Keypoint: Last week chambers in Hawaii, Iowa, and Oklahoma passed consumer privacy bills.
Below is the ninth weekly update on the status of proposed state privacy legislation in 2023. Before we get to our update, we wanted to provide two reminders.
First we are regularly updating our 2023 State Privacy Law Tracker, 2023 State Children’s Privacy Law Tracker, and 2023 State Biometric Privacy Law Tracker. We encourage you to bookmark the pages for easy reference.
Second, the contents provided below are time-sensitive and subject to change.
Table of Contents
- What’s New?
- Upcoming Hearings
- Consumer Data Privacy Bills
- Biometric Privacy Bills
- Children’s Privacy Bills
- Data Broker Bills
- Health Data Privacy Bills
- Automated Employment Decision Tools Bills
- Algorithmic Discrimination Bills
1. What’s New?
Three consumer data privacy bills passed a chamber last week.
On March 6, the Iowa Senate passed SF 262 by a vote of 47-0. The bill is most analogous to the business-friendly Utah Consumer Privacy Act. Keir Lamont and Mercedes Subhani from the Future of Privacy Forum prepared a very useful chart comparing the Iowa bill to the Connecticut Data Privacy Act. Last year, the Iowa House passed a consumer privacy bill, but it failed to pass the Senate.
On March 7, the Hawaii Senate passed SB 974 by a 23-0 vote with 1 excused. The bill, which is based on the VCDPA, would go into effect July 1, 2050, as currently drafted (not a typo).
On March 8, the Oklahoma House passed HB 1030 by a vote of 84-11. This is the third year in a row that the House has passed the bill. In the last two years, the bill did not receive a Senate committee hearing.
In total, there are now five states that have passed a consumer privacy bill out of one chamber this year – Hawaii, Indiana, Iowa, Montana, and Oklahoma.
Last week there also was committee movement on consumer privacy bills in New Hampshire, Maryland, and Oregon.
In New Hampshire, the Senate Judiciary Committee voted 5-0 to approve an amended version of SB 255. The amended bill now contains a 100,000-consumer threshold for applicability, which is approximately 7.1% of the state’s population.
In Maryland, the Senate Finance Committee held hearings on SB 698 (consumer privacy) and SB 844 (children’s privacy). In Oregon, the Senate Judiciary Committee held a public hearing on an amended version of SB 619. There was extensive testimony at both hearings with the Maryland hearing containing contentious questioning of industry representatives.
Three states introduced consumer privacy bills last week.
In Florida, what appear to be companion bills were introduced in the Senate (S 262) and House (H 1547) by Senator Jennifer Bradley and Representative Fiona McFarland. Senator Bradley and Representative McFarland authored competing data privacy bills in 2021 and 2022. The bills apply to businesses that collect Florida consumers’ personal information, make in excess of $1 billion in gross revenues, and either (1) derive 50% or more of their global annual revenues from providing targeted advertising or the sale of ads online or (2) operate a consumer smart speaker and voice command component service with an integrated virtual assistant connected to a cloud computing service that uses hands-free verbal activation. It is worth noting that Florida has a short 60-day 2023 legislative session, having opened March 7 and closing May 5.
In New York, Senator Comrie introduced the It’s Your Data Act (S5555). The bill joins six other New York consumer privacy bills we have been tracking.
In Texas, Representative Fischer introduce a fairly limited consumer privacy bill (HB 4854). Texas lawmakers also introduced bills on children’s privacy (HB 4948), social media (HB 4412), and data brokers (SB 2105).
Finally, the West Virginia legislature closed without passing any bills. The legislature had been considering consumer privacy and children’s privacy bills.
2. Upcoming Hearings
March 13
Public hearing on Texas HB 4 (consumer data privacy) in House Business & Industry Committee
March 14
Public hearing on Washington HB 1155 (health data privacy) in Senate Committee on Law & Justice
Hearing on Tennessee HB 1181 and SB 73 (consumer privacy)
3. Consumer Data Privacy Bills
The below states are considering consumer data privacy bills. These bills are also tracked on our 2023 State Privacy Law Tracker.
