States set most US privacy law in practice, and this hub tracks that patchwork as it grows.
Breach Notification
November 9, 2026
Arizona's breach article opens with a duty to investigate any security incident, then gives the data owner 45 days from the determination that a breach occurred. Above 1,000 individuals, filings go to three credit bureaus, the Attorney General and the state homeland security director. Only the Attorney General may enforce, under a penalty ceiling of $500,000.
Read more →
Genetic Privacy
November 9, 2026
Arizona protects genetic test results through a small chapter in its civil procedure title, not through a single privacy act. A.R.S. 12-2802 makes the results privileged to the person tested and lists who may receive them. Title 20 adds an insurer consent rule, and a separate consumer testing chapter borrows 12-2802 as its disclosure standard.
Read more →
GLBA
November 9, 2026
Arizona has no statute based on the NAIC data security model, but Chapter 11 of Title 20 governs how insurers, producers and support organizations handle personal information. It sets notice duties in section 20-2104, gives individuals access and correction rights, limits disclosure under section 20-2113 and provides limited private remedies.
Read more →
Breach Notification
November 9, 2026
Louisiana's breach chapter imposes a reasonable security duty and a record destruction duty before it reaches notice. Residents are told within 60 days of discovery, unless written reasons for delay reach the Attorney General inside that window. A separate regulation requires the Attorney General's copy within 10 days of resident notice, and R.S. 51:3075 allows a suit for actual damages.
Read more →
Employee Privacy
November 9, 2026
Louisiana's 2014 Personal Online Account Privacy Protection Act stops employers and educational institutions from asking for the login credentials to a personal online account. The definition of personal account is tightly drawn, the employer exceptions are longer than the school ones, and the chapter's only liability section limits exposure.
Read more →
Genetic Privacy
November 9, 2026
La. R.S. 22:1023 is a health insurance statute with reach beyond underwriting. It restricts insurers' use of genetic information, requires detailed signed authorizations, treats an insured's genetic information as property, and creates statutory damages of at least $50,000 or $100,000. A 2015 appellate decision read it to reach a diagnostic code inside an insurer's own systems.
Read more →
Genetic Privacy
November 9, 2026
North Carolina's genetic employment statute is one short section enacted in 1997. It forbids refusing employment or discharging someone because of requested genetic testing or counseling, or genetic information about the person or family. It reaches any public or private entity, but says nothing about remedies and does not regulate testing itself.
Read more →
Breach Notification
November 9, 2026
North Carolina's Identity Theft Protection Act does not limit its breach duty to computers: section 75-65 reaches personal information in any form. Every business that notifies a person also reports to the Attorney General's Consumer Protection Division, with no minimum count, and a violation is an unfair practice under G.S. 75-1.1, with private suits reserved for those injured.
Read more →
Data Security Rules
November 9, 2026
Article 2A of Chapter 75, the Identity Theft Protection Act, goes further than breach notice. Section 75-62 limits how a business may display, transmit, mail or sell Social Security numbers, section 75-64 sets rules for destroying records, and each section makes a violation a violation of G.S. 75-1.1. The two differ on private suits and on treble damages.
Read more →
Breach Notification
November 9, 2026
South Carolina's private-sector breach statute names the Department of Consumer Affairs, not the Attorney General. Section 39-1-90 sends filings above 1,000 persons to that Department, gives it power to set a per-resident fine, and lets an injured resident sue. Its text reaches computerized or other data, though its definition of a breach mentions only computerized data.
Read more →
Genetic Privacy
November 9, 2026
South Carolina's Chapter 93 of Title 38 regulates genetic information in health coverage, but two of its sections are written without limiting them to insurers. It bars issuers from using genetic information in coverage decisions and requires informed consent for genetic tests. Violations can draw department fines, unfair trade practice exposure and a private action.
Read more →
Data Security Rules
November 9, 2026
South Carolina added Chapter 99 to Title 38 through 2018 Act No. 171, signed May 3, 2018 and effective January 1, 2019, and its Department of Insurance describes it as the first enactment of the NAIC data security model. The chapter tracks the model closely, so its interest lies in the places where the wording, the timing and the later amendments part from it.
