MARK37 Resources

Privacy Bill Tracker

US Privacy Bill Tracker: Every Federal & State Law (2026)

The United States has no comprehensive federal data privacy law, and depending on who you ask, that may be more feature than bug. While privacy advocates frame the absence as a failure, others see federal “privacy” legislation as government standardizing its own access to your data, locking in surveillance infrastructure under the banner of consumer protection, and preempting stronger state laws that actually have teeth.

What follows is a complete tracker of every significant privacy law and bill at the federal and state level: enacted laws, sectoral laws covering health, biometrics, children, and data brokers, and everything pending right now. Read the details carefully. Not every bill called a “privacy” law is designed to protect yours.

Last Updated: October 25, 2026

Status key: ✅ Enacted & in effect  |  🔵 Enacted – future effective date  |  🟡 Pending / in progress  |  🔴 Stalled or failed  |  ⚫ Session closed without passing

Federal Privacy Bill Tracker: Legislation & Status

Comprehensive Consumer Privacy Bills

🟡 SECURE Data Act (HR 8413) – Pending, House Committee

House Republicans’ big federal privacy push, introduced April 2026. The goal is to replace every state privacy law with one federal standard, which sounds clean until you realize it would wipe out stronger state laws that actually have enforcement teeth. Gives you the right to see, fix, delete, and download your data, and lets you opt out of your data being sold or used for targeted ads. Companies would need parental consent before collecting data on anyone under 16. The FTC and state AGs would enforce it, but you can’t sue companies yourself.
HR 8413 · Rep. John Joyce · House Energy & Commerce and Judiciary Committees · Introduced Apr 21, 2026 · Subcommittee hearing held Jun 3, 2026 · No further action

UPDATE Jun 2026: The House Subcommittee on Commerce, Manufacturing, and Trade held a formal hearing on HR 8413 on June 3, 2026, the first significant movement since introduction. The same week, a bipartisan coalition of state attorneys general from 44 states sent a letter to Congressional leadership opposing the bill’s preemption provisions, arguing federal law must set a floor not a ceiling. A companion bill was also introduced: the GUARD Financial Data Act (HR 8398), which would update the Gramm-Leach-Bliley Act’s financial privacy rules alongside SECURE Data Act passage.

🟡 Online Privacy Act of 2026 (HR 8014) – Pending, House Committee

A Democratic proposal that would create an entirely new federal agency, the Digital Privacy Agency, dedicated solely to enforcing your data rights. Goes after “behavioral personalization,” which is the technical term for platforms using algorithms to build a profile on you and manipulate what you see. Still sitting in committee with little momentum.
HR 8014 · Introduced Mar 19, 2026 · Rep. Lofgren · No further action

🟡 Consumer Data Privacy and Security Act of 2026 (S 4211) – Pending, Senate Committee

A Senate bill that gives you the right to know what data companies have on you, fix it if it’s wrong, and delete it. Also requires companies to actually secure your data and hold their vendors to the same standards. FTC enforces it. If the feds open a case against a company, states have to stand down, which is a red flag for anyone who thinks state enforcement is more reliable.
S 4211 · Mar 25, 2026 · Sen. Moran · Senate Commerce Committee

🔴 American Privacy Rights Act (APRA) – Failed, 118th Congress

A bipartisan bill that got further than most (it cleared committee in 2024) but never made it to a floor vote. Killed by fights over whether it would override California’s tougher privacy law and whether regular people should be able to sue companies directly. Congress changed hands after the 2024 election and the whole thing reset from scratch.

🔴 American Data Privacy and Protection Act (ADPPA) – Failed, 117th Congress

The first comprehensive federal privacy bill to actually clear a full committee: passed unanimously in 2022. Then it died. California didn’t want its stronger state law wiped out, and neither Republicans nor Democrats could agree on whether individuals should have the right to sue. It never got a floor vote.

Children’s Privacy & Online Safety, Federal

✅ TAKE IT DOWN Act – Signed into Law, May 2025

The only new federal privacy law passed in 2025. Makes it a crime to post or threaten to post intimate images of someone without their consent, including AI-generated fake images (deepfakes). Platforms have 48 hours to take down flagged content once someone reports it. Platforms had until May 19, 2026 to build and implement their removal systems. That deadline has now passed, meaning full enforcement is in effect.
Signed May 19, 2025 · Platform removal procedure compliance deadline: May 19, 2026 (now passed)

✅ COPPA Rule Amendments (FTC Final Rule) – In Effect

An update to the 1998 children’s privacy law. Tightens the rules on what companies can collect from kids under 13 and gives parents more control over how that data gets used and shared. Companies had until April 2026 to fully comply.
Effective Jun 23, 2025 · Full compliance deadline Apr 22, 2026

🟡 Kids Online Safety Act (KOSA, S 1748) – Passed Senate Commerce, Floor Passage Blocked Sep 30, 2026

Been bouncing around Congress since 2022. The Senate passed it 91–3 in 2024. That’s about as bipartisan as it gets. The House version waters it down considerably: where the Senate said platforms have a legal “duty of care” to protect kids, the House version just says platforms need “reasonable policies.” The House version (HR 6484) passed a subcommittee in December 2025 and was folded into the KIDS Act. On September 30, 2026, Sen. Blumenthal asked the Senate to pass S 1748 by unanimous consent and Sen. Rand Paul objected, so the bill now needs 60 votes on the floor. The Senate is out until November 9, so the earliest it can move is the lame-duck session.
Senate Commerce Committee passed unanimously Aug 5, 2026 · Unanimous consent blocked by Sen. Paul Sep 30, 2026 · House passed its own version (KIDS Act) Jun 29, 2026 · Reconciliation required

🟡 COPPA 2.0 (S 836) – Passed Senate, Held in House

Extends the existing children’s online privacy law to cover teens up to age 17, not just kids under 13. Would restrict how platforms collect and use teen data and limit targeted advertising aimed at minors. The Senate passed this version (S 836) by unanimous consent on March 5, 2026. It reached the House on March 16, 2026 and has been held at the desk there with no vote. The House’s own version (HR 6291) was folded into the KIDS Act instead.
S 836 · Sen. Markey · Passed Senate Mar 5, 2026 (unanimous consent) · Held at House desk since Mar 16, 2026

🟡 Don’t Sell Kids’ Data Act of 2025 (HR 6292) – Pending

Specifically targets data brokers, companies that buy and sell your information as a business. Would make it illegal for them to collect, use, or sell data on anyone under 18. If a data broker has a minor’s data, they have 10 days to delete it after a request.
HR 6292 · Introduced Nov 25, 2025 · Rep. Pallone · Forwarded by House Energy & Commerce subcommittee Dec 11, 2025

🟡 KIDS Act – Kids Internet and Digital Safety Act (HR 7757) – Passed House, Pending Senate (Uncertain)

The most significant development in federal children’s privacy this year. On June 22, 2026, Chairman Brett Guthrie (R-KY) and Ranking Member Frank Pallone (D-NJ) announced they had reached a bipartisan agreement on a single consolidated KIDS Act, a major shift from the partisan 28-24 committee vote on March 5, 2026. This is no longer a standalone bill; it now absorbs all 14 of the major child safety proposals from the December 2025 subcommittee package into one omnibus law. Component bills folded into the KIDS Act:

Notably absent from this list (still separate, standalone bills, see entries below): the App Store Accountability Act and Don’t Sell Kids’ Data Act of 2025, both of which remain controversial enough that they were not folded into the bipartisan deal. The bipartisan KIDS Act agreement significantly increases the odds of a House floor vote and eventual Senate consideration, something no children’s privacy package has achieved in the 119th Congress to date. 44 state attorneys general had filed a letter in May 2026 opposing the earlier partisan version over preemption concerns. Update June 29, 2026: The House passed the KIDS Act 267-117 in a decisive bipartisan vote, the most significant congressional advance on children’s online safety legislation in years. Senate sponsors of the original KOSA initially declared the House bill problematic because House leadership removed KOSA’s “duty of care” provision, the standard requiring platforms to prevent harm to minors. Update Aug 5, 2026: Rather than take up the House package directly, the Senate is moving its own children’s safety bills. The Senate Commerce Committee advanced its own version of KOSA plus a slate of children’s AI bills (see below), and the White House is reportedly working with Sen. Blackburn on a separate Senate package. The two chambers now have to reconcile competing approaches, with the duty-of-care question still the central dispute.
Bipartisan agreement Jun 22, 2026 · Passed House Jun 29, 2026 (267-117) · Referred to Senate Commerce Jul 13, 2026, no further Senate action · Duty of care still disputed

🟡 SAFE for Kids Act (S 4741) – Safety and Age Filtering Enforcement – Pending, Senate

Introduced June 10, 2026 by Sen. Jim Banks (R-IN). Requires commercial websites where more than one-third of the content is sexually explicit material harmful to minors to implement age verification before granting access. This is specifically an online pornography age verification bill, not a broad social media or general internet age verification law. The “commercial entities” language in the bill text is standard drafting, but the one-third-explicit-content threshold means it targets adult content sites, not social media platforms or general e-commerce. FTC enforcement through consumer protection law; DOJ may investigate knowing violations; private right of action for parents and guardians. Supported by Heritage Action, American Principles Project, Ethics and Religious Liberty Commission, and Concerned Women for America. The bill has significant legal tailwind: the Supreme Court upheld online pornography age verification requirements in Free Speech Coalition v. Paxton (2025), removing a major constitutional obstacle that had blocked earlier state versions of this type of law. Over 25 states have already enacted similar requirements at the state level. No House companion bill yet as of this update.
S 4741 · Introduced Jun 10, 2026 · Sen. Jim Banks (R-IN) · Referred to Senate Commerce Committee · No companion House bill yet

🟡 App Store Accountability Act (HR 3149) – Pending, Not Included in Bipartisan KIDS Act

Would require Apple and Google to verify a user’s age before letting minors download apps or make in-app purchases, putting the responsibility on the app store rather than individual apps. Forwarded by a House Energy & Commerce subcommittee in December 2025 and approved by the full committee 26-23 on March 5, 2026, but was deliberately excluded from the June 2026 bipartisan KIDS Act agreement. Some Democrats, including Rep. Jake Auchincloss, have called this proposal a “handout to Meta” since it shifts liability away from individual social media platforms onto Apple and Google. Several states (Texas, Utah, Louisiana) have already enacted similar laws (see the State Laws section below).
HR 3149 · Rep. John James · Approved by House Energy & Commerce 26-23 Mar 5, 2026 · Excluded from bipartisan KIDS Act deal Jun 2026

🟡 Sammy’s Law (HR 2657) – Pending, Not Included in Bipartisan KIDS Act

Would require large social media platforms to build real-time APIs that parents can use to delegate monitoring of their child’s account to third-party safety software companies. Drew criticism from privacy advocates (including the Center for Democracy and Technology) who argue it would expose children’s sensitive data to third-party actors with insufficient privacy safeguards and enable 24/7 monitoring of children’s private communications. Not included in the bipartisan KIDS Act deal.
HR 2657 · Reps. Wasserman Schultz and Carter (GA) · Forwarded by House Energy & Commerce subcommittee Dec 11, 2025

🟡 Senate Children’s AI Safety Package – Advanced from Committee Aug 5, 2026

On August 5, 2026, the Senate Commerce Committee ordered a slate of children’s online safety bills reported to the full Senate, marking the Senate’s own path separate from the House-passed KIDS Act. Combined with the GUARD Act (advanced earlier by the Senate Judiciary Committee), this represents the most significant federal movement on children’s AI safety to date. The four bills below now await full Senate floor votes.

🟡 GUARD Act (S 3062) – Advanced from Senate Judiciary

The Guidelines for User Age-verification and Responsible Dialogue Act, from Sens. Hawley (R-MO) and Blumenthal (D-CT) with 17+ bipartisan cosponsors. Advanced unanimously (22-0) from the Senate Judiciary Committee April 30, 2026. Bans AI companions for minors under 18, requires all chatbots to verify user age, mandates disclosure of non-human and non-professional status, and creates new criminal penalties for AI chatbots that engage minors in sexual content or encourage self-harm. The most aggressive of the federal chatbot bills. Critics (including NetChoice and Fight for the Future) warn the age-verification requirement could usher in broad online ID checks.
S 3062 · Advanced Senate Judiciary 22-0 Apr 30, 2026 · Placed on Senate calendar May 11, 2026 · Awaiting full Senate

🟡 Youth AI Privacy Act (S 4199) – Advanced from Senate Commerce

From Sen. Markey (D-MA). Requires AI chatbots available to minors to build in safe design features, disclose they are not human, ban advertising to minors through chatbots, and limit how long a chatbot can retain memory of a child’s interactions. A committee amendment from Chairman Cruz (adopted 15-13 along party lines) softened the original 30-day memory-retention cap by letting parents opt into longer retention.
S 4199 · Advanced Senate Commerce Aug 5, 2026 · Awaiting full Senate

🟡 CHATBOT Act (S 4407) – Advanced from Senate Commerce

From Sen. Cruz (R-TX). Requires AI chatbot providers to create family accounts and obtain verifiable parental consent before minors can use the service. Parents would be able to control privacy settings, time limits, and review conversation logs. Advanced by voice vote August 5, 2026.
S 4407 · Advanced Senate Commerce Aug 5, 2026 · Awaiting full Senate

🟡 Children’s Artificial Intelligence Toy Safety Act (S 5171) – Advanced from Senate Commerce

From Sens. Duckworth (D-IL) and Murkowski (R-AK). Directs the National Academies of Sciences, Engineering and Medicine to study the physical, mental, emotional, and social risks of AI-enabled toys for children, and requires the FTC and Consumer Product Safety Commission to prepare a joint action plan for Congress. A study-and-report bill rather than a regulatory mandate. Advanced by voice vote August 5, 2026.
S 5171 · Advanced Senate Commerce Aug 5, 2026 · Awaiting full Senate

Data Brokers, Federal

🟡 DELETE Act – Pending

Right now if you want data brokers to delete your information, you have to contact each one individually, and there are hundreds of them. This bill would force the FTC to build a single website where you submit one request and every registered data broker has to honor it. Also creates a permanent “do not track” list so they can’t collect your data going forward. Bipartisan bill reintroduced in 2025.
Reintroduced Apr 3, 2025 · Senate Commerce Committee

Federal AI Legislation, Privacy Implications

🟡 American Leadership in AI Act (HR 8516) – Pending

Introduced April 27, 2026 by Reps. Ted Lieu (D-CA) and Jay Obernolte (R-CA), bipartisan legislation consolidating over 20 standalone AI proposals from the Bipartisan AI Task Force. Nearly 200 pages covering AI standards, federal AI adoption, workforce impacts, cybersecurity, and R&D funding. Addresses AI-enabled crimes including deepfakes and fraud. Referred to seven House committees. Distinct from the Great American AI Act (see below).
HR 8516 · Introduced Apr 27, 2026 · Multiple committees

🟡 Great American AI Act (GAAIA) – Discussion Draft, Not Yet Formally Introduced

Released as a discussion draft on June 4, 2026 by Reps. Jay Obernolte (R-CA) and Lori Trahan (D-MA). At 269 pages, the most comprehensive federal AI governance framework proposed to date. Key provisions: requires large frontier AI developers (over $500M revenue) to undergo semi-annual third-party audits; establishes disclosure requirements; addresses workforce impacts; and, most controversially, would preempt state AI development laws for three years. That preemption provision would effectively freeze California, New York, and Illinois AI transparency laws during the preemption window. Still a discussion draft soliciting public feedback; not yet formally introduced as a bill. Democratic opposition emerged within hours of release, and it still had not been formally introduced as of late October 2026.
Discussion draft released Jun 4, 2026 · Obernolte/Trahan · Not introduced as of Oct 2026

🔴 AI Preemption Moratorium (10-year) – Dropped from Final Law

A 10-year moratorium on all state AI laws was inserted into the House version of the “One Big Beautiful Bill” budget reconciliation package (HR 1) and passed the House in a narrow 215-214 party-line vote on May 22, 2025. If enacted, it would have preempted every state AI law nationwide (California, Colorado, New York, Illinois, and 1,000+ pending state AI bills) for a decade. It faced fierce opposition including from some Senate Republicans (Sen. Blackburn argued states couldn’t stop protecting consumers while waiting for Congress to act) and faced a likely Byrd Rule challenge in the Senate. The moratorium was stripped from the bill before final passage. President Trump signed the final One Big Beautiful Bill into law on July 4, 2025, without the AI moratorium. States remain free to regulate AI. The Great American AI Act (discussion draft, see above) now proposes a narrower 3-year preemption instead.
HR 1 · House passed May 22, 2025 · Stripped by the Senate 99-1 on Jul 1, 2025 · Not enacted

🟡 Senior Chatbot Protection Act of 2026 (S 5117) – Pending, Senate Commerce

From Sens. Mark Kelly (D-AZ) and Jim Justice (R-WV). Would require AI chatbots and voice assistants to clearly say they are AI and not a person or licensed professional, add safeguards for sensitive conversations such as health care, estate planning, or a crisis, and limit deceptive design aimed at older users.
S 5117 · Introduced Jul 23, 2026 · Senate Commerce

🟡 AI Emergency Button Act (S 5417) – Pending, Senate Commerce

Sen. John Kennedy’s “kill switch” bill would require AI systems to include a way for a human operator to shut them down. Kennedy asked the Senate to pass it by unanimous consent the day he introduced it, and Sen. Rand Paul objected, arguing Congress should understand the technology before regulating it. A House companion (HR 10567) was filed September 24, 2026.
S 5417 · Sen. Kennedy · Introduced Sep 16, 2026 · Unanimous consent blocked by Sen. Paul Sep 16, 2026

🟡 AI Risk Management and Security Act of 2026 (S 5576) – Pending, Senate

From Sens. Warner, Schatz, and Kim. Would create a permanent AI Safety Board in the Commerce Department, give it 45 days of pre-release access to frontier AI models, and require incident reporting. Sen. Cruz blocked a unanimous consent request the day it was introduced. Cruz and Sen. Klobuchar have said there will be no Commerce Committee AI markup before the election.
S 5576 · Introduced Sep 29, 2026 · Unanimous consent blocked by Sen. Cruz Sep 29, 2026

🟡 NO FAKES Act of 2026 (S 4591) – On Senate Calendar, Floor Passage Blocked

Creates a federal right over digital replicas of your voice and likeness, aimed at AI deepfakes made without permission. Bipartisan, led by Sens. Coons and Blackburn. The Senate Judiciary Committee reported it June 24, 2026. On September 30, 2026, Blackburn asked for passage by unanimous consent and Sen. Cruz objected.
S 4591 · Reported by Senate Judiciary Jun 24, 2026 · Unanimous consent blocked by Sen. Cruz Sep 30, 2026

Executive Order on State AI Laws and the DOJ AI Litigation Task Force – Signed December 11, 2025. President Trump’s executive order “Ensuring a National Policy Framework for Artificial Intelligence” directs the Justice Department to challenge state AI laws in court, has the Commerce Department list state laws it considers “onerous,” and ties some federal broadband funding to state AI policy. DOJ formed an AI Litigation Task Force in January 2026 and made its first court move on April 24, 2026, intervening in xAI v. Colorado against Colorado’s original AI Act. A non-binding White House framework released in March 2026 asks Congress to preempt state AI laws. No new DOJ suit against a state AI law has been reported since September 1, 2026. An executive order cannot preempt state law on its own; only Congress or the courts can.

