Keypoint: Last week saw a flurry of activity across numerous states, including bills advancing in Virginia, Oklahoma, Washington, Utah, and South Carolina, while lawmakers continued to introduce bills across the country.
Below is the sixth weekly update on the status of proposed state privacy legislation in 2025. As always, the contents provided below are time-sensitive and subject to change.
Table of Contents
- What’s New
- AI Bills
- Bill Tracker Chart
1. What’s New
With the Virginia legislative session closing on February 22, the state passed its first privacy-related bill with the House voting to pass SB 754 by a 52-43 vote. The bill previously passed the Senate. It does not appear that the bill was amended while in the House such that the bill will move on to the governor. The bill amends the state’s consumer protection law to prohibit “obtaining, disclosing, selling, or disseminating any personally identifiable reproductive or sexual health information without the consent of the consumer.”
The Virginia legislature is still considering two other privacy-related bills (prohibiting the sale of geolocation data and regulating social media companies) in addition to six AI-related bills that we have been tracking with Byte Back AI.
Turning to consumer data privacy bills, two states advanced bills out of committee last week.
In Oklahoma, Senator Howard’s SB 546 advanced out of the Technology and Telecommunications committee. The bill is based on the Washington Privacy Act model.
In Washington, HB 1671 advanced out of the House Technology, Economic Development & Veterans committee by a 7-4 vote. The bill, which authorizes a private right of action for violations, is reportedly based on EPIC and Consumer Reports’ model state privacy bill.
Lawmakers in three states introduced new consumer data privacy bills last week.
In Vermont, Representative Monique Priestley introduced the Vermont Data Privacy and Online Surveillance Act (H 208). Representative Priestley was the primary author of last year’s data privacy bill that passed the legislature, was vetoed by the Governor, and could not secure enough votes in the Senate to override the veto. This year’s bill again contains a private right of action – this time with statutory damages. Representative Priestley also introduced an Age-Appropriate Design Code Act bill (H 210) and a bill to amend the state’s data broker law (H 211).
In Alabama, a group of lawmakers filed HB 283. The bill is now in committee. This is the first time we have tracked a consumer data privacy bill filed in Alabama since 2021.
In New Mexico, a second consumer data privacy bill was filed as HB 410. In New York, A 4947 (the NY Privacy Act) was introduced as a companion bill to S 3044.
In addition, lawmakers in three states introduced bills to amend their state’s existing consumer data privacy laws.
In Montana, Senator Daniel Zolnikov introduced a bill (SB 297) that would, among other things, add Connecticut-style children’s data privacy provisions to Montana’s law.
Meanwhile, Kentucky Senator Branscum introduced HB 473, which amends Kentucky’s existing privacy law to add more healthcare-related exemptions.
In California, Assembly Member Lowenthal filed AB 566. The bill prohibits a business from developing or maintaining a browser that does not include a setting that enables a consumer to send an opt-out preference signal to businesses with which the consumer interacts through the browser and would, six months after the adoption of regulations by the California Privacy Protection Agency (CPPA), prohibit a business from developing or maintaining a mobile operating system that does not include a setting that enables a consumer to send an opt-out preference signal to businesses with which the consumer interacts through the mobile operating system. The bill should look familiar to our readers – a similar bill authored by the same lawmaker passed the legislature last year but was vetoed by the governor.
Moving to kids’ privacy bills, three bills saw movement last week. In Utah, the App Store Accountability Act (SB 142) passed the Senate. Among other things, the bill requires app store providers to verify user ages. In Arkansas, both kids’ privacy bills were amended (HB 1082 and HB 1083). Meanwhile, the South Carolina Social Media Regulation Act (H 3431) was amended and advanced out of the Judiciary committee.
We also continue to see new kids’ privacy bills introduced across the country with new bills filed in Alabama (HB 276), Arizona (HB 2861), Connecticut (SB 1295), Iowa (HF 278), New York (S 4600 and S 4609), and Tennessee (SB 811 and HB 825).
In addition, Colorado’s SB 86 (social media regulation) is set for a committee hearing on February 19.
Turning to data broker bills, in California, Senator Becker introduced SB 361. The bill builds on the existing California data broker law and requires a data broker to provide additional information to the CPPA, including whether the data broker collects consumers’ login or account information, various government identification numbers, citizenship data, union membership status, sexual orientation status, and biometric data.
Finally, we are tracking two bills that do not fit into our customary categories. In Illinois, the Privacy Protections for Location Information Derived from Electronic Devices Act was introduced in both chambers (SB 2121 and HB 3712). In Minnesota, two Senators introduced a bill to establish neurodata rights (SF 1240).
2. AI Bills
Our latest edition of Byte Back AI is now available to subscribers. Subscriptions start as low as $50/month. In this edition, we provide:
- Updates on AI bills in numerous states, including Virginia, New York, Colorado, and Utah (among many others).
- Summaries of California and Washington hearings.
- Our latest AI state bill tracker chart. We are now tracking over 300 state AI bills filed across 42 states.
In addition, on February 18 from 1:00-2:00 p.m. ET / 10:00-11: a.m. PT, we are hosting a webinar on the AI bills introduced to date. The webinar is offered exclusively to paid Byte Back AI subscribers.
Click here for more information on paid subscriptions.
3. Bill Tracker Chart
For more information on all of the privacy bills introduced to date, including links to the bills, bill status, last action, and hearing dates, please see our bill tracker chart.