New statutes and the bills likely to become them, tracked by bill number with effective dates called out.
Breach Notification
November 9, 2026
Arizona's breach article opens with a duty to investigate any security incident, then gives the data owner 45 days from the determination that a breach occurred. Above 1,000 individuals, filings go to three credit bureaus, the Attorney General and the state homeland security director. Only the Attorney General may enforce, under a penalty ceiling of $500,000.
Read more →
Genetic Privacy
November 9, 2026
Arizona protects genetic test results through a small chapter in its civil procedure title, not through a single privacy act. A.R.S. 12-2802 makes the results privileged to the person tested and lists who may receive them. Title 20 adds an insurer consent rule, and a separate consumer testing chapter borrows 12-2802 as its disclosure standard.
Read more →
GLBA
November 9, 2026
Arizona has no statute based on the NAIC data security model, but Chapter 11 of Title 20 governs how insurers, producers and support organizations handle personal information. It sets notice duties in section 20-2104, gives individuals access and correction rights, limits disclosure under section 20-2113 and provides limited private remedies.
Read more →
Breach Notification
November 9, 2026
Louisiana's breach chapter imposes a reasonable security duty and a record destruction duty before it reaches notice. Residents are told within 60 days of discovery, unless written reasons for delay reach the Attorney General inside that window. A separate regulation requires the Attorney General's copy within 10 days of resident notice, and R.S. 51:3075 allows a suit for actual damages.
Read more →
Employee Privacy
November 9, 2026
Louisiana's 2014 Personal Online Account Privacy Protection Act stops employers and educational institutions from asking for the login credentials to a personal online account. The definition of personal account is tightly drawn, the employer exceptions are longer than the school ones, and the chapter's only liability section limits exposure.
Read more →
Genetic Privacy
November 9, 2026
La. R.S. 22:1023 is a health insurance statute with reach beyond underwriting. It restricts insurers' use of genetic information, requires detailed signed authorizations, treats an insured's genetic information as property, and creates statutory damages of at least $50,000 or $100,000. A 2015 appellate decision read it to reach a diagnostic code inside an insurer's own systems.
Read more →
Genetic Privacy
November 9, 2026
North Carolina's genetic employment statute is one short section enacted in 1997. It forbids refusing employment or discharging someone because of requested genetic testing or counseling, or genetic information about the person or family. It reaches any public or private entity, but says nothing about remedies and does not regulate testing itself.
Read more →
Breach Notification
November 9, 2026
North Carolina's Identity Theft Protection Act does not limit its breach duty to computers: section 75-65 reaches personal information in any form. Every business that notifies a person also reports to the Attorney General's Consumer Protection Division, with no minimum count, and a violation is an unfair practice under G.S. 75-1.1, with private suits reserved for those injured.
Read more →
Data Security Rules
November 9, 2026
Article 2A of Chapter 75, the Identity Theft Protection Act, goes further than breach notice. Section 75-62 limits how a business may display, transmit, mail or sell Social Security numbers, section 75-64 sets rules for destroying records, and each section makes a violation a violation of G.S. 75-1.1. The two differ on private suits and on treble damages.
Read more →
Breach Notification
November 9, 2026
South Carolina's private-sector breach statute names the Department of Consumer Affairs, not the Attorney General. Section 39-1-90 sends filings above 1,000 persons to that Department, gives it power to set a per-resident fine, and lets an injured resident sue. Its text reaches computerized or other data, though its definition of a breach mentions only computerized data.
Read more →
Genetic Privacy
November 9, 2026
South Carolina's Chapter 93 of Title 38 regulates genetic information in health coverage, but two of its sections are written without limiting them to insurers. It bars issuers from using genetic information in coverage decisions and requires informed consent for genetic tests. Violations can draw department fines, unfair trade practice exposure and a private action.
Read more →
Data Security Rules
November 9, 2026
South Carolina added Chapter 99 to Title 38 through 2018 Act No. 171, signed May 3, 2018 and effective January 1, 2019, and its Department of Insurance describes it as the first enactment of the NAIC data security model. The chapter tracks the model closely, so its interest lies in the places where the wording, the timing and the later amendments part from it.
