Notice of Risk to Personal Data Act, applies one notice trigger to information brokers and a misuse-based trigger to everyone else. Notice is due within 30 days of learning of a breach and identifying its scope, every notice is copied to a state regulator, and violations are civil violations with fines that do not reach public bodies.
Read more →
Employee Privacy
November 2, 2026
Maine's employee social media privacy rules were enacted as Part B of a 2015 bill about leave for victims of violence. Five sections of Title 26 bar employers from seeking passwords, in-person viewing, account information, contact additions or settings changes from employees and applicants, keep three exceptions, and leave enforcement to Department of Labor fines.
Read more →
State Comprehensive Privacy Laws
November 2, 2026
Montana enacted its Consumer Data Privacy Act in 2023 and rewrote much of it two years later. Senate Bill 297, in force since October 1, 2025, halved the main threshold, ended the nonprofit exemption, added a duty of care toward minors that reaches businesses of any size, and struck the notice-and-cure step before an Attorney General action.
Read more →
Breach Notification
November 2, 2026
Montana has three parallel breach sections: MCA 30-14-1704 for persons and businesses, 33-19-321 for insurance licensees, and 2-6-1503 for state agencies. Each sends a copy of every resident notice to a state office, and none sets a day count. The general section is enforced through the Consumer Protection Act by the Department of Justice.
Read more →
Genetic Privacy
November 2, 2026
Montana's Genetic Information Privacy Act, Title 30, chapter 23, part 1, came from SB 351 of 2023 and was rewritten in 2025. Its free conference committee version reaches any organization that collects, uses or analyzes genetic data, ties government access to warrants, restricts foreign storage, and gives the attorney general sole enforcement power.
Read more →
Privacy Litigation
November 2, 2026
Ohio's 2023 budget bill added a rule requiring social platforms to get a parent's verifiable consent before a child under 16 could sign up. A federal judge in Columbus blocked it before it took effect and entered a permanent injunction in April 2025. In June 2026 a divided Sixth Circuit panel reversed, and NetChoice has until December 3, 2026 to seek Supreme Court review.
Read more →
Breach Notification
November 2, 2026
Ohio's private-sector breach law requires notice to residents within 45 days when an access-and-acquisition incident creates a material risk of identity theft or fraud. It names no state office to receive notice, sends a report to the national credit bureaus above 1,000 residents, and gives the Attorney General exclusive power to sue for penalties that rise with each day of noncompliance.
Read more →
Data Security Rules
November 2, 2026
Chapter 1354 of the Ohio Revised Code, enacted by Senate Bill 220 in 2018, imposes no security duty. It describes a written cybersecurity program that lets a covered entity plead an affirmative defense to an Ohio tort claim alleging that unreasonable security caused a data breach, and states that it creates neither a minimum standard nor a private right of action.
Read more →
Breach Notification
November 2, 2026
Wisconsin's breach statute never uses the word breach. It requires notice when an entity knows personal information was acquired without authorization, counts DNA profiles and biometric data as personal information, and sets a 45-day limit. It names no enforcer and no penalty, and a federal court has held it creates no private right of action.
Read more →
Employee Privacy
November 2, 2026
Wisconsin's Internet privacy protection statute, created by 2013 Wisconsin Act 208, applies one access rule to employers, educational institutions and landlords. It bars conditioning a job, admission or tenancy on handing over or displaying a personal Internet account, lists what stays permitted, and routes retaliation claims through the Fair Employment Act process.
Read more →
Genetic Privacy
November 2, 2026
Wisconsin regulates genetic testing in employment through two statutes created by the same 1992 act. Section 111.372 of the Fair Employment Act bars employers, unions, employment agencies and licensing agencies from testing as a condition of a job, and s. 942.07 makes testing or disclosure without written consent a Class B misdemeanor.
Read more →