Privacy Regulation Database

EU regulation targeting large online platforms designated as gatekeepers. Imposes obligations on core platform services.

EU regulation on digital services establishing transparency and accountability obligations for online platforms.

EU regulation on artificial intelligence. Risk-based framework with strict rules for high-risk AI systems and prohibitions on certain AI practices.

EU directive on privacy in electronic communications. Governs cookies, direct marketing, and confidentiality of communications. Often enforced alongside GDPR.

EU-wide data protection law governing the processing of personal data of individuals in the EU/EEA. Sets strict requirements for consent, data subject rights, breach notification, and cross-border transfers.

Japan comprehensive data protection law. Amended in 2020 and 2022 with strengthened individual rights and cross-border transfer rules.

The ADA limits when employers may ask disability-related questions or require medical exams: none before a job offer, post-offer exams if required of all entering employees, and job-related, business-necessary exams for current employees. Medical information obtained must be kept in separate, confidential medical files.

Brazil's comprehensive data protection law, modeled on GDPR.

Protects cable TV subscriber privacy. Requires notice and consent before collecting or disclosing personally identifiable information about subscribers viewing habits.

Section 631 requires cable operators to give subscribers an annual privacy notice, limits collection and disclosure of subscriber personal information without consent, gives subscribers access to their data, and requires destruction of data no longer needed.

CIPA conditions E-rate and certain library funding on adopting an internet safety policy with technology protection measures that block obscene images, child sexual abuse material, and content harmful to minors. School policies must also address minors' online safety and the unauthorized disclosure of minors' personal information, and schools must educate students about appropriate online behavior.

COPPA requires notice to parents and verifiable parental consent before collecting personal information from children under 13 online. The FTC's COPPA Rule was substantially amended in 2025 (effective June 23, 2025, with most compliance required by April 22, 2026), adding separate consent for third-party disclosures, a written security program, a written retention policy, and biometric and government identifiers to the definition of personal information.

China comprehensive personal information protection law. Strict cross-border transfer restrictions. Applies extraterritorially to processing of Chinese residents data.

Section 222 requires carriers to protect the confidentiality of customer proprietary network information, such as call details and location, and limits its use without customer approval. FCC rules require authentication before disclosing call detail records and breach reporting to the Secret Service and FBI. A broader 2024 FCC breach rule covering personally identifiable information was upheld by a Sixth Circuit panel in August 2025, but en banc rehearing was granted on July 31, 2026 and the amended 47 CFR 64.2011 is not yet in effect.

The CFAA is an anti-hacking law, included here because section 1030(a)(2) protects the confidentiality of information on computers, including financial records, consumer reports, and information on any protected computer. It is the main federal basis for prosecuting data theft and gives victims of unauthorized access a civil remedy.

Part 2 makes records identifying a patient as having a substance use disorder diagnosis or treatment in a federally assisted program confidential, allowing disclosure mainly with patient consent or under narrow exceptions and court orders. The 2024 final rule (effective April 16, 2024; compliance Feb. 16, 2026) aligned Part 2 with HIPAA, allowing a single consent for treatment, payment, and operations and adding breach notification and HIPAA-style penalties.

CAN-SPAM sets rules for commercial email rather than banning it. Senders must not use false headers or deceptive subject lines, must identify messages as ads, include a physical postal address, and offer a working opt-out honored within 10 business days. It preempts most state commercial email laws.

CIRCIA will require covered critical infrastructure entities to report covered cyber incidents to CISA within 72 hours and ransom payments within 24 hours. The reporting duties take effect only on the dates set in CISA's final rule; as of September 2026 the final rule had not been published (CISA held further town halls in 2026 and targeted fall 2026).

India comprehensive data protection law. Enforcement beginning 2025. Applies to processing of digital personal data within India and outside India if processing is for offering goods/services to Indian data principals.

Section 1033 gives consumers a right to access their financial account data. The CFPB's 2024 rule would require providers to share data through interfaces and would limit third parties' collection, use, and retention of that data to what the consumer requested. Compliance dates (originally April 1, 2026 to April 1, 2030) are stayed, and the CFPB opened a reconsideration (ANPR, Aug. 22, 2025).

This regulation bars U.S. persons from data brokerage and genomic-data transactions that give countries of concern or covered persons access to bulk sensitive personal data or government-related data. Other vendor, employment, and investment transactions are allowed only if CISA security requirements are met. Bulk thresholds range from 100 persons (genomic data) to 100,000 persons (covered identifiers); due diligence, audit, and reporting duties began October 6, 2025.

The DPPA limits disclosure of personal information in state driver and vehicle records to listed permissible uses, such as law enforcement, insurance, and certain business verification, and requires express consent for uses like marketing. It binds private recipients and resellers, not just state agencies.

