Keypoint: Last week, consumer data privacy amendment bills crossed chambers in Montana and Kentucky, a social media bill crossed chambers in Colorado, and there were movements with numerous other bills.
Below is the eighth weekly update on the status of proposed state privacy legislation in 2025. As always, the contents provided below are time-sensitive and subject to change.
Table of Contents
- What’s New
- AI Bills
- Bill Tracker Chart
1. What’s New
The big news last week was three bills crossing chambers.
In Montana, SB 297 unanimously passed the Senate on February 24. The bills amends Montana’s existing consumer data privacy law to, among other things, lower the law’s applicability threshold from 50,000 consumers to 25,000 consumers and add Connecticut-style children’s privacy provisions. The bill is now with the House Judiciary committee.
In Kentucky, HB 473 unanimously passed the House on February 25. The bill amends Kentucky’s existing consumer data privacy law to add a healthcare-related exemption and make technical changes.
Meanwhile, Colorado’s SB 86 (social media) passed the Senate on February 26 by a 28-5 vote. It is now with the House Health & Human Services committee.
Turning to other developments, Utah’s HB 418 passed out of the Senate Business and Labor Committee on February 28. The bill previously passed the House. The bill adds a right to correction to Utah’s existing consumer data privacy law and also creates new obligations on social media companies. Utah’s legislative session closes March 7.
In New Mexico, SB 420 – the Community Privacy & Safety Act – passed out of committee with a do pass recommendation. New Mexico’s legislature closes March 22.
Moving north, Oregon lawmakers filed two bills to amend the state’s existing consumer data privacy law. A bipartisan and bicameral group of lawmakers introduced HB 3899. The bill lowers the law’s applicability thresholds and prohibits controllers from processing sensitive data for purposes of targeted advertising or profiling and prohibits controllers from selling sensitive data.
Separately, Representative Gomberg introduced HB 3875. That bill amends Oregon’s law to provide that it applies to motor vehicle manufacturers and their affiliates, regardless of the number of consumers from which the entities obtain personal data.
We also continue to see lawmakers introduce new bills. In Vermont, a bipartisan group of Senators introduced S 93. That bill is a more business-friendly competitor to Representative Priestley’s data privacy bill. Finally, lawmakers filed three new consumer data privacy bills in West Virginia (HB 2987, HB 2953, and HB 3005).
We also saw movement with numerous children’s-related bills last week. First, several states advanced bills out of committee:
An amended Washington SB 5708 (protecting Washington children online) passed out of its second Senate committee while an amended version of its House companion bill (HB 1834) also passed out of its second committee.
Alabama SB 187 (age verification) was reported out of committee and read for a second time on the Senate floor.
Arizona HB 2861 (social media) advanced in the House.
Iowa HF 278 (social media) advanced out of committee.
Three Oklahoma bills passed out of committee – HB 1388 (children’s privacy), SB 931 (social media), and SB 885 (social media / Safe Screens for Kids Act).
In Vermont, an amended S 69 – an Age-Appropriate Design Code Act bill – received a favorable committee report. Separately, lawmakers introduced a unique bill (H 365) that requires social media platforms and AI systems to register annually with the state and agree to produce safety and privacy terms.
Moving to new bills, a new age verification bill was introduced in Minnesota (HF 1434), a new Age-Appropriate Design Code Act bill was filed in Rhode Island (HB 5830), and a new social media bill was introduced in Colorado (HB 1287).
Turning to health data privacy bills, New Mexico’s HB 430 – the Health Data Privacy Act – was reported out of committee with a do pass recommendation on February 24. Also, a My Health My Data-like bill was introduced in Rhode Island (HB 5857).
Finally, a group of Vermont lawmakers introduced H 366. The bill creates privacy rights for neural data.
2. AI Bills
Our latest edition of Byte Back AI is now available to subscribers. Subscriptions start as low as $50/month. In this edition, we provide:
- Updates on AI bills in numerous states, including bills crossing chambers in Arizona, Utah, Georgia, Kentucky, Montana, and South Dakota.
- A summary of hearings on algorithmic discrimination bills in Connecticut and Maryland.
- Our latest AI state bill tracker chart. We are tracking hundreds of state AI bills filed across 43 states.
- This week we offer two special features: a rundown of Utah’s AI-related bills and an updated comparison of key definitions among various algorithmic discrimination bills.
- Our “three things to know” this week.
Click here for more information on paid subscriptions.
3. Bill Tracker Chart
For more information on all of the privacy bills introduced to date, including links to the bills, bill status, last action, and hearing dates, please see our bill tracker chart.