Read more →
Consent Management
November 2, 2026
Maine's chapter 94 of Title 35-A is one section long. Since July 1, 2020 it has barred broadband providers from using, selling or sharing customer personal information without express, affirmative consent, and from pricing that choice. Four industry groups sued in 2020; the federal court's published orders rejected their preemption claims and declined to strike the law on the pleadings.
Read more →
Breach Notification
November 2, 2026
Maine's breach chapter, the Notice of Risk to Personal Data Act, applies one notice trigger to information brokers and a misuse-based trigger to everyone else. Notice is due within 30 days of learning of a breach and identifying its scope, every notice is copied to a state regulator, and violations are civil violations with fines that do not reach public bodies.
Read more →
Employee Privacy
November 2, 2026
Maine's employee social media privacy rules were enacted as Part B of a 2015 bill about leave for victims of violence. Five sections of Title 26 bar employers from seeking passwords, in-person viewing, account information, contact additions or settings changes from employees and applicants, keep three exceptions, and leave enforcement to Department of Labor fines.
Read more →
State Comprehensive Privacy Laws
November 2, 2026
Montana enacted its Consumer Data Privacy Act in 2023 and rewrote much of it two years later. Senate Bill 297, in force since October 1, 2025, halved the main threshold, ended the nonprofit exemption, added a duty of care toward minors that reaches businesses of any size, and struck the notice-and-cure step before an Attorney General action.
Read more →
Breach Notification
November 2, 2026
Montana has three parallel breach sections: MCA 30-14-1704 for persons and businesses, 33-19-321 for insurance licensees, and 2-6-1503 for state agencies. Each sends a copy of every resident notice to a state office, and none sets a day count. The general section is enforced through the Consumer Protection Act by the Department of Justice.
Read more →
Genetic Privacy
November 2, 2026
Montana's Genetic Information Privacy Act, Title 30, chapter 23, part 1, came from SB 351 of 2023 and was rewritten in 2025. Its free conference committee version reaches any organization that collects, uses or analyzes genetic data, ties government access to warrants, restricts foreign storage, and gives the attorney general sole enforcement power.
Read more →
Privacy Litigation
November 2, 2026
Ohio's 2023 budget bill added a rule requiring social platforms to get a parent's verifiable consent before a child under 16 could sign up. A federal judge in Columbus blocked it before it took effect and entered a permanent injunction in April 2025. In June 2026 a divided Sixth Circuit panel reversed, and NetChoice has until December 3, 2026 to seek Supreme Court review.
Read more →
Breach Notification
November 2, 2026
Ohio's private-sector breach law requires notice to residents within 45 days when an access-and-acquisition incident creates a material risk of identity theft or fraud. It names no state office to receive notice, sends a report to the national credit bureaus above 1,000 residents, and gives the Attorney General exclusive power to sue for penalties that rise with each day of noncompliance.
Read more →
Data Security Rules
November 2, 2026
Chapter 1354 of the Ohio Revised Code, enacted by Senate Bill 220 in 2018, imposes no security duty. It describes a written cybersecurity program that lets a covered entity plead an affirmative defense to an Ohio tort claim alleging that unreasonable security caused a data breach, and states that it creates neither a minimum standard nor a private right of action.
Read more →
Breach Notification
November 2, 2026
Wisconsin's breach statute never uses the word breach. It requires notice when an entity knows personal information was acquired without authorization, counts DNA profiles and biometric data as personal information, and sets a 45-day limit. It names no enforcer and no penalty, and a federal court has held it creates no private right of action.
Read more →
Employee Privacy
November 2, 2026
Wisconsin's Internet privacy protection statute, created by 2013 Wisconsin Act 208, applies one access rule to employers, educational institutions and landlords. It bars conditioning a job, admission or tenancy on handing over or displaying a personal Internet account, lists what stays permitted, and routes retaliation claims through the Fair Employment Act process.
Read more →
Genetic Privacy
November 2, 2026
Wisconsin regulates genetic testing in employment through two statutes created by the same 1992 act. Section 111.372 of the Fair Employment Act bars employers, unions, employment agencies and licensing agencies from testing as a condition of a job, and s. 942.07 makes testing or disclosure without written consent a Class B misdemeanor.