Extends government restrictions on wiretaps to include electronic data transmissions. Includes the Wiretap Act (Title I), Stored Communications Act (Title II), and Pen Register Act (Title III).

The Wiretap Act, as expanded by ECPA in 1986, makes it a crime to intentionally intercept the contents of wire, oral, or electronic communications in transit, or to use or disclose unlawfully intercepted contents. Federal law is one-party consent: a private party may record a communication it participates in, or where one party consents, unless done for a criminal or tortious purpose. Many states require all-party consent.

The SCA protects email and other stored communications and records held by service providers. It bars unauthorized access to stored communications, restricts public providers from voluntarily disclosing customer content and records, and sets the legal process the government must use to compel disclosure (amended by the CLOUD Act in 2018).

The Pen Register Act bars installing or using devices that capture non-content routing and addressing information (such as numbers dialed or email headers) without a court order, subject to provider exceptions. It is primarily a limit on government surveillance but also reaches private parties.

EPPA generally bars private employers from requiring, requesting, or using lie detector tests on employees or job applicants, or taking action based on results or refusal. A limited exception allows polygraphs during ongoing investigations of economic loss, with strict procedural protections and confidentiality of results.

FACTA amended the FCRA to fight identity theft. It requires card receipt truncation, fraud alerts, written identity theft prevention programs for creditors (Red Flags Rule), secure disposal of consumer report information, and an opt-out before affiliates use shared data for marketing.

The FCRA governs the collection, accuracy, and use of consumer report information. It limits who may obtain reports and for what purposes, requires accuracy procedures and dispute handling, and gives consumers rights to their files, free credit freezes, and adverse action notices. The Homebuyers Privacy Protection Act (effective March 4, 2026) restricts mortgage 'trigger leads'; the CFPB's 2025 medical debt rule was vacated in July 2025.

The FDCPA protects debtor privacy by barring collectors from discussing a debt with third parties such as employers, family members, or neighbors, except in narrow cases. Regulation F adds rules on electronic communications, including opt-out notices.

FERPA gives parents, and students once they turn 18 or enter postsecondary school, the right to inspect and seek amendment of education records and generally requires written consent before personally identifiable information from those records is disclosed. It lists exceptions such as school officials with legitimate educational interests, directory information, and health or safety emergencies.

Section 5 bans unfair or deceptive acts or practices in commerce. The FTC uses it as the main federal privacy and data security authority: misrepresenting data practices is deception, and failing to use reasonable security or making harmful data uses can be unfair. Several later privacy statutes (COPPA, PADFA, TAKE IT DOWN) are enforced as if they were FTC rules.

The HBNR requires vendors of personal health records and related entities outside HIPAA to notify individuals, the FTC, and sometimes the media after a breach of unsecured identifiable health information. The 2024 amendments (effective July 29, 2024) confirm the rule covers health apps and treat unauthorized disclosures, not just hacks, as breaches.

GINA bars health insurers and employers from using genetic information, including family medical history, to make coverage or employment decisions. Employers generally may not request, require, or buy genetic information, and must keep any they hold confidential in separate medical files.

GLBA requires financial institutions to give privacy notices, let consumers opt out of most sharing with nonaffiliated third parties, and protect customer information. The FTC's 2021 Safeguards Rule amendments require a detailed security program (qualified individual, encryption, MFA), and since May 13, 2024 require notice to the FTC of incidents involving 500 or more consumers. The SEC's 2024 Regulation S-P amendments require incident response programs and 30-day customer breach notice (compliance Dec. 3, 2025 for larger and June 3, 2026 for smaller entities).

HITECH's privacy subtitle created the federal breach notification duty for HIPAA covered entities and business associates, made business associates directly subject to HIPAA security and penalty provisions, and raised HIPAA penalties. A 2021 amendment requires HHS to consider an entity's recognized security practices when setting fines and audit outcomes.

The Privacy Rule limits how covered entities and business associates use and disclose protected health information and gives individuals rights of access, amendment, and accounting. The Security Rule requires administrative, physical, and technical safeguards for electronic PHI, and the Breach Notification Rule requires notice of breaches of unsecured PHI. A 2024 reproductive health amendment was vacated nationwide in June 2025 except most Notice of Privacy Practices changes, which had a February 16, 2026 compliance date.

This 2025 law limits 'trigger leads', which are credit reports sold to other lenders when a consumer applies for a mortgage. From March 4, 2026, an agency may pass on such a report only for a firm offer of credit or insurance to a party that has the consumer's documented consent or already originates, services, or holds an account relationship with the consumer.

Singapore comprehensive data protection law with Do Not Call Registry.

Saudi Arabia comprehensive data protection law, heavily influenced by GDPR.

