Keypoint: Last week the legislatures in Montana and Tennessee passed consumer data privacy bills and the Washington legislature passed the My Health My Data Act.

Below is the fifteenth weekly update on the status of proposed state privacy legislation in 2023. Before we get to our update, we wanted to provide two reminders.

First, we are regularly updating our 2023 State Privacy Law Tracker, 2023 State Children’s Privacy Law Tracker, and 2023 State Biometric Privacy Law Tracker. We encourage you to bookmark the pages for easy reference.

Second, the contents provided below are time-sensitive and subject to change. If you are not already subscribed to our blog, consider doing so to stay updated. If you are interested in tracking developments between blog posts, consider following on LinkedIn and/or Twitter.

Table of Contents

  1. What’s New?
  2. Upcoming Hearings
  3. Consumer Data Privacy Bills
  4. Biometric Privacy Bills
  5. Children’s Privacy Bills
  6. Data Broker Bills
  7. Health Data Privacy Bills
  8. Automated Employment Decision Tools Bills
  9. Algorithmic Discrimination Bills

1. What’s New?

Legislatures in three states passed privacy bills last week.

First, the Washington legislature passed the My Health My Data Act on April 17. With a private right of action, broad applicability to businesses of all sizes and types, a scope that is broader than its name suggests, and strong consent-based requirements and privacy rights, MHMD will be a transformative privacy law for the United States. You can find more details about the bill here.

Second, on April 21, the Montana legislature passed Senator Zolnikov’s SB 384 – the Montana Consumer Data Privacy Act. In doing so, Montana becomes the first Republican-controlled legislature to pass a consumer data privacy bill that requires controllers to recognize universal opt out mechanisms. The bill also provides additional opt-out rights for children, sunsets the right to cure, and adjusts the applicability threshold to take into account a state’s smaller population. You can find our analysis of the bill here.

Third, just a couple hours after Montana, Tennessee’s legislature passed HB 1181 – the Tennessee Information Privacy Act. The Tennessee bill is a more business-friendly version of the Virginia Consumer Data Protection Act.

All three bills will next move to the state governors. For a comparison of the Montana and Tennessee bills against the existing laws / passed bills, see our chart here.

In other consumer privacy bill news, the New Hampshire House Judiciary Committee held a public hearing on New Hampshire SB 255. The Committee is scheduled to consider the bill in executive session on May 3.

In children’s privacy bill news, Texas HB 18 was placed on the House major state calendar for April 25. The bill creates a duty for digital service providers to prevent harm to children. In Louisiana, SB 162 was reported out of the Committee on Commerce, Consumer Protection and International Affairs and recommitted to the Finance Committee. In Florida, HB 591 is out of committee and on the House second reading calendar. The Louisiana and Florida bills regulate social media companies’ interaction with minors. New children’s social media bills were also introduced in North Carolina (HB 644) and New York (S6418).

Turning to biometric privacy bill developments, lawmakers introduced a new bill in Maine (LD 1705). Maine currently is in a special session.

In data broker bill news, the Texas House Business & Commerce Committee held a public hearing on SB 2105. No vote was taken.

Finally, in AI bill news, the California Assembly Judiciary Committee passed an amended version of AB 331 by an 8-3 vote and referred the bill to the Appropriations Committee. The bill regulates the use of automated decision tools.

2. Upcoming Hearings

April 24

Hearing on California SB 287 (features that harm children) in Senate Appropriations Committee

Meeting scheduled on Minnesota SF 2810 (age-appropriate design code act) in Judiciary and Public Safety Committee

April 25

Hearing on California SB 362 (California Deletion Act) in Senate Judiciary Committee

May 3

Executive session on New Hampshire SB 255 (consumer data privacy) in House Judiciary Committee

3. Consumer Data Privacy Bills

The below states are considering consumer data privacy bills. These bills are also tracked on our 2023 State Privacy Law Tracker.

Florida

Companion bills were introduced in the Senate (S 262) and House (H 1547) by Senator Jennifer Bradley and Representative Fiona McFarland, respectively. An amended version of the Senate bill passed out of the Commerce and Tourism Committee on April 5, 2023, and is now with the Rules Committee.