Read more →
Consent Management
November 2, 2026
Maine's chapter 94 of Title 35-A is one section long. Since July 1, 2020 it has barred broadband providers from using, selling or sharing customer personal information without express, affirmative consent, and from pricing that choice. Four industry groups sued in 2020; the federal court's published orders rejected their preemption claims and declined to strike the law on the pleadings.
Read more →
Breach Notification
November 2, 2026
Maine's breach chapter, the Notice of Risk to Personal Data Act, applies one notice trigger to information brokers and a misuse-based trigger to everyone else. Notice is due within 30 days of learning of a breach and identifying its scope, every notice is copied to a state regulator, and violations are civil violations with fines that do not reach public bodies.
Read more →
Employee Privacy
November 2, 2026
Maine's employee social media privacy rules were enacted as Part B of a 2015 bill about leave for victims of violence. Five sections of Title 26 bar employers from seeking passwords, in-person viewing, account information, contact additions or settings changes from employees and applicants, keep three exceptions, and leave enforcement to Department of Labor fines.
Read more →
State Comprehensive Privacy Laws
November 2, 2026
Montana enacted its Consumer Data Privacy Act in 2023 and rewrote much of it two years later. Senate Bill 297, in force since October 1, 2025, halved the main threshold, ended the nonprofit exemption, added a duty of care toward minors that reaches businesses of any size, and struck the notice-and-cure step before an Attorney General action.
Read more →
Breach Notification
November 2, 2026
Montana has three parallel breach sections: MCA 30-14-1704 for persons and businesses, 33-19-321 for insurance licensees, and 2-6-1503 for state agencies. Each sends a copy of every resident notice to a state office, and none sets a day count. The general section is enforced through the Consumer Protection Act by the Department of Justice.
Read more →
Genetic Privacy
November 2, 2026
Montana's Genetic Information Privacy Act, Title 30, chapter 23, part 1, came from SB 351 of 2023 and was rewritten in 2025. Its free conference committee version reaches any organization that collects, uses or analyzes genetic data, ties government access to warrants, restricts foreign storage, and gives the attorney general sole enforcement power.
Read more →
Breach Notification
November 2, 2026
Ohio's private-sector breach law requires notice to residents within 45 days when an access-and-acquisition incident creates a material risk of identity theft or fraud. It names no state office to receive notice, sends a report to the national credit bureaus above 1,000 residents, and gives the Attorney General exclusive power to sue for penalties that rise with each day of noncompliance.
Read more →
Data Security Rules
November 2, 2026
Chapter 1354 of the Ohio Revised Code, enacted by Senate Bill 220 in 2018, imposes no security duty. It describes a written cybersecurity program that lets a covered entity plead an affirmative defense to an Ohio tort claim alleging that unreasonable security caused a data breach, and states that it creates neither a minimum standard nor a private right of action.
Read more →
Breach Notification
November 2, 2026
Wisconsin's breach statute never uses the word breach. It requires notice when an entity knows personal information was acquired without authorization, counts DNA profiles and biometric data as personal information, and sets a 45-day limit. It names no enforcer and no penalty, and a federal court has held it creates no private right of action.
Read more →
Employee Privacy
November 2, 2026
Wisconsin's Internet privacy protection statute, created by 2013 Wisconsin Act 208, applies one access rule to employers, educational institutions and landlords. It bars conditioning a job, admission or tenancy on handing over or displaying a personal Internet account, lists what stays permitted, and routes retaliation claims through the Fair Employment Act process.
Read more →
Genetic Privacy
November 2, 2026
Wisconsin regulates genetic testing in employment through two statutes created by the same 1992 act. Section 111.372 of the Fair Employment Act bars employers, unions, employment agencies and licensing agencies from testing as a condition of a job, and s. 942.07 makes testing or disclosure without written consent a Class B misdemeanor.
Read more →
State Comprehensive Privacy Laws
October 26, 2026
Iowa's chapter 715D, enacted as Senate File 262 and in force since January 1, 2025, is built from fewer parts than its neighbors. It has nine sections, four consumer rights, a 90-day response window, notice and opt-out in place of consent for sensitive data, no assessment requirement, and a 90-day cure with no end date.