Canada federal private-sector privacy law. Based on 10 fair information principles. Being replaced by Consumer Privacy Protection Act (CPPA).

Australia comprehensive privacy law. 13 Australian Privacy Principles (APPs). Major reform package pending with significantly increased penalties.

New Zealand comprehensive privacy law replacing the 1993 Privacy Act. 13 information privacy principles.

The Privacy Act governs how federal agencies collect, maintain, use, and disclose records about individuals kept in systems of records. It requires consent for most disclosures, public notice of record systems, access and amendment rights, and accuracy and security safeguards. A 2024 amendment (Pub. L. 118-104) added a disclosure exception for the Congressional Budget Office.

Added by the Satellite Home Viewer Improvement Act of 1999, this provision gives satellite TV subscribers privacy protections that mirror the Cable Act: annual notice, consent for collection and disclosure, access, and destruction of unneeded data.

PADFA makes it unlawful for data brokers to sell, license, transfer, or otherwise make available personally identifiable sensitive data of U.S. individuals to a foreign adversary country (currently China, Iran, North Korea, Russia) or an entity controlled by one. It took effect 60 days after enactment on April 24, 2024.

South Africa comprehensive data protection law modeled on GDPR.

PPRA limits surveys, analyses, and evaluations that ask students about eight protected areas, such as political beliefs, mental health, sexual behavior, and family income. It also requires local policies and parent notice on surveys, physical exams, and the collection or use of student information for marketing.

The RFPA limits federal government access to individuals' financial records held by financial institutions. Agencies generally need customer authorization, a subpoena, a search warrant, or a formal written request with notice to the customer, and institutions may not release records until the agency certifies compliance.

South Korea comprehensive data protection law. One of the strictest in Asia with significant penalties.

The TSR bars deceptive and abusive telemarketing and houses the FTC's National Do Not Call Registry. It restricts calls to registered numbers, sets calling hours, limits abandoned calls and robocalls, and requires sellers to pay for registry access.

The TCPA restricts autodialed and prerecorded-voice calls and texts to cell phones without prior express consent, prerecorded calls to residential lines, and unsolicited faxes, and underpins the National Do-Not-Call Registry rules. FCC rules effective April 11, 2025 require honoring consent revocations by any reasonable means within 10 business days; the 'revoke-all' portion was delayed to January 31, 2027. The FCC's 2023 'one-to-one consent' rule was vacated by the Eleventh Circuit and removed in August 2025.

This law makes 'pretexting' for phone records a federal crime. It bars obtaining confidential phone records by false statements or unauthorized account access, and selling or buying such records without the customer's authorization.

The TAKE IT DOWN Act criminalizes knowingly publishing nonconsensual intimate images, including AI-generated 'digital forgeries', and requires covered platforms to run a notice-and-removal process. Since May 19, 2026, platforms must remove a validly reported image within 48 hours and make reasonable efforts to remove known identical copies.

UK implementation of GDPR (post-Brexit: UK GDPR). Supplemented by Data Protection Act 2018.

The VPPA bars video tape service providers from knowingly disclosing personally identifiable information about the videos a consumer requested or obtained, with limited exceptions. The 2013 amendment allows consent to be given electronically and in advance for up to two years. It is now a frequent basis for class actions over tracking pixels on video pages.

This criminal law bars intentionally capturing images of a person's private areas without consent where the person has a reasonable expectation of privacy. It applies only within federal maritime and territorial jurisdiction; state laws cover most other places.

Colorado private-sector employees may inspect and copy their own personnel file at least once a year on request, and former employees may inspect once after separation. Employers may require supervision and charge reasonable copying costs.

SB 26-051 requires device operating systems with app stores to ask for a user's birth date or age bracket at account setup and send an age signal to apps through an API, starting July 1, 2028. Apps must request the signal and are then treated as knowing the user's age range. It includes data-minimization limits: the age signal may not be shared with third parties for other purposes.

Makes commercial pornography websites liable to minors, through their parents, unless they use reasonable age verification (a digitized state ID, a third-party verification database, or transactional data). Sites must also offer Internet and cellular subscribers a free option to block the site on their subscriptions. Verifiers may not retain identifying information once access is granted.

Enacted as SEA 17 (2024), this chapter requires adult websites to verify that visitors are 18 or older using a mobile credential, an independent third-party verification service, or transactional data. Operators and their verification vendors may not keep users' identifying information and must secure it. Verification data counts as 'personal information' under the breach law. A preliminary injunction was vacated after Free Speech Coalition v. Paxton (2025), and the law is enforceable.

Requires adult websites to use a reasonable age-verification method so that minors cannot access sexual material harmful to minors, and bars the site or its verification vendor from keeping users' identifying information after access is granted. It also requires notarized written consent from every person depicted before an adult website publishes a private image, mandated health warnings, and (from September 1, 2025) a 10% gross receipts tax on adult websites.