Florida
What appear to be companion bills were introduced in the Senate (S 262) and House (H 1547) by Senator Jennifer Bradley and Representative Fiona McFarland. The Senate bill was referred to the Commerce and Tourism Committee. The House bill was referred to the Regulatory Reform and Economic Development subcommittee.
Hawaii
On January 20, 2023, lawmakers introduced two versions of the Hawaii Consumer Data Protection Act in the Senate – SB 974 and SB 1110. On March 7, 2023, the Senate passed SB 974 by a vote of 23-0-1.
SB 1110 was referred to the Senate Committee on Commerce and Consumer Protection / Senate Judiciary Committee and the Senate Committee on Ways and Means.
Lawmakers also introduced HB 1497, which passed out of the House Committee on Higher Education and Technology and has now been assigned to another committee.
Illinois
Representative Kam Buckner introduced HB 1381 – the Right to Know Act on January 24, 2023. The bill is narrow, focusing on disclosures and access to personal information. On March 10, 2023, the bill was referred to the Rules Committee. A companion bill was filed under bill number SB 1365. That bill was referred to the Judiciary Committee’s subcommittee on privacy.
On February 17, Representative Rashid introduced HB 3385. The bill is based on the federal American Data Privacy and Protection Act. The bill was referred to the Senate Assignments Committee.
Indiana
The Indiana Senate passed SB 5 on February 9, 2023, and the bill was sent to the House. Last year, the Indiana Senate passed Senator Brown’s SB 358 but it did not make it out of the House.
On January 19, 2023, Representative Chris Jeter filed HB 1554. HB 1554 is similar, but not identical, to SB 5 and includes additional provisions regarding data brokers and children. The bill was assigned to the Committee on Commerce, Small Business and Economic Development.
Iowa
House Study Bill 12 was introduced on January 12, 2023. On January 23, 2023, it passed a three-member subcommittee of the Economic Growth and Technology Committee. On February 15, a committee report was filed recommending amendment and passage. The bill is now renumbered as House File 346. Last year, the Iowa House passed House File 2506 but it stalled in the Senate.
Meanwhile, on January 23, 2023, lawmakers introduced a companion senate bill – Senate Study Bill 1071. That bill was referred to the Technology Committee. On January 31, 2023, a subcommittee recommended amendment and passage of the senate bill. The bill is now renumbered as Senate File 262.
Kentucky
Republican Senator Whitney Westerfield introduced SB15 on January 5, 2023. The bill was referred to the Committee on Economic Development, Tourism and Labor, which passed the bill on February 23, 2023. Last year, Senator Westerfield filed SB15.
On February 17, 2023, two house members introduced HB 301. The bill was referred to the Small Business & Information Technology Committee.
Maryland
On February 6, 2023, lawmakers cross filed SB 0698 and HB 0807. The Senate bill was referred to the Finance Committee. The House bill was referred to the Economic Matters Committee.
Massachusetts
Massachusetts lawmakers have introduced three competing bills.
First, on January 18 and 19, 2023, the Massachusetts Data Privacy Protection Act (MDPPA) was filed in both the Senate (SD 745) by Senator Cynthia Stone Creem and in the House (HD2281) by Representatives Andres Vargas and David Rogers. That bill is based on the federal American Data Privacy Protection Act with additional provisions relating to workplace surveillance.
Second, on January 20, 2023, the Massachusetts Information Privacy and Security Act (MIPSA) was introduced in both the Senate (SD1971) by Senator Barry Finegold and in the House (HD 3263) by Representative Daniel Carey.
Third, Representative Russell Holmes introduced HD 3245 – the Internet Bill of Rights.
Minnesota
Two Republican Senators introduced SF 950, which would require consent for the collection of personal information. The bill was referred to the Commerce and Consumer Protection Committee. On February 16, 2023, a companion bill, HF 1892, was filed in the House.
