Every two weeks, we'll look to publish a snapshot on what's moving at the U.S. state level when it comes to privacy bills, to help inform your own privacy project prioritization.

In 2023 alone, seven states have passed comprehensive privacy bills: Florida (SB 262), Indiana (SB 0005), Iowa (SF 262), Montana (SB 384), Texas (HB 4), Tennessee (HB 1181), and Nevada (SB 370). 

Also, just last week, Connecticut enacted SB 3, which provides additional restrictions on health data and childrens’ online activity. This new law builds upon SB 6 the existing Connecticut Data Privacy Act, which was passed last year and goes into effect July 1, 2023.

A handful of states are rushing legislative activity over the next week due to the fact that they are set to adjourn at the end of the month. Below are three states that are considering comprehensive privacy legislation:

Oregon

A comprehensive privacy measure that generally follows the Virginia Consumer Data Protection Act, SB 619 is one of the bills caught up in the mad dash to pass as many bills as possible before the Oregon legislature adjourned on June 25. Approved by both the Oregon House and Senate, the Act will now go to the Governor's desk for a final signature. As long as it's not vetoed, this bill is set to become law.

Delaware

Delaware is also in the final days of its 2023 legislative session, as it will adjourn on June 30. The state is also considering a comprehensive privacy bill, HB 154 (summary here). The bill has already passed out of the House and is slated for a Senate committee hearing next Tuesday, June 27. This hearing is a sign that this could be put on the fast track for approval before they adjourn. We’ll continue to monitor closely and will provide updates on whether this one makes it over the finish line. 

New Hampshire

New Hampshire also adjourns on June 30 and is pushing forward their own comprehensive privacy bill, SB 255, which is modeled after Connecticut’s bill that was passed last year. The bill has passed the House and is expecting a Senate committee hearing on Wednesday, June 28. Given the scheduled committee hearing, it also seems likely that this one could eke out full approval before they adjourn. We’ll be watching this one closely.

Finally, there are nearly a dozen states that have year-round legislative sessions and a few of them are actively considering privacy legislation. All of the bills below are very early in the legislative process, and there have been no recent developments to suggest that these are gaining traction. Regardless, we’ll continue to monitor these states and bills and provide updates as they occur.

North Carolina (adjourns August 31)

SB 525 (North Carolina Consumer Privacy Act)

Massachusetts (adjourns November 15)

HD 2281 (Massachusetts Data Privacy Protection Act)

SD 745 (Massachusetts Data Privacy Protection Act)

HD 3263 (Massachusetts Information Privacy and Security Act)

SD 1971 (Massachusetts Information Privacy and Security Act)

H 1555 (Internet Bill of Rights)

New Jersey (year-round)

SB 3714 (New Jersey Disclosure and Accountability Transparency Act)

A 505  (New Jersey Disclosure and Accountability Transparency Act)

Pennsylvania (year-round)

HB 1201 (Consumer Data Privacy Act)

HB708 (Consumer Data Protection Act)