As U.S. privacy pros know, the past few years have seen many state privacy bills proposed but, as of January 1st, only five states had comprehensive privacy laws in effect. So far in 2023, Iowa approved its “Act relating to consumer data protection” (which we reported on here) and late last week, the Indiana Legislature passed the Indiana Consumer Data Privacy Act which is pending the governor’s signature (discussed here).

Last week, the Montana House of Representatives and Senate voted unanimously to approve SB 384 (cited as Montana’s “Consumer Data Privacy Act” or “MCDPA”). After several amendments by the House, the Montana Senate approved MCDPA and MCDPA is on its way to enrollment and the Governor’s deck. Meanwhile, the Tennessee Information Protection Act (“TIPA”) was unanimously passed by the Tennessee House on April 10th and the Tennessee Senate on April 21st.

Other states also are moving their own comprehensive consumer privacy bills through legislatures this year and other more specialized privacy laws are also in the works, such as laws focused on children, social media (e.g., Utah’s Social Media Regulation Act discussed here) and health information not protected by HIPAA (Washington’s My Health My Data Act). Stay tuned to find out whether the Indiana Consumer Data Privacy Act is #7 and which state wins the #8 slot.  And, a federal privacy law is still on the table.

Following is the (non-inclusive) list of the bills that we are tracking.

State Name of Bill Progress
Indiana Indiana Consumer Data Privacy Act (“ICDPA”)
  • Signed by the Indiana Speaker on April 21, 2023.
  • Governor Holcomb has until April 28th to signs or veto or if he takes no action, ICDPA becomes law.
  • Track it here.
Montana Montana Consumer Data Privacy Act (“MCDPA”)
  • Pending enrollment.
  • Once enrolled, MCDPA is off to Governor.
  • Track it here.
Tennessee Tennessee Information Protection Act (“TIPA”)
  • Passed by the House on April 10, 2023.
  • Passed the Senate on April 21, 2023.
  • Track it here.
Oklahoma Oklahoma Computer Data Privacy Act
  • Introduced in February 2023.
  • Passed three readings in the House and was referred to the Senate rules committee.
  • Track it here.
New Hampshire An Act relative to the expectation of privacy.
  • Introduced January 24, 2023, the bill has been considered and amended several times.
  • A public hearing was held on April 19, 2023.
  • An executive session is scheduled for May 3, 2023, where a committee will deliberate and decide whether to move the bill to the floor.
  • Track it here.
Hawaii

Consumer Data Protection Act

 

  • Introduced January 20, 2023
  • Passed first reading in the House and Senate on March 9, 2023.
  • Track it here.
Texas Texas Data Privacy and Security Act
  • Introduced February 16, 2023.
  • Passed by the House on April 5th and received by the Senate for deliberation on the same day.
  • Track it here.
Illinois Illinois Data Privacy and Protection Act (“IDPPA”)
  • Introduced February 17, 2023.
  • Re-referred to Rules Committee on March 10, 2023.
  • Track it here.
Louisiana Louisiana Consumer Privacy Act
  • Introduced in Senate and referred to committee on April 10, 2023.
  • Track it here.
Minnesota
  1. Minnesota Consumer Data Privacy Act
  2. Act relating to consumer data privacy (D)
  3. Act relating to consumer data privacy (R)
  • The Minnesota Consumer Data Privacy Act was referred to committee on March 15, 2023.
  • The Act relating to consumer data privacy (D) was referred to committee February 6, 2023.
  • The Act relating to consumer data privacy (R) was referred to committee February 16, 2023.
  • Track the Consumer Data Privacy Act here, the (D) bill here, and the (R) bill here.
New Jersey New Jersey Disclosure and Accountability Transparency Act
  • Introduced March 13, 2023, with no significant progress.
  • Track it here.
New York
  1. Data Privacy and Protection Law
  2. Acquisition and Control of Private and Personal Information; Data Security Protections
  3. New York Privacy Act
  4. Digital Fairness Act
  5. New York Privacy Act (II)
  6. New York Data Protection Act
  7. It’s Your Data Act
  • All seven bills were introduced and referred to committee between January 4 and April 3, 2023, with no significant progress.
  • Track Data Privacy and Protection Law here.
  • Track Acquisition and Control of Private and Personal Information here.
  • Track New York Privacy Act here.
  • Track Digital Fairness Act here.
  • Track New York Privacy Act (II) here.
  • Track New York Data Protection Act here.
  • Track It’s Your Data Act here.
North Carolina North Carolina Consumer Privacy Act
  • Introduced April 3, 2023.
  • Passed first reading and referred to committee on April 4, 2023.
  • Track it here.
Oregon Act relating to protections for the personal data of consumers.
  • Introduced January 9, 2023.
  • Two hearings held, and bill was referred to committee on April 12, 2023.
  • Track it here.
Pennsylvania Pennsylvania Consumer Data Protection Act
  • Introduced March 27, 2023 and referred to committee.
  • Track it here.
Rhode Island
  1. Data Transparency and Privacy Protection Act (House)
  2. Data Transparency and Privacy Protection Act (Senate)
  3. Data Transparency and Privacy Protection Act (House II)
  • All three bills were introduced in February and March 2023, with no significant progress.
  • Track the first bill here.
  • Track the second bill here.
  • Track the third bill here.
Vermont An act relating to enhancing consumer privacy
  • Introduced January 26, 2023, with no significant progress.
  • Track it here.
Washington People’s Privacy Act
  • Introduced and referred to committee on January 26, 2023, with no significant progress.
  • Track it here.
Massachusetts
  1. Massachusetts Data Privacy Protection Act
  2. Massachusetts information privacy and security act
  3. Internet Bill of Rights
  • All three were referred to committee on February 16, 2023, with no significant progress.
  • Track Data Privacy Protection Act here.
  • Track Information Privacy and Security Act here.
  • Track Internet Bill of Rights here.

States are moving fast in 2023 to pass comprehensive privacy laws. Privacy World will continue to cover legislative developments. If you have any questions, please contact the authors or your relationship partner at SPB.