FTC Investigation of Frontier AI Companies – The FTC confirmed on September 30, 2026 that it is investigating leading AI developers, and sent civil investigative demands (compulsory requests for records) to OpenAI and Anthropic on October 14, 2026. The consumer protection probe covers AI safety incidents, safeguards, marketing, and privacy policies. It is an investigation, not a finding of wrongdoing.

🟡 AI Accountability and Personal Data Protection Act (S 2367) – Pending, Senate Judiciary

Introduced by Sen. Josh Hawley (R-MO) and Sen. Richard Blumenthal (D-CT), an unusual right-left pairing that reflects genuine bipartisan anger at Big Tech. This is the only federal bill in the 119th Congress that would create a direct federal tort, a legal cause of action, against any company that collects, processes, sells, or exploits your personal data without your express, prior consent. Unlike most privacy bills that rely on the FTC to enforce rules, this one lets you sue directly. Consent buried in a privacy policy or user agreement does not count. It must be specific, affirmative, and informed. Does not preempt existing state privacy laws.
S 2367 · Sen. Hawley, Blumenthal · Referred to Senate Judiciary · 119th Congress

Government Surveillance & Warrantless Data Access, Federal

This is the section of federal privacy law that matters most if you believe the biggest threat to your data isn’t corporations, it’s government. The bills below would restrict the federal government’s ability to access your personal data without a warrant. Three specifically target the practice of law enforcement and intelligence agencies simply buying your data from data brokers, bypassing the Fourth Amendment entirely. The Supreme Court handed down a landmark ruling on geofence warrants on June 29, 2026, making this the most active area of federal privacy litigation right now.

✅ Chatrie v. United States – Supreme Court Ruling, June 29, 2026

In one of the most significant Fourth Amendment rulings in years, the Supreme Court held 6-3, in an opinion by Justice Kagan, that police obtaining a person’s Location History from Google is a “search” under the Fourth Amendment. The Court did not decide whether the specific geofence warrant in this case was valid; it sent that question back to the Fourth Circuit. Geofence warrants allow law enforcement to demand that companies like Google hand over data on every device in a geographic area during a specific time window, sweeping in hundreds or thousands of people with no connection to the crime being investigated. The ruling directly limits government location data collection and gives the pending surveillance reform bills below significant legal tailwind.
Chatrie v. United States, No. 25-112 · Supreme Court · Decided Jun 29, 2026 · Warrant question remanded to the Fourth Circuit

🔴 FISA Section 702 – Statutory Authority Lapsed Jun 12, 2026

Section 702 is the law that lets US intelligence agencies collect the communications of foreigners abroad without a warrant, and in the process sweeps in large amounts of Americans’ emails, texts, and calls. The 2024 reauthorization expired in April 2026. After two short extensions, the House passed a three-year renewal 235-191, the Senate fell short 47-52, and the House rejected a three-week stopgap. The law lapsed June 12, 2026 for the first time since 2008. Collection continues under court-approved certifications through March 2027, so the practical effect is limited for now. Expect a reauthorization fight in the lame-duck session, with warrant requirements for searching Americans’ data as the central dispute.
Lapsed Jun 12, 2026 · Collection continues under existing certifications through Mar 2027 · Lame-duck reauthorization expected

🟡 Government Surveillance Reform Act of 2026 (S 4082) – Pending, Senate Judiciary

Introduced by Sen. Ron Wyden (D-OR) with bipartisan co-sponsors Sen. Mike Lee (R-UT), Sen. Elizabeth Warren (D-MA), and Sen. Cynthia Lummis (R-WY). The most comprehensive federal surveillance reform bill in the 119th Congress. Would require warrants before law enforcement can access your location information, web browsing records, and search query history. Critically, also bans federal law enforcement and intelligence agencies from simply buying your personal data from commercial data brokers to get around warrant requirements, a loophole the CIA’s former Deputy Director once said produced intelligence so sensitive “you would keep it Top Secret” if it had been collected through traditional methods. Includes protections for car data, metadata, and third-party service provider data.
S 4082 · Sen. Wyden, Lee, Warren, Lummis · Senate Judiciary Committee · Introduced Mar 2026

🟡 Protect Liberty and End Warrantless Surveillance Act of 2026 (HR 7816) – Pending, House Judiciary

The House companion to the Senate surveillance reform effort. Includes Title II, the “Fourth Amendment Is Not For Sale Act,” which specifically prohibits law enforcement and intelligence agencies from purchasing personal data from data brokers. The same provision passed the House Judiciary Committee unanimously in the previous Congress but stalled before a floor vote. Also includes FISA reform and geofence warrant restrictions.
HR 7816 · Rep. Andy Biggs · House Judiciary and Intelligence Committees · Introduced Mar 5, 2026

🟡 Surveillance Accountability Act (HR 8470) – Pending, House Judiciary

Introduced by Reps. Thomas Massie (R-KY) and Lauren Boebert (R-CO). Would require a warrant for any government search that significantly impinges on privacy, including accessing data, metadata, or personal information held by banks, telecoms, internet providers, cloud storage, or data brokers. Closes the “third-party doctrine” loophole that lets agencies argue data loses Fourth Amendment protection once it’s shared with any company. Creates a private right of action: you can sue the government directly for violations. The most expansive of the three surveillance bills; least likely to advance but sets a marker for what genuine surveillance reform would look like.
HR 8470 · Reps. Massie, Boebert · House Judiciary · Introduced Apr 2026

Facial Recognition & Biometric Surveillance, Federal

The federal government has no comprehensive law governing how it uses facial recognition technology. The Trump administration has been aggressively expanding biometric surveillance: DHS is consolidating facial recognition across CBP, ICE, USCIS, and TSA into a single centralized matching engine while simultaneously removing internal oversight directives. A May 1, 2026 Congressional Research Service report documented the expansion without a single law in place governing it. Four bills are pending:

🟡 Facial Recognition Act of 2025 (HR 4695) – Pending, House Judiciary

Introduced by Rep. Ted Lieu with bipartisan cosponsors. Would regulate law enforcement use of facial recognition technology: requires annual accuracy and bias testing by NIST, training standards for human operators, and a prohibition on using facial recognition for mass “face surveillance” (tracking people without suspicion). A facial recognition match alone cannot establish probable cause; corroborating evidence is required. Does not ban law enforcement facial recognition outright; sets guardrails.
HR 4695 · Reps. Lieu, Clarke, Gomez · House Judiciary and Science Committees · Introduced Jul 23, 2025

🟡 Traveler Privacy Protection Act of 2025 (S 1691) – Pending, Senate Commerce

Bipartisan bill introduced by Sens. Merkley, Kennedy, Markey, Marshall, Van Hollen, and Daines. Would ban TSA and DHS from capturing or storing biometric data from airline passengers without explicit congressional authorization. Allows limited opt-in use at Trusted Traveler checkpoints only, with mandatory opt-out option, clear signage, and zero penalty for passengers who decline. Bans passive surveillance and tracking outside the screening location.
S 1691 · Bipartisan · Senate Commerce, Science & Transportation · Introduced May 2025

🟡 Federal Government Facial Recognition Prohibition (HR 3782) – Pending, House

Would prohibit the federal government from using facial recognition as a means of identity verification for general purposes, a broader restriction than the Traveler Privacy Protection Act. In response to DHS’s removal of its internal facial recognition oversight directive in February 2025.
HR 3782 · Rep. Andrew Ogles · House Oversight Committee · Introduced Jun 5, 2025

🟡 ICE Out of Our Faces Act (S 3779) – Pending, Senate

Introduced February 2026. Would ban ICE and CBP from using biometric surveillance systems including facial recognition for monitoring individuals. Introduced in direct response to the Trump administration granting ICE expanded access to new facial recognition tools and extending some access to CBP officers assisting with removal operations.
S 3779 · Sen. Markey · Introduced Feb 4, 2026 · Senate Homeland Security and Governmental Affairs · House companion HR 7363

🟡 Buzz Off Act (HR 96), Drone Surveillance Prohibition – Pending, House

Would prohibit federal agencies from using drones to conduct surveillance of US citizens. Introduced in the first days of the 119th Congress reflecting ongoing concerns about warrantless aerial surveillance.
HR 96 · Rep. Andy Biggs · House Judiciary · Introduced Jan 3, 2025

Financial Privacy, Federal

🟡 GUARD Financial Data Act (HR 8398) – Pending, House Financial Services

Introduced alongside the SECURE Data Act on April 21, 2026. Would update the 1999 Gramm-Leach-Bliley Act (GLBA), the foundational financial privacy law, to modernize how banks, insurance companies, and financial service firms handle your personal information. Designed to work in tandem with the SECURE Data Act as a unified federal privacy framework covering both general consumer data and financial data specifically. Faces the same state AG opposition as the SECURE Data Act due to preemption concerns.
HR 8398 · Rep. Bill Huizenga · House Financial Services Committee · Introduced Apr 21, 2026 · No further action

Government Privacy, Federal

🟡 Privacy Act Modernization Act of 2025 (S 1208) – Pending

Updates the 1974 law governing how the federal government handles your personal data. Currently only protects US citizens and green card holders. This expands it to everyone physically in the country. Limits what agencies can do with your data and stiffens the criminal penalties for misuse. One notable provision: it kicks in immediately for the Department of Government Efficiency (DOGE) and similar temporary government operations, rather than waiting the usual two years.
S 1208 · Sen. Wyden · Referred to Senate Homeland Security and Governmental Affairs Mar 31, 2025 · No further action

Existing Federal Sectoral Privacy Laws, In Effect

Law What It Covers Who Enforces
HIPAA (1996) Controls how doctors, hospitals, and insurance companies handle your medical records. They have to keep your health data private, secure it properly, and tell you if there’s a breach. Critically, it does NOT cover health apps, fitness trackers, or any company that isn’t a traditional healthcare provider. That’s a massive gap. HHS Office for Civil Rights
COPPA (1998) Websites and apps can’t collect personal information from kids under 13 without a parent’s permission. If a site knows it’s talking to a child, it has to get parental consent first. Updated by the FTC in 2025 with stricter rules. FTC
GLBA (1999) Banks and financial institutions have to tell you what data they collect and share, and give you a way to opt out of some of it. Also requires them to have real security programs protecting your financial data. Weak by modern standards but still the baseline for the finance industry. FTC and financial regulators
FCRA (1970) Governs credit reports, background checks, and tenant screening. You have the right to see what’s in your file, dispute errors, and know when it’s being used against you. One of the few federal privacy laws with real teeth for individuals. FTC and CFPB
FERPA (1974) Schools can’t share your kid’s education records without your permission. Parents can see their child’s records and challenge anything that’s wrong. Once a student turns 18, those rights transfer to them. Applies to any school that gets federal funding, so basically all of them. US Dept. of Education
VPPA (1988) Video services can’t share your viewing history without your consent. Passed in 1988 after a reporter published Supreme Court nominee Robert Bork’s video rental records. Has become surprisingly relevant again as streaming platforms and news sites embed Facebook/Google trackers that share what videos you watch. Private right of action (you can sue)
ECPA (1986) Requires law enforcement to get a warrant before accessing your private electronic communications and stored data. Written in 1986 when email barely existed, widely considered dangerously outdated for the modern digital world. Reform efforts have been going nowhere for years. DOJ / Courts

State Privacy Bill Tracker: Comprehensive Laws (Enacted)

As of October 2026, 23 states have enacted comprehensive consumer privacy laws, counting the way most trackers do, which leaves out Florida’s much narrower Digital Bill of Rights (listed below anyway). Nineteen are in effect, and four were enacted this year: Oklahoma, Alabama, and Louisiana (taking effect in 2027) and Vermont (2028). Georgia is not on the list: the bill once reported as Georgia’s privacy law was rewritten into an unrelated tax bill before it passed (see the note below the 2027 table). Most of these laws look similar on paper, they give you the right to see, correct, delete, and download your data, and to opt out of your data being sold. The real differences are in how aggressive the enforcement is, whether you can sue companies yourself, and how many businesses the law actually covers.

Currently In Effect

State & Law Plain English Summary Effective Date
California
CCPA / CPRA		 The strongest state privacy law in the country. California has its own dedicated privacy enforcement agency (CPPA) that can go after companies independently. Covers not just consumers but also employees and job applicants. Includes rules on automated decision-making, data brokers, and sensitive data. Sets the standard everything else gets compared to. CCPA: Jan 1, 2020
CPRA: Jan 1, 2023
Virginia
Consumer Data Protection Act (VCDPA)		 The template most other states copied. Basic consumer rights to access, fix, delete, and opt out of data sales. Only the Attorney General can enforce it. You can’t sue a company yourself. Applies to businesses that handle data on 100,000+ Virginians, or 25,000+ if selling data is a major revenue source. 2026 update: Governor Spanberger signed SB 338 on April 13, 2026, adding a hard ban on the sale of precise geolocation data, effective July 1, 2026. Virginia becomes the third state with this prohibition (after Maryland and Oregon). Jan 1, 2023
Colorado
Colorado Privacy Act (CPA)		 Similar to Virginia but with a notable addition: companies must honor the Global Privacy Control signal, a browser setting that automatically tells sites not to sell your data. One of a handful of states requiring this. AG enforces it; same 100,000 consumer threshold as Virginia. 2025 update: A June 2025 amendment added precise geolocation data (pinpointing you within roughly 1,850 feet) to the law’s definition of sensitive data, meaning companies now need your explicit consent before processing or selling it. Jul 1, 2023
Connecticut
Data Privacy Act (CTDPA)		 Closely follows Virginia and Colorado. Has required businesses to honor universal opt-out signals like Global Privacy Control since January 1, 2025. SB 4 (2026) added data broker registration, signed May 27, 2026. Major July 1, 2026 update (Public Act 25-113): Connecticut’s applicability threshold dropped dramatically from 100,000 consumers to just 35,000. Two new no-threshold triggers were added: any business that sells personal data (even one resident’s record) is now covered, and any business that processes sensitive data from any Connecticut resident is covered regardless of volume. The blanket exemption for financial institutions was narrowed to certain banks, credit unions, insurers, and broker-dealers, though data already covered by federal financial privacy law (GLBA) is still exempt. Sensitive data now includes neural data, mental and physical disability status, and new health categories, minors’ protections now run to age 18, and privacy notices must disclose whether personal data is used to train large language models. These changes make Connecticut’s law one of the broadest in the country by applicability scope. Jul 1, 2023
Utah
Consumer Privacy Act (UCPA)		 The most business-friendly of the first batch of state laws. Does not require honoring browser opt-out signals. No requirement for companies to conduct privacy risk assessments. Applies only to businesses making $25M+ per year. Light on obligations, light on enforcement. July 1, 2026 update (HB 418, 2025, Utah Digital Choice Act): Amendments add a right to correction and new requirements for social media data portability and interoperability. Dec 31, 2023
Texas
Data Privacy and Security Act (TDPSA)		 Unusually broad: applies to any business operating in Texas or targeting Texas consumers, with no minimum revenue requirement. The Texas AG has shown it means business, mainly under the state’s biometric and deceptive trade practices laws rather than the TDPSA itself: it secured a $1.4B settlement against Meta (July 2024, biometric data) and a $1.375B settlement against Google (May 2025, geolocation/biometric data), the two largest privacy settlements ever obtained by a single state AG. Small businesses mostly exempt. Jul 1, 2024
Florida
Digital Bill of Rights (FDBR)		 Narrowly written to only hit the very biggest tech companies, those making over $1 billion a year with most of that from online ads. In practice, this means only a handful of companies like Google, Meta, and Amazon are affected. Everyone else is exempt. First enforcement action: On October 14, 2025, Florida AG James Uthmeier filed the state’s first FDBR action against Roku, alleging it collected and sold children’s viewing habits, voice recordings, and sensitive personal data without authorization or meaningful notice. Civil penalties under the FDBR can reach $150,000 per violation involving children. Separately, Florida’s 2024 social media law for minors (HB 3), challenged in CCIA and NetChoice v. Uthmeier, became enforceable after the Eleventh Circuit reversed the preliminary injunction on October 14, 2026. The case continues. Jul 1, 2024
Montana
Consumer Data Privacy Act (MCDPA)		 Virginia-style law adjusted for Montana’s smaller population. Standard consumer rights to access, fix, delete, and opt out. 2025 amendment (SB 297, effective Oct 1, 2025): Lowered the threshold to 25,000 Montana consumers (15,000 if more than 25% of revenue comes from selling data), added children’s privacy provisions, and removed the cure period, so violations are immediately enforceable. Oct 1, 2024
Oregon
Consumer Privacy Act (OCPA)		 Covers more people than most states: includes employees and job applicants, not just customers. Oregon’s AG has been active: published a detailed report on enforcement actions in 2025. Nonprofit organizations were added to coverage in July 2025. Jan 1, 2026 updates (HB 2008): Oregon now prohibits the sale of personal data when a controller knows or willfully disregards that a consumer is under 16. Also bans the sale of precise geolocation data within a 1,750-foot radius, among the strictest geolocation protections of any state. Oregon joined the universal opt-out mechanism states (requiring businesses to honor Global Privacy Control) on Jan 1, 2026. Oregon’s 30-day cure period also expired on January 1, 2026. Violations are now immediately enforceable without a grace period. Jul 1, 2024
Delaware
Personal Data Privacy Act (DPDPA)		 Standard Virginia-model law with lower thresholds for a smaller state: covers businesses handling data on 35,000+ Delaware residents. A 2026 amendment (HB 380), signed by Governor Meyer on September 2, 2026, lowers the threshold to 15,000 consumers, narrows the financial institution exemption to banks, insurers, and their affiliates, and adds contract and due-diligence rules for third parties, effective January 1, 2027. Note: Delaware’s 60-day cure period ended December 31, 2025. Violations are now immediately enforceable without a grace period. Jan 1, 2025
Iowa
Consumer Data Protection Act (ICDPA)		 One of the weakest state privacy laws on the books. Notably, it does not give you the right to delete or correct data that a company got from a third party, only data they collected directly from you. Very business-friendly; privacy advocates consider it mostly symbolic. Jan 1, 2025
New Hampshire
Privacy Act (NHPA)		 Virginia-style law scaled to New Hampshire’s population. Covers businesses handling data on 35,000+ residents. 60-day cure period. 2026 amendment (HB 1460): Signed June 19, 2026. Prohibits controllers from selling the personal data of children under 13. Effective January 1, 2027. Jan 1, 2025
New Jersey
Data Privacy Act (NJDPA)		 Follows Virginia with some Connecticut-style additions. Covers businesses handling data on 100,000+ New Jersey residents. Jan 20, 2026: Outgoing Governor Phil Murphy signed A 5017, amending the law to add targeted new exemptions before leaving office. Note: New Jersey’s cure period ended July 1, 2026, so violations are now immediately enforceable. 2026 additions: Governor Mikie Sherrill signed a major data broker law on June 30, 2026 (A 5328, see Data Broker Registration Laws below), the NJ Kids Code Act on August 11, 2026, and the Fair Price Protection Act, which bans surveillance pricing for groceries, on July 23, 2026 (both in the Children’s Privacy and 2026 activity sections below). Jan 15, 2025
Nebraska
Data Privacy Act (NDPA)		 Standard Virginia-model law. Covers businesses handling data on 100,000+ Nebraskans, or 25,000+ if at least a quarter of their revenue comes from selling data. Jan 1, 2025
Tennessee
Information Protection Act (TIPA)		 Business-friendly law with one unique requirement: companies must align their security practices with recognized frameworks like NIST. Applies only to businesses making $25M+ per year with 175,000+ Tennessee customers. AG enforcement only. Jul 1, 2025
Maryland
Online Data Privacy Act (MODPA)		 One of the toughest state laws passed so far. Companies can only collect data they actually need for the specific reason they stated, no hoarding for future use. Applies to businesses handling data on 35,000+ Maryland residents. Considered a significant step up from the Virginia template. 2026 amendment (HB 711, Ch. 874): Became law May 31, 2026 without the Governor’s signature, effective July 1, 2026. Bars companies from knowingly selling personal data to government agencies involved in civil immigration enforcement, and requires public-records custodians to check whether records are being sought for that purpose. Oct 1, 2025
Minnesota
Consumer Data Privacy Act (MCDPA)		 Stronger than most Virginia-copy laws. You can request a list of every third party your data was shared with. That’s rare. Also requires honoring browser opt-out signals and has broader biometric data definitions (includes data pulled from photos and videos). Covers businesses handling data on 100,000+ Minnesotans. Note: Minnesota’s 30-day cure period expired January 31, 2026. Violations are now immediately enforceable without a grace period. Jul 31, 2025
Indiana
Consumer Data Protection Act (INCDPA – IN SB 5)		 A close copy of Virginia’s law. Business-friendly with a short 30-day window for companies to fix violations before facing fines. Covers businesses handling data on 100,000+ Indiana residents. Jan 1, 2026
Kentucky
Consumer Data Protection Act (KCDPA – KY HB 15)		 Essentially the same as Virginia’s law. AG enforces it, no personal lawsuits allowed. A 2026 amendment (HB 692, effective July 1, 2027) requires your consent before companies collect automatic content recognition data from smart TVs and monitors, the technology that tracks what you watch. Jan 1, 2026
Rhode Island
Data Transparency & Privacy Protection Act (RIDTPPA – HB 7787 / SB 2500)		 Virginia-style law with one standout difference: no grace period. Most state laws give companies 30–60 days to fix violations before being fined. Rhode Island doesn’t. Get caught, get fined immediately. Covers businesses handling data on 35,000+ Rhode Island residents. Jan 1, 2026