Read more →
Breach Notification
October 26, 2026
Iowa's Personal Information Security Breach Protection chapter dates from 2008 and was reshaped in 2014 and 2018. It reaches paper printouts of computer records, lets a business skip notice only on a written no-harm finding kept five years, and puts a five-business-day Attorney General clock behind the first consumer notice.
Read more →
Genetic Privacy
October 26, 2026
Iowa Code 729.6, enacted in 1992 and rewritten in 2010, bars every Iowa employer regardless of size from soliciting, requiring or administering a genetic test as a condition of employment, requires written informed consent before anyone obtains genetic information, and lets an aggrieved worker, county attorney or the attorney general sue for equitable relief.
Read more →
State Comprehensive Privacy Laws
October 26, 2026
Kentucky's privacy statute, House Bill 15 of 2024, took effect January 1, 2026 at KRS 367.3611 to 367.3629. A 2025 act widened its health-data exemptions before it ever applied, its 30-day cure has no expiry, penalties flow to a dedicated fund, and the Attorney General invoked it eight days after it began.
Read more →
Breach Notification
October 26, 2026
Kentucky's private-sector breach statute was created by House Bill 232 in 2014 and has not been amended since. It counts an incident as a breach only if it causes or is reasonably believed to cause identity theft or fraud, requires no notice to any state office, and contains no enforcement clause of its own.
Read more →
Breach Notification
October 26, 2026
House Bill 5 of 2014 gave Kentucky's executive branch, local governments, school districts and public universities, and the contractors that receive their data, a security duty and a staged reporting chain: officials within 72 hours, again within 48 hours of the investigation's end, then affected individuals within 35 days.
Read more →
State Comprehensive Privacy Laws
October 26, 2026
Nebraska's design code, LB 504, was approved May 30, 2025 and became operative January 1, 2026. LB 838 rewrote its coverage test, more than doubled its list of engagement features and added two sections, effective July 18, 2026. Penalties of up to $50,000 became available July 1, 2026, and the Attorney General first pleaded the Act in October 2026.
Read more →
Breach Notification
October 26, 2026
Nebraska's Financial Data Protection and Consumer Notification of Data Security Breach Act of 2006 requires a good-faith investigation before notice, routes every required notice to the Attorney General as well, offers a small-business newspaper option, and since 2018 carries a security duty enforced through the Consumer Protection Act.
Read more →
State Comprehensive Privacy Laws
October 26, 2026
Nebraska's Data Privacy Act, sections 1 to 30 of LB 1074 (2024), took effect January 1, 2025 at sections 87-1101 to 87-1130. It counts no consumers, reaching any business outside the federal small-business definition, and it still binds small businesses on selling sensitive data. Its cure demands proof, and no enforcement under it was found.
Read more →
Breach Notification
October 26, 2026
New Hampshire's three-section breach subdivision took effect January 1, 2007 and has not been amended. It requires notice when misuse is likely or cannot be determined, routes the state notice to a primary regulator or the Attorney General, and gives injured persons a damages action that doubles or trebles for willful violations.
Read more →
Employee Privacy
October 26, 2026
New Hampshire's 2014 workplace privacy act, HB 1407 (chapter 305), bars employers from asking for login information to an employee's or applicant's personal social networking account, forcing contact additions, or demanding lower privacy settings. It keeps employer equipment, employer accounts and two kinds of investigation outside the bar, and is enforced only by a labor commissioner penalty.
Read more →
State Comprehensive Privacy Laws
October 26, 2026
RSA chapter 507-H, in force since January 1, 2025, reaches businesses at 35,000 consumers, requires opt-out signals, conditions teen targeting on consent, and from 2027 bars selling a child's data. Violations are prosecuted under the consumer protection act at up to $10,000 each, and the chapter grants no rulemaking power.
Read more →
Employee Privacy
October 19, 2026
Michigan's Bullard-Plawecki Employee Right to Know Act, in force since January 1, 1979, gives employees of employers with four or more workers a right to review and copy their personnel records, but excludes eight categories of material, bars records of off-duty associations and political activity, requires mailed notice before disciplinary records go to outsiders, and lets employees sue.