Iowa's 2026 age verification law requires adult websites and apps with a substantial portion of content pornographic for minors to use reasonable age verification, such as digital ID, commercially reasonable transactional data, or an Attorney General-approved method. It also limits the privacy impact: verifiers may not retain, sell, or share identifying information and must secure the data.

Requires age verification for access to material harmful to minors and bars keeping the identifying information used. 2026 S.B. 73 added VPN-circumvention rules, an excise tax, and Division rulemaking on age-verification data privacy, security, and disposal.

Adult websites with a substantial share of material harmful to minors must use reasonable age verification (digitized ID, government ID, or transactional-data checks) before granting access. The verifier may not keep identifying information after access is granted. SB 488 (Ch. 199, L. 2025) made the law privately enforceable only, and a federal challenge (Free Speech Coalition v. Knudsen) was dismissed on August 6, 2025.

Enacted in HB 3 (2024), this law requires adult sites to verify that visitors are 18 or older, and to offer both an anonymous and a standard verification method. It also limits what third-party anonymous age verifiers can do with the identifying information they receive: no retention after verification, no other use, no sharing, and reasonable security.

Requires commercial adult websites to verify that users are at least 18 using government ID or commercially reasonable transactional-data methods, and lets injured persons or parents sue for failures. To protect user privacy, platforms and verification vendors may not keep identifying information after access is granted. Enforcement is exclusively private; state officials may not enforce it.

Requires commercial pornography websites to use reasonable age verification, such as Louisiana's digitized ID (LA Wallet) or a commercial system using government ID or transactional data, before granting access. Neither the site nor its verification vendor may retain the user's identifying information after access is granted. The 2022 law created a private damages remedy; a 2023 law added Attorney General enforcement with daily civil penalties.

Requires covered adult websites to verify that users are 18 or older using digital identification or a commercial age verification system, and bars retaining identifying information from verification. The U.S. Supreme Court upheld the age-verification requirement in Free Speech Coalition v. Paxton (June 27, 2025); the Fifth Circuit's 2024 affirmance of the injunction against the mandatory health warnings (129B.004) was not disturbed.

Enacted by LB504 (2025) and expanded by LB838 (2026), this law requires large online services to give known minors protective, high-privacy defaults and tools to limit contact, engagement-driving design features, recommendations, purchases, time spent, and geolocation sharing. It restricts data collection, profiling, targeted advertising, and overnight and school-hour notifications for minors, and requires parental tools for children under 13.

Alabama's state wiretap statute lets the Attorney General seek court orders to intercept wire and electronic communications in felony drug investigations and bars anyone other than ALEA from owning interception devices. It creates a civil cause of action against any person who unlawfully intercepts, discloses, or uses a communication, with exceptions for carrier operations and for a party to the communication or one who has a party's prior consent (unless the purpose is criminal, tortious, or injurious). A 2025 amendment made the program permanent and broadened who can be sued.

Enacted as sections 1-11 of LB525 (2026), this law declares farmers the owners of agricultural data from their farms, land, devices, and equipment. Ag-tech companies get only a nonexclusive right to use the data to provide authorized services and may not sell it without the producer's separate express written consent. It also requires reasonable data security and, from 2027, a no-sale clause in new contracts.

Requires health plans and insurers that use AI or algorithms in utilization review to base decisions on the individual patient's clinical information rather than group data alone, to apply them fairly, and to leave medical-necessity denials to licensed clinicians.

Makes owners and operators of dedicated generative AI chat services liable when they knowingly direct communications to a child intended to encourage the child to imminently engage in sexually explicit conduct, producing sexual images, illegal drug or alcohol use, self-harm or suicide, or violence. The Attorney General enforces the civil provision after giving 90 days to cure, and the same conduct is a form of the crime of endangering the welfare of a child.

Montana bars disclosing the identity of a person tested for HIV or their results in an identifiable way, except as allowed under the Uniform Health Care Information Act and related law. People harmed can sue for statutory damages.

Records identifying someone with, or suspected of having, HIV or AIDS are confidential in New Jersey no matter who holds them. They may be disclosed only with the person's prior written informed consent or under narrow exceptions for IRB-reviewed research, audits, treating personnel, required public health reporting, and other legally authorized purposes.

Requires covered entities to protect sensitive personally identifying information with reasonable security measures, investigate suspected breaches, and notify affected Alabama residents within 45 days when a breach is reasonably likely to cause substantial harm. Larger breaches also require notice to the Attorney General and the national consumer reporting agencies, and records must be disposed of securely.

