Keypoint: Last week, a Virginia social media bill became law while bills advanced in Colorado, California, North Carolina, Connecticut, South Carolina, and Texas.
Below is the seventeenth weekly update on the status of proposed state privacy legislation in 2025. As always, the contents provided below are time-sensitive and subject to change.
Table of Contents
- What’s New
- AI Bills
- Bill Tracker Chart
1. What’s New
In Virginia, SB 854 finally became law. The bill passed the legislature in February but received a Governor’s recommendation in late March. The Senate concurred in the Governor’s recommendation and the Governor approved the law on May 2. The bill amends the VCDPA to create new requirements for social media platforms.
In Colorado, an amended SB 276 passed out of two House committees and is scheduled for floor votes. The bill previously passed the Senate. The bill amends the Colorado Privacy Act’s (CPA) definition of sensitive data to include precise geolocation data. It also amends the CPA to provide that a controller cannot sell a consumer’s sensitive data without first obtaining consent. The Colorado legislature closes May 7.
We also continued to see bills advance in California. AB 566 (opt-out preference signal) passed out of the Assembly Appropriations committee and is now on third reading on the Assembly floor. Meanwhile, AB 1355 (location privacy), passed out of the Judiciary committee and was re-referred to the Appropriations committee where it is set for a May 7 hearing. In addition, four bills passed out of their chamber’s appropriations committee but were then re-referred to that committee – SB 690 (CIPA amendment), SB 771 (social media), AB 1043 (app stores), and SB 354 (insurance privacy).
North Carolina‘s HB 462 (consumer data privacy and social media) was amended and given a favorable committee report then re-referred to the Commerce and Economic Development committee.
In Connecticut, SB 1356 (CTDPA amendments) was referred to the Senate Appropriations committee.
In Maine, LD 1822 (Maine Online Data Privacy Act) was introduced and referred to the Joint Judiciary committee. That committee will hold a May 5 hearing on that bill and two other data privacy bills – LD 1088 (Maine Consumer Data Privacy Act) and LD 1224 (Maine Consumer Privacy Act).
Turning to kid’s privacy bills, South Carolina’s S 268 (Age-Appropriate Design Code Act) unanimously passed the Senate and is pending in the House Judiciary committee. Meanwhile, an amended H 3431 (South Carolina Social Media Regulation Act) passed out of a Senate committee and then through a second floor reading. That bill previously passed the House in February. The South Carolina legislature closes May 8.
Finally, Texas’ HB 186 (social media) passed the House on April 30.
We also saw several state legislatures close this week without passing bills. Indiana’s legislature closed without passing SB 11 (social media). Iowa’s legislature closed without passing the three bills we have been tracking – SF 143 / HF 503 (consumer data privacy law amendments) and HF 798 (social media). Florida’s legislature closed without passing SB 868 (social media). Moving forward, Vermont’s legislature closes on May 9.
2. AI Bills
Our latest edition of Byte Back AI is now available to subscribers. Subscriptions start as low as $50/month. In this edition, we provide:
- Updates on a new law enacted in North Dakota, bills passing out of the legislatures in Oklahoma, Florida, Arizona, and Colorado, and a bill crossing chambers in Texas.
- A summary of last week’s hearing from the California Assembly’s Judiciary committee.
- Our special feature the week – an analysis of the proposed amendments to the Colorado AI Act.
- Our “three things to know this week.”
- An updated state AI bill tracker chart.
Click here for more information on paid subscriptions.
3. Bill Tracker Chart
For more information on all of the privacy bills introduced to date, including links to the bills, bill status, last action, and hearing dates, please see our bill tracker chart.