On February 6, 2023, Representative Mohamud Noor introduced HF 1367. The bill was referred to the Commerce Finance and Policy Committee.
On March 1, 2023, Representative Elkins introduced HF 2309.
Mississippi
Democrat Senator Angela Turner-Ford introduced SB 2080 on January 9, 2023. The bill died in committee.
Montana
Representative Zolnikov introduced SB 384 on February 16, 2023. The bill passed the Montana Senate on March 1 and is now with the House.
New Hampshire
On January 19, 2023, a bipartisan and bicameral group of lawmakers led by Senator Sharon Carson introduced SB 255. The Senate Judiciary Committee held a hearing on February 17. A summary of the hearing is available here. On March 8, 2023, the Senate Judiciary Committee recommended that the bill be passed by a 5-0 vote.
New Jersey
Three bills that we tracked last year have carried over to the 2023 session. On February 2, 2023, the Senate voted 27-11 to pass S332. The bill is narrow, perhaps most similar to the Nevada Online Privacy Protection Act. It contains privacy notice provisions, a right to know, and a limited right to opt out of sales. A companion House bill (A1971) has not seen movement. A505 remains in committee. It also is not as broad as the other bills discussed in this section.
New York
On January 4, 2023, Democrat Senator Kevin Thomas introduced S365. The bill was referred to the Consumer Protection Committee. Senator Thomas introduced S6701 last year. On January 9, 2023, lawmakers also introduced A417, which would create consumer rights around access to and transfers of personal information. The bill was referred to the Consumer Affairs and Protection Committee.
On January 17, 2023, a group of lawmakers introduced the Online Consumer Protection Act (A1366). The bill was referred to the Consumer Affairs and Protection Committee.
On January 19, 2023, Senator Brian Kavanagh introduced the Digital Fairness Act (SB2277). The bill was referred to the Internet and Technology Committee. Both of the bills were filed in 2022.
On January 26, 2023, Assemblymember Vanel introduced the New York Data Protection Act (A 2587). The bill was referred to the Government Operations committee.
On January 30, 2023, Senator Hoylman-Sigal introduced S3162, which is a narrow bill. The bill was referred to the Consumer Protection Committee. A companion house bill also was filed under bill number A 4374.
On March 8, 2023, Senator Comrie introduced the It’s Your Data Act (S5555).
Oklahoma
Republican Representative Josh West pre-filed HB 1030 – the Oklahoma Computer Data Privacy Act (OCDPA). The bill passed the House by a vote of 84-11 on March 8.
Oregon
Democrat Senator Floyd Prozanski and Democrat Representative Paul Hovley introduced SB 619. The bill was filed at the request of Attorney General Ellen Rosenblum. The Attorney General’s office convened a work group over the summer and fall to work on the bill. On March 7, the Senate Judiciary Committee held a public hearing on an amended version of the bill.
Rhode Island
Lawmakers filed H 5354 on February 3, 2023. The bill was referred to the House Innovation, Internet & Technology Committee, which recommended that the bills be held for further study.
Tennessee
Republic Senator Bo Watson introduced SB73 on January 4, 2023. On January 20, 2023, the bill was referred to the Senate Commerce & Labor Committee. The bill text is available here. On February 2, 2023, a companion bill was filed in the House (HB 1181). The bill was referred to the Banking & Consumer Affairs subcommittee. Tennessee lawmakers considered a similar bill last year.
Texas
Representative Capriglione introduced the Texas Data Privacy and Security Act (HB 1844) on February 3, 2023. The bill is based on the Virginia Consumer Data Protection Act. On February 16, the bill was identified as a speaker priority bill and renumbered as HB 4. The bill was referred to the House Business & Industry Committee.
Vermont
On January 26, 2023, a bipartisan group of representatives introduced H.121. The bill was referred to Committee on Commerce and Economic Development, which held a hearing on February 9, 2023.