Enacted, Effective 2027

State & Law Plain English Summary Effective Date
🔵 Oklahoma
Consumer Data Privacy Act – SB 546		 Oklahoma tried and failed to pass a privacy law for nearly a decade. Signed March 20, 2026. Business-friendly version that mirrors Virginia and Texas: companies get a chance to fix violations before being fined. Covers businesses handling data on 100,000+ Oklahomans, or 25,000+ if selling data is a major revenue source. Jan 1, 2027
🔵 Alabama
Personal Data Protection Act – HB 351		 Passed both chambers without a single no vote (104-0 in the House, 34-0 in the Senate). Signed in April 2026. Has one of the lowest coverage thresholds in the country: it applies to any company with data on more than 25,000 Alabamians, or any company that makes more than 25% of its money selling data regardless of how many people it affects. AG enforces it with fines up to $15,000 per violation, after a 45-day window to fix violations. No private lawsuits allowed. Enacted April 17, 2026. May 1, 2027
🔵 Louisiana
Louisiana Data Privacy Act – SB 386 (Act No. 502)		 Signed into law by Governor Jeff Landry on May 29, 2026, making Louisiana the 22nd state with a comprehensive privacy law and the third to enact one in 2026 (following Oklahoma and Alabama). Largely tracks Texas’s TDPSA framework. Covers businesses with $25M+ in annual revenue, or that handle data on 75,000+ Louisiana consumers, or that earn 50%+ of revenue from selling data. Requires consent before processing sensitive data. AG enforcement only, with a 30-day window to fix violations through July 31, 2027. Note: a version that would have named AI systems in processor-duty language was stripped before signing. Louisiana nearly became the second state (after Texas) to explicitly regulate AI in a privacy law’s processor obligations. 🔵 Act 502 · Signed May 29, 2026 · Effective Jan 1, 2027
Vermont
Vermont Data Privacy and Online Surveillance Act		 Signed by Governor Phil Scott on June 16, 2026, Vermont’s fourth comprehensive privacy state of 2026, after Oklahoma, Alabama, and Louisiana. This is Vermont’s second attempt: a 2024 version (H.121) was vetoed by Scott and the Senate couldn’t override it. This year’s bill is more business-friendly and closely tracks the 2025 Connecticut model. Unusually low thresholds: applies to businesses processing data of 35,000+ Vermont consumers, OR the sensitive data of just 3,000+ consumers, OR offering for sale the data of 3,000+ consumers. Consumer health data provisions apply even more broadly than the general thresholds. 🔵 Act 145 · Signed Jun 16, 2026 · Effective Jan 1, 2028

Note on Georgia: Georgia SB 111 (Act 462) was widely reported in 2026 as the “Georgia Consumer Privacy Protection Act,” and the Governor’s signed-bill list still uses that caption. The bill text the Governor’s office posts for SB 111, however, contains only rural hospital tax credit provisions and no consumer privacy provisions. The privacy language was replaced before final passage. Georgia does not have a comprehensive consumer privacy law. Its 2026 chatbot law (SB 540) is listed in the chatbot section below.

State Laws, Sectoral & Specialized (Enacted)

Biometric Privacy Laws

State & Law Plain English Summary Status
Illinois
Biometric Information Privacy Act (BIPA)		 The most powerful privacy law in the US for individual lawsuits. If a company scans your fingerprint, face, or iris without written consent, you can sue them directly: $1,000 per accident, $5,000 if they did it on purpose. Facebook/Meta paid $650M (2020), TikTok paid $92M (2021), BNSF Railway faced a $228M jury verdict (first BIPA jury trial). Companies are terrified of this law. Illinois softened it slightly in 2024 after the potential exposure became enormous, but it still has teeth no other law matches. ✅ Enacted 2008, amended 2024. Actively enforced.
Texas
Capture or Use of Biometric Identifier (CUBI)		 Companies must tell you and get your consent before capturing your biometrics for commercial purposes. Can’t sell your biometric data without permission. Only the AG can enforce it. You can’t sue on your own. Texas AG has brought enforcement actions. ✅ Enacted 2009. Actively enforced by AG.
Washington
Biometric Identifiers (RCW 19.375)		 Requires consent before enrolling your biometric data in a commercial database. No selling or sharing without permission. No private lawsuits, only state enforcement. ✅ Enacted 2017.
Arkansas
Personal Information Protection Act, biometric amendment (Act 1030 of 2019)		 Adds biometric data (fingerprints, faceprints, DNA, and similar) to the personal information Arkansas businesses must secure and report if breached. It does not require consent before collection and has no private right of action. Much weaker than Illinois BIPA. ✅ Enacted 2019.
Colorado
Biometric Privacy Amendments (HB 24-1130)		 2024 update to Colorado’s privacy law that extended biometric protections to more types of businesses and added protections for employee biometric data, not just customer data. ✅ Signed May 31, 2024 · Effective Jul 1, 2025.

Consumer Health Data Laws & Other State Privacy Statutes

✅ Washington – My Health MY Data Act (MHMDA)

This one gets called “BIPA 2.0” for a reason. It covers health data that HIPAA misses entirely: your fitness tracker, your period app, your mental health app, any website that detects you’re near a healthcare facility. If a company processes health-related data about Washington residents and they’re not a traditional healthcare provider, this law applies to them. You can sue companies directly for violations, which is rare and makes this law genuinely feared by tech companies. First class-action lawsuit was filed in 2025.
Effective Mar 31, 2024 · Private right of action

✅ Nevada – Consumer Health Data Privacy Law (SB 370, 2023)

Similar to Washington’s law, it covers health data that falls through HIPAA’s cracks, like apps and wellness platforms. Requires consent before collecting or sharing your health data. Unlike Washington, you can’t sue companies yourself here, only state enforcement. No public enforcement actions have happened yet as of 2025.
Effective Mar 31, 2024

✅ Connecticut – Health and Online Safety Provisions (Public Act 23-56)

Added health data protections and children’s online safety rules on top of Connecticut’s existing privacy law. Prohibits geofencing around health facilities, requires consent for consumer health data, and adds children’s social media protections.
Effective Oct 1, 2023

✅ California – Consumer Health Data Privacy Law (AB 45)

Specifically protects data collected from people at or near reproductive health clinics and family planning centers. Passed after the Dobbs decision raised real concerns about location data being used to identify and prosecute people seeking certain medical services.
Effective Jan 1, 2026

✅ Nevada – Revised Statutes Chapter 603A

Nevada’s older, separate online privacy law that predates the wave of comprehensive state laws. Gives you the right to tell websites not to sell your personal information and requires them to respond within 60 days (extendable by 30). A separate provision gives you the same opt-out right against data brokers. AG enforcement, up to $5,000 per violation, no private lawsuits. Narrower than a full privacy law but still applies to any business with Nevada customers.
Enacted 2017, later expanded

✅ West Virginia – SB 84, Police Surveillance Cameras on Private Land – In Effect

Police may not put a surveillance camera, including a game camera, on private land to gather evidence against the owner or occupant without the owner’s consent or a warrant. Exceptions cover cameras placed where an officer is lawfully present and pointed at areas open to public view, and emergencies. “Private land” means posted, cultivated, or fenced land, so open unposted land is not covered. Passed unanimously in both chambers.
Ch. 200 · Approved Mar 14, 2026 · Effective Jun 4, 2026

🔵 Wyoming – SF 20, Government Data Privacy – Signed, Phased In 2027-2029

Government entities in Wyoming (other than law enforcement and the courts) must adopt personal-data policies, collect only what they need, and generally keep it no longer than three years. Residents can see and dispute data held about them. Government may not buy, sell, or trade residents’ personal data without written consent, with limited exceptions. One of the few state laws aimed at government data collection rather than businesses.
Ch. 48 · Signed Mar 6, 2026 · Policy duties begin Jul 1, 2027 (state agencies), 2028 (counties, cities, colleges), 2029 (other subdivisions)

Data Broker Registration Laws

✅ California – Delete Act (SB 362)

Data brokers, companies whose entire business is buying and selling your personal information, are required to register with California’s privacy agency. The bigger deal: California is building a single website where you can opt out of every registered data broker at once, instead of hunting them down individually. The DROP portal (Delete Request and Opt-out Platform) launched January 1, 2026. More than 560,000 Californians had signed up by October 2026, covering 660+ registered data brokers, and brokers began processing those deletion requests August 1, 2026. A 2026 law (AB 883) makes brokers check the list every 30 days instead of 45. The state privacy agency, now branded CalPrivacy, has started fining brokers, including LocateSmarter ($116,490, August 2026), Cybba ($52,400), and SalesIntel Research ($36,400). A 2025 expansion law (CA SB 361) requires data brokers to disclose significantly more about what they collect and who they sell to, including whether data is sold to foreign actors, federal or state governments, or generative AI developers.
Enacted 2023 · DROP portal live Jan 1, 2026 · Brokers processing requests since Aug 1, 2026 · SB 361 disclosures also effective 2026

✅ Vermont – Data Broker Law (Act 171)

The first data broker registration law in the US, passed in 2018. Data brokers have to register annually with the state and disclose what they collect and who they sell it to. Doesn’t give you a way to opt out, but at least makes the industry visible. 2026 amendment (H.211, enacted as Act 138): Signed by Governor Scott June 16, 2026. Raises the annual registration fee from $100 to $900, adds a $20,000 surety bond requirement, expands the definitions of “data broker,” “brokered personal information,” and “sale” (potentially sweeping in businesses that didn’t consider themselves brokers), adds data breach notification duties, and requires brokers to honor individual deletion requests within 30 days. The Senate stripped a proposed universal one-stop deletion portal, replacing it with a feasibility study. Most provisions effective January 1, 2027.
Enacted 2018 · Amended by Act 138 (H.211), signed Jun 16, 2026 · Amendments effective Jan 1, 2027

✅ New Jersey – Data Broker and Data Collector Law (A 5328) – Signed Jun 30, 2026

One of the most aggressive data broker laws in the country. Covers data brokers and also “data collectors,” companies with a direct customer relationship that sell data to brokers. Registration fees run from $5,000 up to $1.5 million for the largest brokers, and selling sensitive data is banned, with penalties up to $50,000 per record. The law took effect on signing, but the registry itself does not start for 270 days, and state regulators have said registration will not be required until 2027. It replaced the earlier S 2316 / S 4109 bills.
A 5328 · Signed Jun 30, 2026 (P.L.2026, c.25) · Registration expected 2027

✅ Texas – Data Broker Registration (SB 2105)

Data brokers operating in Texas must register with the Secretary of State ($300 fee), post a notice on their websites, and maintain a security program. Unlike California, it does not give you a general right to opt out of data broker sales.
SB 2105 · Effective Sept 1, 2023 · Applies to data from Dec 1, 2023

✅ Montana – SB 282, Law Enforcement Data Broker Prohibition – In Effect

Signed May 5, 2025, making Montana one of the first states to close the loophole that lets law enforcement buy citizens’ personal data from data brokers, getting around the warrant requirement. Under this law, Montana law enforcement must obtain a warrant before accessing personal data that data brokers have collected about Montana citizens, even if the broker is willing to sell it voluntarily. Directly addresses the same loophole that the federal Government Surveillance Reform Act (S 4082) is trying to close at the national level.
Signed May 5, 2025 · In Effect · Montana

✅ Oregon – Data Broker Registration (HB 2052)

Requires data brokers to register with Oregon’s Department of Consumer and Business Services and disclose what data they collect and sell. Part of Oregon’s broader privacy law package.
Effective Jan 1, 2024

Children’s Privacy, State Laws

🔵 Alabama – App Store Accountability Act (HB 161) – Enacted, Effective Jan 1, 2027

Requires app stores (Apple, Google) to verify a user’s age and get parental consent before anyone under 18 can download an app. Enacted February 17, 2026, separate from Alabama’s main privacy law, and includes a private right of action for parents. Alabama is one of four states (alongside Utah, Texas, and Louisiana) with this type of app store age verification requirement.
HB 161 · Enacted Feb 17, 2026 · Effective Jan 1, 2027

🔴 Nebraska – LB 383, Parental Rights in Social Media Act – Partially Blocked by Federal Court

Signed by Governor Pillen on May 20, 2025, one of the most comprehensive social media minor protection laws in the country. Required social media platforms to verify every user’s age, obtain parental consent before any minor under 18 could create an account, and give parents full monitoring rights (view posts, messages, control privacy settings, limit time). Penalties of $2,500 per violation with both AG and private enforcement. The social media provisions were set to take effect July 1, 2026. On June 27, 2026, Senior U.S. District Judge John Gerrard partly granted NetChoice’s request for a preliminary injunction. The age verification and parental consent requirements are blocked as likely First Amendment violations. The provisions letting parents view a minor’s posts and messages were not blocked and may be enforced. No appeal had been confirmed as of this update.
Signed May 20, 2025 · Partially enjoined Jun 27, 2026 · NetChoice v. Hilgers

✅ Nebraska – Age-Appropriate Online Design Code Act (AAODCA, LB 504) – Partially in Effect

Signed by Governor Pillen on May 30, 2025, ten days after LB 383. Requires online services meeting a size threshold ($25M+ revenue, 50,000+ consumers, 50%+ revenue from data sales) to protect user data, implement design features that reduce compulsive-use harm, and give parents access to their child’s privacy and account settings. Took effect January 1, 2026; AG enforcement began July 1, 2026. Any AAODCA violation is also a separate violation of Nebraska’s Uniform Deceptive Trade Practices Act with penalties up to $50,000 per violation.
Signed May 30, 2025 · Effective Jan 1, 2026 · AG enforcement began Jul 1, 2026

🔴 Virginia – SB 854, Social Media Screen Time Restrictions – Blocked by Federal Court

Would have required social media platforms to detect if users are under 16 and limit them to one hour of use per day unless parents adjust settings, the first state law in the US to impose time limits rather than access restrictions. Took effect January 1, 2026. Preliminarily enjoined on February 27, 2026 by a federal judge (NetChoice v. Jones) as a likely First Amendment violation. The Fourth Circuit appeal was fully briefed in June 2026, with no ruling yet.
Ch. 703 of 2025 · Effective Jan 1, 2026 · Preliminarily enjoined Feb 27, 2026 · Fourth Circuit appeal pending

