Keypoint: It was a busy week with lawmakers in Virginia and Colorado moving forward with bills to amend the Virginia Consumer Data Protection Act and Colorado Privacy Act.
Below is the third weekly update on the status of proposed state privacy legislation in 2024.
Table of Contents
- What’s New
- Bill Tracker Charts
- Bill Tracker Maps
1. What’s New?
In Virginia, two children’s privacy bills that seek to amend the Virginia Consumer Data Protection Act (VCDPA) passed their respective chambers. First, HB 707 unanimously passed the House of Delegates on February 6. Among other things, the bill prohibits controllers from processing children’s data for the purposes of targeted advertising, sale, or profiling without parental consent. Notably, the bill retains the VCDPA’s definition of “child” as a natural person under the age of 13. The VCDPA currently requires controllers to obtain parental consent for the processing of personal data of children under 13. The bill also creates additional data protection impact assessment requirements for online products, services or features that a controller knows are directed to children. The bill was referred to the Senate Committee on Commerce and Law. Meanwhile, SB 361 unanimously passed the Senate on February 9. That bill was amended and now matches the text of HB 707.
Another VCDPA amendment bill (SB 359) was engrossed by the Senate on February 9. That bill seeks to amend the VCDPA to add restrictions on social media companies.
In other children’s privacy bill developments, lawmakers introduced new bills in Arizona (HB 2858) and Illinois (SB 3334).
Virginia is not the only state moving forward with legislation to amend its existing consumer privacy law. In Colorado, HB 1058 passed the House on February 9. The bill seeks to amend the Colorado Privacy Act’s definition of sensitive data to include biological and neural data. In other health data privacy developments, a Hawaii committee voted to pass an amended version of HB 1566 – a My Health My Data-like health data privacy bill.
In consumer data privacy act developments, Iowa lawmakers introduced SF 2272, which seeks to amend the Iowa consumer privacy law by, among other things, increasing the age of child to under 18 years of age, adding “health data” to the law’s definition of sensitive data (and defining the term), and adding a right to opt out of profiling.
In addition, lawmakers introduced new consumer data privacy bills in Kentucky (HB 15), Illinois (SB 3517 and HB 5581), and Georgia (SB 473). There are now three consumer data privacy act bills filed in Kentucky.
Further, the New York Privacy Act (S 365) passed out of committee. Last year, that bill passed the Senate but died in the Assembly. In Maine, lawmakers held another work session on the two competing consumer data privacy bills (LD 1973 / LD 1977).
Finally, in data broker bill news, a new data broker bill was introduced in Illinois (HB 3516) while a Hawaii committee recommended that HB 1668 be deferred.
2. Bill Tracker Charts
For more information on all of the bills introduced to date, including links to the bills, bill status, last action, hearing dates, and bill sponsor information, please see the following charts:
These charts are updated on a weekly basis. Husch privacy clients can email fred.sager@huschblackwell.com to obtain unredacted copies of the charts.
3. Bill Tracker Maps
To access our tracker maps, click the following links:
[View source.]