Bars telephone solicitations to Alabama residential subscribers who have registered their objection on the state do-not-call list maintained by the Public Service Commission, which incorporates Alabama numbers from the national registry. Solicitors must identify themselves and may not block caller ID.

Regulates direct-to-consumer genetic testing companies. They must post plain-language privacy notices and get express consent for initial collection and use, for each transfer to third parties, for secondary uses, and for genetic-data-based marketing, plus informed consent for research. Consumers can access their data, delete their accounts, and have samples destroyed.

Alabama's comprehensive consumer privacy law gives Alabama residents rights to confirm, access, correct, delete, and port their personal data and to opt out of targeted advertising, sale, and profiling for solely automated significant decisions. Controllers must minimize data, secure it, get consent before processing sensitive data, publish a privacy notice, and may not sell or use for targeted advertising the data of known 13- to 15-year-olds without consent. It takes effect May 1, 2027 and has a lower applicability threshold (25,000 consumers) than most state privacy laws, offset by a broad small-business exemption.

Requires commercial telephone sellers and their salespeople to be licensed by the Attorney General's Consumer Division before soliciting Alabama purchasers, and imposes disclosure and cancellation rules on telemarketing sales. It is mainly an anti-fraud telemarketing law; the related do-not-call rules are in chapter 8-19C.

Requires anyone using smart glasses to video and record or transcribe a direct in-person conversation to specifically notify all participants first. The law responds to covert smart-glasses filming posted to social media, and exempts public meetings, law enforcement and first responders, recordings of officials and police in public, evidence preservation, and recordings made in the recorder's own home, workplace, or vehicle. It does not change the one-party consent rule of the Electronic Surveillance Act. It became law without the Governor's signature.

Creates a heritable, transferable property right in each person's identity for commercial purposes, and makes it a violation to use someone's identity commercially in Louisiana without consent. It also bars using a realistic digital replica of a professional performer to create the impression that the performer is actually playing a fictional role. News, commentary, parody, expressive works, and other listed uses are exempt.

Florida's deepfake sexual-imagery law, created in 2022 (SB 1798). It criminalizes generating, soliciting, or maliciously promoting realistic altered sexual images of real people without consent and gives victims a civil claim. Brooke's Law (HB 1161, 2025) added a platform duty: by December 31, 2025, covered platforms had to set up a process to take down such images within 48 hours of a valid request.

SB 419 would have barred TikTok from operating in Montana from January 1, 2024, citing user-data privacy and national-security concerns about Chinese control. A federal court preliminarily enjoined it on November 30, 2023, before it took effect. Its own section 4 voids the Act if TikTok is sold to a company not incorporated in a foreign-adversary country; the parties agreed that happened with the 2025-2026 TikTok divestiture, and the case was dismissed on February 23, 2026, with the Ninth Circuit appeal closed by mandate on September 23, 2026.

Makes it a misdemeanor to knowingly insert false information into caller ID with intent to mislead, defraud, or deceive a call recipient. The Legislature cited loss of personal information to spoofing scams.

Prohibits creating a web page or domain name that impersonates a legitimate online business and using it to induce people to provide identifying information such as SSNs, biometric data, or account numbers. Internet access providers and affected brand owners may sue.

Outlaws phishing: impersonating another person or business through the internet, e-mail, or wireless communications to get Tennessee residents to hand over identifying information, fraudulently obtaining such information, and mimicking or hijacking websites and e-mail traffic to defraud. It gives strong civil remedies to service providers, site and trademark owners, and victims.

Requires app stores to verify each Texas account holder's age category, link minors' accounts to a verified parent account, and obtain parental consent for minors' downloads and purchases, and requires developers to assign age ratings and use the app store's age signals. A federal district court preliminarily enjoined it on December 23, 2025, but the Fifth Circuit stayed that injunction and the U.S. Supreme Court declined to vacate the stay in July 2026, so the law is enforceable while litigation continues.

Enacted by 2025 S.B. 142 and amended by 2026 H.B. 498, it requires app stores to verify age category, affiliate minor accounts with a parent, and obtain parental consent for downloads and purchases, with a parental consent disclosure about the app's data practices. The chapter is enacted but its duties begin May 6, 2027. Industry challenges (CCIA v. Brown, M.M. v. Brown, D. Utah) were terminated on April 21, 2026.

Requires app stores to request and verify the age category (under 13, 13-15, 16-17, 18+) of Alabama account holders, link minors' accounts to a parent account, and obtain verifiable parental consent before a minor downloads or buys an app or makes in-app purchases. Developers must check age category and consent status through the app store and may use that data only for age-related protections and legal compliance. Age verification data must be minimized and encrypted.

Enacted by 2025 H.B. 452, it requires mental health chatbots to disclose they are AI, bars selling or sharing users' health information and inputs, and limits advertising based on user input. A separate affirmative defense against unlicensed-practice claims is available to suppliers that file a written policy with the Division (58-60-118).