Washington
Representative Shelley Kloba reintroduced the People’s Privacy Act (HB 1616) on January 26, 2023. Representative Kloba previously ran the bill in 2021, but did not introduce it in 2022. The bill was referred to the Civil Rights & Judiciary Committee. A group of senators filed a companion bill on January 31, 2023 (SB 5643).
West Virginia
Lawmakers introduced HB 3498 and HB 3453 on February 14, 2023. Both bills were referred to the House Technology and Infrastructure Committee. HB 3498 appears to have passed out of the House Technology and Infrastructure Committee on February 20.
4. Biometric Privacy Bills
The following states are considering BIPA-like biometric information privacy bills. The bills are also tracked on our 2023 State Biometric Privacy Law Tracker.
Arizona
Senator Rogers introduced SB1238. The Senate Transportation Committee voted SB 1238 out of committee by a vote of 4-3. The committee chair, while voting in favor of the bill, noted that everyone on the committee recognizes that the bill needs “to be fixed before it moves beyond this point.”
Hawaii
The Hawaii Biometric Information Privacy Act (SB 1085) was introduced on January 20, 2023. The bill was referred to the Senate Committee on Labor and Technology and Committee on Judiciary. The committee deferred the measure during a February 10 hearing. The committee chair indicated that the bill needed further study and they will try to have a working group during the interim.
Kentucky
Kentucky lawmakers introduced HB 483 on February 21, 2023. On March 1, 2023, the bill was reported favorably out of the Kentucky Small Business & Information Technology Committee and referred to the Rules Committee.
Maryland
Delegates Love, Charkoudian, Lehman, and Watson introduced HB 33 on January 11, 2023. The bill was referred to the Economic Matters Committee. Last year, the Maryland House passed HB 259, but the bill did not make it out of the Senate. On January 20, 2023, a group of thirteen senators cross-filed SB0169 in the Senate. The bill was referred to the Finance Committee.
Massachusetts
Representative Fernandes introduced HD3053 and Senator Montigny introduced SD 2218.
Mississippi
Representative Anthony Porter introduced HB 467 on January 12, 2023. The bill was referred to the Judiciary Committee.
Missouri
Representative Doug Clemens introduced HB 1047 on February 6, 2023. Missouri Representative Lovasco introduced HB 1225 on February 23, 2023.
Minnesota
Senator Lucero introduced SF 954. The bill was referred to the Commerce and Consumer Protection Committee. On March 2, 2023, Representative Scott introduced HF 2532 – a companion bill to SF 954.
New York
On January 17, 2023, a group of New York lawmakers introduced the New York Biometric Privacy Act (A1362). The bill was referred to the Consumer Affairs and Protection Committee. On February 9, 2023, a companion bill (S4457) was cross-filed in the Senate and referred to the Consumer Protection Committee.
On January 20, 2023, Senator John Liu introduced S2390, which would prohibit private entities from using biometric data for any advertising, marketing or any other identified activities. The bill was referred to the Consumer Protection Committee.
Tennessee
Senator Campbell introduced SB 339 on January 23, 2023. The bill was referred to the Senate Commerce and Labor Committee. Representative McKenzie introduced HB 932 on February 1, 2023. The bill was referred to the Banking & Consumer Affairs Subcommittee.
Vermont
On January 26, 2023, a bipartisan group of representatives introduced H.121. The bill was referred to Committee on Commerce and Economic Development, which held a hearing on February 9, 2023.
5. Children’s Privacy Bills
The following states are considering legislation to regulate children’s privacy. This list of bills is not intended to cover student data privacy bills. The bills are also tracked on our 2023 State Children’s Privacy Law Tracker.
California
On February 2, 2023, Senator Skinner introduced SB 287. This bill prohibits a social media platform from using a design, algorithm, or feature that it knows, or which by the exercise of reasonable care should have known, causes child users to do any of certain things, including experience addiction to the social media platform.