An amended version of Representative McFarland’s HB 1547 was reported out of the Regulatory Reform and Economic Development Subcommittee on March 30, 2023. The bill was amended to add additional child’s privacy provisions. It is now in the House Commerce Committee.

Hawaii

On January 20, 2023, lawmakers introduced two versions of the Hawaii Consumer Data Protection Act in the Senate – SB 974 and SB 1110. On March 7, 2023, the Senate passed SB 974 by a vote of 23-0-1.

SB 1110 was referred to the Senate Committee on Commerce and Consumer Protection / Senate Judiciary Committee and the Senate Committee on Ways and Means.

Lawmakers also introduced HB 1497, which passed out of the House Committee on Higher Education and Technology and has now been assigned to another committee.

Illinois

Representative Kam Buckner introduced HB 1381 – the Right to Know Act on January 24, 2023. The bill is narrow, focusing on disclosures and access to personal information. On March 10, 2023, the bill was referred to the Rules Committee. A companion bill was filed under bill number SB 1365. That bill was referred to Assignments.

On February 17, Representative Rashid introduced HB 3385. The bill is based on the federal American Data Privacy and Protection Act. The bill was referred to the Senate Rules Committee.

Indiana

The Indiana legislature passed SB 5 on April 13, 2023.

Iowa

On March 28, Iowa Governor Kim Reynolds signed SF 262 into law, making Iowa the sixth state to pass consumer data privacy legislation.

Kentucky

The Kentucky legislature closed on March 30 without passing a bill.

Louisiana

Louisiana is considering SB 199. The bill is sponsored by Representative Daryl Deshotel, who sponsored HB 987 in 2022. On April 10, 2023, the bill was referred to the Senate Committee on Commerce, Consumer Protection and International Affairs.

Maryland

The Maryland legislature closed without passing SB 0698 and HB 0807.

Massachusetts

Massachusetts lawmakers introduced three competing bills.

First, on January 18 and 19, 2023, the Massachusetts Data Privacy Protection Act (MDPPA) was filed in both the Senate (SD 745) by Senator Cynthia Stone Creem and in the House (HD2281) by Representatives Andres Vargas and David Rogers. That bill is based on the federal American Data Privacy Protection Act with additional provisions relating to workplace surveillance.

Second, on January 20, 2023, the Massachusetts Information Privacy and Security Act (MIPSA) was introduced in both the Senate (SD1971) by Senator Barry Finegold and in the House (HD 3263) by Representative Daniel Carey.

Third, Representative Russell Holmes introduced HD 3245 – the Internet Bill of Rights.

Minnesota

Two Republican Senators introduced SF 950, which requires consent for the collection of personal information. The bill was referred to the Commerce and Consumer Protection Committee. On February 16, 2023, a companion bill, HF 1892, was filed in the House.

On February 6, 2023, Representative Mohamud Noor introduced HF 1367. The bill was referred to the Commerce Finance and Policy Committee.

On March 1, 2023, Representative Elkins introduced HF 2309. A companion Senate bill (SF 2915) was filed on March 15, 2023.

Mississippi

Democrat Senator Angela Turner-Ford introduced SB 2080 on January 9, 2023. The bill died in committee.

Montana

Senator Zolnikov’s SB 384 passed the legislature on April 21, 2023.

New Hampshire

On January 19, 2023, a bipartisan and bicameral group of lawmakers led by Senator Sharon Carson introduced SB 255. On March 16, 2023, an amended version of the bill passed the Senate. The bill was introduced in the House and referred to the Judiciary.

New Jersey

Three bills that we tracked last year carried over to the 2023 session. On February 2, 2023, the Senate voted 27-11 to pass S332. The bill is narrow, perhaps most similar to the Nevada Online Privacy Protection Act. It contains privacy notice provisions, a right to know, and a limited right to opt out of sales. A companion House bill (A1971) has not seen movement. A505 remains in committee. It also is not as broad as the other bills discussed in this section. On March 13, 2023, Senator Gopal introduced S3714, which is a companion bill to A505.

New York

On January 4, 2023, Democrat Senator Kevin Thomas introduced S365. The bill was referred to the Consumer Protection Committee. Senator Thomas introduced S6701 last year. On January 9, 2023, lawmakers also introduced A417, which would create consumer rights around access to and transfers of personal information. The bill was referred to the Consumer Affairs and Protection Committee.