Read more →
Breach Notification
October 19, 2026
Michigan's breach duty is section 12 of the Identity Theft Protection Act, MCL 445.72. It requires notice unless the entity determines, with ordinary prudence, that the breach is not likely to cause substantial loss, injury or identity theft. Insurers are carved out to a parallel regime in the Insurance Code, and Senate Bills 360 to 364 would add Attorney General notice.
Read more →
VPPA
October 19, 2026
Michigan's Preservation of Personal Privacy Act bars businesses that sell, rent or lend books, sound recordings or videos from knowingly disclosing records identifying what a customer bought. Until 2016 PA 92 took effect on July 31, 2016, it carried $5,000 in statutory damages; claims over pre-amendment disclosures then produced a run of federal rulings on its limitations period.
Read more →
State Comprehensive Privacy Laws
October 19, 2026
Minnesota's Consumer Data Privacy Act, Minn. Stat. 325M.10 to 325M.21, has applied since July 31, 2025 to entities that control or process data on 100,000 Minnesotans, or 25,000 with a sale-revenue test. It adds a third-party list right and a written policy inventory to the familiar model, and since January 31, 2026 the Attorney General may sue without a warning letter.
Read more →
Breach Notification
October 19, 2026
Minnesota's private-sector breach statute, Minn. Stat. 325E.61, has changed little since 2006. It requires notice to residents whose unencrypted personal information was or is reasonably believed acquired, without a risk-of-harm exception or a day count, adds a 48-hour credit bureau notice above 500 persons, and leaves government entities to a separate statute with its own rules.
Read more →
Breach Notification
October 19, 2026
Tennessee replaced its breach statute twice in two years. Public Chapter 692 of 2016 set a 45-day deadline and dropped the encryption exception; Public Chapter 91 of 2017 rewrote section 47-18-2107 in full, restoring encryption by reference to FIPS 140-2, keeping 45 days, adding a materiality test and a credit bureau duty, and keeping a customer's right to sue.
Read more →
AI & Privacy
October 19, 2026
Tennessee's Ensuring Likeness, Voice, and Image Security Act, enacted as Public Chapter 588 and effective July 1, 2024, renamed the state's 1984 publicity statute, added a voice right that covers simulations, and created civil liability for public distribution of unauthorized voices or likenesses and for tools whose primary purpose is producing a particular person's voice or likeness.
Read more →
State Comprehensive Privacy Laws
October 19, 2026
Tennessee's privacy statute, enacted as Public Chapter 408 of 2023 and in force since July 1, 2025, combines a $25 million revenue floor with high consumer counts, broad entity exemptions, a permanent 60-day cure, an affirmative defense for programs aligned to the NIST Privacy Framework, and court-awarded treble damages for willful violations.
Read more →
Background Checks
October 12, 2026
Massachusetts runs criminal record checks through a state system with tiered access. An employer or landlord sees convictions only within fixed lookback windows, must collect a signed acknowledgment and check identification first, must hand the record to the applicant before asking about it, and holds the result under storage and logging rules set by regulation.
Read more →
Employee Privacy
October 12, 2026
Section 52C of chapter 149 gives current and former Massachusetts employees a right to review and copy their personnel record within five business days of a written request, to be told within ten days when negative information is added, and to file a rebuttal that travels with the record. The Attorney General enforces it; courts have recognized a narrower personal remedy.
Read more →
Biometric Privacy
October 12, 2026
Local Law 63 of 2021 added a tenant data privacy chapter to the New York City Administrative Code for apartment buildings that use key fobs, phone apps or biometric scanners at the door. It lists the only data such a system may hold, puts 90-day clocks on keeping it, bars its sale and several surveillance uses, and gives occupants a damages action for one violation only: an unlawful sale.
Read more →
COPPA
October 12, 2026
Utah's SB 142 of 2025 made app stores, not individual apps, the point where a user's age is checked and a parent's consent is collected. HB 498 of 2026 rewrote it before any duty applied: obligations now begin May 6, 2027, government enforcement is gone, and a harmed minor or parent may sue for the greater of actual damages or $1,000 per violation.
Read more →
AI & Privacy
October 12, 2026
Utah's SB 149 took effect May 1, 2024, creating an Office of Artificial Intelligence Policy, a regulatory sandbox and a rule that a business using generative AI must admit it when asked. SB 226 of 2025 moved that duty to chapter 77 of Title 13 and narrowed it, HB 452 added mental health chatbot rules, and the office's own chapter is set to be repealed July 1, 2027.
