Breach Notification
November 2, 2026
Maine's breach chapter, the Notice of Risk to Personal Data Act, applies one notice trigger to information brokers and a misuse-based trigger to everyone else. Notice is due within 30 days of learning of a breach and identifying its scope, every notice is copied to a state regulator, and violations are civil violations with fines that do not reach public bodies.
Read more →
State Comprehensive Privacy Laws
November 2, 2026
Montana enacted its Consumer Data Privacy Act in 2023 and rewrote much of it two years later. Senate Bill 297, in force since October 1, 2025, halved the main threshold, ended the nonprofit exemption, added a duty of care toward minors that reaches businesses of any size, and struck the notice-and-cure step before an Attorney General action.
Read more →
Breach Notification
November 2, 2026
Montana has three parallel breach sections: MCA 30-14-1704 for persons and businesses, 33-19-321 for insurance licensees, and 2-6-1503 for state agencies. Each sends a copy of every resident notice to a state office, and none sets a day count. The general section is enforced through the Consumer Protection Act by the Department of Justice.
Read more →
Genetic Privacy
November 2, 2026
Montana's Genetic Information Privacy Act, Title 30, chapter 23, part 1, came from SB 351 of 2023 and was rewritten in 2025. Its free conference committee version reaches any organization that collects, uses or analyzes genetic data, ties government access to warrants, restricts foreign storage, and gives the attorney general sole enforcement power.
Read more →
Privacy Litigation
November 2, 2026
Ohio's 2023 budget bill added a rule requiring social platforms to get a parent's verifiable consent before a child under 16 could sign up. A federal judge in Columbus blocked it before it took effect and entered a permanent injunction in April 2025. In June 2026 a divided Sixth Circuit panel reversed, and NetChoice has until December 3, 2026 to seek Supreme Court review.
Read more →
Breach Notification
November 2, 2026
Ohio's private-sector breach law requires notice to residents within 45 days when an access-and-acquisition incident creates a material risk of identity theft or fraud. It names no state office to receive notice, sends a report to the national credit bureaus above 1,000 residents, and gives the Attorney General exclusive power to sue for penalties that rise with each day of noncompliance.
Read more →
Data Security Rules
November 2, 2026
Chapter 1354 of the Ohio Revised Code, enacted by Senate Bill 220 in 2018, imposes no security duty. It describes a written cybersecurity program that lets a covered entity plead an affirmative defense to an Ohio tort claim alleging that unreasonable security caused a data breach, and states that it creates neither a minimum standard nor a private right of action.
Read more →
State Comprehensive Privacy Laws
October 26, 2026
Iowa's chapter 715D, enacted as Senate File 262 and in force since January 1, 2025, is built from fewer parts than its neighbors. It has nine sections, four consumer rights, a 90-day response window, notice and opt-out in place of consent for sensitive data, no assessment requirement, and a 90-day cure with no end date.
Read more →
Breach Notification
October 26, 2026
Iowa's Personal Information Security Breach Protection chapter dates from 2008 and was reshaped in 2014 and 2018. It reaches paper printouts of computer records, lets a business skip notice only on a written no-harm finding kept five years, and puts a five-business-day Attorney General clock behind the first consumer notice.
Read more →
State Comprehensive Privacy Laws
October 26, 2026
Kentucky's privacy statute, House Bill 15 of 2024, took effect January 1, 2026 at KRS 367.3611 to 367.3629. A 2025 act widened its health-data exemptions before it ever applied, its 30-day cure has no expiry, penalties flow to a dedicated fund, and the Attorney General invoked it eight days after it began.
Read more →
Breach Notification
October 26, 2026
Kentucky's private-sector breach statute was created by House Bill 232 in 2014 and has not been amended since. It counts an incident as a breach only if it causes or is reasonably believed to cause identity theft or fraud, requires no notice to any state office, and contains no enforcement clause of its own.