✅ South Carolina – H 3431, Social Media Regulation Act (Act 96) – In Effect, Litigation Pending

Requires online platforms to use reasonable care with minors’ data, limits data collection on minors, and requires parental controls and annual reporting. Passed the House 112-0 and took effect when signed on February 5, 2026. NetChoice sued four days later (NetChoice v. Wilson); its request for a preliminary injunction was fully briefed in April 2026 and no ruling has been reported, so the law remains enforceable.
Act 96 of 2026 · Signed and effective Feb 5, 2026 · NetChoice v. Wilson pending

✅ Florida – HB 3 (2024), Social Media Use for Minors – Enforceable, Litigation Ongoing

Bars children under 14 from holding social media accounts and requires parental consent for 14- and 15-year-olds. A federal judge blocked it in June 2025, but on October 14, 2026 the Eleventh Circuit reversed that injunction, so Florida can enforce the law while the challenge continues.
CCIA and NetChoice v. Uthmeier · Injunction reversed Oct 14, 2026

✅ Mississippi – HB 1126, Walker Montgomery Protecting Children Online Act – Enforceable Pending Appeal

Requires social media platforms to verify ages and get parental consent for minors. A federal judge blocked it in June 2025, but the Fifth Circuit stayed that order, and in August 2025 the Supreme Court declined to step in, though Justice Kavanaugh wrote that the law is likely unconstitutional. The Fifth Circuit heard argument February 3, 2026; no decision has been reported.
NetChoice v. Fitch · Injunction stayed Jul 2025 · Fifth Circuit argued Feb 3, 2026

✅ Tennessee – HB 1891, Protecting Children from Social Media Act – In Effect, Litigation Ongoing

Requires age verification and parental consent for minors’ social media accounts. The trial court refused to block it. On August 28, 2026 the Sixth Circuit vacated that refusal and sent the case back for another look, without ruling on whether the law is constitutional. No injunction had been reported as of this update.
Signed May 2, 2024 · Effective Jan 1, 2025 · NetChoice v. Skrmetti on remand

✅ West Virginia – HB 4412, Age Verification for Adult Sites – In Effect

Requires websites with sexual material harmful to minors to verify users’ ages, and lets people sue publishers and distributors who fail to. West Virginia joins the 25+ states with this type of law, which the Supreme Court upheld in principle in Free Speech Coalition v. Paxton (2025).
Ch. 70 · Approved Apr 1, 2026 · Effective Jun 12, 2026

🔴 Arkansas – Acts 900 and 901 of 2025, Social Media Design Laws – Blocked by Federal Court

Act 901 bars platform designs and features a platform knows or should know lead users to buy drugs, develop eating disorders, attempt suicide, or become addicted, and lets parents sue after a child under 16 attempts or dies by suicide following exposure to self-harm content. It was blocked December 15, 2025. Act 900 adds an addictive-practices ban, a notification curfew, privacy-by-default settings, and a parental dashboard; it was blocked April 20, 2026, the day before it would have taken effect. Arkansas has appealed both.
NetChoice v. Griffin · Act 901 enjoined Dec 15, 2025 · Act 900 enjoined Apr 20, 2026 · On appeal

🔴 Ohio – Parental Notification by Social Media Operators Act – Blocked Pending Supreme Court Petition

Requires parental consent before children under 16 open social media accounts. A federal judge struck it down in April 2025. On June 18, 2026 a divided Sixth Circuit vacated that ruling, finding NetChoice could not assert minors’ rights, but on August 17, 2026 it put its own decision on hold while NetChoice asks the Supreme Court to take the case. Until that is resolved, the law stays blocked.
NetChoice v. Yost, No. 25-3371 · Sixth Circuit decision Jun 18, 2026 · Mandate stayed Aug 17, 2026

🔴 Texas – SCOPE Act (HB 18), Content Filtering Rules – Partially Blocked

Texas’s 2024 law on minors online. On July 24, 2026 the Fifth Circuit kept the injunction against the requirement that platforms monitor and filter content for minors, finding it preempted by federal law (Section 230), for the industry groups that sued. Its age-registration provisions remain enforceable. The tracker’s Texas AG investigation entry relies on this law.
CCIA v. Paxton, No. 24-50721 · Fifth Circuit Jul 24, 2026 · Texas sought rehearing

✅ New York – SAFE for Kids Act (S7694A) – Enacted

Requires social media platforms to turn off algorithmic “addictive feeds” for users under 18 unless a parent specifically opts in. New York was the first state to restrict algorithmic feeds for minors. Enforcement depends on rules from the Attorney General.
Signed Jun 2024

✅ New York – Child Data Protection Act (S7695B) – In Effect

Prohibits websites and apps from collecting, using, sharing, or selling personal data of anyone under 18 without informed consent, or without parental consent for kids under 13. AG enforces with fines up to $5,000 per violation.
Signed Jun 2024

🔵 Minnesota – Kids Social Media Safety Act (HF 4138, Ch. 111) – Signed, Effective Jul 1, 2027

Platforms with 10,000+ account holders must estimate users’ ages and get verifiable parental consent for users 15 and under. Child accounts get maximum privacy settings by default, no addictive features (infinite scroll, autoplay, most push notifications), no targeted ads, and no sale of their data. Includes a private right of action ($10,000 statutory damages for knowing or reckless violations) plus AG enforcement. Passed the House 132-2 and the Senate 66-0.
HF 4138 · Signed May 26, 2026 · Effective Jul 1, 2027

🔵 New Jersey – Kids Code Act (A 4015) – Signed, Effective 2027

Covers online services likely to be used by minors that have $25M+ in revenue or data on 25,000+ consumers. Requires the highest privacy settings by default for minors, limits late-night notifications, and adds data minimization and anti-compulsive-design duties. Includes a private right of action of $5,000 per violation or triple damages. Passed the Senate 36-4 and the Assembly 73-5.
A 4015 · Signed Aug 11, 2026 (P.L.2026, c.73) · Takes effect about 13 months after signing (fall 2027)

✅ Georgia – SB 351 (2024), Social Media Age Verification and Parental Consent – Injunction Vacated, Enforceable

Requires social media platforms to verify ages and get parental consent for users under 16. A federal judge blocked it in June 2025, but on October 15, 2026 the Eleventh Circuit vacated that injunction, finding NetChoice had not met the high bar for a facial First Amendment challenge. The law can now be enforced while the case continues.
NetChoice v. Attorney General of Georgia, No. 25-12436 · Eleventh Circuit · Injunction vacated Oct 15, 2026

✅ Utah – App Store Accountability Act (SB 142) – In Effect

Utah was the first state in the US to pass an app store age verification law. Requires app stores to verify user ages and get parental consent before minors can download apps or make purchases. Penalties up to $1,000 per violation plus a private right of action. App store and developer duties took effect May 6, 2026; enforcement and the private right of action start December 31, 2026. Google has built a Play Age Signals API specifically to help Android developers comply with Utah, Texas, and Louisiana simultaneously.
Signed Mar 26, 2025 · Duties effective May 6, 2026 · Private right of action from Dec 31, 2026

✅ Texas – App Store Accountability Act (SB 2420) – In Effect (litigation ongoing)

Signed by Governor Greg Abbott in May 2025. Requires app stores to verify every user’s age and obtain parental consent before anyone under 18 can download apps, make in-app purchases, or receive significant app updates. Violations are treated as deceptive trade practices with a private right of action: parents can sue directly for injunctive relief, actual and punitive damages.

The law was supposed to take effect January 1, 2026, but a federal judge blocked it on December 23, 2025, comparing mandatory age checks to requiring every bookstore to card customers at the door and calling it likely unconstitutional under the First Amendment. Texas appealed. The Fifth Circuit lifted the injunction on June 4, 2026 via a stay pending appeal. Apple activated enforcement the same day: new Apple Accounts in Texas now require age verification before downloading any app. Google activated its Play Age Signals API simultaneously. The constitutional case continues; the Fifth Circuit has not yet ruled on the merits and the industry group CCIA believes the law will ultimately be struck down.
Signed May 2025 · Blocked Dec 23, 2025 · Injunction lifted Jun 4, 2026 · Fifth Circuit appeal pending

🔵 Louisiana – App Store Accountability Act (HB 977) – Signed, Effective Jul 1, 2027

Signed May 15, 2026 as Act 185, after passing 94-0 and 36-0. Replaces Louisiana’s 2025 app store law (Act 481), which never took effect. Penalties up to $10,000 per violation, AG enforcement, with a 45-day window to fix violations. Similar scope to Texas and Utah: requires parental consent before minors can download apps or make purchases. Faces the same First Amendment litigation risk as Texas and Utah. The Fifth Circuit’s eventual ruling on Texas SB 2420 will determine whether Louisiana’s law survives.
Act 185 · Signed May 15, 2026 · Effective Jul 1, 2027

✅ Minnesota – Social Media Warning Labels Law (MN Stat. 325M.335) – In Effect

Social media platforms must display mental health warning labels to their users, similar to the warnings on cigarette packs. First such state law to actually take effect. NetChoice sued on April 29, 2026 (NetChoice v. Ellison); the state’s motion to dismiss is pending and the law has not been blocked.
Effective Jul 1, 2026 · Challenged in NetChoice v. Ellison, no injunction

🔵 California – Social Media Warning Labels (AB 56)

California’s version of the social media mental health warning label requirement, signed by Governor Newsom on October 13, 2025. Requires platforms to show a mental health warning the first time a user opens the platform each day, again after three hours of cumulative use, and at least hourly after that. Takes effect at the start of 2027.
Signed Oct 13, 2025 · Effective Jan 1, 2027

🔴 Colorado – Social Media Warning Labels (HB 24-1136) – Blocked by Court

Colorado was actually the first state to pass a social media warning label law (signed June 6, 2024). A federal judge blocked enforcement in November 2025 (NetChoice v. Weiser), ruling it likely violated the First Amendment as compelled speech. Colorado AG Phil Weiser appealed to the Tenth Circuit, and briefing finished August 14, 2026 with no decision yet. A 2026 alternative (HB 26-1148) focused on privacy settings for young users was postponed indefinitely in committee on April 7, 2026.
Signed Jun 6, 2024 · Blocked Nov 6, 2025 · Tenth Circuit briefing complete Aug 14, 2026, decision pending

🔴 California – Age-Appropriate Design Code Act (CAADCA, AB 2273) – Mostly Blocked, Repealed and Replaced

Requires any online service that kids might use to design with children’s best interests in mind: no dark patterns, privacy on by default, no profiling of minors. Most of it never took effect. In March 2026 the Ninth Circuit left five of the six challenged provisions blocked in NetChoice v. Bonta. The Legislature then repealed the law and replaced it with a rewritten version, AB 2246, signed September 10, 2026 (see the 2026 activity table).
Signed 2022 · Mostly enjoined (NetChoice v. Bonta) · Repealed and replaced by AB 2246, Sep 2026

Children’s Privacy, Additional Sectoral Laws

✅ Arkansas – Children and Teens’ Online Privacy Protection Act (HB 1717) – In Effect

Signed by Governor Sarah Huckabee Sanders on April 21, 2025. Modeled directly on the stalled federal COPPA 2.0 bill. Arkansas essentially passed at the state level what Congress couldn’t agree on federally. Extends COPPA-style protections beyond children under 13 to teens aged 13-16, banning targeted advertising and requiring data minimization, consent, and deletion rights for both age groups. Arkansas joins New York as one of only two states with privacy protections specifically covering this teen age bracket in the absence of a broader comprehensive privacy law. AG-only enforcement; no private right of action; no proactive age verification requirement. Arkansas does not have a comprehensive consumer privacy law for adults. Residents over 16 have no state-level right to access, delete, or correct their personal data, and cannot opt out of data broker sales or targeted advertising under state law. What some sites call the “Arkansas Personal Data Protection Act” is actually the Personal Information Protection Act, a 2005 data security and breach notification law, not a comprehensive privacy law. HB 1717 adds teen-specific protections but does not create adult privacy rights. For now, Arkansas adults who want to exercise data rights must rely on other states’s laws if the company they are dealing with is also subject to California, Texas, or Connecticut law.
Act 952 · Signed Apr 21, 2025 · In effect since Jul 1, 2026

Automated Decision-Making & AI Privacy

✅ California – Automated Decision-Making Rules (CPPA)

When a company uses an algorithm to make a significant decision about you (whether you get a loan, see a job posting, or get flagged for review), California now requires them to tell you that’s happening and give you the right to opt out. The same rules phase in cybersecurity audits and risk assessments over the next several years. California’s privacy agency finalized these rules in 2025 and they’re considered the most far-reaching AI privacy rules in the US.
CPPA rules finalized 2025

✅ California Executive Order N-9-26 on AI Oversight – Issued September 18, 2026

Governor Newsom signed Executive Order N-9-26 on September 18, 2026. It directs the state’s Government Operations Agency to speed up implementation of California’s new AI audit laws (SB 813 and AB 1405), and has state agencies convene experts to deliver, within two months, a guide for strengthening California’s AI safety laws. Proposals on the table include on-site independent verification at frontier AI labs and a “kill switch” whose effectiveness is checked by an independent organization. These are proposals, not requirements. Does not have the force of law but signals California’s legislative direction for 2027.
Executive Order N-9-26 · Issued Sep 18, 2026 · Expert group announced Sep 23, 2026

✅ Illinois Executive Order 2026-07, Illinois AI Cabinet – Issued September 22, 2026

Governor Pritzker created an unpaid advisory AI Cabinet of outside experts and leaders from seven state agencies. It will write AI incident-response policies, recommend protections for public infrastructure, and weigh tying data center incentives and state contracts to AI safety standards. It creates no binding privacy rules.
Executive Order 2026-07 · Effective Sep 22, 2026 · Sunsets by Dec 31, 2027

✅ Oregon Executive Order 26-26, Responsible AI Procurement Standards – Issued September 23, 2026

Governor Kotek directed the state’s chief information officer to develop standards for third-party safety review of AI the state buys, assess whether to require a “kill switch” for frontier models, and add procurement safeguards. An implementation proposal is due within 90 days. Applies to state purchasing, not private companies directly.
Executive Order 26-26 · Effective Sep 23, 2026

✅ California – AB 2013, AI Training Data Transparency Act – In Effect

Effective January 1, 2026. Requires developers of generative AI systems to post detailed summaries of the datasets used to train their models, including the sources, types of data, how data was collected, and whether copyrighted material or personal information was included. Applies to AI systems made available in California. One of the first state laws to mandate disclosure of what goes into AI training data.
Effective Jan 1, 2026

✅ Illinois – HB 3773, AI in Employment Decisions (IHRA Amendment) – In Effect

Effective January 1, 2026. Amended the Illinois Human Rights Act to directly address AI-driven employment decisions. Makes clear that the use of AI or automated decision-making tools that results in unlawful discrimination is a civil rights violation under state law, regardless of whether a human reviewed the AI output. Illinois is one of the first states to amend its existing civil rights statute to explicitly cover AI.
Public Act 103-0804 · Signed Aug 9, 2024 · Effective Jan 1, 2026

🔵 California – SB 867, Companion Chatbot Toy Moratorium – Signed, Effective Jan 1, 2027

Signed by Governor Newsom September 10, 2026. Imposes a four-year moratorium on the manufacture, sale, exchange, or possession with intent to sell any toy that includes a “companion chatbot,” defined as an AI system that provides adaptive, human-like responses, exhibits anthropomorphic features, and is capable of sustaining a relationship across multiple interactions. The first toy-specific AI chatbot ban in the US. The definition excludes bots used solely for customer service, video game features limited to game replies, and standalone virtual assistants that do not sustain relationships or elicit emotional responses.
Signed Sep 10, 2026 (Ch. 189) · Takes effect Jan 1, 2027 · Ban expires Jan 1, 2031

🔵 New York – RAISE Act, AI Safety and Transparency (S6953B) – Signed, Effective Jan 1, 2027

Requires large frontier AI developers to publish safety frameworks, disclose safety testing, and report critical safety incidents to the state. Signed December 19, 2025 and rewritten by a chapter amendment (S 8828) signed March 27, 2026.
Ch. 699 of 2025 · Chapter amendment Ch. 96 of 2026 · Effective Jan 1, 2027

✅ California – Transparency in Frontier Artificial Intelligence Act (SB 53) – In Effect

Signed by Governor Newsom on September 29, 2025, effective January 1, 2026, the first state law in the country specifically regulating frontier AI model development. Requires large frontier developers (those training the most compute-intensive models) to publish safety frameworks describing how they manage catastrophic risk, report critical safety incidents to the state, and provides whistleblower protections for employees who raise safety concerns. California became the model that Illinois (SB 315) and New York later followed.
Signed Sep 29, 2025 · Effective Jan 1, 2026

✅ California – AI Transparency Act (SB 942, amended by AB 853) – In Effect Since Aug 2, 2026

Requires large AI systems (over one million monthly users) to offer free tools that let people detect whether content was AI-generated, and to embed provenance disclosures in AI-generated content. Originally set for January 2026, a 2025 amendment (AB 853) delayed the effective date to August 2, 2026 and added provisions covering large online platforms and content-hosting services. Now in effect as of August 2, 2026. Amended again on September 30, 2026 by SB 1000 (see the 2026 activity table) and AB 2713; the large-platform provenance duties start January 1, 2027.
Amended by AB 853, SB 1000, and AB 2713 · Effective Aug 2, 2026 · Platform duties Jan 1, 2027

✅ Washington – SSB 5886, Forged Digital Likeness – In Effect

Signed in 2026. Amends existing law to include “forged digital likeness” (AI-generated deepfakes) as something in which every individual has a property right. Creates a private right of action for unauthorized use of a person’s AI-generated likeness. Passed the Senate 47-0 and the House 85-9.
Ch. 69 · Signed Mar 16, 2026 · Effective Jun 11, 2026

🔵 Washington – HB 1170, AI Content Provenance Disclosure – Signed, Effective 2027

Signed by Governor Ferguson in March 2026. Modeled on California’s AI Transparency Act. Requires covered generative AI providers (those with over one million monthly users, publicly accessible in Washington) to make a free provenance detection tool available, embed a latent disclosure in AI-created or AI-altered images, video, and audio, and offer users the option of a visible manifest disclosure. Enforced by the Washington Attorney General under the Consumer Protection Act. Part of the growing “content provenance” wave aimed at helping people tell whether media was AI-generated.
Ch. 167 · Signed Mar 24, 2026 · Effective Feb 1, 2027