Read more →
COPPA
October 12, 2026
Utah replaced its 2023 social media laws in 2024 with two bills. SB 194 created the Minor Protection in Social Media Act at chapter 71 of Title 13, requiring age assurance and maximum-privacy defaults for minor accounts, and HB 464 created a private action over minors' excessive use. A federal court enjoined chapter 71 on September 10, 2024, and the Tenth Circuit appeal remains pending.
Read more →
State Comprehensive Privacy Laws
October 5, 2026
Florida's Digital Bill of Rights, enacted by SB 262 in 2023, assigns most of its duties to a controller defined so narrowly that a $1 billion revenue floor and one of three business-model tests must both be met. One section, 501.715, reaches any for-profit business collecting Floridians' data that sells sensitive data, and 2024 rules fill in the enforcement detail.
Read more →
Breach Notification
October 5, 2026
Florida's breach statute is section 501.171, created in 2014 by CS/CS/SB 1524 as the Florida Information Protection Act. It pairs a duty to take reasonable security measures with two 30-day notice clocks, one to residents and one to the Department of Legal Affairs at 500 people, and it treats a violation as a FDUTPA unfair practice with per-breach civil penalties capped at $500,000.
Read more →
Breach Notification
October 5, 2026
Virginia's breach statute sits in the criminal code at section 18.2-186.6 but is enforced civilly by the Attorney General, with penalties up to $150,000 per breach. Residents and the Attorney General get notice when identity theft or fraud is caused or reasonably believed likely. A medical statute reaches only public bodies, and payroll and tax preparer breaches have rules of their own.
Read more →
State Comprehensive Privacy Laws
October 5, 2026
Virginia has amended its Consumer Data Protection Act twice for minors. Chapters 840 and 844 of 2024 restricted processing of a known child's data and required parental consent under COPPA from January 1, 2025. Chapter 703 of 2025 capped social media use by users under 16 at one hour a day, a rule a federal court preliminarily enjoined as to NetChoice members in February 2026.
Read more →
Consumer Health Data
October 5, 2026
Virginia protects reproductive and sexual health data through its general consumer protection statute rather than its privacy law. SB 754, enacted in 2025 as chapter 591, added a prohibited practice to Va. Code § 59.1-200 and a seven-part definition to § 59.1-198, bringing the Act's private damages action and Attorney General remedies with it.
Read more →
Genetic Privacy
September 28, 2026
The Illinois Genetic Information Privacy Act, 410 ILCS 513, has been in force since 1998. It adopts HIPAA's definition of genetic information, which covers family medical history, forbids employers to solicit that information, limits insurers, and lets any aggrieved person sue for $2,500 or $15,000 per violation. Public Act 104-642 adds biomarkers from January 1, 2027.
Read more →
Data Brokers
September 28, 2026
Nevada's rules for commercial websites sit in NRS 603A.300 to 603A.360 and were built in three steps: a 2017 privacy notice requirement, a 2019 right to direct an operator not to sell covered information, and a 2021 bill that extended the opt-out to data brokers, broadened the definition of sale and limited the 30-day repair window to first failures.
Read more →
Data Security Rules
September 28, 2026
Senate Bill 227 of 2009 was introduced as an encryption rule and enacted with a payment card clause: a Nevada data collector that accepts cards follows the current PCI Data Security Standard for those transactions, and other data collectors encrypt personal information leaving their control. A 2011 bill widened the device rule, and 2025 bills renamed the office that approves other methods.
Read more →
Breach Notification
September 28, 2026
Pennsylvania's breach statute is the Act of December 22, 2005, P.L. 474, No. 94. Senate Bill 696, enacted as Act 151 of 2022, rewrote its trigger and added duties for State agencies, contractors, counties, schools and municipalities. Senate Bill 824, enacted as Act 33 of 2024, added Attorney General notice and credit monitoring and quietly narrowed the medical information element.
