Keypoint: The 2023 state legislative session is off to a fast start with state lawmakers introducing consumer data privacy bills in eight states and numerous bills on biometric information, children’s privacy, health data privacy, data broker regulation, and automated employment decision tools.
We are back for our fourth year of tracking state privacy legislation and our third year of providing weekly updates. As in past years, we will track consumer data privacy legislation through our weekly updates and our State Privacy Law Tracker map.
With the rapid expansion of state privacy bill topics, we are expanding our coverage. Last year, we added biometric privacy bills and data broker bills to our weekly alerts. This year, we are adding children’s privacy, health data privacy, automated employment decision tools, and algorithmic discrimination bills.
Table of Contents
- What’s New?
- Upcoming Hearings
- Consumer Data Privacy Bills
- Biometric Privacy Bills
- Data Broker Bills
- Children’s Privacy Bills
- Health Data Privacy Bills
- Automated Employment Decision Tools Bills
- Algorithmic Discrimination Bills
1. What’s New?
With legislatures opening across the country, there was an avalanche of new bills.
Eight states are now considering broad consumer data privacy bills – Indiana, Iowa, Kentucky, Mississippi, New York, Oklahoma, Oregon, and Tennessee. Seven of those bills were filed last session. Three states – Indiana, Iowa, and Oklahoma –passed a bill out of one chamber but not the other. In addition, three New Jersey bills rolled over from the last legislative session. Although not as broad as the other bills, we have included them in our alerts and tracker.
The Oregon bill is new this year. It is the product of a work group run by the Oregon Attorney General in 2022. In fact, Oregon has turned into a hotbed for privacy legislation with lawmakers also filing an age-appropriate design code bill and refiling a data broker bill.
Lawmakers in New Jersey, Texas, Virginia, and West Virginia are now considering children’s privacy bills. As noted in our introduction, this is a new category of bills we will be following this year. We expect to see lawmakers file more of these bills after California passed its first-in-the-nation Age-Appropriate Design Code law in September 2022. The Oregon and New Jersey bills are similar to the California law. The Texas bill would prohibit individuals between 13 and 18 years of age from using a social media platform. The Virginia companion bills would amend the Virginia Consumer Data Protection Act to protect children under the age of 18. The West Virginia bill would complement federal children’s privacy law by extending protections to children under the age of 18.
Lawmakers have filed two biometric privacy bills to date in Maryland and Mississippi. The Maryland bill is a refile from the last legislative session. Last year’s bill passed the House but stalled in the Senate. These two bills are likely only the start. In December 2022, Pluribus News reported that the ACLU hopes that “at least 20% of the state legislatures” will introduce BIPA-like bills this year based on a “coordinated, multi-state” effort by the ACLU.
Lawmakers in three states – New York, Virginia, and Washington – have proposed health data privacy bills. These bills would create privacy obligations and requirements for the processing of health-related data.
Finally, two states – New Jersey and New York – are considering automated employment decision tool bills. These bills, apparently inspired by New York City Local Law 144, would regulate how employers use automated tools to make employment decisions.
2. Upcoming Hearings
January 18, 2023
Public hearing on Oregon HB 2052 (data brokers).
3. Consumer Data Privacy Bills
The below states are considering consumer data privacy bills. These bills are also tracked on our 2023 State Privacy Law Tracker.
Indiana
Republican Senator Liz Brown introduced SB 5 on January 9, 2023. The bill was referred to the Committee on Commerce and Technology. Last year, the Indiana Senate passed Senator Brown’s SB 358 but it did not make it out of the House.
Iowa
House Study Bill 12 was introduced on January 12, 2023. It was referred to the Economic Growth and Technology Committee and assigned to a three-member subcommittee. Last year, the Iowa House passed House File 2506 but it stalled in the Senate.
Kentucky
Republican Senator Whitney Westerfield introduced SB15 on January 5, 2023. The bill was referred to the Committee on Economic Development, Tourism and Labor. Last year, Senator Westerfield filed SB15.
Mississippi
Democrat Senator Angela Turner-Ford introduced SB 2080 on January 9, 2023. The bill was referred to the Judiciary Committee. Last year, Senator Turner-Ford introduced SB 2330.
New Jersey
Three bills that we tracked last year have carried over to the 2023 session –S332, A505, and A1971. The bills remain in committee. These bills are not as broad as the other bills discussed in this section.
New York
On January 4, 2023, Democrat Senator Kevin Thomas introduced S365. The bill was referred to the Consumer Protection Committee. Senator Thomas introduced S6701 last year. On January 9, 2023, lawmakers also introduced A417, which would create consumer rights around access to and transfers of personal information. The bill was referred to the Consumer Affairs and Protection Committee.