Read more →
State Comprehensive Privacy Laws
October 26, 2026
Iowa's chapter 715D, enacted as Senate File 262 and in force since January 1, 2025, is built from fewer parts than its neighbors. It has nine sections, four consumer rights, a 90-day response window, notice and opt-out in place of consent for sensitive data, no assessment requirement, and a 90-day cure with no end date.
Read more →
Breach Notification
October 26, 2026
Iowa's Personal Information Security Breach Protection chapter dates from 2008 and was reshaped in 2014 and 2018. It reaches paper printouts of computer records, lets a business skip notice only on a written no-harm finding kept five years, and puts a five-business-day Attorney General clock behind the first consumer notice.
Read more →
Genetic Privacy
October 26, 2026
Iowa Code 729.6, enacted in 1992 and rewritten in 2010, bars every Iowa employer regardless of size from soliciting, requiring or administering a genetic test as a condition of employment, requires written informed consent before anyone obtains genetic information, and lets an aggrieved worker, county attorney or the attorney general sue for equitable relief.
Read more →
State Comprehensive Privacy Laws
October 26, 2026
Kentucky's privacy statute, House Bill 15 of 2024, took effect January 1, 2026 at KRS 367.3611 to 367.3629. A 2025 act widened its health-data exemptions before it ever applied, its 30-day cure has no expiry, penalties flow to a dedicated fund, and the Attorney General invoked it eight days after it began.
Read more →
Breach Notification
October 26, 2026
Kentucky's private-sector breach statute was created by House Bill 232 in 2014 and has not been amended since. It counts an incident as a breach only if it causes or is reasonably believed to cause identity theft or fraud, requires no notice to any state office, and contains no enforcement clause of its own.
Read more →
Breach Notification
October 26, 2026
House Bill 5 of 2014 gave Kentucky's executive branch, local governments, school districts and public universities, and the contractors that receive their data, a security duty and a staged reporting chain: officials within 72 hours, again within 48 hours of the investigation's end, then affected individuals within 35 days.
Read more →
State Comprehensive Privacy Laws
October 26, 2026
Nebraska's design code, LB 504, was approved May 30, 2025 and became operative January 1, 2026. LB 838 rewrote its coverage test, more than doubled its list of engagement features and added two sections, effective July 18, 2026. Penalties of up to $50,000 became available July 1, 2026, and the Attorney General first pleaded the Act in October 2026.
Read more →
Breach Notification
October 26, 2026
Nebraska's Financial Data Protection and Consumer Notification of Data Security Breach Act of 2006 requires a good-faith investigation before notice, routes every required notice to the Attorney General as well, offers a small-business newspaper option, and since 2018 carries a security duty enforced through the Consumer Protection Act.
Read more →
State Comprehensive Privacy Laws
October 26, 2026
Nebraska's Data Privacy Act, sections 1 to 30 of LB 1074 (2024), took effect January 1, 2025 at sections 87-1101 to 87-1130. It counts no consumers, reaching any business outside the federal small-business definition, and it still binds small businesses on selling sensitive data. Its cure demands proof, and no enforcement under it was found.
Read more →
Breach Notification
October 26, 2026
New Hampshire's three-section breach subdivision took effect January 1, 2007 and has not been amended. It requires notice when misuse is likely or cannot be determined, routes the state notice to a primary regulator or the Attorney General, and gives injured persons a damages action that doubles or trebles for willful violations.
Read more →
Employee Privacy
October 26, 2026
New Hampshire's 2014 workplace privacy act, HB 1407 (chapter 305), bars employers from asking for login information to an employee's or applicant's personal social networking account, forcing contact additions, or demanding lower privacy settings. It keeps employer equipment, employer accounts and two kinds of investigation outside the bar, and is enforced only by a labor commissioner penalty.
Read more →
State Comprehensive Privacy Laws
October 26, 2026
RSA chapter 507-H, in force since January 1, 2025, reaches businesses at 35,000 consumers, requires opt-out signals, conditions teen targeting on consent, and from 2027 bars selling a child's data. Violations are prosecuted under the consumer protection act at up to $10,000 each, and the chapter grants no rulemaking power.
