Consent Management
November 2, 2026
Maine's chapter 94 of Title 35-A is one section long. Since July 1, 2020 it has barred broadband providers from using, selling or sharing customer personal information without express, affirmative consent, and from pricing that choice. Four industry groups sued in 2020; the federal court's published orders rejected their preemption claims and declined to strike the law on the pleadings.
Read more →
Breach Notification
November 2, 2026
Maine's breach chapter, the Notice of Risk to Personal Data Act, applies one notice trigger to information brokers and a misuse-based trigger to everyone else. Notice is due within 30 days of learning of a breach and identifying its scope, every notice is copied to a state regulator, and violations are civil violations with fines that do not reach public bodies.
Read more →
Employee Privacy
November 2, 2026
Maine's employee social media privacy rules were enacted as Part B of a 2015 bill about leave for victims of violence. Five sections of Title 26 bar employers from seeking passwords, in-person viewing, account information, contact additions or settings changes from employees and applicants, keep three exceptions, and leave enforcement to Department of Labor fines.
Read more →
State Comprehensive Privacy Laws
November 2, 2026
Montana enacted its Consumer Data Privacy Act in 2023 and rewrote much of it two years later. Senate Bill 297, in force since October 1, 2025, halved the main threshold, ended the nonprofit exemption, added a duty of care toward minors that reaches businesses of any size, and struck the notice-and-cure step before an Attorney General action.
Read more →
Breach Notification
November 2, 2026
Montana has three parallel breach sections: MCA 30-14-1704 for persons and businesses, 33-19-321 for insurance licensees, and 2-6-1503 for state agencies. Each sends a copy of every resident notice to a state office, and none sets a day count. The general section is enforced through the Consumer Protection Act by the Department of Justice.
Read more →
Genetic Privacy
November 2, 2026
Montana's Genetic Information Privacy Act, Title 30, chapter 23, part 1, came from SB 351 of 2023 and was rewritten in 2025. Its free conference committee version reaches any organization that collects, uses or analyzes genetic data, ties government access to warrants, restricts foreign storage, and gives the attorney general sole enforcement power.
Read more →
Privacy Litigation
November 2, 2026
Ohio's 2023 budget bill added a rule requiring social platforms to get a parent's verifiable consent before a child under 16 could sign up. A federal judge in Columbus blocked it before it took effect and entered a permanent injunction in April 2025. In June 2026 a divided Sixth Circuit panel reversed, and NetChoice has until December 3, 2026 to seek Supreme Court review.
Read more →
Breach Notification
November 2, 2026
Ohio's private-sector breach law requires notice to residents within 45 days when an access-and-acquisition incident creates a material risk of identity theft or fraud. It names no state office to receive notice, sends a report to the national credit bureaus above 1,000 residents, and gives the Attorney General exclusive power to sue for penalties that rise with each day of noncompliance.
Read more →
Data Security Rules
November 2, 2026
Chapter 1354 of the Ohio Revised Code, enacted by Senate Bill 220 in 2018, imposes no security duty. It describes a written cybersecurity program that lets a covered entity plead an affirmative defense to an Ohio tort claim alleging that unreasonable security caused a data breach, and states that it creates neither a minimum standard nor a private right of action.
Read more →
Breach Notification
November 2, 2026
Wisconsin's breach statute never uses the word breach. It requires notice when an entity knows personal information was acquired without authorization, counts DNA profiles and biometric data as personal information, and sets a 45-day limit. It names no enforcer and no penalty, and a federal court has held it creates no private right of action.
Read more →
Employee Privacy
November 2, 2026
Wisconsin's Internet privacy protection statute, created by 2013 Wisconsin Act 208, applies one access rule to employers, educational institutions and landlords. It bars conditioning a job, admission or tenancy on handing over or displaying a personal Internet account, lists what stays permitted, and routes retaliation claims through the Fair Employment Act process.
Read more →
Genetic Privacy
November 2, 2026
Wisconsin regulates genetic testing in employment through two statutes created by the same 1992 act. Section 111.372 of the Fair Employment Act bars employers, unions, employment agencies and licensing agencies from testing as a condition of a job, and s. 942.07 makes testing or disclosure without written consent a Class B misdemeanor.
Read more →