On January 17, 2023, a group of lawmakers introduced the Online Consumer Protection Act (A1366). The bill was referred to the Consumer Affairs and Protection Committee.

On January 19, 2023, Senator Brian Kavanagh introduced the Digital Fairness Act (SB2277). The bill was referred to the Internet and Technology Committee. Both of the bills were filed in 2022.

On January 26, 2023, Assemblymember Vanel introduced the New York Data Protection Act (A 2587). The bill was referred to the Government Operations committee.

On January 30, 2023, Senator Hoylman-Sigal introduced S3162, which is a narrow bill. The bill was referred to the Consumer Protection Committee. A companion house bill also was filed under bill number A 4374.

On March 8, 2023, Senator Comrie introduced the It’s Your Data Act (S5555). The bill was referred to the Codes Committee.

On April 3, 2023, Assemblymember Solages introduced A6319, which is based on the federal American Data Privacy and Protection Act.

North Carolina

Lawmakers introduced SB 525 on April 4, 2023. The bill was referred to the Senate Committee on Rules and Operations.

Oklahoma

Republican Representative Josh West pre-filed HB 1030 – the Oklahoma Computer Data Privacy Act (OCDPA). The bill passed the House by a vote of 84-11 on March 8. It is now with the Senate Rules Committee.

Oregon

Democrat Senator Floyd Prozanski and Democrat Representative Paul Hovley introduced SB 619 at the request of Attorney General Ellen Rosenblum. The Attorney General’s office convened a work group over the summer and fall to work on the bill. On March 7, the Senate Judiciary Committee held a public hearing on an amended version of the bill. A work group session was held on April 3, 2023. On April 12, 2023, the bill was referred to the Ways and Means Committee.

Pennsylvania

Pennsylvania is considering HB 708. The bill is sponsored by Representative Malcom Kenyatta, who sponsored HB 2257 in 2022.

Rhode Island

Lawmakers filed H 5354 on February 3, 2023. The bill was referred to the House Innovation, Internet & Technology Committee, which recommended that the bills be held for further study.

On March 23, a group of Senators introduced SB 754. The bill was referred to the Senate Commerce committee. A companion bill was filed in the House (HB 6236). On April 4, 2023, the House Innovation, Internet & Technology Committee held a hearing on HB 6236. The Committee recommended that the bill be held for further study.

Tennessee

HB 1181 passed the legislature on April 21, 2023.

Texas

Representative Capriglione’s Texas Data Privacy and Security Act (HB 1844) unanimously passed the House on April 5, 2023. The bill is now with the Senate.

Texas lawmakers also are considering HB 4854. That bill was introduced on March 10 and referred to the House Business & Industry Committee.

Vermont

On January 26, 2023, a bipartisan group of representatives introduced H.121. The bill was referred to Committee on Commerce and Economic Development, which has held several hearings to date.

Washington

Representative Shelley Kloba reintroduced the People’s Privacy Act (HB 1616) on January 26, 2023. Representative Kloba previously ran the bill in 2021, but did not introduce it in 2022. The bill was referred to the Civil Rights & Judiciary Committee. A group of senators filed a companion bill on January 31, 2023 (SB 5643).

West Virginia

The West Virginia legislature closed without passing HB 3498 and HB 3453.

4. Biometric Privacy Bills

The following states are considering BIPA-like biometric information privacy bills. The bills are also tracked on our 2023 State Biometric Privacy Law Tracker.

Arizona

The Arizona legislature closed without passing SB1238.

Hawaii

The Hawaii Biometric Information Privacy Act (SB 1085) was introduced on January 20, 2023. The bill was referred to the Senate Committee on Labor and Technology and Committee on Judiciary. The committee deferred the measure during a February 10 hearing. The committee chair indicated that the bill needed further study and they will try to have a working group during the interim.

Kentucky

The Kentucky legislature closed without passing HB 483.

Maryland

The Maryland legislature closed without passing HB 33 and SB0169.

Massachusetts

Representative Fernandes introduced H.63 and Senator Montigny introduced S.195. On April 6, 2023, S.195 was discharged to the committee on Advanced Information Technology, the Internet and Cybersecurity.