Read more →
Employee Privacy
October 19, 2026
Michigan's Bullard-Plawecki Employee Right to Know Act, in force since January 1, 1979, gives employees of employers with four or more workers a right to review and copy their personnel records, but excludes eight categories of material, bars records of off-duty associations and political activity, requires mailed notice before disciplinary records go to outsiders, and lets employees sue.
Read more →
Breach Notification
October 19, 2026
Michigan's breach duty is section 12 of the Identity Theft Protection Act, MCL 445.72. It requires notice unless the entity determines, with ordinary prudence, that the breach is not likely to cause substantial loss, injury or identity theft. Insurers are carved out to a parallel regime in the Insurance Code, and Senate Bills 360 to 364 would add Attorney General notice.
Read more →
VPPA
October 19, 2026
Michigan's Preservation of Personal Privacy Act bars businesses that sell, rent or lend books, sound recordings or videos from knowingly disclosing records identifying what a customer bought. Until 2016 PA 92 took effect on July 31, 2016, it carried $5,000 in statutory damages; claims over pre-amendment disclosures then produced a run of federal rulings on its limitations period.
Read more →
State Comprehensive Privacy Laws
October 19, 2026
Minnesota's Consumer Data Privacy Act, Minn. Stat. 325M.10 to 325M.21, has applied since July 31, 2025 to entities that control or process data on 100,000 Minnesotans, or 25,000 with a sale-revenue test. It adds a third-party list right and a written policy inventory to the familiar model, and since January 31, 2026 the Attorney General may sue without a warning letter.
Read more →
Breach Notification
October 19, 2026
Minnesota's private-sector breach statute, Minn. Stat. 325E.61, has changed little since 2006. It requires notice to residents whose unencrypted personal information was or is reasonably believed acquired, without a risk-of-harm exception or a day count, adds a 48-hour credit bureau notice above 500 persons, and leaves government entities to a separate statute with its own rules.
Read more →
Automated Decision-Making
October 19, 2026
Paragraph (g) of Minn. Stat. 325M.14, subdivision 1, gives a consumer profiled for a significant decision the right to question the result, be told the reason, learn (if feasible) what might have changed it, review the data used and obtain reevaluation on corrected data. Colorado, Tennessee and California treat the same ground differently, and the statute does not define most of its terms.
Read more →
Breach Notification
October 19, 2026
Tennessee replaced its breach statute twice in two years. Public Chapter 692 of 2016 set a 45-day deadline and dropped the encryption exception; Public Chapter 91 of 2017 rewrote section 47-18-2107 in full, restoring encryption by reference to FIPS 140-2, keeping 45 days, adding a materiality test and a credit bureau duty, and keeping a customer's right to sue.
Read more →
AI & Privacy
October 19, 2026
Tennessee's Ensuring Likeness, Voice, and Image Security Act, enacted as Public Chapter 588 and effective July 1, 2024, renamed the state's 1984 publicity statute, added a voice right that covers simulations, and created civil liability for public distribution of unauthorized voices or likenesses and for tools whose primary purpose is producing a particular person's voice or likeness.
Read more →
State Comprehensive Privacy Laws
October 19, 2026
Tennessee's privacy statute, enacted as Public Chapter 408 of 2023 and in force since July 1, 2025, combines a $25 million revenue floor with high consumer counts, broad entity exemptions, a permanent 60-day cure, an affirmative defense for programs aligned to the NIST Privacy Framework, and court-awarded treble damages for willful violations.
Read more →
Background Checks
October 12, 2026
Massachusetts runs criminal record checks through a state system with tiered access. An employer or landlord sees convictions only within fixed lookback windows, must collect a signed acknowledgment and check identification first, must hand the record to the applicant before asking about it, and holds the result under storage and logging rules set by regulation.
Read more →
Employee Privacy
October 12, 2026
Section 52C of chapter 149 gives current and former Massachusetts employees a right to review and copy their personnel record within five business days of a written request, to be told within ten days when negative information is added, and to file a rebuttal that travels with the record. The Attorney General enforces it; courts have recognized a narrower personal remedy.
Read more →
Privacy Litigation
October 12, 2026
In Vita v. New England Baptist Hospital the Supreme Judicial Court split 5 to 1 over whether browsing a hospital's public website is a wire communication under the Massachusetts wiretap act. The majority found the word ambiguous and applied the rule of lenity. The dissent read 'any communication' as plain. Bills filed in 2025 to rewrite the definitions went to study.
