Keypoint: Last week the Nevada legislature passed a health data privacy bill, the Delaware House passed a consumer data privacy bill, the Oregon House passed a data broker bill, and the New York Senate passed consumer and health data privacy bills although the New York legislature closed without further movement on the bills.
Below is the twenty-second weekly update on the status of proposed state privacy legislation in 2023. Before we get to our update, we wanted to provide two reminders.
First, we are regularly updating our 2023 State Privacy Law Tracker, 2023 State Children’s Privacy Law Tracker, and 2023 State Biometric Privacy Law Tracker. We encourage you to bookmark the pages for easy reference.
Second, the contents provided below are time-sensitive and subject to change. If you are not already subscribed to our blog, consider doing so to stay updated. If you are interested in tracking developments between blog posts, consider following on LinkedIn and/or Twitter.
Table of Contents
- What’s New?
- Upcoming Hearings
- Consumer Data Privacy Bills
- Biometric Privacy Bills
- Children’s Privacy Bills
- Data Broker Bills
- Health Data Privacy Bills
- Automated Employment Decision Tools Bills
- Algorithmic Discrimination Bills
1. What’s New?
The big news last week was the Nevada legislature passing SB 370. The bill is modeled off the Washington My Health My Data Act but with important differences, including that it does not have a private right of action and contains a narrower definition of consumer health data. If signed by the Nevada Governor, the bill will go into effect March 31, 2024.
In other health data privacy bill news, the New York Senate passed S158 but the bill failed to advance in the Assembly before the legislature closed on June 9.
In consumer data privacy bill developments, the Delaware House passed HB 154 by a 33-5 vote. The bill is now assigned to the Senate Banking, Business, Insurance and Technology Committee.
The New York Senate passed S365 but the bill failed to advance in the Assembly before the legislature closed.
In Florida, Governor Ron DeSantis signed SB 262 into law. This is a consumer data privacy bill with narrow applicability that also contains children’s data privacy provisions.
In other children’s privacy bill developments, the Louisiana legislature passed SB 162, which applies to social media companies.
Finally, in data broker bill news, the Oregon House passed HB 2052. The bill is now with the Senate. The Oregon legislature also is considering a consumer data privacy bill (SB 619). That bill is scheduled for second and third readings in the Senate this week. The Oregon legislature is scheduled to close June 26.
2. Upcoming Hearings
None.
3. Consumer Data Privacy Bills
The below states are considering consumer data privacy bills. These bills are also tracked on our 2023 State Privacy Law Tracker.
Delaware
The Delaware House passed HB 154 by a 33-5 vote on June 8, 2023. The bill is now assigned to the Senate Banking, Business, Insurance and Technology Committee.
Florida
On June 6, 2023, Florida Governor Ron DeSantis signed SB 262 into law.
Hawaii
The Hawaii legislature closed without passing SB 974, SB 1110, and HB 1497.
Illinois
The Illinois legislature closed without passing HB 1381, SB 1365, and HB 3385.
Indiana
On May 1, 2023, Indiana Governor Eric Holcomb signed SB 5 into law, making Indiana the seventh state to pass consumer data privacy legislation.
Iowa
On March 28, 2023, Iowa Governor Kim Reynolds signed SF 262 into law, making Iowa the sixth state to pass consumer data privacy legislation.
Kentucky
The Kentucky legislature closed without passing a bill.
Louisiana
The Louisiana legislature closed without passing SB 199.
Maine
State lawmakers are considering LD 1973 and LD 1977.
Maryland
The Maryland legislature closed without passing SB 0698 and HB 0807.
Massachusetts
Massachusetts lawmakers introduced three competing bills.
First, on January 18 and 19, 2023, the Massachusetts Data Privacy Protection Act (MDPPA) was filed in both the Senate (SD 745) by Senator Cynthia Stone Creem and in the House (HD2281) by Representatives Andres Vargas and David Rogers. That bill is based on the federal American Data Privacy Protection Act with additional provisions relating to workplace surveillance.
