Keypoint: Last week Indiana and Utah lawmakers passed bills through a chamber, Maryland lawmakers filed three sets of bills, lawmakers continued to file children’s privacy and social media regulation bills, and there were numerous developments with biometric privacy, health data privacy, and algorithmic discrimination bills.

Below is the fifth weekly update on the status of proposed state privacy legislation in 2023. Before we get to our update, we wanted to provide two reminders.

First, we are regularly updating our 2023 State Privacy Law Tracker and new 2023 State Children’s Privacy Law Tracker and 2023 State Biometric Privacy Law Tracker. We encourage you to bookmark the pages for easy reference.

Second, the contents provided below are time-sensitive and subject to change. If you are not already subscribed to our blog, consider doing so to stay updated. If you are interested in tracking developments between blog posts, consider following on LinkedIn and/or Twitter.

Table of Contents

  1. What’s New?
  2. Upcoming Hearings
  3. Consumer Data Privacy Bills
  4. Biometric Privacy Bills
  5. Children’s Privacy Bills
  6. Data Broker Bills
  7. Health Data Privacy Bills
  8. Automated Employment Decision Tools Bills
  9. Algorithmic Discrimination Bills

1. What’s New?

The big news of the week was two states passing bills through a chamber.

In Indiana, SB 5 – a consumer privacy bill similar to the Virginia Consumer Data Protection Act – passed the Senate by a 49-0 vote and was referred to the House. Last year, the Indiana Senate passed Senator Brown’s SB 358 but it did not make it out of the House.

In Utah, a heavily amended HB 311 passed the House by a vote of 68-6. As amended, the bill creates a private right of action against social media companies “for any addiction, financial, physical, or emotional harm suffered as a consequence of using or having an account on the social media company’s social media platform.” It also would make contracts entered into by a minor using an interactive computer service unenforceable without parental consent. The bill is now with the Senate Rule Committee. The Senate bill (SB 152) is on second reading in the Senate.

The other big news was the cross-filing of numerous privacy bills in Maryland. Lawmakers filed bills relating to: (1) online and biometric data privacy (SB 698 and HB 807), (2) children’s data privacy (SB 844 and HB 901), and (3) health data privacy (HB 995 and SB 790). The bills are already set for hearings in the coming weeks. Maryland lawmakers already are considering cross-filed biometric privacy bills (SB 169 and HB 33). Last week the Senate Finance Committee held a hearing on SB 169 although no vote was taken.

In other consumer privacy bill news, the Hawaii Senate Committee on Commerce and Consumer Protection held a hearing on SB 974. The committee deferred the measure until February 15. In the Hawaii House, HB 1497, which passed out of a committee last week, passed a second reading and was referred to another committee. In Vermont, lawmakers held a committee hearing on H.121 although no vote was taken. Finally, in Minnesota, Representative Mohamud Noor introduced HF 1367.

In children’s privacy news, Virginia HB 1688, which passed the House last week, was passed by indefinity in the Senate General Laws and Technology Committee, signaling that the bill is dead. In the meantime, lawmakers continued to introduce bills across the country with bills filed in Texas (HB 2155) (social media regulation), Minnesota (HF 1503) (social media regulation), Illinois (SB1739) (Minor Online Data Privacy Act), and Kansas (SB22) (notifying parents if a child downloads an app).

Turning to biometric privacy bills, the Arizona Senate Transportation Committee passed SB 1238 out of committee by a 4-3 vote. The committee chair, while voting in favor of the bill, noted that everyone on the committee recognizes that the bill needs “to be fixed before it moves beyond this point.” There also was a new bill introduced in Missouri (HB 1047) and, in New York, Senator Liu filed S4457, which is a companion bill to A1362.

In Washington, Representatives Kloba and Berry filed a data broker registration bill (HB 1799). The bill appears to have momentum as it already has been set for a public hearing on February 14 and executive session on February 17.

In health data privacy news, an Illinois lawmaker introduced a health data privacy Act (SB1601), although the bill currently lacks text.

Finally, lawmakers filed two algorithmic discrimination bills. In Washington, DC, councilmembers reintroduced the Stop Discrimination by Algorithms Act of 2023 (B25-0114). In Minnesota, lawmakers introduced SF 1441, which would make it unlawful for an owner, operator, or provider of an interactive computer service to restrict, either directly, manually, or through the use of an algorithm, a user’s account or content based on race, sex, political ideology, or religious beliefs.