Oklahoma
Republican Representative Josh West pre-filed HB 1030 – the Oklahoma Computer Data Privacy Act (OCDPA). The Oklahoma legislature will open February 6, 2023. Representative West filed privacy legislation the last two years with the bills passing the House but not the Senate. In previous years, the bills were co-sponsored by Collin Walke who retired from the House. As in prior years, the hallmark of the OCDPA is that it would require consumer consent for all personal data collection.
Oregon
Democrat Senator Floyd Prozanski and Democrat Representative Paul Hovley introduced SB 619. The bill was filed at the request of Attorney General Ellen Rosenblum. The Attorney General’s office convened a work group over the summer and fall to work on the bill. The work group was led by Kate Denison and Kimberly McCullough. The bill was referred to the Joint Committee on Ways and Means.
Tennessee
Republic Senator Bo Watson introduced SB73 on January 4, 2023. The bill passed first and second consideration and is held at the desk pending committee appointments. The bill text is available here. Tennessee lawmakers considered a similar bill last year.
4. Biometric Privacy Bills
The following states are considering BIPA-like biometric information privacy bills:
Maryland
Delegates Love, Charkoudian, Lehman, and Watson introduced HB 33 on January 11, 2023. The bill was referred to the Economic Matters Committee. Last year, the Maryland House passed HB 259, but the bill did not make it out of the Senate.
Mississippi
Representative Anthony Porter introduced HB 467 on January 12, 2023. The bill was referred to the Judiciary Committee.
5. Data Broker Bills
The following states are considering bills that would regulate data brokers:
New Jersey
Democrat Assemblyman William Moen, Jr. introduced A4811 on October 20, 2022. The bill was referred to the Assembly Science, Innovation and Technology Committee.
Oregon
HB 2052 was introduced at the request of the Attorney General’s office. It was referred to the Business and Labor Committee and is scheduled for a public hearing on January 18, 2023. Last year lawmakers considered HB 4017.
6. Children’s Privacy Bills
The following states are considering legislation to regulate children’s privacy. This list of bills is not intended to cover student data privacy bills.
New Jersey
Democrat Assemblyman Conaway, Jr. introduced A4919 on December 5, 2022. The bill was referred to the Assembly Science, Innovation and Technology Committee. The New Jersey legislative website indicates that a companion bill (S3493) will be introduced by Democrat Senator Vitale. The bill appears to be based on the California Age-Appropriate Design Code law that passed in 2022.
Oregon
Democrat Senator Chris Gorsek introduced SB196. The bill was referred to the Judiciary Committee. The bill appears to be based on the California Age-Appropriate Design Code law that passed in 2022.
Texas
Texas lawmakers are considering HB 896, which would prohibit an individual between 13 and 18 years of age from using a social media platform.
Virginia
Lawmakers introduced companion bills to amend the Virginia Consumer Data Protection Act (VCDPA) (HB 1688 / SB 1026). The bills would amend the VCDPA by (1) re-defining “child” to be a person under 18 years of age (and not under 13); (2) require operators to obtain parental consent prior to registering a child for their product or services; and (3) require operators to not knowingly process the personal data of a child for purposes of (i) targeted advertising, (ii) the sale of such personal data, or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning a consumer. The bills are pending committee referral.
West Virginia
Delegate Wayne Clark introduced HB 2460 on January 11, 2023. The bill states that it is intended to “complement the body of federal law governing online privacy protections for children” and would extend protections to children under 18. The bill was referred to the House Judiciary Committee.
7. Health Data Privacy Bills
The following states are considering bills that would create new or additional privacy protections for health data processed by private entities:
New York
Senator Liz Krueger filed SB 158 on January 4, 2023. The bill was referred to the Senate Internet and Technology Committee.
Virginia
Lawmakers are considering companion bills HB 2219 and SB 1432. The bills are pending committee referral.
Washington
Companion bills were filed in the House (HB 1155) and Senate (SB 5351). The House bill was referred to the Civil Rights & Judiciary Committee. The Senate bill was referred to the Law & Justice Committee.
8. Automated Employment Decision Tools Bills
The following states are considering bills that would regulate the use of automated employment decision tools. These bills are similar to New York City Local Law 144.
New Jersey
A group of assembly members introduced A4909 on December 5, 2022. The bill was referred to the Assembly Labor Committee. An identical bill was introduced in the Senate by Senator Andrew Zwicker under bill number S1926. That bill was referred to the Senate Labor Committee.
New York
Representative Latoya Joyner introduced A567 on January 9, 2023. The bill was referred to the Labor Committee.
9. Algorithmic Discrimination Bills
These bills would protect against algorithmic discrimination and promote transparency such as the Washington, D.C. Stop Discrimination by Algorithms Act of 2021 (B24-0558). Our focus is on bills that impact businesses, not government. No states have proposed such legislation to date.
[View source.]