✅ Kansas – HB 2183, AI-Generated Deepfake Images – In Effect

Signed by Governor Kelly on February 5, 2026. Extends Kansas child sexual exploitation crimes to images that are AI-generated, morphed, or indistinguishable from a real child, and expands the state’s breach of privacy crime to cover sharing fake images that appear to show an identifiable person. One of the earliest state deepfake laws enacted in 2026.
Signed Feb 5, 2026 · Effective Jul 1, 2026

✅ Wyoming – HB 102, Protecting Kids from Deepfakes and Exploitative Images – In Effect

Makes it a felony to create AI-generated child sexual abuse material, to distribute sexual deepfakes of adults without consent, or to knowingly build or distribute AI systems designed to make that material or to promote self-harm. Using AI is no defense to a crime. AI developers are not liable when others misuse their systems unless the system was built for illegal use.
Ch. 91 · Signed Mar 7, 2026 · Effective Jul 1, 2026

🔵 Utah – HB 276, Digital Content Provenance Standards Act – Signed, Effective 2027

Signed by Governor Cox on March 24, 2026. Utah’s counterpart to Washington’s HB 1170 and California’s AI Transparency Act. Requires generative AI providers with more than one million monthly users to include hidden provenance disclosures in AI-generated content, adds duties for large platforms (more than two million users), and requires capture devices made on or after January 1, 2028 to support provenance data. Also creates a Digital Voyeurism Prevention Act with a private right of action and a 48-hour takedown requirement for nonconsensual intimate imagery. Enforced by Utah’s Division of Consumer Protection.
Signed Mar 24, 2026 · Effective Jan 1, 2027 · Device duty Jan 1, 2028

✅ Texas – Responsible AI Governance Act (TX HB 149)

Texas’s broad AI law. Bans AI built to encourage self-harm or crime, unlawful discrimination, child sexual abuse material, and certain deepfakes. Bans government “social scoring” and some government biometric identification. Requires disclosure when you interact with AI used by government agencies or in health care. The AG enforces it exclusively, with a 60-day window to fix violations and penalties up to $200,000 per violation. Creates a 36-month regulatory sandbox and an AI Council. It also amended the state biometric law so that publicly posted images do not count as consent, while exempting some AI training uses.
HB 149 · Effective Jan 1, 2026

🔵 Colorado – AI Act Replacement (SB 26-189) – Signed, Effective Jan 1, 2027

Colorado Gov. Jared Polis signed SB 26-189 on May 14, 2026, repealing and replacing the original Colorado AI Act (SB 24-205), the first-in-the-nation comprehensive AI law. The replacement is significantly narrower: it drops the original law’s broad “high-risk AI” and algorithmic discrimination framework in favor of a transparency-based regime focused on “automated decision-making technology” (ADMT) used in consequential decisions. Companies must now disclose when ADMT is used to make or materially influence decisions affecting you (employment, credit, housing, healthcare), provide explanations after adverse decisions, and give you correction rights. Annual third-party audits are NOT required, a major retreat from the original law.
Signed May 14, 2026 · Effective Jan 1, 2027

AI Companion Chatbots & Therapy Bot Laws: A New Category Entirely

This is one of the fastest-moving and least-noticed areas of privacy regulation right now. Following the suicides of multiple teenagers linked to relationships with AI companion chatbots, and a January 2026 settlement between Google, Character.AI, and the family of a Florida teen, states have moved with extraordinary speed to regulate AI systems designed to simulate human relationships. As of mid-2026, there are an estimated 98 active chatbot-specific bills across 34 states. Here are the laws that have actually been signed:

✅ California – SB 243, Companion Chatbots – In Effect

The first law in the country to specifically regulate AI companion chatbots, and one of the few with a private right of action, meaning you can sue directly rather than waiting for the state to act. Signed by Governor Newsom on October 13, 2025 after the case of 14-year-old Sewell Setzer, who died by suicide after an emotional and romantic relationship with a Character.AI chatbot that told him to “come home” minutes before he died. Requires chatbots to clearly disclose they’re AI, not human, if a reasonable person could be misled. For known minors, requires repeated reminders every three hours, a break reminder, and bans on sexually explicit content. Requires a published protocol for handling suicidal ideation and self-harm.
Signed Oct 13, 2025 · Effective Jan 1, 2026 · Private right of action · Minor-user rules replaced by SB 1119 starting Jul 1, 2027

✅ New York – AI Companion Models Law (General Business Law Article 47) – In Effect

The first state law to actually take effect regulating AI companions, November 5, 2025, two months before California’s. Requires recurring disclosure every three hours (regardless of the user’s age) that the AI is a computer program, not human. Requires self-harm and suicidal ideation detection with referral to the 988 crisis line. AG-only enforcement; no private right of action, unlike California.
Effective Nov 5, 2025

🔵 Oregon – SB 1546, AI Companion Regulation – Signed, Effective Jan 1, 2027

Signed by Governor Kotek on March 31, 2026 after passing 26-1 in the Senate and 52-0 in the House. Requires disclosure that a chatbot is AI, with reminders every hour for known minors. Bans sexual content for minors and an extensive list of manipulative techniques, including simulating distress when a user tries to leave the conversation, encouraging kids to keep secrets from parents, and soliciting in-app purchases framed as necessary to “maintain the relationship.” Includes a private right of action with $1,000 statutory damages per violation.
Ch. 85 · Signed Mar 31, 2026 · Effective Jan 1, 2027 · Private right of action

🔵 Washington – HB 2225, AI Companion Chatbot Regulation – Signed, Effective Jan 1, 2027

Signed by Governor Bob Ferguson on March 24, 2026, the same month as Oregon’s law, creating a coordinated Pacific Northwest framework. Requires disclosure every three hours for all users (stricter than California or Oregon, which use a “reasonable person” standard for adults). For minors, disclosure required every hour. Enforced through the state Consumer Protection Act by the AG, with a private right of action available in certain contexts.
Ch. 168 · Signed Mar 24, 2026 · Effective Jan 1, 2027

✅ Illinois – Wellness and Oversight for Psychological Resources Act (HB 1806) – In Effect

Illinois was the first state to explicitly prohibit autonomous AI therapy. Prohibits AI from making independent therapeutic decisions, directly engaging in therapeutic communication with clients, or generating treatment plans without licensed review. Penalties reach $10,000 per incident.
Public Act 104-0054 · Signed Aug 1, 2025 · Effective immediately

✅ Nevada – AB 406, AI Mental Health Restrictions – In Effect

Bans offering AI systems that provide or claim to provide professional mental or behavioral healthcare services. Prohibits AI from performing the functions of a school counselor, psychologist, or social worker in public schools. Restricts licensed professionals to administrative/supportive AI use only, with oversight required. Civil penalties up to $15,000 per violation.
Signed by Gov. Lombardo Jun 5, 2025 · Effective Jul 1, 2025

✅ Colorado – HB 26-1195, Psychotherapy Artificial Intelligence Restrictions – Signed

Signed by Governor Polis on June 3, 2026. Prohibits AI from directly engaging in therapeutic communication with clients, generating unsupervised treatment recommendations, or detecting emotions/mental states without human oversight. Applies to all licensed, certified, or registered psychotherapy providers. Bans advertising or offering psychotherapy via AI unless conducted by a regulated professional. Enforced by DORA licensing boards and the Colorado Consumer Protection Act, separate from the state’s broader AI Act (SB 26-189).
Signed Jun 3, 2026 · Effective Aug 12, 2026

✅ Vermont – Act 156 (H.816), AI in Mental Health Services – Signed

One of the strictest of the bunch: a categorical ban, not a harm-based liability standard. Makes it unprofessional conduct for a licensed mental health provider to let AI independently make therapeutic decisions or deliver treatment. Carves out room for administrative AI use (note-taking, transcription, scheduling) but draws a hard line once AI crosses into diagnosis or treatment planning. Consumer Protection Act enforcement available to both the AG and private plaintiffs. Long legislative journey: introduced January 2026, passed House in March, went through a conference committee after the House rejected a Senate amendment, and was finally signed by Governor Phil Scott on June 17, 2026.
Signed Jun 17, 2026 · Effective immediately upon enactment · Private right of action

✅ Hawaii – SB 3001, Artificial Intelligence Disclosure and Safety Act – In Effect

Signed into law July 14, 2026 and effective immediately. Requires AI companion chatbot operators to disclose the chatbot is not human, build protocols to detect and respond to suicidal ideation or self-harm, and add extra protections for minor account holders (no sexually explicit content, no claiming to be a licensed mental health professional). Annual reporting to the state Department of Health begins in 2028. Hawaii is among the roughly dozen states that enacted a chatbot safety law in the first half of 2026.
Act 248 · Signed Jul 14, 2026 · Effective immediately

🔵 Georgia – SB 540, Chatbot Disclosure and Safety – Signed, Effective Jul 1, 2027

Requires AI chatbots to identify themselves as non-human at the start of every conversation and at regular intervals, with more frequent reminders for known minors. Adds limits on minors’ use, privacy tools, a suicide and self-harm response protocol, and Attorney General enforcement.
SB 540 · Signed May 11, 2026 (Act 518) · Effective Jul 1, 2027

🔵 Iowa – SF 2417, Conversational AI Safety – Signed, Obligations Apply Jul 1, 2027

Signed by Governor Kim Reynolds on May 2, 2026 after passing the Senate 48-0 and the House 95-0. The law took effect July 1, 2026, but its requirements apply starting July 1, 2027. Conversational AI services must clearly disclose to users, especially minors, that they are talking to AI and not a human or a licensed mental health professional, with a reminder every three hours of continuous use or a persistent disclaimer. Operators must have a protocol that refers users who express suicidal thoughts to crisis resources. Research tools and internal enterprise AI are excluded. Enforced by the Iowa Attorney General: the greater of actual damages or $1,000 per violation, capped at $500,000 per operator. No private right of action.
Signed May 2, 2026 · Requirements apply Jul 1, 2027

🔵 Idaho – S 1297, Conversational AI Safety Act – Signed, Effective Jul 1, 2027

Signed March 31, 2026. Nearly identical to Nebraska’s Conversational AI Safety Act: public-facing chatbots must clearly disclose they are AI, follow crisis-response protocols when a user expresses suicidal ideation, and may not claim to provide professional mental or behavioral health care.
Signed Mar 31, 2026 (Ch. 249) · Effective Jul 1, 2027

✅ Tennessee – SB 1580, AI Mental Health Representation Ban – In Effect

Signed by Governor Bill Lee on April 1, 2026, effective July 1, 2026. Prohibits developers and deployers of AI systems, including chatbots, from advertising or representing that the system is or can act as a qualified mental or behavioral health professional. Violations are unfair or deceptive practices under the Tennessee Consumer Protection Act, with a private right of action and civil penalties up to $5,000 per violation. Passed unanimously: Senate 32-0, House 94-0.
Signed Apr 1, 2026 · Effective Jul 1, 2026 · Private right of action

✅ Delaware – HB 191, AI Professional Licensing Ban – Signed

Signed April 23, 2026. Prohibits any nonhuman entity, including an AI-powered agent, from being licensed or certified to practice as a professional nurse, advanced practice registered nurse, practical nurse, physician, or physician assistant. Part of the broader wave of states drawing a hard line against AI systems presenting themselves as licensed healthcare providers.
Signed Apr 23, 2026 (Ch. 85:250) · Effective on signing

✅ Maine – LD 1727, AI Chatbot Disclosure – In Effect

Effective September 24, 2025. Requires disclosure when a user interacts with AI and cannot reasonably detect that the entity is not a natural person. One of the earliest chatbot disclosure laws in the country, predating the 2026 wave.
Signed Jun 12, 2025 (P.L. 2025, c. 294) · Effective Sep 24, 2025

✅ Maine – LD 2082, Regulation of AI in Mental Health Services – Signed

Prohibits the clinical use of AI in mental health therapy while allowing administrative use. Signed by the Governor on April 13, 2026.
Signed Apr 13, 2026 (P.L. 2026, c. 687)

🔵 Nebraska – LB 525, Conversational AI Safety Act (part of Agricultural Data Privacy Act) – Signed, Effective Jul 1, 2027

An unusual pairing: the first half of the bill is an Agricultural Data Privacy Act, the second half regulates conversational AI aimed at minors. Requires disclosure that a service is AI, not human, and bars services from claiming to provide professional mental or behavioral health care. Passed 49-0 on April 10, 2026 and signed by Governor Pillen on April 14, 2026.
Signed Apr 14, 2026 · Passed 49-0 · Effective Jul 1, 2027

Enforcement Actions & Litigation Worth Watching

Even without a specific law, several states are using existing consumer protection and medical licensing statutes against AI chatbot companies right now:

Pennsylvania v. Character.AI – Filed May 1, 2026 in Commonwealth Court. Pennsylvania’s Department of State sued Character.AI after an investigator found a chatbot character named “Emilie”, described as “Doctor of psychiatry” with roughly 45,500 user interactions, offered to assess the investigator for antidepressant medication and provided a fake Pennsylvania medical license number when asked. The suit alleges this violates Pennsylvania’s Medical Practice Act, which bans practicing medicine without a license. The first known case of a state medical licensing authority suing an AI platform directly over chatbot conduct. Character.AI has since entered bankruptcy proceedings (see the multistate entry below).

Texas AG Investigation into Meta and Character.AI – Opened December 2024, expanded August 18, 2025. Attorney General Ken Paxton is investigating both companies for marketing AI chatbots as mental health tools without medical credentials, under the Texas SCOPE Act and TDPSA. Part of a broader Texas investigation into 15 companies (including Reddit, Instagram, and Discord) over children’s privacy practices.

Kentucky v. Character Technologies – Filed January 8, 2026 in Franklin Circuit Court, the first state lawsuit (not just investigation) against Character.AI. Attorney General Russell Coleman’s complaint alleges violations of the Kentucky Consumer Protection Act and Kentucky’s new Consumer Data Protection Act, citing two deaths linked to the platform and seeking $2,000 penalties per willful violation.

44 State AGs Joint Warning Letters – August 25, 2025, attorneys general from 44 states sent coordinated warning letters to major AI companies (including Anthropic, Apple, Google, Meta, Microsoft, OpenAI, Perplexity, and xAI), citing internal Meta documents that allegedly authorized AI assistants to “flirt and engage in romantic roleplay with children” as young as eight.

FTC Safety Report Orders – On September 11, 2025, the FTC voted 3-0 to order seven companies (Alphabet, Character Technologies, Instagram, Meta, OpenAI, Snap, and X.AI) to submit detailed reports on chatbot safety, monetization, and child-impact monitoring within 45 days.

Florida v. OpenAI – Filed June 1, 2026 in the 10th Judicial Circuit Court (Highlands County, Florida). Attorney General James Uthmeier sued OpenAI and Sam Altman personally, alleging the company prioritized speed to market over safety, deployed a product that facilitates self-harm and violence, collects data from minors without meaningful parental oversight, and causes behavioral addiction. The first state-led lawsuit of its kind against OpenAI. On September 28, 2026, the AG asked the court for a temporary injunction against OpenAI and Altman; no ruling yet.

States Sue OpenAI – Announced October 14, 2026. At least six states (Iowa, West Virginia, Arkansas, Arizona, Idaho, and Montana) filed consumer protection suits, and the Kansas and Nebraska attorneys general joined the announcement. The suits allege that ChatGPT is marketed as safe while giving dangerous advice and coaching users, including children, toward self-harm. These are allegations; no court has ruled.

Multistate Action in the Character.AI Bankruptcy – October 14, 2026. Character.AI is in bankruptcy proceedings, and a bipartisan group of 40 attorneys general, including DC’s, asked the court to require that any buyer of the company or its user data keep age verification, harm safeguards, and privacy protections in place, and honor users’ rights to access or delete their data. The point: your chatbot conversations are an asset that can be sold.

Texas AG Settlement with Temu – Announced October 16, 2026. Settles a lawsuit Texas filed in February 2026. Temu’s owners agreed to pay $3 million, keep Texans’ data on US servers controlled by a US company, submit to independent audits (with an $8 million penalty for each failed annual audit), and allow a third-party review of their app code for malware and spyware.

Florida v. TP-Link Systems – Filed October 6, 2026 in Polk County. The Florida AG alleges TP-Link misrepresented the security of its routers, its ties to China, and the data practices of its apps (Tether, Deco, Tapo, Kasa), and that its privacy policies do not disclose possible access by Chinese authorities. The state seeks an injunction and civil penalties. These are allegations, not findings. Worth watching for anyone thinking about what runs their home network.

Florida v. Discord – Filed October 15, 2026. Alleges weak age verification and default settings that expose children to predators, under Florida’s consumer protection and children’s online protection laws.

State Bills, 2026 Legislative Activity

This section tracks bills that began the 2026 session as pending. Several were signed into law during the session and are marked ✅ (in effect) or 🔵 (future effective date). They appear here because they originated as pending bills this cycle. Bills marked 🟡 are still active. Bills marked ⚫ failed or had their session close without passage.

State & Bill What It Would Do Status
Connecticut – SB 4 (Public Act 26-64) Signed by Governor Lamont on May 27, 2026. Significantly amends Connecticut’s privacy law and creates a new California Delete Act-style data broker registration and deletion program, run through the Department of Consumer Protection rather than the AG’s office. Also adds a hard ban on selling precise geolocation data, facial recognition signage/policy rules, direct-to-consumer genetic testing protections, and surveillance pricing disclosure rules. Connecticut joins Maryland, Oregon, and Virginia in banning the sale of precise geolocation data, the fourth state to do so. Note: this is layered on top of separate 2025 CTDPA amendments (Public Act 25-113) that take effect July 1, 2026, so Connecticut businesses face two overlapping compliance deadlines this year. ✅ Signed May 27, 2026 · Most provisions effective Oct 1, 2026 · Data broker registration Jan 1, 2027 · Consumer deletion mechanism Jul 1, 2028
Delaware – HB 380 Strengthens Delaware’s existing privacy law: lowers the coverage threshold to 15,000 consumers, narrows the financial institution exemption, and adds contract and due-diligence rules for third parties. Passed the House 30-9 on May 21 and the Senate 15-6 on June 16, 2026. 🔵 Signed Sep 2, 2026 (Ch. 85:463) · Effective Jan 1, 2027
New York – Multiple 2026 bills

🟡 NY Health Information Privacy Act (S9269 / A10357), passed legislature Jun 2026
🟡 AI Training Data Transparency Act (A6578B / S6955A), passed legislature Jun 2026
🔵 Safe by Design Act, enacted in FY 2027 budget

 NY Health Information Privacy Act (S9269): Governor Hochul vetoed the prior version (S 929) on December 19, 2025. This revised version passed the Senate 48-13 on June 3 and the Assembly on June 4, 2026. Would create Washington My Health MY Data-style protections for New Yorkers, requiring consent before any entity collects or sells health data not covered by HIPAA, including data from apps, wearables, and location tracking near healthcare facilities.

