Keypoint: It was another busy week with bills introduced in Colorado, New York and West Virginia, a committee hearing in New Jersey on three bills, a public hearing in Washington on the Washington Privacy Act, the Oklahoma bill was referred to the Senate Judiciary committee, one Florida bill passed out of committee, and a hearing was set on the other Florida bill.

For the fourth week in a row, we are providing an update on the status of proposed CCPA-like privacy legislation. Before we get to our update, we wanted to provide three reminders.

First, there has been so much debate about what to call Virginia’s new privacy law – the Virginia Consumer Data Protection Act – that we started an online poll. Tell us whether you think the law should be called the CDPA or VCPDA. We will keep voting open until April 2 and release the results on our blog.

Second, we have been regularly updating our 2021 State Privacy Law Tracker to keep pace with the latest developments. We encourage you to bookmark the page for easy reference.

Third, the contents provided below are time-sensitive and subject to change. If you are not already subscribed to our blog, consider doing so to stay updated.

What’s New

On March 19, 2021, Colorado lawmakers introduced the Colorado Privacy Act (SB21-190). You can read our analysis of the bill here.

In Florida, HB 969 was added to Civil Justice & Property Rights Subcommittee meeting set for March 23, 2021. As reported in our prior post, the Regulatory Reform Subcommittee previously passed the bill. Meanwhile, SB 1734 passed out of the Senate Commerce and Tourism Committee on March 22. Many thanks to Joe Duball from the IAPP for alerting us to these developments.

In New Jersey, the Assembly Science, Innovation and Technology Committee held a hearing on three bills (A5448, A3283, and A3255) on March 15. A recording of the hearing is available here.

In New York, lawmakers introduced the Digital Fairness Act (A6042).

In Oklahoma, the Oklahoma Computer Data Privacy Act was referred to the Senate Judiciary committee.

In Washington, the House Committee on Civil Rights & Judiciary held a public hearing on the Washington Privacy Act on March 17. The bill is scheduled for an executive committee session on March 26.

Finally, in West Virginia, lawmakers introduced HB 3159 on March 15, 2021. The bill was referred to the House Judiciary Committee. It is similar to the CCPA.

Overview

To date, state lawmakers have introduced bills in 23 states. Connecticut, Florida, Illinois, Minnesota, New York, Massachusetts, and Washington are considering multiple bills. One state (Virginia) has passed legislation whereas the bills in three states (North Dakota, Mississippi, and Utah) have failed.

The below analysis divides the bills into four categories: (1) passed bills, (2) active bills, (3) introduced bills, and (4) dead bills.

Passed bills are those that have become law (i.e., Virginia). Active bills are those that have seen some movement, such as a committee hearing or vote. Introduced bills are those that have been introduced in a state legislature but have yet to see any movement (other than, for example, being referred to a committee). Dead bills are (as you might have guessed) bills that have failed.

For links to all of these bills please see our 2021 State Privacy Law Tracker.

Passed Bills

Virginia

On March 2, 2021, Virginia became the second state – after California – to enact state consumer data privacy legislation. You can find our coverage of the Virginia bill here, and you can find the text of the new law here. We also hosted a webinar on the law on March 11. You can access the recording here.

Active Bills

Washington

The Washington Senate passed the 2021 version of the Washington Privacy Act (WPA) on March 3. The House Committee on Civil Rights & Judiciary held a public hearing on the Washington Privacy Act on March 17. The bill is scheduled for an executive committee session on March 26 (previously scheduled for March 19).

The People’s Privacy Act (a competing bill supported by the ACLU of Washington) has not seen movement since February 1.

Oklahoma

The Oklahoma House passed a revised version of the Oklahoma Computer Data Privacy Act on March 4. The bill is now in the state senate where it was referred to the Senate Judiciary Committee on March 22. You can find a summary of the bill here.

A related bill, HB 1125, also passed the House and is in the state senate. That bill was referred to the Business, Commerce and Tourism Committee on March 15. The bill would amend the Oklahoma Consumer Protection Act to make it unlawful for a person to knowingly make “false or misleading statements in a privacy policy, published on the Internet or other distributed or published, regarding the use of personal information submitted by members of the public.”

Connecticut

Senate Bill 893 introduced on February 17 and Senate Bill 156 introduced on January 15 have not seen any new movement. Both bills are with the Joint General Law Committee, which held a public hearing on February 25.

