Keypoint: It was a very active week with movement on numerous bills, in particular in Virginia, as well as new bills introduced across the country.
Below is the fifth weekly update on the status of proposed state privacy legislation in 2025. As always, the contents provided below are time-sensitive and subject to change.
Table of Contents
- What’s New
- AI Bills
- Bill Tracker Chart
1. What’s New
The big news last week comes from Virginia where several bills advanced while numerous bills died. As discussed last week, February 4 was the deadline for each chamber to pass bills that originated in that chamber. Three bills advanced:
- SB 854 – Amends the VCDPA to prohibit a controller or processor that operates a social media platform that has knowledge that a user is a child younger than 18 years of age from using an addictive feed, unless the controller or processor obtains verifiable parental consent.
- SB 1023 – Amends the VCDPA to provide that a controller of personal data shall not sell or offer for sale precise geolocation data concerning a consumer.
- SB 754 – Amends state consumer protection law to provide that obtaining, disclosing, selling, or disseminating personally identifiable reproductive or sexual health information without the consent of the consumer is a prohibited practice.
The remaining six bills we have been tracking did not make it out of their chamber of origin – SB 769, HB 2043, HB 2250, HB 1624, HB 1817, and HB 2268.
In Oklahoma, HB 1012 – the Oklahoma Computer Data Privacy Act – passed out of committee but reportedly will not be brought for a floor vote this year.
In Maryland, Delegate Harrison filed HB 1365. The bill modifies Maryland’s controversial data minimization provisions. Specifically, the bill description states that it alters the “requirements for a controller to limit the collection of personal data to what is adequate, relevant, and reasonably necessary in relation to the purposes for which the data is processed.”
We also saw states continue to file new consumer data privacy bills. In Georgia, a group of Senators introduced the Georgia Consumer Privacy Protection Act (SB 111). Last year’s version of the bill passed the Senate but failed in the House.
In Illinois, Representative Abdelnasser Rashid introduced the Illinois Data Privacy and Protection Act (HB 3041). The bill is now with the Rules Committee. This is the second consumer data privacy bill filed in Illinois this year.
In New Mexico, two representatives introduced the Internet Privacy & Safety Act (HB 307). The bill, which contains a private right of action, is scheduled for a committee hearing on February 12.
Three new data privacy bills were introduced in New York. Senator Brian Kavanagh introduced S4276 (the Digital Fairness Act) and S4270 (the Online Consumer Protection Act). S4270 is a companion bill to A3087. Meanwhile, Senator Gounardes introduced the Stop Addictive Feeds Exploitation (SAFE) for All Act (S4506). The bill is based on last year’s SAFE for Kids Act but, as its name suggests, would apply the provisions of that law to all individuals regardless of age.
A consumer data privacy bill also was introduced in West Virginia (HB 3498).
Finally, in Mississippi, both consumer data privacy bills died in committee (SB 2500 and SB 2779).
Moving to kids’ privacy bills, we saw movement on three bills last week. On February 3, a Nebraska committee hearing was held on LB 504 (the Nebraska Age-Appropriate Online Design Code Act). An amended bill advanced out of committee by a 7-1 vote.
In Oklahoma, HB 1275 passed out of its initial committee. The bill seeks to regulate social media companies.
In Utah, SB 142 is now on a third reading in the Senate. The bill enacts provisions governing app store operations and creates requirements for age verification and parental consent.
We also saw lawmakers introduce new bills in three states. Washington lawmakers introduced companion social media bills (HB 1834 and SB 5078), while Illinois lawmakers introduced another children’s privacy bill, SB 2037 – the Digital Age Assurance Act. In California, a bill was introduced to regulate social media platforms (AB 364). That is a placeholder bill that currently lacks text.
In health data privacy bill news, while we await the fate of the New York Health Information Privacy Act, Illinois lawmakers filed two new companion health data privacy bills (SB 2273 and HB 3494).
It also was an active week for data broker bills. In Nebraska, a committee hearing was held on LB 602 on February 3.
In addition, lawmakers in three states introduced new data broker bills. In Illinois, Representative Daniel Didech filed a data broker registration / Delete Act bill (HB 2913).
In Maryland, companion data broker registration bills were filed in the House (HB 1089) and Senate (SB 904). The bills also establish the Privacy Protection and Enforcement Unit within the Maryland Division of Consumer Protection in the Office of the Attorney General and create a tax on data brokers.
Finally, in Washington, HB 1887 creates a data broker registry and imposes a monthly severance tax that ranges based on the number of states resident whose information the broker collects each month. For example, data brokers that collect the personal information of one million state residents in a month would pay a monthly tax of $75,000.
2. AI Bills
Our latest edition of Byte Back AI is now available to subscribers. Subscriptions start as low as $50/month. In this edition, we provide:
- Updates on AI bills in numerous states, including California, Maryland, Hawaii, Illinois, Idaho, and Washington.
- The debut of a new section – three things to know this week – which identifies what we will be keeping a close eye on in the week ahead.
- A summary of last week’s hearing on Washington’s HB 1622.
- Our latest AI state bill tracker chart. We are now tracking over 250 state AI bills filed across 39 states.
- Our special feature of the week – an update and summary of Virginia’s numerous AI-related bills, which saw significant movement last week.
In addition, on February 18 from 1:00-2:00 p.m. ET / 10:00-11: a.m. PT, we are hosting a webinar on the AI bills introduced to date. The webinar is offered exclusively to paid Byte Back AI subscribers.
Click here for more information on paid subscriptions.
3. Bill Tracker Chart
For more information on all of the privacy bills introduced to date, including links to the bills, bill status, last action, and hearing dates, please see our bill tracker chart.