Read more →
Breach Notification
October 26, 2026
House Bill 5 of 2014 gave Kentucky's executive branch, local governments, school districts and public universities, and the contractors that receive their data, a security duty and a staged reporting chain: officials within 72 hours, again within 48 hours of the investigation's end, then affected individuals within 35 days.
Read more →
State Comprehensive Privacy Laws
October 26, 2026
Nebraska's design code, LB 504, was approved May 30, 2025 and became operative January 1, 2026. LB 838 rewrote its coverage test, more than doubled its list of engagement features and added two sections, effective July 18, 2026. Penalties of up to $50,000 became available July 1, 2026, and the Attorney General first pleaded the Act in October 2026.
Read more →
Breach Notification
October 26, 2026
Nebraska's Financial Data Protection and Consumer Notification of Data Security Breach Act of 2006 requires a good-faith investigation before notice, routes every required notice to the Attorney General as well, offers a small-business newspaper option, and since 2018 carries a security duty enforced through the Consumer Protection Act.
Read more →
State Comprehensive Privacy Laws
October 26, 2026
Nebraska's Data Privacy Act, sections 1 to 30 of LB 1074 (2024), took effect January 1, 2025 at sections 87-1101 to 87-1130. It counts no consumers, reaching any business outside the federal small-business definition, and it still binds small businesses on selling sensitive data. Its cure demands proof, and no enforcement under it was found.
Read more →
Breach Notification
October 26, 2026
New Hampshire's three-section breach subdivision took effect January 1, 2007 and has not been amended. It requires notice when misuse is likely or cannot be determined, routes the state notice to a primary regulator or the Attorney General, and gives injured persons a damages action that doubles or trebles for willful violations.
Read more →
State Comprehensive Privacy Laws
October 26, 2026
RSA chapter 507-H, in force since January 1, 2025, reaches businesses at 35,000 consumers, requires opt-out signals, conditions teen targeting on consent, and from 2027 bars selling a child's data. Violations are prosecuted under the consumer protection act at up to $10,000 each, and the chapter grants no rulemaking power.
Read more →
State AG Enforcement
October 19, 2026
On October 9, 2024 the attorneys general of 49 states and the District of Columbia settled with Marriott over the Starwood reservation database breach and a later intrusion using franchise employee credentials. Marriott agreed to pay $52 million divided among the states and to a detailed, court-ordered security program, without admitting liability.
Read more →
Breach Notification
October 19, 2026
Michigan's breach duty is section 12 of the Identity Theft Protection Act, MCL 445.72. It requires notice unless the entity determines, with ordinary prudence, that the breach is not likely to cause substantial loss, injury or identity theft. Insurers are carved out to a parallel regime in the Insurance Code, and Senate Bills 360 to 364 would add Attorney General notice.
Read more →
State Comprehensive Privacy Laws
October 19, 2026
Minnesota's Consumer Data Privacy Act, Minn. Stat. 325M.10 to 325M.21, has applied since July 31, 2025 to entities that control or process data on 100,000 Minnesotans, or 25,000 with a sale-revenue test. It adds a third-party list right and a written policy inventory to the familiar model, and since January 31, 2026 the Attorney General may sue without a warning letter.
Read more →
Breach Notification
October 19, 2026
Minnesota's private-sector breach statute, Minn. Stat. 325E.61, has changed little since 2006. It requires notice to residents whose unencrypted personal information was or is reasonably believed acquired, without a risk-of-harm exception or a day count, adds a 48-hour credit bureau notice above 500 persons, and leaves government entities to a separate statute with its own rules.
Read more →
Automated Decision-Making
October 19, 2026
Paragraph (g) of Minn. Stat. 325M.14, subdivision 1, gives a consumer profiled for a significant decision the right to question the result, be told the reason, learn (if feasible) what might have changed it, review the data used and obtain reevaluation on corrected data. Colorado, Tennessee and California treat the same ground differently, and the statute does not define most of its terms.
