
Keypoint: In our second weekly update for 2025, we are tracking new bills filed in Arkansas, Hawaii, Illinois, Massachusetts, Missouri, Nebraska, New Jersey, New York, Oklahoma, South Carolina, Texas, and Virginia.
Below is the second weekly update on the status of proposed state privacy legislation in 2025. As always, the contents provided below are time-sensitive and subject to change.
Table of Contents
- What’s New
- AI Bills
- Bill Tracker Chart
1. What’s New
With legislatures continuing to open across the country, state lawmakers filed numerous bills last week. All told, just two weeks into 2025, we are already tracking 68 bills filed across 16 states. As discussed in part 2, below, this does not include the over 140 state AI bills we are separately tracking.

In Arkansas, Representative Andrew Collins (D) introduced two bills directed at children’s privacy and safety. The first bill – HB 1082 – creates the Arkansas Children and Teens’ Online Privacy Protection Act. That bill focuses on the processing of children’s and teen’s data (e.g., disclosures and processing restrictions). The second bill – HB 1083 – creates the Arkansas Kids Online Safety Act. That bill creates a duty of care for covered platforms to “take reasonable measures in the design and operation of any product, service, or feature that the covered platform knows is used by minors to prevent and mitigate harm to minors, including” anxiety, depression, eating disorders, addictive behaviors and physical violence, among others.
In Hawaii, a group of lawmakers introduced a consumer data privacy bill (SB 1037). Hawaii has considered several consumer data privacy bills in prior years. Lawmakers also introduced two unique bills. SB 1163 prohibits the sale of geolocation information and internet browser information without consent. It also prohibits the sale of data collected through eavesdropping or through an application operating in the background of a device that uses the device’s microphone. SB 170 amends the state’s constitution to create a “right to own one’s data.” Specifically, the bill adds the following language to the Hawaii Constitution: “Each person shall own and have an exclusive property right in the data that that person generates on a public networked information system such as the Internet. The legislature shall determine which data are subject to this provision and the manner in which this provision shall be implemented and enforced.” Finally, a social media bill is pending introduction (HB 566).
In Illinois, Senator Sue Rezin introduced four bills. First, Senator Rezin introduced the Illinois Privacy Rights Act (SB 52). A version of this bill failed last year (SB 3517). She also introduced a data broker registration bill (SB 47). We tracked a data broker registration bill filed last year in Illinois. That bill eventually was amended to remove the data broker provisions. Finally, Senator Rezin introduced two different Age-Appropriate Design Code Act bills (SB 50 and SB 51).
Massachusetts lawmakers filed a flood of bills. First, lawmakers introduced four competing consumer data privacy bills:
- Massachusetts Data Privacy Act: Senators Michael Moore and Cynthia Stone Cream separately introduced the Massachusetts Data Privacy Act in the Senate (SD 495 and SD 267). A version of the bill was reported out of the Advanced Information, Technology, the Internet and Cybersecurity Committee last year. In the House, Representatives Andres Vargas and David Rogers also introduced a version of the bill (HD 2110). We interviewed Representatives Vargas and Rogers back in 2022 about their bill.
- Internet Bill of Rights: Representative Rusell Holmes reintroduced the Internet Bill of Rights (HD 1679). We tracked this bill last year as H.1555.
- Massachusetts Information Privacy and Security Act: Representative Finegold reintroduced the Massachusetts Information Privacy and Security Act (SD 2355). We tracked this bill last year as S.227 / H.60.
- Massachusetts Consumer Data Privacy Act: Representative Tricia Farley-Bouvier introduced the Massachusetts Consumer Data Privacy Act (HD.2135). The bill is based on EPIC and Consumer Reports’ model state privacy bill.
In addition, companion bills to regulate the processing of biometric data were introduced in the House (HD.3523) and Senate (SD.1455). Lawmakers also introduced companion MHMD-style consumer health data privacy bills (HD.715 and SD.1696). Finally, lawmakers introduced companion bills to regulate the processing of location data (SD.501 and HD.2965).
In Missouri, Senator Nick Schroer introduced a Senate version of the Biometric Data Privacy Act (SB 554). We have been tracking two versions of the bill filed in the House.
In Nebraska, Senator Kathleen Kauth introduced the Biometric Autonomy Liberty Law (LB 204) while Senator Tanya Storer introduced a social media bill (LB 383).
On the heels of the state’s consumer data privacy law going into effect last week, New Jersey lawmakers introduced several new privacy bills. First, lawmakers introduced companion biometric data privacy bills (S.3181 and A.1488). Second, lawmakers introduced companion bills to regulate social media companies (S.1959 and A.1879). Finally, lawmakers introduced companion data broker registration bills (S.2349 and A.2184). Versions of these bills were introduced last session as well.
Two new bills were introduced in New York last week. Representative Linda Rosenthal introduced A2141, which is the Assembly companion bill to Senator Liz Krueger’s S929. The bills regulate consumer health data. In addition, Senator Jessica Gonzalez-Rojas introduced an employee data privacy bill (A2107). Versions of that bill have been introduced in prior sessions.
In Oklahoma, a second consumer data privacy bill was filed. The bill (SB 546) is a Washington Privacy Act model bill. Oklahoma lawmakers also filed two AADC-style bills in the House – HB 1388 and HB 1762, and three social media bills – HB 1275, SB 931, and SB 885.
In South Carolina, Representative Gilda Cobb-Hunter (D) filed a bill to provide data privacy rights to employees (H 3732).
In Texas, we have added a social media bill (HB 186) to our tracker. It appears that this bill would create provisions for social media companies in addition to those already provided under the Texas Scope Act.
Finally, we have added two more Virginia bills to our tracker. SB 1023 amends the VCDPA to prohibit the sale of precise geolocation data. In addition, HB 2268 establishes within the Virginia Department of Law a Division of Emerging Technologies, Cybersecurity, and Data Privacy to oversee and enforce laws governing cybersecurity, data privacy, and the use of artificial intelligence (AI) and other emerging technologies. Given that Virginia was the second state to enact a consumer data privacy law, but it has never publicly enforced the law, this bill could be one of the more important ones to track this year.
2. AI Bills
Our latest edition of Byte Back AI is now available to subscribers. Subscriptions start as low as $50/month. In this edition, we provide:
- A huge update on new AI bills filed last week in Connecticut, Hawaii, Illinois, Nebraska, Pennsylvania, Virginia, North Dakota, Georgia, Oklahoma, Texas, Maine, New Jersey, New Hampshire, and New York.
- Summaries of hearings held last week by the California Privacy Protection Agency and Washington Senate.
- Our latest AI state bill tracker chart. We are now tracking over 140 state AI bills filed across 29 states.
- Our special feature of the week – a summary of Washington HB 1168 (Generative AI transparency), which was the subject of a House committee hearing last week.
Click here for more information on paid subscriptions.
3. Bill Tracker Chart
For more information on all of the privacy bills introduced to date, including links to the bills, bill status, last action, and hearing dates, please see our bill tracker chart.