Privacy

264 on file · 181 became law · 49 still moving · 8 moved in 30 days

CanadaBill C-36unverified

Protecting Privacy and Consumer Data Act

The bill reforms Canada federal private sector privacy framework to enhance consumer data protection.

IntroducedJun 15

United States (federal)H.R. 9238

FISA Section 702 extension to July 2026 (H.R. 9238)

Would have extended Title VII of the Foreign Intelligence Surveillance Act, including Section 702, until July 2, 2026.

FailedJun 11

Australia

Children's Online Privacy Code

A binding privacy code being developed by the OAIC under the Privacy Act, as required by the 2024 amendments, to set how online services likely to be accessed by children handle their personal information.

ProposedJun 5

United States (federal)S. 1318

Foreign Intelligence Accountability Act and Anti-CBDC Surveillance State Act (House amendment to S. 1318)

House passed vehicle that would reauthorize FISA Title VII until April 30, 2029 with added Section 702 protections and bar a central bank digital currency.

Passed one chamberJun 5

TexasSB 2420

App Store Accountability Act

Requires mobile app stores to verify user ages, obtain parental consent before minors download apps or make purchases, and share age-category data with developers.

In forceJun 4

United States (federal)No. 25-406 (with No. 25-567, Verizon v. FCC)

FCC v. AT&T, Inc.

The Supreme Court held that the FCC may issue forfeiture orders without a jury, in cases arising from fines against AT&T and Verizon over their handling of customer location data.

RuledJun 4

New YorkA 9349-B / S 8623-B

Surveillance Pricing Prohibition

Would ban using algorithms and consumers' personal data to charge different customers different prices for the same goods or services, with exceptions such as loyalty programs.

Passed bothJun 4

United States (federal)H.R. 9134

Protecting Student Privacy Act

A House bill in Congress, now in committee. Latest step: Referred to the House Committee on Education and Workforce.

In committeeJun 3

ColoradoHB 26-1210

Prohibit Surveillance Price and Wage Setting

Would have banned using surveillance data and algorithms to set individualized prices for consumers or wages for workers.

VetoedJun 2

ConnecticutSB 4

An Act Concerning Consumer Privacy and Protection

Creates data broker registration rules and amends the Connecticut Data Privacy Act, including limits on the sale of precise geolocation data and provisions on facial recognition.

EnactedMay 27

MinnesotaHF 4138

Stop Harms from Addictive Social Media (minor accounts)

Requires large social media platforms to estimate users' ages, obtain verifiable parental consent for accounts of children 15 and under, set those accounts to the most private settings, and bar addictive features and targeted ads on them.

EnactedMay 26

ColoradoSB 26-189

Automated Decision-Making Technology

Repeals and replaces the 2024 Colorado AI Act with notice, explanation, human review and correction rights for consumers affected by automated decision-making technology in consequential decisions.

EnactedMay 14

United States (federal)H.R. 8814

HUD Data Privacy Act of 2026

A House bill in Congress, now in committee. Latest step: Referred to the House Committee on Financial Services.

In committeeMay 14

Council of EuropeCETS No. 225unverified

Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law

Council of Europe treaty requiring parties to ensure that activities across the life cycle of AI systems are consistent with human rights, democracy and the rule of law, entering into force after five ratifications including three Council of Europe member states.

AdoptedMay 13

OhioHB 801

Ohio Privacy Act

Would enact the Ohio Privacy Act, a comprehensive consumer data privacy law.

In committeeMay 13

MinnesotaHF 2700

Consumer health data amendments to the Minnesota Consumer Data Privacy Act

Would amend the Minnesota Consumer Data Privacy Act to treat consumer health data as sensitive data and add protections for sensitive data.

FailedMay 7

United States (federal)S. 4465

FISA Section 702 short-term extension (S. 4465)

Extends the authorities of Title VII of the Foreign Intelligence Surveillance Act, including Section 702, until June 12, 2026.

EnactedApr 30

MichiganSB 758

Michigan Kids Code Act

Would create the Michigan Kids Code Act setting privacy and design requirements for online services used by minors.

Passed one chamberApr 29

United States (federal)H.R. 8322

FISA Section 702 short-term extension (H.R. 8322)

Temporarily extends the authorities of Title VII of the Foreign Intelligence Surveillance Act, including Section 702 surveillance.

EnactedApr 18

AlabamaHB 351

Data Privacy: Consumer Data Processing and Rights

Creates a comprehensive consumer data privacy law giving residents rights over personal data processed by businesses and authorizing enforcement.

EnactedApr 17

NebraskaLB 838

Omnibus bill amending the Age-Appropriate Online Design Code Act and social media deceptive practices

Omnibus consumer and financial bill that adds duties for covered online services under the Age-Appropriate Online Design Code Act and classifies certain social media platform practices as deceptive trade practices.

In forceApr 14

MaineLD 1822

Maine Online Data Privacy Act

Would have enacted a comprehensive consumer online data privacy law in Maine.

FailedApr 13

KentuckyHB 692

Automatic content recognition data consent

Amends the Kentucky Consumer Data Protection Act to bar controllers from collecting automatic content recognition data from smart monitors and TVs without consumer consent.

EnactedApr 13

VirginiaSB 338

Consumer Data Protection Act; precise geolocation data

Amends the Virginia Consumer Data Protection Act to bar controllers from selling consumers' precise geolocation data to third parties.

In forceApr 13

KansasSB 372

App Store Accountability Act

Would have required app stores and developers to verify ages and obtain parental consent for minors, enforced under the Kansas Consumer Protection Act and a private right of action.