Read more →
Breach Notification
October 19, 2026
Tennessee replaced its breach statute twice in two years. Public Chapter 692 of 2016 set a 45-day deadline and dropped the encryption exception; Public Chapter 91 of 2017 rewrote section 47-18-2107 in full, restoring encryption by reference to FIPS 140-2, keeping 45 days, adding a materiality test and a credit bureau duty, and keeping a customer's right to sue.
Read more →
State Comprehensive Privacy Laws
October 19, 2026
Tennessee's privacy statute, enacted as Public Chapter 408 of 2023 and in force since July 1, 2025, combines a $25 million revenue floor with high consumer counts, broad entity exemptions, a permanent 60-day cure, an affirmative defense for programs aligned to the NIST Privacy Framework, and court-awarded treble damages for willful violations.
Read more →
AI & Privacy
October 12, 2026
Utah's SB 149 took effect May 1, 2024, creating an Office of Artificial Intelligence Policy, a regulatory sandbox and a rule that a business using generative AI must admit it when asked. SB 226 of 2025 moved that duty to chapter 77 of Title 13 and narrowed it, HB 452 added mental health chatbot rules, and the office's own chapter is set to be repealed July 1, 2027.
Read more →
COPPA
October 12, 2026
Utah replaced its 2023 social media laws in 2024 with two bills. SB 194 created the Minor Protection in Social Media Act at chapter 71 of Title 13, requiring age assurance and maximum-privacy defaults for minor accounts, and HB 464 created a private action over minors' excessive use. A federal court enjoined chapter 71 on September 10, 2024, and the Tenth Circuit appeal remains pending.
Read more →
State Comprehensive Privacy Laws
October 5, 2026
Florida's Digital Bill of Rights, enacted by SB 262 in 2023, assigns most of its duties to a controller defined so narrowly that a $1 billion revenue floor and one of three business-model tests must both be met. One section, 501.715, reaches any for-profit business collecting Floridians' data that sells sensitive data, and 2024 rules fill in the enforcement detail.
Read more →
Breach Notification
October 5, 2026
Florida's breach statute is section 501.171, created in 2014 by CS/CS/SB 1524 as the Florida Information Protection Act. It pairs a duty to take reasonable security measures with two 30-day notice clocks, one to residents and one to the Department of Legal Affairs at 500 people, and it treats a violation as a FDUTPA unfair practice with per-breach civil penalties capped at $500,000.
Read more →
Breach Notification
October 5, 2026
Virginia's breach statute sits in the criminal code at section 18.2-186.6 but is enforced civilly by the Attorney General, with penalties up to $150,000 per breach. Residents and the Attorney General get notice when identity theft or fraud is caused or reasonably believed likely. A medical statute reaches only public bodies, and payroll and tax preparer breaches have rules of their own.
Read more →
State Comprehensive Privacy Laws
October 5, 2026
Virginia has amended its Consumer Data Protection Act twice for minors. Chapters 840 and 844 of 2024 restricted processing of a known child's data and required parental consent under COPPA from January 1, 2025. Chapter 703 of 2025 capped social media use by users under 16 at one hour a day, a rule a federal court preliminarily enjoined as to NetChoice members in February 2026.
Read more →
Consumer Health Data
October 5, 2026
Virginia protects reproductive and sexual health data through its general consumer protection statute rather than its privacy law. SB 754, enacted in 2025 as chapter 591, added a prohibited practice to Va. Code § 59.1-200 and a seven-part definition to § 59.1-198, bringing the Act's private damages action and Attorney General remedies with it.
Read more →
Data Brokers
September 28, 2026
Nevada's rules for commercial websites sit in NRS 603A.300 to 603A.360 and were built in three steps: a 2017 privacy notice requirement, a 2019 right to direct an operator not to sell covered information, and a 2021 bill that extended the opt-out to data brokers, broadened the definition of sale and limited the 30-day repair window to first failures.
Read more →
Breach Notification
September 28, 2026
Pennsylvania's breach statute is the Act of December 22, 2005, P.L. 474, No. 94. Senate Bill 696, enacted as Act 151 of 2022, rewrote its trigger and added duties for State agencies, contractors, counties, schools and municipalities. Senate Bill 824, enacted as Act 33 of 2024, added Attorney General notice and credit monitoring and quietly narrowed the medical information element.