AI Training Data Transparency Act (A6578B): Would require AI companies to disclose what data they used to train their models. Passed the Senate 54-6 on June 4, 2026 after the Assembly; awaiting Hochul.

Safe by Design Act: Enacted in the FY 2027 state budget on May 26, 2026, effective January 1, 2027. Expands age verification requirements to gaming platforms, sets kids to maximum privacy settings by default, disables AI chatbot features for minors, and requires parental controls on financial transactions.

 🔵 Safe by Design Act: enacted May 26, 2026 · Effective Jan 1, 2027
🟡 Health privacy and AI training data bills: passed legislature Jun 2026 · Awaiting Gov. Hochul
Minnesota – HF 2700 Would have added health data protections to Minnesota’s existing privacy law, covering the health apps and wellness platforms that fall outside HIPAA. Never reached a House floor vote. ⚫ Died · 2026 session ended
California – AB 2246, Age-Appropriate Design Code Rewrite Repeals California’s court-blocked Age-Appropriate Design Code Act (AB 2273) and replaces it with a rewritten version. Online services likely to be used by kids must take reasonable steps to prevent specified harms, and children can void contracts that resulted from manipulative design. Enforced by the AG and local prosecutors. Expect a new court challenge. 🔵 Signed Sep 10, 2026 (Ch. 187)
California – AB 883 Amends the Delete Act so data brokers must check the DROP deletion list every 30 days instead of every 45. Requires state and court officials to tell elected officials and judges they can use DROP, and lets the AG, county counsel, or city attorneys sue brokers on their behalf starting July 1, 2027. 🔵 Signed Sep 27, 2026 (Ch. 507) · Officials and judges provisions operative Jul 1, 2027
California – SB 300 Would have required companion chatbot operators to act when they have reason to know a user is a minor and to block sexually explicit content with minors. Moved to the Assembly inactive file at the author’s request on August 30, 2026 and died when the session ended. SB 1119 (Adam’s Law) became the vehicle for chatbot child safety instead. ⚫ Died · Moved to Assembly inactive file Aug 30, 2026 · Session ended
California – SB 1119 Now known as “Adam’s Law,” named after California teen Adam Raine, who died in 2025 after being coached in suicide techniques by ChatGPT. Requires companion chatbot operators to complete a documented risk assessment for minor users before launching or substantially changing a chatbot, submit to independent child safety audits, and hand audit reports to the AG on request. A harmed child or parent can sue. Replaces SB 243’s minor-user rules starting July 1, 2027. Passed the Assembly 69-4 and the Senate 39-0 on August 31, 2026. 🔵 Signed Sep 10, 2026 (Ch. 190) · Operative Jul 1, 2027
California – AB 1609 Signed as the “Right to Human Customer Service Act.” Large businesses cannot pass off a customer service chatbot as a human, must disclose when you are talking to AI, and must make a good-faith effort to connect you to a live person within 15 minutes or schedule a callback. Penalties are $5,000 for a first violation and $10,000 for each one after. 🔵 Signed Sep 28, 2026 (Ch. 733)
California – SB 903 VETOED by Governor Newsom on September 30, 2026. Would have prohibited AI from independently providing psychotherapy services and required disclosure and consent before AI transcription of therapy sessions. Passed the Assembly 74-1 and the Senate 40-0 on concurrence. Senator Padilla called the veto “deeply disappointing,” noting Newsom had signed SB 1119 (chatbot child safety) just weeks earlier. 🔴 VETOED Sep 30, 2026
California – AB 2575 VETOED by Governor Newsom September 30, 2026. Would have protected healthcare workers from retaliation when overriding AI clinical decision support systems. California Nurses Association called the veto a “green light to discipline nurses who override unsafe AI.” Newsom signed AB 1979 the same day as a narrower alternative. 🔴 VETOED Sep 30, 2026
California – AB 1979, Clinical Judgment in AI-Assisted Care SIGNED September 30, 2026. Requires hospitals and clinics to take reasonable steps so licensed clinicians can still use their own clinical judgment when AI informs patient care. Also puts consumer health chatbots under California’s medical privacy law. Signed as the narrower alternative to the vetoed AB 2575. 🔵 Signed Sep 30, 2026 (Ch. 854)
California – SB 690 Narrows the California Invasion of Privacy Act (CIPA), the wiretapping-era law behind a wave of pixel and tracker lawsuits. When the tracking happens on a website or app, only the Attorney General, not private plaintiffs, can sue over “pen register” or “trap and trace” claims. Applies to pending claims in suits filed within two years before it takes effect. In plain terms: fewer private lawsuits over website tracking, which cuts both ways for consumers. 🔵 Signed Sep 30, 2026 (Ch. 976)
California – AB 1883, Workplace Surveillance Tools Prohibits employers, including public employers, from using AI to monitor employees’ emotional state or to collect “neural data” (measurements of the central or peripheral nervous system). Civil penalty up to $500 per violation, enforced by the Labor Commissioner or public prosecutors. Effective January 1, 2027. 🔵 Signed Sep 30, 2026 (Ch. 853) · Effective Jan 1, 2027
California – SB 1050, Synthetic Performer Disclosures SIGNED by Gov. Newsom at SAG-AFTRA headquarters on September 16, 2026. Requires disclosure of the use of synthetic (AI-generated) performers in video or audio advertisements. Crafted in partnership with SAG-AFTRA. 🔵 Signed Sep 16, 2026 (Ch. 246)
California – SB 947, Automated Decision Systems in Employment SIGNED by Governor Newsom September 30, 2026 as the “No Robo Bosses Act.” California becomes the first state to prohibit employers from relying solely on AI to fire or discipline workers. Newsom reversed a veto he issued on a near-identical version in October 2025. Penalty $500 per violation, enforced by the Labor Commissioner. 🔵 Signed Sep 30, 2026 (Ch. 859) · Operative Jul 1, 2027
California – SB 951, Technological Displacement Amends California’s WARN Act so that when a mass layoff or closure is caused substantially by AI or automation, the employer’s notice must say which job functions are being automated. The state must publish quarterly summaries of AI-driven job displacement and report to the Legislature by January 1, 2028. 🔵 Signed Sep 30, 2026 (Ch. 860)
California – SB 354 Rewrites California’s Insurance Information and Privacy Protection Act. Insurers and their vendors must give standalone privacy notices, limit sharing to necessary insurance purposes or get consent, and honor rights to access, correct, and delete. Penalties start at $5,000 per violation. Most requirements apply from July 1, 2028. 🔵 Signed Sep 27, 2026 (Ch. 481) · Operative Jul 1, 2028
California – SB 1000, AI Transparency Act Amendments Rewrites parts of the AI Transparency Act (SB 942). Removes the one-million-user threshold for covered AI providers, renames the detection tool a “disclosure verification tool,” drops the optional visible disclosure, and requires the hidden (latent) disclosure to say whether AI created or altered the content. Passed as an urgency bill, so it took effect on signing. ✅ Signed Sep 30, 2026 (Ch. 861) · Urgency statute, in effect on signing
California – AB 2656, Notice to Public Employees on AI Would have required state and local public employers to notify the union for a job classification at least 45 days before developing, buying, or requiring generative AI to do that classification’s work. 🔴 Vetoed Sep 30, 2026
California – AB 1542, Ban on Selling Sensitive Personal Information Would have amended the CCPA to bar businesses from selling or sharing consumers’ sensitive personal information with third parties, with limited exceptions. Today, Californians can only limit the use of sensitive data, not stop its sale outright. 🔴 Vetoed Sep 27, 2026
California – SB 1130, Wearable Recording Devices (Smart Glasses) Would have banned using smart glasses or other wearable recorders to capture people without consent in a business where they expect privacy, banned disabling recording indicator lights, and from 2028 required a visible recording light on devices sold in California. 🔴 Vetoed Sep 30, 2026
California – SB 923, Expanding Privacy Rights Act Closes a CCPA gap so your right to delete also reaches data a business got about you from third parties, not just data it collected directly. Lets businesses keep a suppression list so deleted data stays deleted, and requires online-only businesses to accept requests online. Sponsored by the state privacy agency. 🔵 Signed Sep 27, 2026 · Effective Jan 1, 2027
California – AB 1709, Addictive Features Ban for Under-16s Bars covered social media platforms from giving users under 16 addictive features such as algorithmic feeds and autoplay. The AG can write rules and expand which platforms are covered. Creates an e-Safety Advisory Commission in the state Justice Department. Enforced by the AG and local prosecutors. 🔵 Signed Sep 10, 2026 (Ch. 183)
California – AB 1856, Digital Age Assurance Act Amendments Amends California’s 2025 Digital Age Assurance Act (AB 1043), which makes operating systems collect a user’s age bracket at account setup and pass that signal to app stores and developers. AB 1856 extends the rule to any operating system with account setup and bars apps from requesting the signal unless the law requires it. Directly relevant to anyone using or selling devices with alternative operating systems. 🔵 Signed Sep 10, 2026 (Ch. 184) · Underlying act operative Jan 1, 2027
California – SB 813 and AB 1405, AI Audit Framework SB 813 sets up state-recognized independent verification organizations to check AI developers’ safety claims. AB 1405 creates a state registry of AI auditors and, starting in 2029, bars unregistered auditors. Together they are the third-party audit system that Executive Order N-9-26 tells agencies to speed up. 🔵 Both signed Sep 9, 2026 (Ch. 179 and Ch. 178) · Auditor registry requirement Jan 1, 2029
California – AB 1331, Workplace Surveillance Limits Bars employer surveillance in workplace bathrooms and similar private areas, and lets employees leave employer surveillance devices behind when entering them. $500 per violation, enforced by the Labor Commissioner. 🔵 Signed Sep 30, 2026 (Ch. 851)
California – SB 503, Bias in Health Care AI Requires developers and deployers of AI clinical decision support tools to identify and reduce known risks of biased results. 🔵 Signed Sep 30, 2026 (Ch. 857)
California – SB 1111, AI Digital Replicas Extends California’s right-of-publicity law to AI digital replicas of a person, and makes using a digital replica to defraud someone a form of false impersonation. 🔵 Signed Sep 30, 2026 (Ch. 862)
California – SB 1159, AI Agents in Government Processes Says AI agents are not “persons” or “members of the public” under the Public Records Act, the Brown Act, and other open-government laws, and makes it illegal to use AI to fake a real person’s participation with a government agency. 🔵 Signed Sep 30, 2026 (Ch. 863)
Colorado – SB 51, Age Attestation on Computing Devices Requires operating system developers to build age checks into new device accounts, sorting users into age brackets that restrict app access, meant to help apps comply with the Colorado Privacy Act’s stricter rules for minors’ data. Critics (including the Independence Institute) call it largely symbolic since the same content remains accessible through a web browser, school laptop, or library computer that isn’t covered by the law. Signed June 3, 2026. Operating system and app store duties start July 1, 2028. 🔵 Signed Jun 3, 2026 · Takes effect Jul 1, 2028
Alabama – SB 63, AI in Health Coverage Decisions Health plans cannot deny care as not medically necessary based on AI alone: a licensed physician or qualified professional must make the denial. Plans must disclose their AI use in written policies and certify compliance to the Department of Insurance each year. Fines up to $5,000 for a pattern of violations. Enacted April 17, 2026. ✅ Signed Apr 17, 2026 · Effective Oct 1, 2026
Alaska – HB 367, Consumer Data Privacy Act Alaska’s first comprehensive consumer data privacy bill. Establishes the Consumer Personal Information Privacy Act and data broker registration requirements. 35,000 consumer threshold. Referred to House Finance Committee May 12, 2026 and never left committee before the 34th Legislature adjourned. Bills do not carry over. ⚫ Died in House Finance · Legislature adjourned 2026
Arizona – HB 2311, AI Chatbot Disclosures Kids chatbot safety and disclosure requirements. Passed the House AI and Innovation Committee 7-0 and both chambers, but was vetoed by the governor on June 19, 2026. 🔴 Vetoed by Governor Jun 19, 2026
Ohio – HB 813, AI Watermarking Would require AI-generated products to include a watermark and would require AI systems acting as humans to disclose that they are AI. Introduced April 13, 2026. 🟡 In House committee
Wisconsin – AB 172 / SB 166, Consumer Data Privacy Act Wisconsin’s most advanced comprehensive privacy bill attempt. Its Senate companion is SB 166. A prior Wisconsin privacy bill passed the full Assembly four years ago but stalled in the Senate. Key provisions follow the Virginia model; business-friendly. AB 172 passed the Assembly State Affairs Committee 10-0 in January 2026 but failed to pass when the session ended March 23, 2026. ⚫ Failed to pass · Session ended Mar 23, 2026
Maryland – HB 952, Companion Chatbot Regulation Would have regulated companion chatbots, including limits on chatbots presenting themselves as behavioral health providers. Passed the House 123-4 but got only a hearing in the Senate Finance Committee before the session ended. ⚫ Passed House 123-4 · Died in Senate Finance · Session ended Apr 2026
Delaware – HB 306, Chatbot Safety Chatbot safety and disclosure requirements. Passed the House 25-12 on May 5, 2026, then sat in a Senate committee until the session ended June 30. ⚫ Died in Senate committee · Session ended Jun 30, 2026
Massachusetts – S 2619 / H 5479, Massachusetts Data Privacy Act Massachusetts has been trying to pass a comprehensive privacy law since 2019, and 2026 is its closest approach yet. The Senate passed S 2619 40-0 in September 2025; the House unanimously passed its stronger version (H 5479) 146-0 on June 4, 2026. A six-member conference committee was appointed June 17, 2026 to reconcile the two. The bill would include a limited private right of action: individuals could file complaints only against “large data holders” (controllers processing data of 2M+ consumers, or sensitive data of 200,000+), plus a strong data minimization requirement and a total ban on selling precise geolocation data. Key differences still being negotiated: the House version eliminates the right-to-cure period the Senate kept, and the two set different applicability thresholds. If reconciled, it goes to Governor Healey. Formal sessions ended July 31, 2026, so passage this term now depends on an informal session (where any single objection can block a bill) before the term ends in January 2027. As of mid-October, negotiators were reportedly still talking. 🟡 Both chambers passed versions · Conference committee appointed Jun 17, 2026, no report yet
Pennsylvania – HB 78, Consumer Data Privacy Act Pennsylvania’s comprehensive privacy bill passed the House 127-76 in October 2025. The Senate Communications and Technology Committee amended it and reported it out 11-0 on June 24, 2026, and it now awaits a full Senate vote. Was amended in April 2025 to expand the definition of sensitive data to include SSNs, driver’s license numbers, and financial credentials. Follows the Virginia model. Pennsylvania is one of the largest states still without a comprehensive privacy law. It would cover a population comparable to Virginia, Colorado, and Connecticut combined. 🟡 Passed House · Reported by Senate committee Jun 24, 2026 · Awaiting Senate vote
Pennsylvania – SB 806, AI-Generated Content in Advertising Requires disclosure when AI-generated content is used in advertising, treating undisclosed use as an unfair method of competition. Passed the Senate 48-2 and the House 163-40. 🔵 Signed Oct 22, 2026 (Act 99 of 2026)
Pennsylvania – HB 1925, AI in Health Care and Insurance Regulates how hospitals and other facilities, insurers, and Medicaid and CHIP managed care plans use AI, with oversight duties for the state Health, Insurance, and Human Services departments. 🟡 Passed House 144-59 Sep 30, 2026 · In Senate committee since Oct 14
Pennsylvania – SB 1090, AI Disclosures and Safeguards Requires disclosures and safeguards for AI systems that interact with consumers, enforced by the Attorney General. 🟡 Passed Senate 49-1 Mar 17, 2026 · In House committee
Pennsylvania – HB 2637, AI Chatbot Toy Moratorium Would ban making, distributing, selling, or leasing toys for children under 14 that include generative AI chatbots, for three years. Similar to California’s SB 867. Reported out of committee 24-2 on October 7, 2026. 🟡 Reported by House committee Oct 7, 2026
Pennsylvania – HB 2006, AI Companionship App Safety Would require AI companion apps to have safeguards for users who express suicidal thoughts or self-harm. 🟡 Passed House 133-70 Sep 28, 2026 · In Senate committee since Oct 13
New York – S 6954-B, Stop Deepfakes Act Would require provenance data (a record of where content came from) on AI-generated synthetic content. Passed the Senate 60-1 on June 3 and the Assembly on June 4, 2026. Would take effect 180 days after becoming law. 🟡 Passed legislature Jun 2026 · Awaiting Gov. Hochul
Maine – LD 2162, AI Companion Chatbot Regulation (Children) Would regulate and prevent child access to AI chatbots with human-like features and companion interfaces. Both chambers adopted a committee amendment, but the bill did not get final passage before Maine’s 2026 session adjourned. ⚫ Died on adjournment Apr 29, 2026
Hawaii – HB 1782, Companion Chatbot (Minors) Companion chatbot regulation for minors. Passed both House and Senate committees. Related to SB 3001 (now signed). May be superseded by SB 3001’s enactment. ⚫ Died in conference committee · Session adjourned May 2026
Hawaii – HB 2458, Surveillance Pricing (Food) Would have prohibited surveillance pricing in the sale of food. Passed the House but died in Senate committees when the session ended. ⚫ Died in Senate committee · Session adjourned May 2026
California – AB 2564, Surveillance Pricing Would have barred retailers from setting individualized prices based on personal information gathered through electronic surveillance. Passed the Senate 22-14 on the last night of session, but the Assembly never voted on the Senate amendments, so the bill died. ⚫ Died · Passed Senate Aug 31, 2026 · Assembly concurrence vote not taken before session ended
Minnesota – HF 3408, Surveillance Pricing Ban Would have prohibited the use of personal data to set individualized consumer prices. Introduced February 17, 2026 and never left the House Commerce Committee. ⚫ Died in committee · 2026 session ended
Rhode Island – HB 7538, Healthcare AI Disclosure Requires healthcare providers and facilities to tell patients when AI is used to record or summarize visits (AI scribes). Passed both chambers June 11, 2026. ✅ Signed Jun 22, 2026 · Effective on signing
Missouri – HB 2372, AI Therapy Ban (Dropped) The House version, passed April 2, 2026, banned AI from providing therapy, psychotherapy, or mental health diagnoses, with a $10,000 first-violation penalty. The Senate stripped the AI ban. The final health care bill was signed July 13, 2026 with no AI provisions. ⚫ AI provisions dropped · Underlying bill signed Jul 13, 2026 without them
Utah – HB 438, Companion Chatbot Safety Act Would have required companion chatbot operators to follow the Utah Consumer Privacy Act and added disclosure, data protection, and minor safety requirements. Passed the House 68-1 on February 20, 2026, then failed on the Senate floor 12-15 on March 5, 2026. Utah’s existing chatbot law remains HB 452 (mental health chatbot disclosures, effective May 2025). ⚫ Failed in Senate 12-15 Mar 5, 2026
Missouri – HB 2032, AI Chatbot Harmful Content (Minors) Would have required age verification for companion chatbots and barred chatbots that encourage minors to harm themselves or others. Reported out of a House committee but never reached the floor. ⚫ Died · Session closed May 2026
South Carolina – S 788, AI in Therapy and Psychotherapy Would have limited the use of AI in therapy and psychotherapy. Passed the Senate 44-0 in April 2026, then died in a House committee. ⚫ Passed Senate 44-0 · Died in House committee · Session closed
Oklahoma – HB 3544 / SB 1521, Chatbot Safety Companion chatbot safety bills with disclosure requirements, minor protections, and crisis response protocols. HB 3544 passed the House 96-0 but stalled in the Senate. SB 1521 passed both chambers, but the Senate never agreed to the House’s changes before the session ended in May. ⚫ Both died · Session ended May 2026
Michigan – SB 760, Kids Chatbot Safety Would prohibit chatbot operators from offering products to minors unless the chatbot cannot encourage self-harm, suicidal ideation, violence, drug or alcohol use, or disordered eating. Bars chatbots from offering mental health therapy to minors without licensed professional supervision, and from discouraging a minor from seeking help from a professional, parent, or guardian. Passed the full Senate April 29, 2026; now in the House Communications and Technology Committee. 🟡 Passed Senate Apr 29, 2026 · In House committee
Michigan – SB 1077 / HB 5579, Workplace Surveillance Companion bills restricting employers’ use of electronic monitoring and automated decision tools on workers, prohibiting them except for specified purposes. SB 1077 was referred to the Senate Labor Committee June 24, 2026; HB 5579 has been in the House Economic Competitiveness Committee since February 2026. 🟡 In committee in both chambers · 2026
Massachusetts – S 3164, Addictive Social Media Feeds (Minors) Would protect children from addictive social media feeds. Reported by Senate Ways and Means on July 2, 2026 as a new draft replacing S 30, and passed the Senate 38-2 on July 9. Now in the House. 🟡 Passed Senate 38-2 Jul 9, 2026 · In House
North Carolina – SB 1022 A new comprehensive consumer data privacy bill introduced by two Democratic state senators in North Carolina’s Republican-controlled Senate. Would give North Carolinians standard rights to access, correct, delete, and opt out of sale of personal data, following the now-common Virginia-model framework. 🟡 Filed Apr 30, 2026 · In Senate Appropriations since May 5, 2026, no action since
South Carolina – S 896, Chatbot Protection Act Would have regulated AI chatbots. Reported favorably by the Senate Labor, Commerce and Industry Committee on May 6, 2026, with no floor vote before the session ended. ⚫ Reported by Senate committee May 6, 2026 · Session closed
Illinois – SB 340 (Illinois Consumer Data Privacy Act), SB 315, and related AI bills

