Keypoint: Last week, the Virginia legislature passed a VCDPA amendment, kid’s privacy bills crossed chambers in South Carolina and Utah, and lawmakers continued to introduce new bills on various topics.
Below is the seventh weekly update on the status of proposed state privacy legislation in 2025. As always, the contents provided below are time-sensitive and subject to change.
Table of Contents
- What’s New
- AI Bills
- Bill Tracker Chart
1. What’s New
The big news this week was the Virginia legislature unanimously passing SB 854. The bill amends the VCDPA to require social media platforms to use commercially reasonable methods, such as a neutral age screen mechanism, to determine whether a user is a minor (under 16 years of age) and to limit a minor’s use of the platform to one hour per day, per service or application, while allowing a parent to give verifiable parental consent to increase or decrease the daily limit. The amendment goes into effect on January 1, 2026.
Meanwhile, another VCDPA amendment bill – SB 1023, which would have prohibited the sale of precise geolocation data – failed in the House.
Virginia’s legislative session closed on Saturday, February 22. Of the ten privacy bills we tracked this year, only two passed.
We also saw movement with other bills that seek to amend their state’s existing consumer data privacy laws. In Kentucky, HB 473 was reported out of the House Small Business & Information Technology committee. The bill amends Kentucky’s data privacy law to add a healthcare-related exemption and make a technical change to the data protection impact assessment requirement.
Meanwhile, Montana Senator Daniel Zolnikov’s SB 297 passed out of committee and is scheduled for a third Senate reading on February 24. Among other things, the bill lowers the law’s applicability threshold from 50,000 consumers to 25,000 consumers and adds Connecticut-style children’s privacy provisions.
We also continue to see lawmakers introduce bills to amend their state’s existing consumer data privacy laws. In Connecticut, Senator James Maroney introduced SB 1356. The bill amends numerous provisions in the Connecticut Data Privacy Act, including the definitions of biometric data, publicly available information, and sensitive data. The bill also lowers the law’s applicability threshold, removes exemptions, revises the data minimization and children’s privacy provisions, and creates a data broker registry.
In Iowa, HF 503 was introduced as a companion bill to SF 143. The bills amend Iowa’s recently-effective consumer data privacy law to define “child” as under 18, not 13.
Finally, California AB 1159 makes technical changes to the California Online Privacy Protection Act. It is likely a placeholder bill for a forthcoming substantive bill as February 21 was the last day for bills to be introduced in the California legislature.
Turning to bills that would create new laws, in Georgia, SB 111 (the Georgia Consumer Privacy Protection Act) advanced out of the Senate Economic Development & Tourism committee. It was read for a second time on the Senate floor on February 20. Finally, lawmakers filed new consumer data privacy bills in Arkansas (SB 258), Maine (LD 595 – bill lacks text), New Mexico (SB 420), and New York (S 5156).
Moving on to kids’ privacy bills, two bills crossed chambers last week. South Carolina’s H 3431 (social media) passed the House by an 89-14 vote. Meanwhile Utah’s App Store Accountability Act (SB 142) passed the Senate and was referred to the House Rules committee.
Three states also advanced bills out of committee last week. In Colorado, an amended version of SB 86 (social media) passed out of the Senate Judiciary committee. It is scheduled for floor work next week. In Iowa, HF 278 (social media) passed through a subcommittee. In Washington, companion children’s privacy bills (SB 5708 and HB 1834) passed out of committee.
In addition, new kids’ privacy bills were introduced in Alabama (SB 187 and HB 317), Utah (HB 418), and California (AB 940).
Moving on, new consumer health data privacy bills were filed in New Mexico (HB 430) and Vermont (S 74).
Finally, in Texas, a bill (SB 1343) was introduced to amend the state’s data broker registration law.
2. AI Bills
Our latest edition of Byte Back AI is now available to subscribers. In this edition, we provide:
- Updates on AI bills in numerous states, including California, Virginia, Arkansas, and Montana.
- A rundown of the AI bills that passed and failed in Virginia as the legislature closed last week.
- Our “three things to know this week.”
- A summary of last week’s hearing on Maryland’s SB 823 (gen AI disclosures).
- Our latest AI state bill tracker chart. We are now tracking over 330 state AI bills filed across 43 states.
Subscriptions start as low as $50/month. Click here for more information on paid subscriptions.
3. Bill Tracker Chart
For more information on all of the privacy bills introduced to date, including links to the bills, bill status, last action, and hearing dates, please see our bill tracker chart.