Mississippi

Representative Anthony Porter introduced HB 467 on January 12, 2023. The bill was referred to the Judiciary Committee.

Missouri

Representative Doug Clemens introduced HB 1047 on February 6, 2023. Missouri Representative Lovasco introduced HB 1225 on February 23, 2023. On April 5, 2023, HB 1225 was referred to the Special Committee on Government Accountability.

Minnesota

Senator Lucero introduced SF 954. The bill was referred to the Commerce and Consumer Protection Committee. On March 2, 2023, Representative Scott introduced HF 2532 – a companion bill to SF 954.

New York

On January 17, 2023, a group of New York lawmakers introduced the New York Biometric Privacy Act (A1362). The bill was referred to the Consumer Affairs and Protection Committee. On February 9, 2023, a companion bill (S4457) was cross-filed in the Senate and referred to the Consumer Protection Committee.

On January 20, 2023, Senator John Liu introduced S2390, which would prohibit private entities from using biometric data for any advertising, marketing or any other identified activities. The bill was referred to the Consumer Protection Committee.

Tennessee

Senator Campbell introduced SB 339 on January 23, 2023. The bill was referred to the Senate Commerce and Labor Committee. Representative McKenzie introduced HB 932 on February 1, 2023. The bill was referred to the Banking & Consumer Affairs Subcommittee.

Vermont

On January 26, 2023, a bipartisan group of representatives introduced H.121. The bill was referred to Committee on Commerce and Economic Development, which has held several hearings to date.

5. Children’s Privacy Bills

The following states are considering legislation to regulate children’s privacy. This list of bills is not intended to cover student data privacy bills. The bills are also tracked on our 2023 State Children’s Privacy Law Tracker.

Arkansas

The Arkansas legislature passed SB 396 (social media regulation) on April 7, 2023. The bill is now with the Governor.

California

On February 2, 2023, Senator Skinner introduced SB 287. This bill prohibits a social media platform from using a design, algorithm, or feature that it knows, or which by the exercise of reasonable care should have known, causes child users to do any of certain things, including experience addiction to the social media platform. The California Senate Judiciary Committee held a hearing on SB 287 on April 11, 2023. The Committee passed an amended version of the bill and re-referred it to the Senate Appropriations Committee.

On February 17, 2023, Senator Stern introduced the Let Parents Choose Protection Act of 2023 (SB 845). The bill requires large social media platform providers to create, maintain, and make available to third-party safety software providers a set of real-time application programming interfaces, through which a child or a parent or legal guardian of a child may delegate permission to a third-party safety software provider to manage the child’s online interactions, content, and account settings. The bill has been referred to the Judiciary Committee.

California lawmakers are also considering SB 764 – a social media regulation bill.

Connecticut

Senator James Maroney, author of the Connecticut Data Privacy Act, introduced SB 3. The bill contains provisions on children’s data privacy and health data privacy. The Joint Judiciary Committee passed the bill on March 30, 2023.

Florida

HB 591 was filed on February 1, 2023, and referred to the regulatory Reform & Economic Development Subcommittee. On March 9, 2023, the bill was given a favorable report with a committee substitute by the Regulatory Reform and Economic Development subcommittee. The bill is now out of committee and on the House second reading calendar.

Kansas

On February 8, 2023, Senator Holscher introduced SB22, which requires parents to be notified if a child downloads an app. The bill was referred to the Committee on Federal and State Affairs.

Illinois

Lawmakers introduced SB1739 (Minor Online Data Privacy Act) and HB 3880 (Children’s Privacy Protection and Parental Empowerment Act). On March 10, 2023, HB 3880 was re-referred to the Rules Committee.

Iowa

Lawmakers are considering a social media children’s privacy bill (HF 712). The bill was referred to the House Ways and Means Committee.

Louisiana

Louisiana lawmakers are considering SB 162. The bill was reported out of the Committee on Commerce, Consumer Protection and International Affairs and recommitted to the Finance Committee.

Maryland

The Maryland legislature closed without passing SB 844 and HB 901.

Massachusetts

Representative Rogers introduced HD 2325 (An Act Relative to Internet Privacy Rights for Children).