Beginning January 1, 2027, companion chatbots offered in Rhode Island must include protocols to respond to users who express suicidal ideation, self-harm or intent to harm others, including referral to crisis services, and must remind users at the start of a conversation and at least every three hours that they are not talking to a human. Operators must file annual safety-protocol reports with the Attorney General starting July 1, 2027.

Regulates AI companion chatbots designed to simulate ongoing personal or romantic relationships. Operators must disclose that output is artificial where a user could be misled, run a suicide and self-harm protocol with crisis referrals, and apply extra protections for users they know or have reason to believe are minors, with annual public reporting.

Replaced the 2024 AI disclosure rule (former 13-2-12) with a duty to tell consumers they are dealing with generative AI when they clearly ask, and a duty for licensed professionals to disclose AI use up front in high-risk interactions. Using generative AI is no defense to a consumer-protection violation.

Two 2026 laws require disclosure when artificial intelligence is used in Louisiana political messaging. Political calls that use an AI-generated voice of a public figure must say at the start that AI created them, and electioneering communications that use AI to falsely depict a candidate's or recall target's speech or conduct must carry a clear AI disclosure in the statutory format.

Bars developers and deployers of AI systems from advertising or representing to the public that the system is, or can act as, a qualified mental health professional. Violations are added to the Tennessee Consumer Protection Act's list of unfair or deceptive practices.

Created by 2024 S.B. 149 and restructured by 2026 H.B. 320, it sets up the Office of AI Policy, its learning laboratory, and regulatory mitigation agreements. It imposes no general private-sector notice duties. The chapter is repealed July 1, 2027.

Restricts recorded-message robocalls used for polls, information gathering, or advertising. Unless an exemption applies (for example, existing customers, debt collection, school absence calls, or return calls), the called person must consent, the message must identify the caller and a staffed number, and calls must avoid random or sequential dialing, unlisted numbers, emergency facilities, and late hours.

SB 26-189, signed May 14, 2026, repeals and replaces the 2024 Colorado AI Act starting January 1, 2027. It drops the duty of care, risk-management programs, and impact assessments and instead requires developer documentation, deployer notice at the point of interaction, a plain-language explanation after an adverse outcome, and consumer rights to correct inaccurate personal data and get meaningful human review. The Attorney General must adopt rules by January 1, 2027.

Colorado bans prerecorded autodialed sales calls unless the caller has an existing business relationship with the person called and that person consents to hear the message.

Makes it unlawful for anyone, public or private, to use automated license plate readers except for listed purposes such as parking regulation, access control to secured areas, public safety and auto theft, law enforcement, tolling, and commercial vehicle enforcement. Captured data (plate, location, time, photos, vehicle details) generally must be deleted after 90 days and may not be sold or shared except to law enforcement, under subpoena, or to insurers and lenders for specified purposes, with notice to new insurance and loan applicants starting in 2027.

Requires operators of license plate reader systems to secure the data and adopt a public usage and privacy policy covering authorized uses, access, sharing, accuracy, and retention.

Regulations approved June 27, 2025 and effective October 1, 2025 that confirm using an automated-decision system (including AI) in hiring, promotion, or other employment decisions can violate California's anti-discrimination law if it harms people based on protected traits. They require keeping automated-decision data with other employment records for four years and treat some AI assessments as unlawful medical inquiries.

Regulates automated calls and texts that play prerecorded or synthesized messages: they must disconnect promptly, offer a one-digit opt-out, and avoid emergency and health numbers, opted-out subscribers, and (for random or sequential dialing) do-not-call listed numbers. Callers may not misrepresent their identity or purpose or spoof caller ID.

Restricts robocalls: callers may use automatic dialing-announcing devices for commercial solicitations only in listed circumstances, and prerecorded-message devices must disconnect within five seconds after the called party hangs up.

Indiana bars robocalls using prerecorded or synthesized voice messages unless the subscriber consented or a live operator gets consent first. Exceptions cover school messages, existing relationships, and employee scheduling. The chapter also sets calling hours, disclosure and disconnect rules, and a ban on robocalls to hospitals and emergency services.

Regulates prerecorded-message autodialers. Operators must follow CPUC rules, may not place ADAD calls to California phones between 9 p.m. and 9 a.m., and (under 2874) generally need a live operator to introduce the call and obtain consent before the recorded message plays.

This law regulates robocalls and junk faxes in Nebraska. Sellers must obtain a Public Service Commission permit for each autodialer used for solicitations, may not robocall emergency lines, hospital rooms, cell phones, or pagers, must identify themselves, respect calling hours, and keep an internal do-not-call list.