Second, on January 20, 2023, the Massachusetts Information Privacy and Security Act (MIPSA) was introduced in both the Senate (SD1971) by Senator Barry Finegold and in the House (HD 3263) by Representative Daniel Carey.
Third, Representative Russell Holmes introduced HD 3245 – the Internet Bill of Rights.
Minnesota
The Minnesota legislature closed without passing SF 950, HF 1892, HF 1367, HF 2309, and SF 2915.
Mississippi
The Mississippi legislature closed without passing SB 2080.
Montana
On May 22, 2023, Montana Governor Greg Gianforte signed SB 384 into law, making Montana the ninth state to pass consumer data privacy legislation.
New Hampshire
On January 19, 2023, a bipartisan and bicameral group of lawmakers led by Senator Sharon Carson introduced SB 255. On March 16, 2023, an amended version of the bill passed the Senate. A full committee work session was held on June 7, 2023.
New Jersey
On February 2, 2023, the Senate voted 27-11 to pass S332. The bill is narrow, perhaps most similar to the Nevada Online Privacy Protection Act. An amended version of the bill was reported out of the Assembly Science, Innovation and Technology Committee on May 11, 2023. The same committee also reported out a companion bill A1971. A505 remains in committee. It also is not as broad as the other bills discussed in this section. On March 13, 2023, Senator Gopal introduced S3714, which is a companion bill to A505.
New York
The New York legislature closed without passing S365, A7423, A417, A1366, SB2277, A 2587, S3162, A 4374, S5555, and A6319.
North Carolina
Lawmakers introduced SB 525 on April 4, 2023. The bill was referred to the Senate Committee on Rules and Operations.
Oklahoma
The Oklahoma legislature closed without passing HB 1030.
Oregon
Democrat Senator Floyd Prozanski and Democrat Representative Paul Hovley introduced SB 619 at the request of Attorney General Ellen Rosenblum. The Attorney General’s office convened a work group over the summer and fall to work on the bill. On March 7, the Senate Judiciary Committee held a public hearing on an amended version of the bill. A work group session was held on April 3, 2023. On April 12, 2023, the bill was referred to the Ways and Means Committee. A work session was held on May 24, 2023, after which the bill was returned to the full committee, which held a work session on May 31, 2023.
Pennsylvania
Pennsylvania is considering HB 708. The bill is sponsored by Representative Malcom Kenyatta, who sponsored HB 2257 in 2022.
Rhode Island
Lawmakers filed H 5354 on February 3, 2023. The bill was referred to the House Innovation, Internet & Technology Committee, which recommended that the bills be held for further study.
On March 23, a group of Senators introduced SB 754. The bill was referred to the Senate Commerce committee. On May 2, 2023, the committee recommended that the measure be held for further study.
A companion bill was filed in the House (HB 6236). On April 4, 2023, the House Innovation, Internet & Technology Committee held a hearing on HB 6236. The Committee recommended that the bill be held for further study.
Tennessee
Governor Bill Lee signed HB 1181 on May 11, 2023 making Tennessee the eighth state to pass consumer data privacy legislation.
Texas
The Texas legislature passed Representative Capriglione’s Texas Data Privacy and Security Act (HB 4) on May 28, 2023.
Vermont
The Vermont legislature closed without passing H.121.
Washington
The Washington legislature closed without passing HB 1616.
West Virginia
The West Virginia legislature closed without passing HB 3498 and HB 3453.
4. Biometric Privacy Bills
The following states are considering BIPA-like biometric information privacy bills. The bills are also tracked on our 2023 State Biometric Privacy Law Tracker.
Arizona
The Arizona legislature is in recess. It has been considering SB1238.
Hawaii
The Hawaii legislature closed without passing SB 1085.
Kentucky
The Kentucky legislature closed without passing HB 483.
Maine
The Maine Judiciary Committee held a work session on LB1705 on May 25, 2023. The bill was not reported out.
Maryland
The Maryland legislature closed without passing HB 33 and SB0169.
Massachusetts
Representative Fernandes introduced H.63 and Senator Montigny introduced S.195. On April 6, 2023, S.195 was discharged to the committee on Advanced Information Technology, the Internet and Cybersecurity.