Senate Bill 893 is similar to Virginia’s Consumer Data Protection Act. As introduced, Senate Bill 156 is just a one-paragraph bill.

Florida

HB 969 was added to Civil Justice & Property Rights Subcommittee meeting set for March 23, 2021. As reported in our prior post, the bill previously passed out of the Regulatory Reform Subcommittee. Meanwhile, SB 1734 passed out of the Senate Commerce and Tourism Committee on March 22.

HB 969 is perhaps best described as a heavily modified version of the California Privacy Rights Act (CPRA), while SB 1734 is perhaps best described as a heavily modified version of the CCPA.

Illinois

Illinois is considering two bills.

First, HB 2404 (the Right to Know Act) is assigned to the Cybersecurity, Data Analytics, & IT Committee. The bill is on the committee’s agenda for March 26. As its name suggests, the Right to Know Act would provide Illinois residents with the right to know certain information regarding their personal information.

In addition to HB 2404, Illinois lawmakers also introduced HB 3910 (entitled the Consumer Privacy Act) on February 22. That bill was assigned to the Judiciary – Civil Committee on March 16. The bill is listed on the agenda for the March 23 hearing date along with numerous other bills. HB 3910 is a modified version of the CCPA.

New Jersey

New Jersey is new to the active category this week. On March 15, the Assembly Science, Innovation and Technology Committee held a hearing on three bills (A5448, A3283, and A3255). A recording of the hearing is available here.

Introduced Bills

Alabama

House Bill 216 was introduced on February 2, 2021. Notably, the bill has attracted 18 Republican sponsors or co-sponsors. However, to date, it has not moved forward and is currently referred to the House committee on Technology and Research. The bill is similar to the CCPA.

Arizona

HB 2865 was introduced on February 11, 2021. To date, there have been no hearings or votes taken on the bill. The bill is currently pending in the House Commerce Committee. The bill does not readily track the form or contents of either the CCPA or the Virginia and Washington bills.

Colorado

SB21-190 was introduced on March 19, 2021. It was assigned to the Senate Committee on Business, Labor and Technology. You can read our analysis of the bill here.

Kentucky

House Bill 408 was introduced on February 9, 2021 and referred to the Committee on Committees—it has not moved since. In general, the bill focuses on requiring businesses to provide privacy policy disclosures and allowing state residents to opt out of the sale of their personal information. The Kentucky legislature closes on March 30.

Maryland

SB 930 (the Maryland Online Consumer Protection Act) was introduced on February 10, 2021. No action has been taken to date. The bill is a modified version of the CCPA.

Massachusetts

SD 1726 was filed on February 18, 2021. It does not appear that any action has been taken on the bill to date. The bill is a modified version of Washington’s People’s Privacy Act. A second bill, HD 3847, was filed in the state house.

Minnesota

Minnesota is interesting insofar as it was one of the first states to see legislation proposed this year (HF 36 proposed on January 7, 2021), but then lawmakers introduced a second bill (HF 1492 and its companion bill SF 1408) more than a month later. Neither bill has seen movement since being introduced.

HF 36 is a modified (and shortened) version of the CCPA and contains a private right of action. HF 1492 / SF 1408 are similar to the Washington and Virginia bills.

New York

As shown on our tracker, New York legislators have proposed a number of consumer privacy bills in 2021. All of those bills currently sit in committee. In addition, Governor Cuomo’s privacy legislation (see page 148) is still active.

Rhode Island

House Bill 5959 was introduced on February 26, 2021. It is currently pending in committee. The bill would require certain companies to provide privacy policy disclosures.

South Carolina

H 3063 was pre-filed on December 9, 2020 and referred to the Committee on Labor on January 12, 2021. It has not moved since. The bill is limited to providing rights around the collection and use of biometric information.

Texas

In Texas, Representative Capriglione filed six bills “related to increasing the protection of consumer data by the private sector.” One bill, HB 3741, is a data privacy omnibus bill. As introduced, the bill is perhaps best described as a heavily modified version of the CCPA, however, there are many aspects of the bill that make it unique, including its creation of three “categories” of data.

Vermont

H.160 is still a short form bill (i.e., only one paragraph long). The bill has been referred to committee and no further action has been taken to date.

West Virginia

Lawmakers introduced HB 3159 on March 15, 2021. The bill was referred to the House Judiciary Committee. It is similar to the CCPA.

Dead Bills

North Dakota’s HB 1330, Mississippi’s Senate Bill 2612, and Utah’s SB 200 have all died.