Bars robocalls using prerecorded or synthesized voice messages unless the subscriber consented or a live operator first obtains consent, requires live operators to identify the caller and the call's purpose, and requires devices to disconnect within ten seconds after the subscriber hangs up. It also bans commercial telephone solicitations and robocalls before 9 a.m. or after 9 p.m. Minnesota's separate state do-not-call list statute (325E.311 to 325E.316) has expired.

This law limits government use of automatic license plate readers to listed purposes such as traffic enforcement, stolen vehicles, warrants, missing persons, parking, secured-area access, tolling, and weigh stations. It caps retention at 180 days absent evidentiary need, requires posted use and privacy policies and annual reports, and keeps captured plate data out of public records.

Limits police use of automatic license plate readers to criminal investigations with reasonable suspicion and missing or endangered person cases, requires system data to be purged after 21 days and audit trails after two years, and bars selling or sharing the data with private or out-of-state databases. Vendors must certify they will not sell or share Virginia ALPR data and must notify the agency of third-party data requests; contract terms under subsection C apply from July 1, 2026.

Prohibits knowingly selling, giving, or receiving lists of names and addresses from local school board public records for commercial solicitation, and lets custodians demand a written no-solicitation certification from requesters. It also requires redaction of account and similar payment information that could initiate a financial transaction from public records about public contracts.

Makes it unlawful to use an automated online account (a bot) to mislead people in California about its artificial identity to sell goods or services or influence a vote, unless the bot clearly discloses that it is a bot.

Requires publicly funded entities that own or license computerized medical or health insurance information of Virginia residents to notify the Attorney General, the Commissioner of Health, and affected residents without unreasonable delay after a breach. HIPAA-regulated entities and those under the FTC Health Breach Notification Rule are excluded.

Requires anyone who owns or licenses computerized personal information of Virginia residents to notify the Attorney General and affected residents without unreasonable delay after a breach that causes or is reasonably believed to cause identity theft or other fraud. Personal information is name plus SSN, driver's license or state ID, financial account or card number with access code, passport number, or military ID number, when unencrypted and unredacted.

Requires anyone holding computerized personal information of Connecticut residents to notify affected residents and the Attorney General of a breach of unencrypted data within 60 days of discovery. Where Social Security or taxpayer ID numbers are exposed, the data owner must offer at least two years of free identity theft prevention services.

Required online services likely to be used by children to assess risks to children, default to high privacy, estimate users' ages, and avoid harmful data uses, profiling, precise geolocation collection, and dark patterns. It has never been fully enforceable: NetChoice v. Bonta produced preliminary injunctions in 2023 and 2025, and on March 12, 2026 the Ninth Circuit (No. 25-2366) narrowed the injunction, leaving the impact-assessment duties, the data-use restrictions, and the dark-patterns ban enjoined while vacating the injunction as to coverage and age estimation and remanding. AB 2246 (2026) repeals and replaces this title effective January 1, 2027.

Requires large generative AI providers to embed hidden (latent) provenance disclosures in AI-generated images, video, and audio, offer users a visible disclosure option, and provide a free public AI detection tool that does not collect users' personal information. The law became operative August 2, 2026 after AB 853 delayed it and extended provenance duties to large platforms and device makers.

California's comprehensive consumer privacy law. It gives California residents rights to know, delete, correct, opt out of the sale or sharing of their personal information, and limit the use of sensitive personal information, and it bars retaliation for exercising those rights. Proposition 24 (the CPRA, approved November 3, 2020) amended the law, created the California Privacy Protection Agency, and made most changes operative January 1, 2023.

Regulations adopted first by the Attorney General (2020) and then by the California Privacy Protection Agency (2023, 2025) that spell out how businesses give notices, handle consumer requests, honor opt-out preference signals, and avoid dark patterns. The package approved by the Office of Administrative Law on September 22, 2025 (effective January 1, 2026) added mandatory cybersecurity audits, privacy risk assessments submitted to the Agency, and rights to pre-use notice, opt-out, and access for automated decisionmaking technology used for significant decisions.

California's stricter counterpart to the federal Gramm-Leach-Bliley Act. Financial institutions need a consumer's explicit opt-in consent before sharing nonpublic personal information with nonaffiliated third parties, and must give consumers a chance to opt out of certain affiliate and joint-marketing sharing.

California's wiretap and eavesdropping law. It makes it a crime, and a basis for a private suit, to tap or read communications in transit without all parties' consent, to record or eavesdrop on confidential communications without all parties' consent, to use pen registers or trap-and-trace devices without a court order, and to use electronic tracking devices to follow a person. Plaintiffs have used these provisions in large numbers of suits over website tracking tools.

The first U.S. state law requiring commercial websites and online services to post a privacy policy. The policy must describe what personally identifiable information is collected, who it is shared with, and, since 2014, how the site responds to browser Do Not Track signals and whether third parties track users across sites.