🔵 SB 315 – AI Safety Measures Act (signed)
🔵 SB 2909 – No AI Scoring in Teacher Evaluations (signed)
🔵 SB 3114 – Transparency in Downcoding Act (signed)
🟡 HB 3506 – AI Whistleblower Protections

 SB 340 – Illinois Consumer Data Privacy Act: Passed the Illinois Senate 54-3 on May 21, 2026, but did not pass the House: on May 31 it was sent back to the House Rules Committee without a vote, so it never reached the Governor. Would give Illinois residents rights to access, correct, delete, and opt out of data sales and targeted advertising. Would prohibit the outright sale of sensitive personal data. Modeled largely on Minnesota’s 2025 law. Would apply to businesses processing data of 100,000+ Illinois consumers, or 25,000+ if data sales account for more than 25% of revenue. Illinois’s legislative term runs through early January 2027, so it could technically still move in the short fall session (tentatively November 17-19), but nothing is scheduled.

SB 315 – AI Safety Measures Act (Public Act 104-0538): One of the most stringent AI transparency laws in the US, and the first in the country to mandate annual independent third-party audits of frontier AI safety practices, going beyond California and New York’s frontier laws, which only require companies to publish their own safety frameworks. Signed by Governor Pritzker on July 6, 2026 at a Chicago ceremony, calling it “the best artificial intelligence safety and accountability bill in the entire nation.” Passed the Illinois Senate 52-5 on May 21 and the House 110-0 on May 27, 2026. Covers “frontier developers” with $500M+ revenue and models trained above a defined compute threshold, covering companies like OpenAI, Anthropic, Google, Meta, and xAI. Provides whistleblower protections and internal reporting processes for covered employees. Effective January 1, 2027.

SB 2909: Bars evaluators from using AI to assign scores or ratings in teacher evaluations; AI may still be used for administrative support. Signed July 10, 2026 (Public Act 104-0565), effective January 1, 2027.

SB 3114 – Transparency in Downcoding Act: Insurers may not “downcode” medical claims (pay them at a lower billing level) using automated tools that skip review of the clinician’s documentation; downcoding must be made or reviewed by a person. Signed July 10, 2026 (Public Act 104-0568), effective January 1, 2028.

HB 3506 – AI Whistleblower Protections: Would bar large AI developers from stopping employees from reporting activity that poses a critical risk. Stuck in the House Rules Committee since April 2025; SB 315 already covers similar whistleblower protections.

 🔵 SB 315 signed Jul 6, 2026 · Effective Jan 1, 2027
🔵 SB 2909 signed Jul 10, 2026 · Effective Jan 1, 2027
🔵 SB 3114 signed Jul 10, 2026 · Effective Jan 1, 2028
🟡 SB 340 passed Senate May 21, 2026 · Re-referred to House Rules May 31, 2026 · Did not pass House
🟡 HB 3506 in House Rules since Apr 2025
Maine – LD 1822 A comprehensive privacy bill that passed the Senate but died between the two chambers on April 13, 2026, after a hard campaign against it by Maine’s business community. Dead for this session. ⚫ Died between chambers Apr 13, 2026 · Session closed
Connecticut – SB 5 (Public Act 26-15), An Act Concerning Online Safety Signed by Governor Lamont on May 27, 2026, the same day as SB 4. A broad AI and online safety package. Provisions that took effect October 1, 2026: disclosures for subscription AI services, risk and whistleblower duties for frontier AI developers, rules for automated employment decision tools (deployer duties apply to tools deployed on or after October 1, 2027), a rule that using AI is no defense to discrimination claims, provenance data for AI-generated content, and a requirement that employers say whether layoffs are related to AI. AI companion chatbot safety rules, including suicide and self-harm protocols and minor protections, start January 1, 2027. An AI regulatory sandbox starts July 1, 2027. ✅ Signed May 27, 2026 · Most provisions in effect Oct 1, 2026 · Chatbot safety provisions Jan 1, 2027 · Sandbox Jul 1, 2027
New Mexico – Health Data Privacy Act (HB 430) Would have required entities handling health data, including apps, wellness platforms, and consumer health tools, to obtain consent before using, sharing, or selling it, beyond what HIPAA already covers. A Washington My Health MY Data-style bill. Cleared the House Health committee but died before New Mexico’s legislature adjourned March 22, 2025. ⚫ Failed, session closed Mar 22, 2025
Colorado – HB 26-1210, Surveillance Pricing and Wage Setting Ban Would have prohibited using personal data to set individualized consumer prices or employee wages. Passed the legislature in May 2026 and was vetoed by Governor Polis on June 2, 2026. 🔴 Vetoed Jun 2, 2026
Colorado – HB 26-1139, AI in Health Insurance Coverage Decisions Prohibits health insurance decisions regarding coverage from being based solely on AI systems. Requires human review of AI-generated coverage determinations. Signed by Governor Polis on June 2, 2026. 🔵 Signed Jun 2, 2026 · Requirements apply Jan 1, 2027
Colorado – HB 26-1263, Chatbot Safety Bill Passed the House 40-24 and the Senate 24-11 and was signed by Governor Polis on May 29, 2026. Requires AI chatbot operators to disclose they are not human, maintain crisis response protocols for self-harm and suicidal ideation, and adds protections for minor users. 🔵 Signed May 29, 2026 · Effective Jan 1, 2027
New York – S 9051, Kids Companion Chatbot Ban Would prohibit AI companies from offering companion chatbots to children. Requires age assurance before providing companion features. Bans features that simulate emotional relationships or promote harmful behaviors for minors. Passed the Senate 60-0 on June 4 and the Assembly on June 5, 2026. Not yet delivered to Gov. Hochul; in practice, bills passed in June are acted on by year end. Would take effect Jan 1, 2027 if signed. 🟡 Passed legislature Jun 2026 · Awaiting Gov. Hochul (Dec 31 deadline)
New York – A 11560, Responsible Data Center Development Act First-in-the-nation moratorium on large AI data centers (peak power demand over 20 megawatts). One-year halt on state permits while agencies study environmental and energy grid impacts. Passed the Senate 43-17 and the Assembly on June 4, 2026 (Senate companion S 10642). Awaiting Hochul. 🟡 Passed legislature Jun 2026 · Awaiting Gov. Hochul (Dec 31 deadline)
New York – S 8451, FAIR News Act Would require news media content composed, authored, or created through generative AI to carry transparency disclosures. Aimed at combating false or misleading AI-generated news and content plagiarized without attribution. Passed legislature June 2026. 🟡 Passed legislature Jun 2026 · Awaiting Gov. Hochul (Dec 31 deadline)
New York – One Fair Price Act (S 8623B / A 9349B) Prohibits retailers from using personal data to set individualized prices. Bona fide discounts and loyalty programs are exempt. Businesses using automated pricing based on non-personal factors must disclose the system. Passed legislature June 2026. 🟡 Passed legislature Jun 2026 · Awaiting Gov. Hochul (Dec 31 deadline)
New York – A3411, AI Output Inaccuracy Disclosure Would require owners, licensees, and operators of generative AI systems to display a clear and conspicuous notice on user interfaces that AI outputs may be inaccurate. Passed the Assembly January 28, 2026 and the Senate 58-2 on March 9, 2026. Penalty up to $1,000 per violation. Awaiting Hochul. 🟡 Passed legislature Mar 9, 2026 · Awaiting Gov. Hochul
New Jersey – A 4085, Fair Price Protection Act Bans surveillance pricing of groceries and household goods, meaning prices set for you based on your personal data. Bona fide discounts and loyalty programs are exempt. Also puts a one-year moratorium on new electronic shelf labels. AG enforcement under the Consumer Fraud Act. 🔵 Signed Jul 23, 2026 (P.L.2026, c.55) · Main provisions take effect about Aug 2027
North Carolina – H 301, Social Media and AI Safety Social media protections for children under 16 plus provisions on AI in schools. The Senate passed it June 10, 2026; the House refused to agree 111-0 and conference committees were appointed June 23-24. 🟡 In conference committee
New Jersey – A 3497, FAIR Act The “Forbidding the Algorithmic Inflation of Rent Act” makes it a violation of the New Jersey Antitrust Act for a residential landlord to pay for an algorithmic rental-price-setting coordinator (e.g. property management pricing software used to coordinate rents). One of the first AI rental-pricing restrictions in the US. ✅ Signed Jul 20, 2026 (P.L.2026, c.43)
New Jersey – A 4733 Would prohibit advertising or marketing AI as capable of practicing a regulated profession or occupation (medicine, law, mental health therapy, etc.) without holding the appropriate license. Reported by the Assembly Regulated Professions Committee and pending in Assembly Appropriations since May 28, 2026. Senate companion is S 4088. 🟡 In Assembly Appropriations
Rhode Island – S 2197, Oversight of AI Technology in Mental Health Care Act Regulates the use of AI in mental health care, including limits on AI independently providing therapy without licensed human supervision. Passed the Senate May 21 and the House June 8, 2026. ✅ Signed Jun 22, 2026 · Effective on signing
South Dakota No comprehensive privacy bill passed this session. ⚫ Session closed 2026

Data Breach Notification Laws

✅ All 50 States + DC, Puerto Rico, Guam, and the US Virgin Islands

Every state in the country has a law requiring companies to tell you when your personal data has been exposed in a breach. This is the one area of privacy law where there’s universal agreement, though the details vary considerably. California requires notification within 72 hours for certain breaches. New York says “as soon as possible.” Most states give companies 30–90 days. Several require companies to notify the state AG in addition to the affected individuals. If you’ve ever gotten a “we take your privacy seriously” letter in the mail, this is why.

International Privacy Laws Affecting US Businesses

Law Region What It Means For You
GDPR
General Data Protection Regulation		 European Union The most comprehensive privacy law in the world. If your website has European visitors, this applies to you, regardless of where your business is. Maximum fines are 4% of your global revenue or €20 million, whichever is larger. Gives EU residents the right to access, correct, delete, and move their data. Requires breach notification within 72 hours. GDPR fines have passed €7.5 billion in total (CMS Enforcement Tracker, October 2026). In September 2026, Ireland’s regulator fined Google €403 million over how its location settings collected and kept data. Now intersects with the EU AI Act: companies can face both GDPR and AI Act penalties for the same underlying conduct. The standard every other privacy law gets compared to.
ePrivacy Directive
(“Cookie Law”)		 European Union The reason every website on the internet has a cookie consent popup. EU law requires genuine opt-in consent before placing tracking or advertising cookies on someone’s device. “Continuing to browse means you accept” does not count as consent. The planned replacement ePrivacy Regulation was withdrawn by the European Commission in October 2025. Cookie rules are now being revised through the EU Digital Omnibus (see below), which is still pending.
UK GDPR + Data Protection Act 2018 United Kingdom After Brexit, the UK kept its own version of GDPR rather than staying under EU rules. Works essentially the same way for UK residents. Enforced by the Information Commission, which replaced the Information Commissioner’s Office (ICO) on September 30, 2026. 2025-2026 update: The Data (Use and Access) Act 2025, most of whose data protection changes took effect February 5, 2026, amends the UK GDPR framework. See the separate entry below.
PIPEDA Canada (Federal) Canada’s national privacy law for businesses. Requires consent for collecting, using, or sharing personal information commercially. If you have Canadian customers, this applies to you.
Quebec Law 25 (Bill 64) Canada (Quebec) Canada’s toughest privacy law and the closest thing Canada has to GDPR. Requires privacy impact assessments, breach notification, and gives Quebec residents the right to have their data deleted or moved. Any business with Quebec customers needs to be aware of this.
Privacy Act 1988 (amended) Australia Australia’s foundational privacy law. Governs how businesses and government agencies handle personal information through a set of Australian Privacy Principles. The 2024 amendment package is mostly in force. Its automated decision-making transparency rules, requiring businesses to say in their privacy policies when computer programs make or inform significant decisions about you, take effect December 10, 2026. A second round of broader reforms has been flagged but not introduced.
EU AI Act
Regulation (EU) 2024/1689		 European Union The world’s first comprehensive AI regulation. Applies to US companies whenever their AI systems are placed on the EU market or their outputs are used inside the EU, the same extraterritorial reach as GDPR. Prohibitions on unacceptable-risk AI took effect February 2025. General-purpose AI model obligations took effect August 2025. Article 50 transparency obligations (disclosure that content is AI-generated, labeling deepfakes, marking machine-readable provenance) took effect August 2, 2026. IMPORTANT: The EU Digital Omnibus on AI (Regulation (EU) 2026/1744, in force July 27, 2026) deferred the high-risk AI system deadline from August 2, 2026 to December 2, 2027 (standalone systems) and August 2, 2028 (product-embedded systems). Generative AI systems already on the market before August 2, 2026 have until December 2, 2026 to add machine-readable marking. The Omnibus also adds a ban on AI tools that generate non-consensual intimate images of identifiable people. Maximum penalties: €35 million or 7% of global turnover, on top of any GDPR fines for the same conduct.
UK Data (Use and Access) Act 2025 United Kingdom Received Royal Assent June 19, 2025. Major reform to UK data protection law: simplifies compliance and adds new rules for smart data, digital identity verification, and automated decision-making. It has been switched on in stages since August 2025. Most data protection changes took effect February 5, 2026, and the ICO was replaced by a new Information Commission on September 30, 2026. A few provisions, including a new complaints process for individuals, are still being phased in.
India DPDP Act 2023
Digital Personal Data Protection Act		 India India’s first comprehensive data protection law, enacted August 2023. The implementing DPDP Rules were notified in November 2025 with an 18-month phased compliance period, so most obligations apply from around May 2027. Applies to any entity processing the personal data of Indian residents. Consent-based framework with requirements for data fiduciaries including notice, purpose limitation, and data minimization. Penalties up to ₹250 crore (approximately $30 million). US companies with Indian users or outsourced operations in India should be monitoring compliance timelines.
EU Digital Omnibus (GDPR and ePrivacy amendments)
Proposal 2025/0360(COD), pending		 European Union A pending EU proposal, first published November 19, 2025, that would amend the GDPR and the ePrivacy cookie rules. EU member states agreed their negotiating position around October 21, 2026; the European Parliament has not finished its own. Privacy groups including noyb say the member states’ version would let companies use personal data to train AI under “legitimate interest” and would narrow what counts as personal data, so things like pseudonymous IDs could fall outside GDPR. Not law yet: Parliament, member states, and the Commission still have to agree a final text.

For privacy tools, de-Googled phones, and practical steps to protect your data today, visit the MARK37 Resources page or schedule a free consultation.

Change Log

This tracker is updated as bills move through legislatures and are signed into law. Most recent changes appear first.