Read more →
China (PIPL)
September 21, 2026
The Regulations on Network Data Security Management are an administrative regulation of the State Council, made to implement three statutes at once rather than one. They define who a network data processor is, add concrete rules on privacy notices, portability and personalised recommendation, impose annual risk reporting on holders of important data, and set their own fine schedule.
Read more →
State Comprehensive Privacy Laws
September 21, 2026
Substitute Senate Bill 1295 became Public Act 25-113 on June 24, 2025. Its Data Privacy Act sections took effect together on July 1, 2026: a lower threshold, two no-threshold triggers, more sensitive data, profiling rights, impact assessments and a ban on selling teenagers' data. Public Act 26-64 amends several of the same sections again from October 1, 2026.
Read more →
State Comprehensive Privacy Laws
September 21, 2026
Chapter 121 of the Laws of 2024 added article 39-FF, sections 899-ee to 899-mm, to New York's General Business Law. It has applied since June 20, 2025 to operators whose users are known minors or whose services are primarily directed to minors. The Attorney General issued an advance notice in 2024 and implementation guidance in May 2025, but has not published proposed rules.
Read more →
Ransomware
September 14, 2026
The Cyber Incident Reporting for Critical Infrastructure Act of 2022 wrote two reporting clocks into federal law but left their start date, and the definitions of who reports and what, to a CISA rulemaking that was due in October 2025. This sets out what the statute fixes, what the 2024 proposal would add, and where the rulemaking stood on September 14, 2026.
Read more →
State Comprehensive Privacy Laws
September 14, 2026
The Maryland Online Data Privacy Act has applied since October 1, 2025, but not at the section numbers its bill record gives, or in the form its chapter law's plain text suggests. This post sets out the statute as the General Assembly now publishes it, the Attorney General's reading of its minimization rule, and the immigration-enforcement amendments effective July 1, 2026.
Read more →
Data Security Rules
September 14, 2026
The SHIELD Act of 2019 did two things: it widened New York's breach notification statute, General Business Law section 899-aa, and it added section 899-bb, a standalone duty to maintain reasonable data security. This sets out the security requirement as enacted, the routes to deemed compliance, and the three later chapters that changed section 899-aa without touching section 899-bb.
Read more →
State Comprehensive Privacy Laws
September 14, 2026
Vermont enacted its Age-Appropriate Design Code as Act 63 of 2025, signed June 12, 2025. The substantive duties begin on January 1, 2027, but the Attorney General's rulemaking powers took effect in July 2025 and proposed rules are open for comment until October 2, 2026. This post covers its definitions and duties and compares them with the California provisions the Ninth Circuit has ruled on.
Read more →
Automated Decision-Making
September 7, 2026
Colorado's 2024 artificial intelligence statute was delayed once, then repealed and reenacted before it ever took effect. Senate Bill 26-189, signed May 14, 2026, replaced part 17 of article 1 of title 6 with a framework keyed to automated decision-making technology. Consequential decision survived as the trigger; the algorithmic discrimination duty did not.
Read more →
Employee Privacy
September 7, 2026
New Jersey's tracking device statute, N.J.S.A. 34:6B-22, was approved on January 18, 2022 and took effect ninety days later. It reached that form after four reprints that moved it from a fourth-degree crime to a civil penalty, from written consent to written notice, and from any tracking device to one designed for the sole purpose of tracking.
Read more →
UK Data Protection
September 7, 2026
The Data (Use and Access) Act 2025 is a nine-part statute covering smart data schemes, digital identity, buried pipes, birth registers, data protection, a new regulator and much else. Its commencement is the part most easily got wrong: Royal Assent brought almost none of it into force, and a reader working from the Act alone cannot tell what is law today.
Read more →
Data Brokers
September 1, 2026
California's Delete Act took an existing registry and attached machinery to it: one consumer request that reaches every registered broker, a 45-day processing cycle, a triennial third-party audit and a $200-a-day fine for not signing up. This reports what SB 362 and the 2025 amendment require, and the dates the statute and the DROP regulations set.
Read more →
Consumer Health Data
August 12, 2026
Most health data collected by apps, wearables and websites falls outside HIPAA, which reaches only covered entities and their business associates. Washington's My Health My Data Act was the first US statute written specifically to close that gap, and it is enforceable by individuals rather than only by the state.
Read more →