Read more →
State Comprehensive Privacy Laws
September 21, 2026
Substitute Senate Bill 1295 became Public Act 25-113 on June 24, 2025. Its Data Privacy Act sections took effect together on July 1, 2026: a lower threshold, two no-threshold triggers, more sensitive data, profiling rights, impact assessments and a ban on selling teenagers' data. Public Act 26-64 amends several of the same sections again from October 1, 2026.
Read more →
State Comprehensive Privacy Laws
September 21, 2026
Chapter 121 of the Laws of 2024 added article 39-FF, sections 899-ee to 899-mm, to New York's General Business Law. It has applied since June 20, 2025 to operators whose users are known minors or whose services are primarily directed to minors. The Attorney General issued an advance notice in 2024 and implementation guidance in May 2025, but has not published proposed rules.
Read more →
State Comprehensive Privacy Laws
September 14, 2026
The Maryland Online Data Privacy Act has applied since October 1, 2025, but not at the section numbers its bill record gives, or in the form its chapter law's plain text suggests. This post sets out the statute as the General Assembly now publishes it, the Attorney General's reading of its minimization rule, and the immigration-enforcement amendments effective July 1, 2026.
Read more →
Data Security Rules
September 14, 2026
The SHIELD Act of 2019 did two things: it widened New York's breach notification statute, General Business Law section 899-aa, and it added section 899-bb, a standalone duty to maintain reasonable data security. This sets out the security requirement as enacted, the routes to deemed compliance, and the three later chapters that changed section 899-aa without touching section 899-bb.
Read more →
State Comprehensive Privacy Laws
September 14, 2026
Vermont enacted its Age-Appropriate Design Code as Act 63 of 2025, signed June 12, 2025. The substantive duties begin on January 1, 2027, but the Attorney General's rulemaking powers took effect in July 2025 and proposed rules are open for comment until October 2, 2026. This post covers its definitions and duties and compares them with the California provisions the Ninth Circuit has ruled on.
Read more →
CCPA / CPRA
September 1, 2026
California is the only state whose comprehensive privacy law has produced a substantial public enforcement record, and it has two enforcers producing it. This charts the twelve publicly documented CCPA actions, the penalty in each, the document each rests on, and the allegations that recur across almost all of them.
Read more →
Biometric Privacy
August 31, 2026
Texas has regulated the commercial capture of biometric identifiers since 2009, and for more than a decade nobody enforced the statute. The record now consists of two Attorney General actions, against Meta and against Google, and the settlement documents are more informative than the headline figures.
Read more →
Biometric Privacy
August 24, 2026
Illinois is not the only state with a biometric privacy statute: it is the only one where a private plaintiff can bring the claim. Texas, Washington and Colorado each regulate the capture and retention of biometric identifiers, and each reserves enforcement to a state official. This guide reads the three statutes against each other and traces what that enforcement design produces in practice.
Read more →
Consent Management
August 24, 2026
A universal opt-out signal moves the choice from the website to the browser: one setting, broadcast to every site, instead of a banner per visit. Several state statutes now require controllers to honour one. This guide sets out what those statutes and the California regulations say, the conditions on the mechanism, and what two enforcement actions establish about broken opt-out plumbing.
Read more →
Consumer Health Data
August 24, 2026
HIPAA attaches to a category of organisation. A newer class of state statute attaches to a category of information instead, defined by what it reveals about a person's health rather than by who holds it. This guide compares how Nevada, Maryland and Washington draw that line, and where the federal Health Breach Notification Rule sits alongside them.
Read more →
Facial Recognition
August 24, 2026
There is no national facial recognition statute, and the law that exists does not divide by state so much as by who is operating the system. Government deployment has produced warrant requirements, accountability reports and mandatory human review. Private deployment has produced one outright municipal ban and a federal enforcement order. This guide sorts the rules along that line.
Read more →