2. Upcoming Hearings

February 14

Hearing on New Hampshire SB 255 (consumer privacy) in Senate Judiciary Committee

Hearing on Washington HB 1799 (data broker) in House Committee on Consumer Protection and Business

February 15

Committee meeting on Hawaii SB 974 (consumer privacy) in Senate Committee on Commerce and Consumer Protection

February 17

Executive session on Washington HB 1799 (data broker) in House Committee on Consumer Protection and Business

February 22

Hearing on Maryland HB 33 (biometric privacy) in House Economic Matters Committee

Hearing on Maryland HB 807 (online privacy) in House Economic Matters Committee

Hearing on Maryland HB 254 (social media regulation) in House Economic Matters Committee

March 1

Hearing on and HB 901 (age-appropriate design code) in House Economic Matters Committee

Hearing on HB 995 (health data privacy) in House Economic Matters Committee

March 8

Hearing on Maryland SB 844 (age-appropriate design code) in Senate Finance Committee

Hearing on Maryland SB 698 (online privacy) in Senate Finance Committee

Hearing on Maryland SB 709 (health data privacy) in Senate Finance Committee

3. Consumer Data Privacy Bills

The below states are considering consumer data privacy bills. These bills are also tracked on our 2023 State Privacy Law Tracker.

Hawaii

On January 20, 2023, lawmakers introduced two versions of the Hawaii Consumer Data Protection Act in the Senate – SB 974 and SB 1110. SB 974 was referred to the Senate Committee on Commerce and Consumer Protection and the Senate Committee on Ways and Means. SB 1110 was referred to the Senate Committee on Commerce and Consumer Protection / Senate Judiciary Committee and the Senate Committee on Ways and Means.

Lawmakers also introduced HB 1497, which passed out of the House Committee on Higher Education and Technology and has now been assigned to another committee.

Illinois

Representative Kam Buckner introduced HB 1381 – the Right to Know Act on January 24, 2023. The bill is narrow, focusing on disclosures and access to personal information.

Indiana

The Indiana Senate passed SB 5 on February 9, 2023, and the bill was sent to the House. Last year, the Indiana Senate passed Senator Brown’s SB 358 but it did not make it out of the House.

On January 19, 2023, Representative Chris Jeter filed HB 1554. HB 1554 is similar, but not identical, to SB 5 and includes additional provisions regarding data brokers and children. The bill was assigned to the Committee on Commerce, Small Business and Economic Development.

Iowa

House Study Bill 12 was introduced on January 12, 2023. On January 23, 2023, it passed a three-member subcommittee of the Economic Growth and Technology Committee. Last year, the Iowa House passed House File 2506 but it stalled in the Senate.

Meanwhile, on January 23, 2023, lawmakers introduced a companion senate bill – Senate Study Bill 1071. That bill was referred to the Technology Committee. On January 31, 2023, a subcommittee recommended amendment and passage of the senate bill.

Kentucky

Republican Senator Whitney Westerfield introduced SB15 on January 5, 2023. The bill was referred to the Committee on Economic Development, Tourism and Labor. Last year, Senator Westerfield filed SB15.

Maryland

On February 6, 2023, lawmakers cross filed SB 0698 and HB 0807. The Senate bill was referred to the Finance Committee. The House bill was referred to the Economic Matters Committee.

Massachusetts

Massachusetts lawmakers have introduced three competing bills.

First, on January 18 and 19, 2023, the Massachusetts Data Privacy Protection Act (MDPPA) was filed in both the Senate (SD 745) by Senator Cynthia Stone Creem and in the House (HD2281) by Representatives Andres Vargas and David Rogers. That bill is based on the federal American Data Privacy Protection Act with additional provisions relating to workplace surveillance.

Second, on January 20, 2023, the Massachusetts Information Privacy and Security Act (MIPSA) was introduced in both the Senate (SD1971) by Senator Barry Finegold and in the House (HD 3263) by Representative Daniel Carey.

Third, Representative Russell Holmes introduced HD 3245 – the Internet Bill of Rights.

Minnesota

Two Republican Senators introduced SF 950, which would require consent for the collection of personal information. The bill was referred to the Commerce and Consumer Protection Committee. In addition, on February 6, 2023, Representative Mohamud Noor introduced HF 1367. The bill was referred to the Commerce Finance and Policy Committee.