Read more →
Biometric Privacy
October 12, 2026
Local Law 63 of 2021 added a tenant data privacy chapter to the New York City Administrative Code for apartment buildings that use key fobs, phone apps or biometric scanners at the door. It lists the only data such a system may hold, puts 90-day clocks on keeping it, bars its sale and several surveillance uses, and gives occupants a damages action for one violation only: an unlawful sale.
Read more →
COPPA
October 12, 2026
Utah's SB 142 of 2025 made app stores, not individual apps, the point where a user's age is checked and a parent's consent is collected. HB 498 of 2026 rewrote it before any duty applied: obligations now begin May 6, 2027, government enforcement is gone, and a harmed minor or parent may sue for the greater of actual damages or $1,000 per violation.
Read more →
AI & Privacy
October 12, 2026
Utah's SB 149 took effect May 1, 2024, creating an Office of Artificial Intelligence Policy, a regulatory sandbox and a rule that a business using generative AI must admit it when asked. SB 226 of 2025 moved that duty to chapter 77 of Title 13 and narrowed it, HB 452 added mental health chatbot rules, and the office's own chapter is set to be repealed July 1, 2027.
Read more →
COPPA
October 12, 2026
Utah replaced its 2023 social media laws in 2024 with two bills. SB 194 created the Minor Protection in Social Media Act at chapter 71 of Title 13, requiring age assurance and maximum-privacy defaults for minor accounts, and HB 464 created a private action over minors' excessive use. A federal court enjoined chapter 71 on September 10, 2024, and the Tenth Circuit appeal remains pending.
Read more →
State Comprehensive Privacy Laws
October 5, 2026
Florida's Digital Bill of Rights, enacted by SB 262 in 2023, assigns most of its duties to a controller defined so narrowly that a $1 billion revenue floor and one of three business-model tests must both be met. One section, 501.715, reaches any for-profit business collecting Floridians' data that sells sensitive data, and 2024 rules fill in the enforcement detail.
Read more →
Breach Notification
October 5, 2026
Florida's breach statute is section 501.171, created in 2014 by CS/CS/SB 1524 as the Florida Information Protection Act. It pairs a duty to take reasonable security measures with two 30-day notice clocks, one to residents and one to the Department of Legal Affairs at 500 people, and it treats a violation as a FDUTPA unfair practice with per-breach civil penalties capped at $500,000.
Read more →
Pixel Tracking
October 5, 2026
Florida's Security of Communications Act forbids intercepting electronic communications without every party's consent and gives a civil claim with a $1,000 liquidated damages floor. When session replay suits under it reached Florida's federal courts in 2021, judges dismissed them on the statutory definitions, holding that clicks, keystrokes and page views were not the contents of a communication.
Read more →
Breach Notification
October 5, 2026
Virginia's breach statute sits in the criminal code at section 18.2-186.6 but is enforced civilly by the Attorney General, with penalties up to $150,000 per breach. Residents and the Attorney General get notice when identity theft or fraud is caused or reasonably believed likely. A medical statute reaches only public bodies, and payroll and tax preparer breaches have rules of their own.
Read more →
State Comprehensive Privacy Laws
October 5, 2026
Virginia has amended its Consumer Data Protection Act twice for minors. Chapters 840 and 844 of 2024 restricted processing of a known child's data and required parental consent under COPPA from January 1, 2025. Chapter 703 of 2025 capped social media use by users under 16 at one hour a day, a rule a federal court preliminarily enjoined as to NetChoice members in February 2026.
Read more →
Consumer Health Data
October 5, 2026
Virginia protects reproductive and sexual health data through its general consumer protection statute rather than its privacy law. SB 754, enacted in 2025 as chapter 591, added a prohibited practice to Va. Code § 59.1-200 and a seven-part definition to § 59.1-198, bringing the Act's private damages action and Attorney General remedies with it.
Read more →
Genetic Privacy
September 28, 2026
The Illinois Genetic Information Privacy Act, 410 ILCS 513, has been in force since 1998. It adopts HIPAA's definition of genetic information, which covers family medical history, forbids employers to solicit that information, limits insurers, and lets any aggrieved person sue for $2,500 or $15,000 per violation. Public Act 104-642 adds biomarkers from January 1, 2027.