Minnesota

On February 9, 2023, Minnesota lawmakers introduced HF 1503, which seeks to regulate social media. The bill was referred to the Judiciary Finance and Civil Law committee.

On February 27, 2023, Senator Matthews introduced SF 2101.

On February 27, 2023, Representatives Bahner and Elkins introduced HF 2257, a bill based on the California Age-Appropriate Design Code. That bill was referred to the Judiciary Finance and Civil Law committee, which held a hearing and referred the bill back to the Commerce committee. On April 12, the bill was added to HF 2680 – the omnibus commerce bill.

A companion senate bill (SF 2810) was filed on March 13, 2023. The Senate Committee on Commerce and Consumer Protection held a hearing on the Senate companion bill on March 23, 2023. The committee re-referred an amended version of the bill to the Committee on Judiciary and Public Safety.

Nevada

A group of lawmakers introduced AB 320 – a bill modeled off the California Age-Appropriate Design Code Act. On April 15, the bill was marked as “no further action allowed.”

New Jersey

Democrat Assemblyman Conaway, Jr. introduced A4919 on December 5, 2022. The bill was referred to the Assembly Science, Innovation and Technology Committee. A companion bill (S3493) was introduced by Democrat Senator Vitale on January 19, 2023, and referred to the Law and Public Safety Committee. The bill appears to be based on the California Age-Appropriate Design Code law that passed in 2022.

Lawmakers also introduced A5069 and S3608, which prohibit social media platforms from using certain practices or features that cause child users to become addicted to the platform. On March 16, 2023, A5069 was referred to the Assembly Health Committee. On March 20, 2023, it was reported and referred to the Assembly Appropriations Committee.

On March 20, 2023, the Assembly Health Committee favorably reported A5069. The bill was referred to the Assembly Appropriations Committee.

New Mexico

The New Mexico legislature closed without passing SB 319.

New York

A group of lawmakers filed the New York Child Data Privacy and Protection Act (S3281) on January 30, 2023. The bill was referred to the Internet and Technology Committee. A companion bill was filed in the Assembly (A 4967). Lawmakers are also considering S6418.

North Carolina

Lawmakers are considering HB 644.

Oregon

Democrat Senator Chris Gorsek introduced SB196. The bill was referred to the Judiciary Committee. The bill appears to be based on the California Age-Appropriate Design Code law that passed in 2022.

South Carolina

Senator Verdin introduced S404, which would prohibit operators of internet-based applications from using automated decision systems to place content on social media platforms for users under the age of 18.

Texas

Texas lawmakers are considering HB 896, which prohibits an individual between 13 and 18 years of age from using a social media platform; HB 2155, which regulates children’s use of social media; HB 18, which creates a duty for digital service providers to prevent harm to children; HB 4412, which restricts a digital service providers online agreements with minors; and HB 4948, which is based on the California Age-Appropriate Design Code Act.

The House Youth Health & Safety, Select Committee held a public hearing on HB 18 on March 20. On April 11, 2023, the House Committee on Youth Health & Safety reported favorably as substituted HB 18 by a 5-1 vote. The bill has been placed on the House major state calendar.

HB 896, 2155, 4412, and 4948 were referred to the House Youth Health & Safety, Select Committee.

Utah

The Utah Governor signed SB 152 and HB 311 into law on March 23, 2023.

Virginia

The Virginia legislature closed without passing HB 1688 and SB 1026.

West Virginia

The West Virginia legislature closed without passing HB 2460 and HB 2964.

6. Data Broker Bills

The following states are considering bills that would regulate data brokers:

California

California lawmakers are considering SB 362 – the California Deletion Act. Among other things, the bill moves oversight for California’s data broker registry from the Attorney General to the California Privacy Protection Agency and requires the Agency to establish an accessible deletion mechanism that allows a consumer, through a single verifiable consumer request, to request that every data broker that maintains any personal information delete any personal information related to that consumer held by the data broker or associated service provider or contractor.

New Jersey

Democrat Assemblyman William Moen, Jr. introduced A4811 on October 20, 2022. The bill was referred to the Assembly Science, Innovation and Technology Committee.

Democrat Assemblyman John McKeon introduced A5254 on February 28, 2023. The bill was referred to the Assembly Science, Innovation and Technology Committee.