Mississippi

Democrat Senator Angela Turner-Ford introduced SB 2080 on January 9, 2023. The bill died in committee.

New Hampshire

On January 19, 2023, a bipartisan and bicameral group of lawmakers led by Senator Sharon Carson introduced SB 255.

New Jersey

Three bills that we tracked last year have carried over to the 2023 session. On February 2, 2023, the Senate voted 27-11 to pass S332. The bill is narrow, perhaps most similar to the Nevada Online Privacy Protection Act. It contains privacy notice provisions, a right to know, and a limited right to opt out of sales. A companion House bill (A1971) has not seen movement. A505 remains in committee. It also is not as broad as the other bills discussed in this section.

New York

On January 4, 2023, Democrat Senator Kevin Thomas introduced S365. The bill was referred to the Consumer Protection Committee. Senator Thomas introduced S6701 last year. On January 9, 2023, lawmakers also introduced A417, which would create consumer rights around access to and transfers of personal information. The bill was referred to the Consumer Affairs and Protection Committee.

On January 17, 2023, a group of lawmakers introduced the Online Consumer Protection Act (A1366). The bill was referred to the Consumer Affairs and Protection Committee.

On January 19, 2023, Senator Brian Kavanagh introduced the Digital Fairness Act (SB2277). The bill was referred to the Internet and Technology Committee. Both of the bills were filed in 2022.

On January 26, 2023, Assemblymember Vanel introduced the New York Data Protection Act (A 2587). The bill was referred to the Government Operations committee.

On January 30, 2023, Senator Hoylman-Sigal introduced S3162, which is a narrow bill. The bill was referred to the Consumer Protection Committee.

Oklahoma

Republican Representative Josh West pre-filed HB 1030 – the Oklahoma Computer Data Privacy Act (OCDPA). The bill was referred to the Government Modernization and Technology Committee. Representative West filed privacy legislation the last two years with the bills passing the House but not the Senate. In previous years, the bills were co-sponsored by Collin Walke who retired from the House. As in prior years, the hallmark of the OCDPA is that it would require consumer consent for all personal data collection.

Oregon

Democrat Senator Floyd Prozanski and Democrat Representative Paul Hovley introduced SB 619. The bill was filed at the request of Attorney General Ellen Rosenblum. The Attorney General’s office convened a work group over the summer and fall to work on the bill. The bill was referred to the Joint Committee on Ways and Means.

Rhode Island

Lawmakers filed H 5354 on February 3, 2023. The bill was referred to the House Innovation, Internet & Technology Committee.

Tennessee

Republic Senator Bo Watson introduced SB73 on January 4, 2023. On January 20, 2023, the bill was referred to the Senate Commerce & Labor Committee. The bill text is available here. On February 2, 2023, a companion bill was filed in the House (HB 1181). The bill was referred to the Banking & Consumer Affairs subcommittee. Tennessee lawmakers considered a similar bill last year.

Texas

Representative Capriglione introduced the Texas Data Privacy and Security Act (HB 1844) on February 3, 2023. The bill is based on the Virginia Consumer Data Protection Act.

Vermont

On January 26, 2023, a bipartisan group of representatives introduced H.121. The bill was referred to Committee on Commerce and Economic Development, which held a hearing on February 9, 2023.

Washington

Representative Shelley Kloba reintroduced the People’s Privacy Act (HB 1616) on January 26, 2023. Representative Kloba previously ran the bill in 2021, but did not introduce it in 2022. The bill was referred to the Civil Rights & Judiciary Committee. A group of senators filed a companion bill on January 31, 2023 (SB 5643).

4. Biometric Privacy Bills

The following states are considering BIPA-like biometric information privacy bills. The bills are also tracked on our 2023 State Biometric Privacy Law Tracker.

Arizona

Senator Rogers introduced SB1238. The Senate Transportation Committee voted SB 1238 out of committee by a vote of 4-3. The committee chair, while voting in favor of the bill, noted that everyone on the committee recognizes that the bill needs “to be fixed before it moves beyond this point.”

Hawaii

The Hawaii Biometric Information Privacy Act (SB 1085) was introduced on January 20, 2023. The bill was referred to the Senate Committee on Labor and Technology and Committee on Judiciary.