Read more →
Data Brokers
September 28, 2026
Nevada's rules for commercial websites sit in NRS 603A.300 to 603A.360 and were built in three steps: a 2017 privacy notice requirement, a 2019 right to direct an operator not to sell covered information, and a 2021 bill that extended the opt-out to data brokers, broadened the definition of sale and limited the 30-day repair window to first failures.
Read more →
Data Security Rules
September 28, 2026
Senate Bill 227 of 2009 was introduced as an encryption rule and enacted with a payment card clause: a Nevada data collector that accepts cards follows the current PCI Data Security Standard for those transactions, and other data collectors encrypt personal information leaving their control. A 2011 bill widened the device rule, and 2025 bills renamed the office that approves other methods.
Read more →
Breach Notification
September 28, 2026
Pennsylvania's breach statute is the Act of December 22, 2005, P.L. 474, No. 94. Senate Bill 696, enacted as Act 151 of 2022, rewrote its trigger and added duties for State agencies, contractors, counties, schools and municipalities. Senate Bill 824, enacted as Act 33 of 2024, added Attorney General notice and credit monitoring and quietly narrowed the medical information element.
Read more →
Pixel Tracking
September 28, 2026
Pennsylvania's Wiretapping and Electronic Surveillance Control Act gives anyone whose electronic communication is intercepted a civil claim for at least $1,000, and it requires every party's consent. Popa v. Harriet Carter Gifts read it to reach tracking code running in a Pennsylvania browser. Later session replay appeals turned on personal jurisdiction and Article III standing.
Read more →
Genetic Privacy
September 28, 2026
Five state statutes read for this explainer regulate companies that sell DNA tests directly to consumers or analyze the resulting data: California, Arizona, Utah, Virginia and Montana. Each requires layered consent, a way to delete data and destroy samples, and limits on sharing with insurers or employers. They differ on who is covered, who enforces, and how much a violation costs.
Read more →
TCPA
September 28, 2026
Florida amended its telephone solicitation statute in 2021 and again in 2023, Oklahoma enacted a near copy of the 2021 Florida text in 2022, and Maryland followed with the Stop the Spam Calls Act in 2024. Each requires written consent for automated sales calls, adds call-time and frequency caps, and gives called parties a $500 damages claim.
Read more →
State Comprehensive Privacy Laws
September 21, 2026
Substitute Senate Bill 1295 became Public Act 25-113 on June 24, 2025. Its Data Privacy Act sections took effect together on July 1, 2026: a lower threshold, two no-threshold triggers, more sensitive data, profiling rights, impact assessments and a ban on selling teenagers' data. Public Act 26-64 amends several of the same sections again from October 1, 2026.
Read more →
State Comprehensive Privacy Laws
September 21, 2026
Chapter 121 of the Laws of 2024 added article 39-FF, sections 899-ee to 899-mm, to New York's General Business Law. It has applied since June 20, 2025 to operators whose users are known minors or whose services are primarily directed to minors. The Attorney General issued an advance notice in 2024 and implementation guidance in May 2025, but has not published proposed rules.
Read more →
Data Security Rules
September 14, 2026
The NAIC adopted its Insurance Data Security Model Law in late 2017 as a template for state legislatures. It asks insurance licensees to run a written information security program, oversee vendors, investigate cybersecurity events and notify the insurance commissioner within 72 hours. This walks through the model's text and compares it with eight enacted state versions.
Read more →
State Comprehensive Privacy Laws
September 14, 2026
The Maryland Online Data Privacy Act has applied since October 1, 2025, but not at the section numbers its bill record gives, or in the form its chapter law's plain text suggests. This post sets out the statute as the General Assembly now publishes it, the Attorney General's reading of its minimization rule, and the immigration-enforcement amendments effective July 1, 2026.
Read more →
Data Security Rules
September 14, 2026
The SHIELD Act of 2019 did two things: it widened New York's breach notification statute, General Business Law section 899-aa, and it added section 899-bb, a standalone duty to maintain reasonable data security. This sets out the security requirement as enacted, the routes to deemed compliance, and the three later chapters that changed section 899-aa without touching section 899-bb.