Mississippi
The Mississippi legislature closed without passing HB 467.
Missouri
The Missouri legislature closed without passing HB 1047.
Minnesota
The Minnesota legislature closed without passing SF 954 and HF 2532.
Nevada
SB 370 was amended to remove the biometric privacy provisions before it was passed by the legislature.
New York
The New York legislature closed without passing A1362, S4457, and S2390.
Tennessee
The Tennessee legislature closed without passing SB 339 and HB 932.
Vermont
The Vermont legislature closed without passing H.121.
5. Children’s Privacy Bills
The following states are considering legislation to regulate children’s privacy. This list of bills is not intended to cover student data privacy bills. The bills are also tracked on our 2023 State Children’s Privacy Law Tracker.
Arkansas
The Arkansas legislature passed SB 396 (social media regulation) and the bill was signed by the Governor.
California
On February 2, 2023, Senator Skinner introduced SB 287. On June 1, 2023, the bill was ordered to the inactive file. On February 17, 2023, Senator Stern introduced the Let Parents Choose Protection Act of 2023 (SB 845). The bill did not make it out of committee. California lawmakers also were considering SB 764 – a social media regulation bill – that did not advance.
Connecticut
The Connecticut legislature unanimously passed SB 3 on June 3, 2023.
Florida
The Florida legislature closed without passing HB 591. However, children’s privacy protections were passed in SB 262.
Kansas
The Kansas legislature closed without passing SB22.
Illinois
The Illinois legislature closed without passing SB1739 and HB 3880.
Iowa
The Iowa legislature closed without passing HF 712.
Louisiana
On June 7, 2023, the Louisiana legislature passed SB 162.
Maryland
The Maryland legislature closed without passing SB 844 and HB 901.
Massachusetts
Representative Rogers introduced HD 2325 (An Act Relative to Internet Privacy Rights for Children).
Minnesota
The Minnesota legislature closed without passing HF 1503, SF 2101, HF 2257, and SF 2810.
Nevada
The Nevada legislature closed without passing AB 320.
New Jersey
Democrat Assemblyman Conaway, Jr. introduced A4919 on December 5, 2022. The bill was referred to the Assembly Science, Innovation and Technology Committee. A companion bill (S3493) was introduced by Democrat Senator Vitale on January 19, 2023, and referred to the Law and Public Safety Committee. The bill appears to be based on the California Age-Appropriate Design Code law that passed in 2022.
Lawmakers also introduced A5069 and S3608, which prohibit social media platforms from using certain practices or features that cause child users to become addicted to the platform. On March 16, 2023, A5069 was referred to the Assembly Health Committee. On March 20, 2023, it was reported and referred to the Assembly Appropriations Committee.
On March 20, 2023, the Assembly Health Committee favorably reported A5069. The bill was referred to the Assembly Appropriations Committee.
New Mexico
The New Mexico legislature closed without passing SB 319.
New York
The New York legislature closed without passing S3281, A 4967, and S6418.
North Carolina
The House Judiciary Committee favorably reported an amended version of HB 644 – the Social Media Algorithmic Control in Information Technology Act. The bill was re-referred to the House Appropriations Committee. The bill description states that it “combat[s] social media addiction by requiring that social media platforms respect the privacy of North Carolina users’ data and not use a North Carolina minor’s data for advertising or algorithmic recommendations.”
Lawmakers also are considering the Let Parents Choose Act / Sammy’s Law of 2023 (HB 773).
Oregon
Democrat Senator Chris Gorsek introduced SB196. The bill was referred to the Judiciary Committee. The bill appears to be based on the California Age-Appropriate Design Code law that passed in 2022.
South Carolina
Senator Verdin introduced S404, which would prohibit operators of internet-based applications from using automated decision systems to place content on social media platforms for users under the age of 18.
Texas
The Texas legislature passed HB 18 on May 28, 2023.
Utah
The Utah Governor signed SB 152 and HB 311 into law on March 23, 2023.