Maryland

Delegates Love, Charkoudian, Lehman, and Watson introduced HB 33 on January 11, 2023. The bill was referred to the Economic Matters Committee. Last year, the Maryland House passed HB 259, but the bill did not make it out of the Senate. On January 20, 2023, a group of thirteen senators cross-filed SB0169 in the Senate. The bill was referred to the Finance Committee.

Massachusetts

Representative Fernandes introduced HD3053 and Senator Montigny introduced SD 2218.

Mississippi

Representative Anthony Porter introduced HB 467 on January 12, 2023. The bill was referred to the Judiciary Committee.

Missouri

Representative Doug Clemens introduced HB 1047 on February 6, 2023.

Minnesota

Senator Lucero introduced SF 954. The bill was referred to the Commerce and Consumer Protection Committee.

New York

On January 17, 2023, a group of New York lawmakers introduced the New York Biometric Privacy Act (A1362). The bill was referred to the Consumer Affairs and Protection Committee. On February 9, 2023, a companion bill (S4457) was cross-filed in the Senate and referred to the Consumer Protection Committee.

On January 20, 2023, Senator John Liu introduced S2390, which would prohibit private entities from using biometric data for any advertising, marketing or any other identified activities. The bill was referred to the Consumer Protection Committee.

Tennessee

Senator Campbell introduced SB 339 on January 23, 2023. The bill was referred to the Senate Commerce and Labor Committee. Representative McKenzie introduced HB 932 on February 1, 2023. The bill was referred to the Banking & Consumer Affairs Subcommittee.

Vermont

On January 26, 2023, a bipartisan group of representatives introduced H.121. The bill was referred to Committee on Commerce and Economic Development, which held a hearing on February 9, 2023.

5. Children’s Privacy Bills

The following states are considering legislation to regulate children’s privacy. This list of bills is not intended to cover student data privacy bills. The bills are also tracked on our 2023 State Children’s Privacy Law Tracker.

Florida

HB 591 was filed on February 1, 2023, and referred to the regulatory Reform & Economic Development Subcommittee.

Kansas

On February 8, 2023, Senator Holscher introduced SB22, which requires parents to be notified if a child downloads an app. The bill was referred to the Committee on Federal and State Affairs.

Illinois

Lawmakers introduced SB1739 (Minor Online Data Privacy Act).

Maryland

Lawmakers introduced SB 844 and HB 901–age-appropriate design code act bills. Lawmakers also introduced HB 254 (social media regulation), which was referred to the House Economic Matters Committee.

Massachusetts

Representative Rogers introduced HD 2325 (An Act Relative to Internet Privacy Rights for Children).

Minnesota

On February 9, 2023, Minnesota lawmakers introduced HF 1503, which seeks to regulate social media.

New Jersey

Democrat Assemblyman Conaway, Jr. introduced A4919 on December 5, 2022. The bill was referred to the Assembly Science, Innovation and Technology Committee. A companion bill (S3493) was introduced by Democrat Senator Vitale on January 19, 2023, and referred to the Law and Public Safety Committee. The bill appears to be based on the California Age-Appropriate Design Code law that passed in 2022.

New Mexico

Lawmakers introduced the New Mexico Age-Appropriate Design Code Act (SB 319) on February 2, 2023, and referred to the Senate Tax, Business and Transportation Committee.

New York

A group of lawmakers filed the New York Child Data Privacy and Protection Act (S3281) on January 30, 2023. The bill was referred to the Internet and Technology Committee.

Oregon

Democrat Senator Chris Gorsek introduced SB196. The bill was referred to the Judiciary Committee. The bill appears to be based on the California Age-Appropriate Design Code law that passed in 2022.

South Carolina

Senator Verdin introduced S404, which would prohibit operators of internet-based applications from using automated decision systems to place content on social media platforms for users under the age of 18.

Texas

Texas lawmakers are considering HB 896, which would prohibit an individual between 13 and 18 years of age from using a social media platform. They are also considering another social media regulation bill – HB 2155.

Utah

Utah lawmakers introduced SB 152 and HB 311. A heavily amended HB 311 passed the House by a vote of 686. As amended, the bill would create a private right of action against social media companies “for any addiction, financial, physical, or emotional harm suffered as a consequence of using or having an account on the social media company’s social media platform.” It also would make contracts entered into by a minor using an interactive computer service unenforceable without parental consent. The bill was referred to the Senate Rule Committee. The Senate bill (SB 152) is on second reading in the Senate.