Read more →
Dark Patterns
September 14, 2026
California, Colorado and Connecticut define a dark pattern in nearly the same words, and each treats agreement obtained through one as no consent at all. What differs is the material around that sentence: an example-driven regulation in California, design and withdrawal rules in Colorado, and in Connecticut a statute that points to the FTC.
Read more →
State Comprehensive Privacy Laws
September 14, 2026
Vermont enacted its Age-Appropriate Design Code as Act 63 of 2025, signed June 12, 2025. The substantive duties begin on January 1, 2027, but the Attorney General's rulemaking powers took effect in July 2025 and proposed rules are open for comment until October 2, 2026. This post covers its definitions and duties and compares them with the California provisions the Ninth Circuit has ruled on.
Read more →
Automated Decision-Making
September 7, 2026
Colorado's 2024 artificial intelligence statute was delayed once, then repealed and reenacted before it ever took effect. Senate Bill 26-189, signed May 14, 2026, replaced part 17 of article 1 of title 6 with a framework keyed to automated decision-making technology. Consequential decision survived as the trigger; the algorithmic discrimination duty did not.
Read more →
CPPA
September 7, 2026
Proposition 24 established the California Privacy Protection Agency in December 2020, but the power to write CCPA regulations did not move to it on that date. The transfer was conditional, it completed in April 2022, and the Attorney General's own regulatory authority was never extinguished. This traces the grant, the condition, the board that exercises it, and what the agency has adopted.
Read more →
Workplace Monitoring
September 7, 2026
Three states condition workplace electronic monitoring on notice rather than on consent, and each builds the requirement differently. Connecticut makes a posted notice the legal notice. New York requires a notice on hiring and a posting. Delaware offers a choice between a daily electronic notice and a one-time acknowledged one.
Read more →
Facial Recognition
September 7, 2026
Three states regulate what happens to an applicant's face during hiring, through four statutes that each define permission differently. Maryland asks for a signed waiver with four listed contents. Illinois asks for notice, an explanation and consent, and separately for a written release. Texas asks only that the individual be informed and consent before capture.
Read more →
Employee Privacy
September 7, 2026
New Jersey's tracking device statute, N.J.S.A. 34:6B-22, was approved on January 18, 2022 and took effect ninety days later. It reached that form after four reprints that moved it from a fourth-degree crime to a civil penalty, from written consent to written notice, and from any tracking device to one designed for the sole purpose of tracking.
Read more →
Data Brokers
September 7, 2026
Registration statutes are usually compared by what they demand of a filer. They can also be compared by what they hand back to the public, and on that axis the four state registries are not alike. One publishes every answer as a downloadable file; the other three publish a search box. This reports what is readable off each, and what California's file disclosed.
Read more →
Data Brokers
September 1, 2026
California's Delete Act took an existing registry and attached machinery to it: one consumer request that reaches every registered broker, a 45-day processing cycle, a triennial third-party audit and a $200-a-day fine for not signing up. This reports what SB 362 and the 2025 amendment require, and the dates the statute and the DROP regulations set.
Read more →
CCPA / CPRA
September 1, 2026
California is the only state whose comprehensive privacy law has produced a substantial public enforcement record, and it has two enforcers producing it. This charts the twelve publicly documented CCPA actions, the penalty in each, the document each rests on, and the allegations that recur across almost all of them.
Read more →
CCPA / CPRA
September 1, 2026
The California Privacy Protection Agency's rulemaking package on automated decisionmaking technology, risk assessments and cybersecurity audits took effect January 1, 2026, and the obligations it creates switch on across four separate years. This reports what the approved text defines, whom each article reaches by its own terms, and the dates written into it.
Read more →
BIPA
August 31, 2026
Two 2023 decisions of the Illinois Supreme Court set the outer bounds of exposure under the Biometric Information Privacy Act, and the legislature answered one of them in 2024. The reasoning in each is more revealing than the result: both courts reached conclusions the statutory text compelled while acknowledging the consequences.
Read more →
BIPA
August 31, 2026
Section 10 of the Illinois Biometric Information Privacy Act carves health care information out of the definition of a biometric identifier. In Mosby v. Ingalls Memorial Hospital, the Illinois Supreme Court held that the carve-out is two clauses joined by "or" and that only the first is limited to patients. The second turns on purpose, whatever the source.