Virginia
The Virginia legislature closed without passing HB 1688 and SB 1026.
West Virginia
The West Virginia legislature closed without passing HB 2460 and HB 2964.
6. Data Broker Bills
The following states are considering bills that would regulate data brokers:
California
California lawmakers are considering SB 362 – the California Deletion Act. Among other things, the bill moves oversight for California’s data broker registry from the Attorney General to the California Privacy Protection Agency and requires the Agency to establish an accessible deletion mechanism that allows a consumer, through a single verifiable consumer request, to request that every data broker that maintains any personal information delete any personal information related to that consumer held by the data broker or associated service provider or contractor. The bill was voted out of the Senate Judiciary Committee by a 9-2 vote on April 25, 2023. It was voted out of the Senate Appropriations Committee by a 5-2 vote on May 18, 2023, and ordered to a third reading on May 22, 2023. The Assembly passed the bill by a 32-8 vote on May 31, 2023.
New Jersey
Democrat Assemblyman William Moen, Jr. introduced A4811 on October 20, 2022. The bill was referred to the Assembly Science, Innovation and Technology Committee.
Democrat Assemblyman John McKeon introduced A5254 on February 28, 2023. The bill was referred to the Assembly Science, Innovation and Technology Committee.
On May 11, 2023, the two bills were combined and unanimously voted out of the Assembly Science, Innovation and Technology Committee.
Oregon
HB 2052 was introduced at the request of the Attorney General’s office. The Business and Labor Committee held a public hearing on January 18, 2023 and work session on February 6. On February 13, 2023, the bill was referred to the Ways and Means Committee, which held a work session on May 30 and returned the bill to the full committee, which held a work session on June 2, 2023. On June 7, 2023, the Oregon House passed the bill by a 49-9 vote. The bill is now with the Senate.
Texas
The Texas legislature passed SB 2105 on May 24, 2023.
Vermont
The Vermont legislature closed without passing H.121.
Washington
The Washington legislature closed without passing HB1799.
7. Health Data Privacy Bills
The following states are considering bills that would create new or additional privacy protections for health data processed by private entities:
Connecticut
The Connecticut legislature unanimously passed SB 3 on June 3, 2023.
Illinois
The Illinois legislature closed without passing SB1601 and HB 4093.
Maryland
The Maryland legislature closed without passing HB 995 and SB 790.
Massachusetts
Massachusetts lawmakers filed two health data privacy companion bills – SD 2118 and HD 3855.
Maine
Lawmakers are considering LD 1902. A work session was held on May 25, 2023, and the bill was not reported out.
Nevada
On June 5, 2023, the Nevada legislature passed SB 370.
New York
The New York legislature closed without passing SB 158 and A 4983.
Virginia
The Virginia legislature closed without passing HB 2219 and SB 1432.
Washington
The My Health My Data Act (HB 1155) was signed into law on April 27, 2023. You can find our analysis of the bill as it passed the House here and as is passed the legislature here.
8. Automated Employment Decision Tools Bills
The following states are considering bills that would regulate the use of automated employment decision tools. These bills are similar to New York City Local Law 144.
New Jersey
A group of assembly members introduced A4909 on December 5, 2022. On January 19, 2023, the Assembly Labor Committee favorably reported the bill by a vote of 8-1.
An identical bill was introduced in the Senate by Senator Andrew Zwicker under bill number S1926. That bill was referred to the Senate Labor Committee.
New York
The New York legislature closed without passing A567 and S5641.
Vermont
The Vermont legislature closed without passing H.114.
9. Algorithmic Discrimination Bills
These bills would protect against algorithmic discrimination and promote transparency.
California
The California legislature did not pass AB 331.
Minnesota
The Minnesota legislature closed without passing SF 1441.
Washington, DC
On February 2, 2023, councilmembers introduced the Stop Discrimination by Algorithms Act of 2023 (B25-0114). The bill was referred to the Committee on Business and Economic Development, and Committee on Judiciary and Public Safety. On February 10, 2023, a notice of intent to act was published in the District of Columbia register.