Virginia

Lawmakers introduced companion bills to amend the Virginia Consumer Data Protection Act (VCDPA) (HB 1688 / SB 1026). The bills are now dead.

West Virginia

Delegate Wayne Clark introduced HB 2460 on January 11, 2023. The bill states that it is intended to “complement the body of federal law governing online privacy protections for children” and would extend protections to children under 18. The bill was referred to the House Judiciary Committee.

Delegate Young introduced HB 2964 – the Online Privacy Protection for Children Act – on January 24, 2023. The bill was referred to the House Judiciary Committee.

6. Data Broker Bills

The following states are considering bills that would regulate data brokers:

New Jersey

Democrat Assemblyman William Moen, Jr. introduced A4811 on October 20, 2022. The bill was referred to the Assembly Science, Innovation and Technology Committee.

Oregon

HB 2052 was introduced at the request of the Attorney General’s office. The Business and Labor Committee held a public hearing on January 18, 2023 and work session on February 6. Last year lawmakers considered HB 4017.

Vermont

On January 26, 2023, a bipartisan group of representatives introduced H.121. The bill was referred to Committee on Commerce and Economic Development, which held a hearing on February 9, 2023. The bill would amend Vermont’s existing data broker statute to add additional requirements.

Washington

Representatives Shelley Kloba and Liz Berry introduced HB1799 on February 9, 2023. The bill was referred to the House Committee on Consumer Protection and Business.

7. Health Data Privacy Bills

The following states are considering bills that would create new or additional privacy protections for health data processed by private entities:

Illinois

On February 9, 2023, Senator Villanueva introduced SB1601. The bill was referred to the Assignments Committee. The bill currently lacks text.

Maryland

Lawmakers in cross-filed health data privacy bills – HB 995 and SB 790.

Massachusetts

Massachusetts lawmakers filed two health data privacy companion bills – SD 2118 and HD 3855.

New York

Senator Liz Krueger filed SB 158 on January 4, 2023. The bill was referred to the Senate Internet and Technology Committee.

Virginia

Lawmakers are considering companion bills HB 2219 and SB 1432. The House bill was referred to the Committee on Health, Welfare and Institutions. On January 31, 2023, a subcommittee recommended laying it on the table. On February 7, the bill was marked as “left in Health, Welfare and Institutions.” The Senate bill was referred to the Committee on Education and Health. On February 2, 2023, the committee passed by the bill indefinitely.

Washington

Companion bills were filed in the House (HB 1155) and Senate (SB 5351). The House bill was referred to the Civil Rights & Judiciary Committee, which held a hearing on January 24, 2023. Amendments were accepted during an executive session on February 3, 2023. The bill is now placed on second reading by the Rules Committee. The Senate bill was referred to the Law & Justice Committee.

8. Automated Employment Decision Tools Bills

The following states are considering bills that would regulate the use of automated employment decision tools. These bills are similar to New York City Local Law 144.

New Jersey

A group of assembly members introduced A4909 on December 5, 2022. On January 19, 2023, the Assembly Labor Committee favorably reported the bill by a vote of 8-1.

An identical bill was introduced in the Senate by Senator Andrew Zwicker under bill number S1926. That bill was referred to the Senate Labor Committee.

New York

Representative Latoya Joyner introduced A567 on January 9, 2023. The bill was referred to the Labor Committee.

Vermont

Representative Priestley filed H.114 on January 26, 2023. The bill was referred to the General and Housing Committee.

9. Algorithmic Discrimination Bills

These bills would protect against algorithmic discrimination and promote transparency.

Minnesota

On February 8, 2023, lawmakers introduced SF 1441. The bill would make it unlawful for “an owner, operator, or provider of an interactive computer service to restrict, either directly, manually, or through the use of an algorithm, a user’s account or content based on race, sex, political ideology, or religious beliefs.” The bill was referred to the Judiciary and Public Safety Committee.

Washington, DC

On February 2, 2023, councilmembers introduced the Stop Discrimination by Algorithms Act of 2023 (B25-0114). The bill was referred to the Committee on Business and Economic Development, and Committee on Judiciary and Public Safety.