Read more →
BIPA
August 31, 2026
The Illinois Workers' Compensation Act makes its own remedies exclusive for injuries covered by it, and Illinois employers argued that a fingerprint timeclock claim was such an injury. In McDonald v. Symphony Bronzeville Park, the Illinois Supreme Court answered the certified question in the negative, on grounds that turn on what kind of injury the compensation scheme was built to price.
Read more →
Biometric Privacy
August 31, 2026
Texas has regulated the commercial capture of biometric identifiers since 2009, and for more than a decade nobody enforced the statute. The record now consists of two Attorney General actions, against Meta and against Google, and the settlement documents are more informative than the headline figures.
Read more →
Biometric Privacy
August 24, 2026
Illinois is not the only state with a biometric privacy statute: it is the only one where a private plaintiff can bring the claim. Texas, Washington and Colorado each regulate the capture and retention of biometric identifiers, and each reserves enforcement to a state official. This guide reads the three statutes against each other and traces what that enforcement design produces in practice.
Read more →
Breach Notification
August 24, 2026
Every state has a breach notification statute, and no two set the same combination of deadline, regulator and threshold. This guide charts the individual-notice deadline and the regulator notice rule for the 48 states whose statutes are documented against a primary source in the research behind this site.
Read more →
Consumer Health Data
August 24, 2026
HIPAA attaches to a category of organisation. A newer class of state statute attaches to a category of information instead, defined by what it reveals about a person's health rather than by who holds it. This guide compares how Nevada, Maryland and Washington draw that line, and where the federal Health Breach Notification Rule sits alongside them.
Read more →
Data Brokers
August 24, 2026
Data broker registration is the one privacy obligation that starts with a public filing rather than a consumer request. Four states (California, Vermont, Texas and Oregon) operate registries, and each defines the regulated entity differently enough that a company can be a broker in one and not the next. This guide reads the four statutes against each other.
Read more →
Employee Privacy
August 24, 2026
There is no single employee privacy statute in any state. What exists is a stack of laws written decades apart, each aimed at whatever the anxiety of its moment was: a paper file, a tape recorder, a Facebook password, a fingerprint scanner. Read in the order they arrived, the stack explains its own gaps. This guide takes them chronologically rather than by state.
Read more →
State Comprehensive Privacy Laws
August 24, 2026
Twenty-four states have enacted a comprehensive consumer privacy statute. Twenty are in force as of August 2026 and four take effect between 2027 and 2028. This guide charts every one against the same questions, with each cell drawn from the statute cited in its row.
Read more →
Pixel Tracking
August 24, 2026
Plaintiffs suing over analytics pixels, session recording and web chat rarely plead a privacy statute. They plead eavesdropping laws written for telephone wires in 1967 and 1968, which carry per-violation damages and no requirement to prove loss. This guide sets out the statutory elements those claims turn on, the party-consent question that decides most of them, and the newer pen-register theory.
Read more →
CCPA / CPRA
August 12, 2026
The CCPA gives California residents seven rights over their personal information, each with its own mechanics, exceptions and deadlines. This guide sets out what each right requires of a covered business, how verification works, when a request can be refused, and what the statute permits by way of charging for data.
Read more →
CCPA / CPRA
August 12, 2026
The California Consumer Privacy Act does not apply to every company that touches Californian data. It applies to for-profit entities that do business in California and meet one of three thresholds. This explains what each threshold counts, how the definitions of business, service provider and third party divide responsibility, and which categories of data fall outside the statute.
Read more →
BIPA
August 12, 2026
Illinois BIPA is the only major US biometric statute that lets individuals sue directly, which is why a single-state law drives nationwide settlement exposure. This guide sets out what the statute requires, what the Illinois Supreme Court has held about accrual and injury, and where the obligations sit relative to biometric rules in other states.
Read more →
Consumer Health Data
August 12, 2026
Most health data collected by apps, wearables and websites falls outside HIPAA, which reaches only covered entities and their business associates. Washington's My Health My Data Act was the first US statute written specifically to close that gap, and it is enforceable by individuals rather than only by the state.
Read more →