On February 17, 2023, Senator Stern introduced the Let Parents Choose Protection Act of 2023 (SB 845). The bill requires large social media platform providers to create, maintain, and make available to third-party safety software providers a set of real-time application programming interfaces, through which a child or a parent or legal guardian of a child may delegate permission to a third-party safety software provider to manage the child’s online interactions, content, and account settings. The bill has been referred to the Judiciary Committee.
Florida
HB 591 was filed on February 1, 2023, and referred to the regulatory Reform & Economic Development Subcommittee. On March 9, 2023, the bill was given a favorable report with a committee substitute by the Regulatory Reform and Economic Development subcommittee.
Kansas
On February 8, 2023, Senator Holscher introduced SB22, which requires parents to be notified if a child downloads an app. The bill was referred to the Committee on Federal and State Affairs.
Illinois
Lawmakers introduced SB1739 (Minor Online Data Privacy Act) and HB 3880 (Children’s Privacy Protection and Parental Empowerment Act). On March 10, 2023, HB 3880 was re-referred to the Rules Committee.
Maryland
Lawmakers introduced SB 844 and HB 901–age-appropriate design code act bills. Lawmakers also introduced HB 254 (social media regulation), which was referred to the House Economic Matters Committee.
Massachusetts
Representative Rogers introduced HD 2325 (An Act Relative to Internet Privacy Rights for Children).
Minnesota
On February 9, 2023, Minnesota lawmakers introduced HF 1503, which seeks to regulate social media. The bill was referred to the Judiciary Finance and Civil Law committee.
On February 27, 2023, Senator Matthews introduced SF 2101.
On February 27, 2023, Representatives Bahner and Elkins introduced HF 2257, a bill based on the California Age-Appropriate Design Code. That bill was referred to the Judiciary Finance and Civil Law committee.
New Jersey
Democrat Assemblyman Conaway, Jr. introduced A4919 on December 5, 2022. The bill was referred to the Assembly Science, Innovation and Technology Committee. A companion bill (S3493) was introduced by Democrat Senator Vitale on January 19, 2023, and referred to the Law and Public Safety Committee. The bill appears to be based on the California Age-Appropriate Design Code law that passed in 2022.
Lawmakers also introduced A5069 and S3608, which prohibit social media platforms from using certain practices or features that cause child users to become addicted to the platform.
New Mexico
Lawmakers introduced the New Mexico Age-Appropriate Design Code Act (SB 319) on February 2, 2023, and referred to the Senate Tax, Business and Transportation Committee, which passed the bill by an 8-0 vote on February 24, 2023.
New York
A group of lawmakers filed the New York Child Data Privacy and Protection Act (S3281) on January 30, 2023. The bill was referred to the Internet and Technology Committee. A companion bill was filed in the Assembly (A 4967).
Oregon
Democrat Senator Chris Gorsek introduced SB196. The bill was referred to the Judiciary Committee. The bill appears to be based on the California Age-Appropriate Design Code law that passed in 2022.
South Carolina
Senator Verdin introduced S404, which would prohibit operators of internet-based applications from using automated decision systems to place content on social media platforms for users under the age of 18.
Texas
Texas lawmakers are considering HB 896, which prohibits an individual between 13 and 18 years of age from using a social media platform; HB 2155, which regulates children’s use of social media; HB 18, which creates a duty for digital service providers to prevent harm to children; HB 4412, which restricts a digital service providers online agreements with minors; and HB 4948, which is based on the California Age-Appropriate Design Code Act.
Utah
Utah lawmakers passed SB 152 and HB 311. The bills will now go to the Governor.
Virginia
Lawmakers introduced companion bills to amend the Virginia Consumer Data Protection Act (VCDPA) (HB 1688 / SB 1026). The bills are now dead.
West Virginia
Delegate Wayne Clark introduced HB 2460 on January 11, 2023. The bill states that it is intended to “complement the body of federal law governing online privacy protections for children” and would extend protections to children under 18. The bill was referred to the House Judiciary Committee.
Delegate Young introduced HB 2964 – the Online Privacy Protection for Children Act – on January 24, 2023. The bill was referred to the House Judiciary Committee.