October 25, 2026

  • Colorado SB 26-051 (age attestation) – effective date corrected from Aug 12, 2026 to Jul 1, 2028.
  • App Store Accountability Act (HR 3149) – added full committee approval 26-23 on Mar 5, 2026.
  • KIDS Act (HR 7757) – added the 28-24 committee vote on Mar 5, 2026.
  • Senior Chatbot Protection Act (S 5117) – added.
  • States sue OpenAI – corrected to at least six filing states; Kansas and Nebraska joined the announcement.
  • Multistate action in Character.AI bankruptcy – corrected to 40 attorneys general including DC.
  • Georgia note – Act number (462) added.
  • Rhode Island HB 7538 – effective on signing; link updated to the enacted version.
  • Rhode Island S 2197 – effective on signing; link updated to the enacted version.
  • Kansas HB 2183 – signing date (Feb 5, 2026) and effective date added.
  • Florida HB 3 (social media for minors) – added; enforceable after Oct 14, 2026 ruling.
  • Mississippi HB 1126 – added; enforceable pending Fifth Circuit decision.
  • Tennessee HB 1891 – added; Sixth Circuit remand Aug 28, 2026.
  • West Virginia HB 4412 (age verification) – added; effective Jun 12, 2026.
  • Arkansas Acts 900 and 901 – added; both blocked by federal court.
  • Ohio Parental Notification by Social Media Operators Act – added; blocked pending Supreme Court petition.
  • Texas SCOPE Act (HB 18) – added; content filtering rules blocked Jul 24, 2026.
  • West Virginia SB 84 (police cameras on private land) – added; effective Jun 4, 2026.
  • Wyoming SF 20 (government data privacy) – added.
  • Wyoming HB 102 (AI deepfakes) – added; effective Jul 1, 2026.
  • Pennsylvania HB 2637 (AI chatbot toys) – added.
  • Pennsylvania HB 2006 (AI companion apps) – added.
  • New York S 6954-B (Stop Deepfakes Act) – added.
  • Texas AG settlement with Temu – added.

October 24, 2026

  • Kids Online Safety Act (S 1748) – Sen. Paul blocked a unanimous consent request to pass it on Sep 30, 2026; status updated.
  • COPPA 2.0 (S 836) – corrected: passed the Senate Mar 5, 2026 and is held at the House desk.
  • SECURE Data Act (HR 8413) – introduction date corrected to Apr 21, 2026; sponsor and Judiciary referral added.
  • GUARD Financial Data Act (HR 8398) – introduction date corrected to Apr 21, 2026; sponsor added.
  • KIDS Act (HR 7757) – added Senate referral (Jul 13, 2026) and no further Senate action.
  • App Store Accountability Act (HR 3149) – status corrected to subcommittee action only (Dec 11, 2025).
  • Chatrie v. United States – holding corrected (Location History access is a search; warrant question sent back to the Fourth Circuit) and link fixed.
  • AI Preemption Moratorium (HR 1) – added that the Senate stripped it 99-1 on Jul 1, 2025.
  • Buzz Off Act (HR 96) – renamed to the bill’s official title; sponsor added.
  • Protect Liberty and End Warrantless Surveillance Act (HR 7816) – sponsor and Intelligence Committee referral added.
  • Facial Recognition Act (HR 4695) – Science Committee referral and introduction date added.
  • HR 3782 – sponsor, committee, and introduction date added.
  • ICE Out of Our Faces Act (S 3779) – committee and House companion added.
  • Privacy Act Modernization Act (S 1208) – status changed from active to no action since Mar 31, 2025.
  • Don’t Sell Kids’ Data Act (HR 6292) – introduction date corrected to Nov 25, 2025; subcommittee action added.
  • Sammy’s Law (HR 2657) – subcommittee action (Dec 11, 2025) added.
  • GUARD Act (S 3062) – placed on Senate calendar May 11, 2026.
  • FISA Section 702 – added; statutory authority lapsed Jun 12, 2026.
  • AI Emergency Button Act (S 5417) – added; unanimous consent blocked Sep 16, 2026.
  • AI Risk Management and Security Act (S 5576) – added.
  • NO FAKES Act (S 4591) – added; unanimous consent blocked Sep 30, 2026.
  • Executive order on state AI laws and DOJ AI Litigation Task Force – added.
  • FTC investigation of frontier AI companies – added.
  • FTC chatbot orders – date corrected to Sep 11, 2025.
  • California SB 300 – corrected: did not become law (moved to inactive file Aug 30, 2026). The Oct 3 entry listing it as signed was wrong.
  • California signing and veto count – corrected: Newsom vetoed at least five privacy and AI bills in 2026 (AB 1542, AB 2575, AB 2656, SB 903, SB 1130), not three; the Oct 3 “22 of 25” figure was not supportable.
  • California AB 2564 (surveillance pricing) – corrected: died without a final Assembly vote, was not signed.
  • California AB 883 – corrected signing date to Sep 27, 2026; description updated.
  • California SB 354 – corrected signing date to Sep 27, 2026; operative Jul 1, 2028.
  • California SB 690 – description updated to the signed version (Ch. 976).
  • California AB 1883 – signing date corrected from Sep 3 to Sep 30, 2026.
  • California SB 1119 (Adam’s Law) – description corrected to match the signed bill; operative Jul 1, 2027 confirmed.
  • California SB 951 – description corrected; unsourced 90-day, 25%, and Jul 1, 2027 details removed.
  • California AB 2246 – corrected: signed Sep 10, 2026; it rewrites the Age-Appropriate Design Code, not an under-16 account ban.
  • California SB 1106 – removed; the row described the wrong bill, and its Delete Act change passed in AB 883.
  • California AB 1609 – description updated (15-minute human contact rule, penalties); unsourced $500M threshold removed.
  • California SB 903 – vote counts corrected.
  • California SB 867 – marked as taking effect Jan 1, 2027, not yet in effect.
  • California Executive Order N-9-26 – date corrected to Sep 18, 2026; official link added.
  • California Age-Appropriate Design Code Act (AB 2273) – status changed to mostly blocked and repealed/replaced by AB 2246.
  • California Delete Act / DROP – signup figure updated to 560,000+; CalPrivacy broker fines added.
  • California AI Transparency Act (SB 942) – marked in effect; SB 1000 and AB 2713 amendments noted.
  • California SB 1000 – added (signed Sep 30, 2026, urgency statute).
  • California AB 2656 – added (vetoed Sep 30, 2026).
  • California AB 1542 (sensitive data sale ban) – added (vetoed Sep 27, 2026).
  • California SB 1130 (smart glasses recording) – added (vetoed Sep 30, 2026).
  • California SB 923 (Expanding Privacy Rights Act) – added (signed Sep 27, 2026).
  • California AB 1709 (addictive features, under 16) – added (signed Sep 10, 2026).
  • California AB 1856 (Digital Age Assurance Act amendments) – added (signed Sep 10, 2026).
  • California SB 813 and AB 1405 (AI audit framework) – added (signed Sep 9, 2026).
  • California AB 1331 (workplace surveillance limits) – added (signed Sep 30, 2026).
  • California SB 503 (bias in health care AI) – added (signed Sep 30, 2026).
  • California SB 1111 (AI digital replicas) – added (signed Sep 30, 2026).
  • California SB 1159 (AI agents in government processes) – added (signed Sep 30, 2026).
  • California AB 1979 – chapter number added.
  • California SB 1050 – chapter number added.
  • California SB 947 – chapter number and penalty added.
  • California AB 56 – warning label timing corrected.
  • California SB 243 – noted that SB 1119 replaces its minor-user rules Jul 1, 2027.
  • Georgia SB 111 – removed from the comprehensive laws table; the enacted bill contains no privacy provisions. Note added.
  • Georgia SB 540 (chatbots) – moved to the chatbot section.
  • Georgia SB 351 (social media age verification) – added; Eleventh Circuit vacated the injunction Oct 15, 2026.
  • Alabama App Store Accountability Act – corrected bill number to HB 161; effective Jan 1, 2027.
  • Alabama SB 63 – link added and description corrected.
  • Alaska HB 367 – changed to died in committee.
  • Arizona HB 2311 – link added.
  • Arkansas biometric law – corrected to Act 1030 of 2019 (no consent requirement); link fixed.
  • Colorado HB 26-1210 (surveillance pricing) – corrected: vetoed Jun 2, 2026.
  • Colorado SB 26-189 – marked as taking effect Jan 1, 2027.
  • Colorado HB 26-1263 – signing date corrected to May 29, 2026; effective Jan 1, 2027.
  • Colorado HB 26-1139 – signed Jun 2, 2026; requirements apply Jan 1, 2027.
  • Colorado HB 24-1130 – effective date corrected to Jul 1, 2025.
  • Colorado HB 24-1136 – Tenth Circuit briefing complete; HB 26-1148 failed in committee.
  • Connecticut SB 5 (Public Act 26-15) – corrected signing date to May 27, 2026; provisions in effect Oct 1, 2026 and Jan 1, 2027 listed.
  • Connecticut CTDPA – corrected the 2025 amendment to Public Act 25-113 and the financial institution exemption description.
  • Delaware HB 380 – signed Sep 2, 2026; lowers threshold to 15,000 consumers; link fixed.
  • Delaware HB 306 – changed to died in Senate committee.
  • Delaware HB 191 – link fixed.
  • Florida Digital Bill of Rights – corrected litigation note (the case concerns HB 3, now enforceable).
  • Florida v. OpenAI – temporary injunction motion (Sep 28, 2026) added.
  • Florida v. TP-Link – added.
  • Florida v. Discord – added.
  • Hawaii SB 3001 – Act number added.
  • Hawaii HB 2458 – changed to died in committee.
  • Idaho S 1297 – signing date corrected to Mar 31, 2026; official link added.
  • Illinois SB 340 (Consumer Data Privacy Act) – corrected: passed the Senate only and was sent back to House Rules; it is not awaiting the Governor.
  • Illinois SB 2691 – removed; the bill number belonged to an unrelated insurance study.
  • Illinois HB 3506 – description corrected (AI whistleblower bill, stalled).
  • Illinois SB 315 – Public Act number added; Senate vote date corrected.
  • Illinois SB 2909 – signed Jul 10, 2026; effective Jan 1, 2027.
  • Illinois SB 3114 – corrected to the Transparency in Downcoding Act; effective Jan 1, 2028.
  • Illinois HB 3773 – link and signing details corrected.
  • Illinois HB 1806 – signing date corrected to Aug 1, 2025.
  • Illinois Executive Order 2026-07 (AI Cabinet) – added.
  • Iowa SF 2417 – requirements apply Jul 1, 2027; description corrected.
  • Kansas HB 2183 – description and link corrected.
  • Kentucky HB 692 – description corrected (consent for smart TV content recognition data).
  • Louisiana HB 977 – Act 185, signed May 15, 2026, effective Jul 1, 2027.
  • Maine LD 1822 – corrected to died between chambers Apr 13, 2026.
  • Maine LD 2162 – corrected to died on adjournment Apr 29, 2026.
  • Maine LD 1727 – link fixed; signing date added.
  • Maine LD 2082 – chapter number added.
  • Maryland HB 711 – description corrected (ban on selling data for civil immigration enforcement).
  • Maryland HB 952 – changed to died in Senate committee.
  • Massachusetts S 2619 / H 5479 – status updated; formal sessions ended Jul 31, 2026.
  • Massachusetts S 3164 – corrected: addictive social media feeds bill; passed Senate 38-2.
  • Michigan SB 231 – removed; the bill number belonged to an unrelated bill.
  • Minnesota HF 2700 – changed to died at session end; link fixed.
  • Minnesota HF 3408 – changed to died at session end.
  • Minnesota Kids Social Media Safety Act (HF 4138) – added.
  • Minnesota warning label law – NetChoice v. Ellison noted.
  • Missouri HB 2372 – corrected: AI therapy ban was stripped; underlying bill signed without it. Moved to the 2026 activity table.
  • Montana Biometric Information Privacy Act – removed; the cited bill (SB 325) is not a biometric law.
  • Montana MCDPA – threshold and cure period corrected per the 2025 amendment.
  • Nebraska LB 383 – corrected to partially blocked (Jun 27, 2026).
  • Nebraska LB 525 – marked effective Jul 1, 2027.
  • Nebraska LB 504 – signing gap corrected; link fixed.
  • Nevada consumer health data law – corrected bill to SB 370 (2023).
  • New Hampshire HB 1687 – removed; the bill number belonged to an unrelated bill.
  • New Jersey A 5328 (data broker law) – signing date corrected to Jun 30, 2026; given its own entry.
  • New Jersey S 2316 / S 4109 – row removed (merged into A 5328).
  • New Jersey Data Privacy Act – cure period end date (Jul 1, 2026) added; link fixed.
  • New Jersey Kids Code Act (A 4015) – added; signed Aug 11, 2026.
  • New Jersey Fair Price Protection Act (A 4085) – added; signed Jul 23, 2026.
  • New Jersey A 4733 – status corrected (in Assembly Appropriations).
  • New York Health Information Privacy Act (S 9269) – passed legislature Jun 2026; awaiting Gov. Hochul.
  • New York AI Training Data Transparency Act (A 6578B) – passed legislature Jun 4, 2026; awaiting Gov. Hochul.
  • New York A3411 – status corrected to passed legislature Mar 9, 2026.
  • New York SAFE for Kids Act – moved to the children’s enacted section.
  • New York Child Data Protection Act – moved to the children’s enacted section.
  • New York RAISE Act – moved to the AI enacted section; Mar 27, 2026 chapter amendment added.
  • North Carolina H 301 – added (in conference committee).
  • Ohio HB 813 – link added.
  • Oklahoma HB 3544 – changed to died at session end.
  • Oklahoma SB 1521 – changed to died at session end.
  • Oklahoma SB 546 – signing date (Mar 20, 2026) added; link fixed.
  • Oregon Executive Order 26-26 (AI procurement) – added.
  • Pennsylvania HB 78 – status updated (reported by Senate committee Jun 24, 2026).
  • Pennsylvania SB 806 (AI in advertising) – added; signed Oct 22, 2026.
  • Pennsylvania HB 1925 (AI in health care and insurance) – added.
  • Pennsylvania SB 1090 (AI disclosures) – added.
  • Rhode Island HB 7538 – signed Jun 22, 2026.
  • Rhode Island S 2197 – signed Jun 22, 2026.
  • South Carolina H 3431 (Act 96) – replaces the H 3402 entry, which was the wrong bill.
  • South Carolina S 896 – corrected to the Chatbot Protection Act; marked dead.
  • South Carolina S 788 – corrected to AI in therapy; marked dead.
  • Texas data broker law – corrected to SB 2105 (registration with the Secretary of State, no opt-out right).
  • Texas HB 149 – description updated to match the enacted law.
  • Utah HB 438 – corrected: failed on the Senate floor 12-15; moved from the chatbot laws section to the 2026 activity table.
  • Utah HB 276 – dates and description updated.
  • Utah SB 142 – effective and enforcement dates added.
  • Virginia SB 338 – link fixed.
  • Virginia SB 854 – link fixed; appeal status updated.
  • Washington HB 2225 – marked effective Jan 1, 2027.
  • Oregon SB 1546 – marked effective Jan 1, 2027.
  • Washington SSB 5886 – vote count and dates corrected.
  • Wisconsin AB 172 – changed to failed at session end.
  • Eight states sue OpenAI – added.
  • Multistate action in Character.AI bankruptcy – added.
  • International, GDPR – fines total updated; Ireland’s €403M Google fine added.
  • International, ePrivacy – replacement regulation withdrawn Oct 2025.
  • International, UK Data (Use and Access) Act – link and Royal Assent date corrected; staged commencement and new Information Commission noted.
  • International, EU AI Act – Digital Omnibus regulation number and Dec 2, 2026 transition added.
  • International, India DPDP Act – compliance timeline corrected.
  • International, EU Digital Omnibus (GDPR and ePrivacy amendments) – added as pending.
  • State count – intro now explains the 23-state count, which excludes Florida’s narrower law and Georgia.

October 3, 2026

  • California Newsom final signing/veto decisions (Sept 30 deadline). Newsom signed 22 of 25 privacy and AI bills, vetoed 3. All California pending entries updated to final status.
  • SB 947 “No Robo Bosses Act” – SIGNED Sept 30. First state to ban AI-only firings. Operative Jul 1, 2027.
  • SB 1000 (AI Transparency Act amendments) – SIGNED Sept 30.
  • SB 951 (technological displacement notice) – SIGNED Sept 30.
  • SB 690 (CIPA pen register fix) – SIGNED, retroactive.
  • AB 1979 (clinical judgment) – SIGNED Sept 30.
  • AB 1609 (Right to Human Customer Service Act) – SIGNED Sep 28. Was incorrectly marked as VETOED, corrected.
  • SB 867 (companion chatbot toy moratorium, 4 years) – SIGNED Sep 10. Was entirely missing from tracker.
  • AB 883, SB 300, SB 354 – all SIGNED Sept 30.
  • AB 2575 (healthcare AI override for nurses) – VETOED Sept 30. Nurses Association called it a “green light to discipline nurses who override unsafe AI.”
  • SB 903 (AI in mental health therapy) – VETOED. Senator Padilla called it “deeply disappointing.”
  • AB 2656 (notice to public employees re AI) – VETOED.
  • SB 1119 (Adam’s Law) – signing date corrected from “Sep 30” to the actual Sep 10 ceremony date.
  • Connecticut CART Act (SB 5) – multiple provisions took effect October 1, 2026.

September 2026 and earlier

Earlier changelog entries have been moved to the Change Log Archive page to keep this page readable. That page contains the full history from initial publication (May 28, 2026) through September 24, 2026.

Sources: IAPP US State & Federal Privacy Legislation Trackers · Troutman Pepper Privacy + Cyber + AI weekly state updates · DLA Piper Privacy Matters · Hunton Privacy Blog · WilmerHale Privacy Blog · Lexology · Transparency Coalition AI legislative updates · CalMatters Digital Democracy · LegiScan · official legislature, governor, and attorney general websites · MultiState.us · Congress.gov · Secure Privacy · Last updated October 25, 2026.

Privacy legislation moves fast and this is a living document: bills tracked here move through committees, floor votes, and governors’ desks continuously. Check the Last Updated date at the top of this page, and verify current status with primary sources before relying on any specific bill for compliance purposes.

Connect on Social Media

Get updates by email
Shopping cart0
There are no products in the cart!
Continue shopping