FailedApr 10

MinnesotaHF 3701

Genetic information in long-term care, life and disability insurance

Would prohibit long-term care, life and disability insurers from using genetic information for certain purposes.

FailedApr 7

OregonSB 1587

Limits on public body data sharing with data brokers

Bars public bodies from giving personally identifiable information to a data broker unless the broker attests it will not pass the data to any entity that will use it to enforce federal immigration law.

In forceApr 6

South DakotaSB 41

Digitally fabricated intimate materials

Revises criminal invasion of privacy law to prohibit creating and distributing digitally fabricated intimate materials of identifiable people.

In forceMar 30

WashingtonSB 6002

Driver privacy protections (license plate readers)

Regulates automated license plate reader systems and limits how agencies may use and share the data they capture.

In forceMar 30

MinnesotaHF 4511

Minnesota Age-Appropriate Design Code Act (2026)

Would place obligations on businesses regarding children's personal information and online product design, with attorney general enforcement.

FailedMar 26

MinnesotaHF 3794unverified

Ban on surveillance-based price and wage discrimination

Would prohibit companies from using data obtained through observation, inference or surveillance to set individualized prices for customers or wages for employees, with exceptions for loyalty programs and group discounts.

FailedMar 25

MinnesotaHF 4005

Biometric data consent, sale ban and deletion

Would require consent before collecting biometric data, prohibit its sale, require deletion, and impose civil penalties.

FailedMar 25

OklahomaSB 546

Oklahoma consumer data privacy law

Creates a comprehensive consumer data privacy law giving Oklahomans rights to access, correct, delete and opt out of the sale and targeted advertising use of their personal data, with data protection assessments and Attorney General enforcement.

EnactedMar 20

MinnesotaHF 4456

Data broker registration

Would require data brokers to register with the attorney general, with enforcement and civil penalties.

FailedMar 18

BrazilLei 15.211/2025 (PL 2628/2022)

Digital Statute of Children and Adolescents (ECA Digital)

Sets duties for providers of digital products and services likely to be accessed by children and adolescents, including age verification, parental supervision tools and protection against harmful content.

In forceMar 17

United States (federal)S. 836

Children and Teens’ Online Privacy Protection Act

Would extend children's online privacy protections to teens under 17, ban targeted advertising to minors and update the COPPA knowledge standard.

Passed one chamberMar 16

FloridaSB 482

Artificial Intelligence Bill of Rights

Would have created consumer protections for AI use, including limits on AI companion chatbots for minors, and barred governmental entities from contracting with certain foreign AI entities.

FailedMar 13

CaliforniaAB 2273

California Age-Appropriate Design Code Act

Requires online services likely to be accessed by children to assess and mitigate risks to children and to configure default privacy settings to a high level of privacy.

In forceMar 12

United States (federal)No. 25-2366

NetChoice, LLC v. Bonta (second appeal, Age-Appropriate Design Code Act)

The Ninth Circuit affirmed in part and vacated in part a second preliminary injunction that had blocked the entire California Age-Appropriate Design Code Act.

RuledMar 12

WyomingSF 20

Data privacy for government entities

Sets data privacy requirements for how Wyoming government entities collect, use and share personal data.

In forceMar 6

New MexicoSB 40

Driver Privacy and Safety Act

Enacts the Driver Privacy and Safety Act, limiting the sharing of automated license plate reader information and requiring reporting, with enforcement and penalties.

In forceMar 4

VirginiaSB 854

Consumer Data Protection Act; social media platforms and minors

Requires social media platforms to use commercially reasonable age screening and limit users under 16 to one hour per day per platform unless a parent consents to more.

In forceFeb 27

AlabamaHB 263

Biological and Neural Data Protection

Would have barred health and fitness apps from disclosing or using biological and neural data without express consent.

FailedFeb 26

BrazilLei 15.352/2026 (conversion of Medida Provisoria 1.317/2025)

Law restructuring the ANPD as the National Data Protection Agency

Amends the LGPD to establish the Agencia Nacional de Protecao de Dados (ANPD) as a special autonomous federal agency, creates a data protection regulation and enforcement career, and sets the ECA Digital's entry into force for 2026-03-17.

In forceFeb 25

United Kingdom2025 c. 18

Data (Use and Access) Act 2025

Reforms UK data protection law, creates frameworks for digital verification services and smart data, restructures the Information Commissioner's Office, adds an offence of creating or requesting intimate images of adults without consent, and requires government reports on copyright and AI.

In forceFeb 6

South CarolinaH 3431

Age-Appropriate Code Design (Social Media Regulation Act, Act 96 of 2026)

Requires covered online services to use reasonable care with minors' personal data, limit data collection from minors, restrict compulsive-use design features and provide parental controls, with Attorney General enforcement.

In forceFeb 5

UtahSB 142

App Store Accountability Act

Requires app stores to verify users' ages and obtain parental consent before minors download apps or make purchases, and to share age category data with developers.

In forceFeb 5

MississippiSB 2015unverified

Mississippi Consumer Data Privacy Act

Would have enacted a comprehensive consumer data privacy law in Mississippi.

FailedFeb 3

TaiwanPresidential Order Hua-Zong-Yi-Yi-Zi No. 11500001671

Artificial Intelligence Basic Act

Sets Taiwan's basic AI governance framework with the National Science and Technology Council as competent authority, seven governance principles, a risk classification framework coordinated by the Ministry of Digital Affairs, and labeling and accountability rules for high-risk AI.

In forceJan 14

WashingtonHB 1671

Protecting personal data privacy

Would create a comprehensive consumer data privacy law for Washington with consumer rights and data minimization duties.

FailedJan 12