Oregon

HB 2052 was introduced at the request of the Attorney General’s office. The Business and Labor Committee held a public hearing on January 18, 2023 and work session on February 6. On February 13, 2023, the bill was referred to the Ways and Means Committee. Last year lawmakers considered HB 4017.

Texas

Lawmakers are considering SB 2105. The bill was referred to the House Business & Commerce Committee.

Vermont

On January 26, 2023, a bipartisan group of representatives introduced H.121. The bill was referred to Committee on Commerce and Economic Development, which has held a number of hearings to date. The bill would amend Vermont’s existing data broker statute to add additional requirements.

Washington

Representatives Shelley Kloba and Liz Berry introduced HB1799 on February 9, 2023. The bill was referred to the House Committee on Consumer Protection and Business. The House Committee held a hearing on the bill on February 14. The bill was scheduled for executive session on February 15, but no action was taken.

7. Health Data Privacy Bills

The following states are considering bills that would create new or additional privacy protections for health data processed by private entities:

Connecticut

Senator James Maroney, author of the Connecticut Data Privacy Act, introduced SB 3. The bill contains provisions on children’s data privacy and health data privacy. The Joint Judiciary Committee passed the bill on March 30.

Illinois

On February 9, 2023, Senator Villanueva introduced SB1601. The bill was referred to the Assignments Committee. The bill currently lacks text.

On February 17, 2023, Illinois Representative Ann Williams introduced HB 3603. The bill was referred to the Rules Committee. On March 9, the bill was placed on calendar second reading – short debate.

Maryland

The Maryland legislature closed without passing HB 995 and SB 790.

Massachusetts

Massachusetts lawmakers filed two health data privacy companion bills – SD 2118 and HD 3855.

Nevada

A group of lawmakers introduced SB 370 on March 23, 2023. The bill was referred to the Commerce and Labor Committee.

New York

Senator Liz Krueger filed SB 158 on January 4, 2023. The bill was referred to the Senate Internet and Technology Committee. A companion bill was filed in the Assembly (A 4983).

Virginia

The Virginia legislature closed without passing HB 2219 and SB 1432.

Washington

The My Health My Data Act (HB 1155) passed the legislature on April 17, 2023. You can find our analysis of the bill as it passed the House here and as is passed the legislature here.

8. Automated Employment Decision Tools Bills

The following states are considering bills that would regulate the use of automated employment decision tools. These bills are similar to New York City Local Law 144.

New Jersey

A group of assembly members introduced A4909 on December 5, 2022. On January 19, 2023, the Assembly Labor Committee favorably reported the bill by a vote of 8-1.

An identical bill was introduced in the Senate by Senator Andrew Zwicker under bill number S1926. That bill was referred to the Senate Labor Committee.

New York

Representative Latoya Joyner introduced A567 on January 9, 2023. The bill was referred to the Labor Committee. A companion bill (S5641) was introduced in the Senate on March 10, 2023, and referred to the Labor Committee.

Vermont

Representative Priestley filed H.114 on January 26, 2023. The bill was referred to the General and Housing Committee.

9. Algorithmic Discrimination Bills

These bills would protect against algorithmic discrimination and promote transparency.

California

California AB 331 would regulate the use of automated decision tools, which the bill defines as “a system or service that uses artificial intelligence and has been specifically developed and marketed to, or specifically modified to, make, or be a controlling factor in making, consequential decisions.” The Assembly Committee on Privacy and Consumer Protection passed an amended version of the bill by an 8-3 vote on April 11. The bill was re-referred to the Judiciary Committee.

Minnesota

On February 8, 2023, lawmakers introduced SF 1441. The bill would make it unlawful for “an owner, operator, or provider of an interactive computer service to restrict, either directly, manually, or through the use of an algorithm, a user’s account or content based on race, sex, political ideology, or religious beliefs.” The bill was referred to the Judiciary and Public Safety Committee.

Washington, DC

On February 2, 2023, councilmembers introduced the Stop Discrimination by Algorithms Act of 2023 (B25-0114). The bill was referred to the Committee on Business and Economic Development, and Committee on Judiciary and Public Safety. On February 10, 2023, a notice of intent to act was published in the District of Columbia register.