6. Data Broker Bills
The following states are considering bills that would regulate data brokers:
New Jersey
Democrat Assemblyman William Moen, Jr. introduced A4811 on October 20, 2022. The bill was referred to the Assembly Science, Innovation and Technology Committee.
Democrat Assemblyman John McKeon introduced A5254 on February 28, 2023. The bill was referred to the Assembly Science, Innovation and Technology Committee.
Oregon
HB 2052 was introduced at the request of the Attorney General’s office. The Business and Labor Committee held a public hearing on January 18, 2023 and work session on February 6. On February 13, 2023, the bill was referred to the Ways and Means Committee. Last year lawmakers considered HB 4017.
Texas
Lawmakers are considering SB 2105.
Vermont
On January 26, 2023, a bipartisan group of representatives introduced H.121. The bill was referred to Committee on Commerce and Economic Development, which held a hearing on February 9, 2023. The bill would amend Vermont’s existing data broker statute to add additional requirements.
Washington
Representatives Shelley Kloba and Liz Berry introduced HB 1799 on February 9, 2023. The bill was referred to the House Committee on Consumer Protection and Business. The House Committee held a hearing on the bill on February 14. The bill was scheduled for executive session on February 15, but no action was taken.
7. Health Data Privacy Bills
The following states are considering bills that would create new or additional privacy protections for health data processed by private entities:
Illinois
On February 9, 2023, Senator Villanueva introduced SB1601. The bill was referred to the Assignments Committee. The bill currently lacks text.
On February 17, 2023, Illinois Representative Ann Williams introduced HB 3603. The bill was referred to the Rules Committee. On March 9, the bill was placed on calendar second reading – short debate.
Maryland
Lawmakers in cross-filed health data privacy bills – HB 995 and SB 790. SB 790 was withdrawn.
Massachusetts
Massachusetts lawmakers filed two health data privacy companion bills – SD 2118 and HD 3855.
New York
Senator Liz Krueger filed SB 158 on January 4, 2023. The bill was referred to the Senate Internet and Technology Committee. A companion bill was filed in the Assembly (A 4983).
Virginia
Lawmakers considered companion bills HB 2219 and SB 1432. The Virginia legislature is now closed.
Washington
Companion bills were filed in the House (HB 1155) and Senate (SB 5351). The House passed HB 1155 on March 4. The Senate bill was referred to the Law & Justice Committee.
8. Automated Employment Decision Tools Bills
The following states are considering bills that would regulate the use of automated employment decision tools. These bills are similar to New York City Local Law 144.
New Jersey
A group of assembly members introduced A4909 on December 5, 2022. On January 19, 2023, the Assembly Labor Committee favorably reported the bill by a vote of 8-1.
An identical bill was introduced in the Senate by Senator Andrew Zwicker under bill number S1926. That bill was referred to the Senate Labor Committee.
New York
Representative Latoya Joyner introduced A567 on January 9, 2023. The bill was referred to the Labor Committee. A companion bill (S5641) was introduced in the Senate on March 10, 2023, and referred to the Labor Committee.
Vermont
Representative Priestley filed H.114 on January 26, 2023. The bill was referred to the General and Housing Committee.
9. Algorithmic Discrimination Bills
These bills would protect against algorithmic discrimination and promote transparency.
Minnesota
On February 8, 2023, lawmakers introduced SF 1441. The bill would make it unlawful for “an owner, operator, or provider of an interactive computer service to restrict, either directly, manually, or through the use of an algorithm, a user’s account or content based on race, sex, political ideology, or religious beliefs.” The bill was referred to the Judiciary and Public Safety Committee.
Washington, DC
On February 2, 2023, councilmembers introduced the Stop Discrimination by Algorithms Act of 2023 (B25-0114). The bill was referred to the Committee on Business and Economic Development, and Committee on Judiciary and Public Safety. On February 10, 2023, a notice of intent to act was published in the District of Columbia register.