Indiana prohibits knowingly transmitting misleading or inaccurate caller ID information with intent to defraud, cause harm, or wrongfully obtain anything of value. Blocking caller ID and authorized law enforcement and intelligence activity are exempt.

HB 24-1147 bars distributing AI deepfakes of candidates close to an election unless the communication carries a clear disclosure that the media was edited and depicts false speech or conduct. The disclosure must also be embedded in metadata where feasible.

Requires notice and consent before capturing biometric identifiers for a commercial purpose, limits their sale or disclosure, and requires secure storage and timely destruction. H.B. 149 (2025) clarified that a publicly available image alone does not supply consent unless the individual posted it, and added AI-related exemptions.

Montana's 'kidfluencer' law requires parents who earn money from videos featuring their children to set aside a share of gross earnings in trust for the child and keep records. When the child turns 18, they can ask the platform that paid for the videos to permanently delete them, a statutory 'right to be forgotten'.

Lets parents and schools register children's email addresses and other contact points; senders of adult-product or harmful-to-minors marketing must scrub their lists against the registry.

Gives a party to a communication a civil claim against anyone who intercepts it without any party's consent or who uses or divulges intercepted information. Consent of one party takes the acquisition outside the definition of interception.

Lets Delaware consumers freeze their credit reports so new credit cannot be opened without their PIN or password, with deadlines for credit bureaus to place, lift, and remove freezes. A 2013 amendment lets parents and guardians freeze or create a record for children under 16 and protected adults, and the chapter guarantees identity-theft victims a local police report.

Enacted in 2024 as the first comprehensive U.S. state law on algorithmic discrimination, it requires developers and deployers of high-risk AI systems to use reasonable care against algorithmic discrimination, with risk-management programs, impact assessments, consumer notices, correction and appeal rights, and disclosure when consumers interact with AI. The 2025 special session (SB 25B-004) moved its start date from February 1, 2026 to June 30, 2026. SB 26-189 repeals and reenacts Part 17 with a narrower automated decision-making framework effective January 1, 2027, so these duties are in force only for the interim. Enforcement is also on hold: in X.AI LLC v. Weiser (D. Colo. No. 1:26-cv-01515), a court order entered April 27, 2026 on the parties' stipulation bars the Attorney General from starting enforcement, including investigations, of SB 24-205 or legislation replacing it for conduct through 14 days after the court rules on xAI's forthcoming preliminary injunction motion.

Colorado's credit reporting law (recodified in 2017 from earlier law) limits when consumer reports may be furnished, restricts reporting of old or sensitive items, and gives consumers free disclosure, dispute, identity-theft block, and security freeze rights, including freezes for protected minors. Since 2023 agencies may not report adverse medical debt information (HB 23-1126), a provision set to repeal July 1, 2028.

Colorado requires businesses to investigate a possible breach promptly and notify affected Colorado residents within 30 days after determining that a breach occurred, unless misuse is not reasonably likely. The Attorney General must be notified within 30 days if 500 or more residents are affected, and national consumer reporting agencies if more than 1,000. Personal information includes name plus SSN, ID numbers, medical or health insurance information, or biometric data, and online credentials.

Colorado maintains its own do-not-call list. Telemarketers must register, scrub against the list at least quarterly, not call listed numbers, and not block caller ID.

Colorado's comprehensive consumer privacy law gives residents rights to opt out of targeted advertising, sale, and significant-decision profiling, and to access, correct, delete, and port their personal data, with an appeal process. Controllers must give a privacy notice, minimize and secure data, get opt-in consent for sensitive data, honor universal opt-out signals, and run data protection assessments. Amendments added biological and neural data (2024), biometric rules (2025), minors' online protections (2025), and precise geolocation as sensitive data with consent required to sell sensitive data (2025).

HB 24-1058 made Colorado the first state to add neural data to its privacy law. It defines biological data (including neural data) and treats it as sensitive data, so controllers need opt-in consent and a data protection assessment to process it.

HB 24-1130 added biometric-specific duties to the Colorado Privacy Act, reaching any controller that handles biometric identifiers regardless of size and covering employees. Controllers need a public written retention and deletion policy, advance notice, consent, and may not sell biometric identifiers. Employers may require consent only for listed purposes such as secure access, timekeeping, and safety.

SB 24-041 added a minors' duty of care to the Colorado Privacy Act for online services known to be used by anyone under 18. Without the minor's consent (or a parent's for children under 13), controllers may not use minors' data for targeted ads, sale, or significant profiling, use engagement-extending design features, or collect precise geolocation beyond what is needed. Heightened-risk services need a minors' data protection assessment.

The Attorney General's rules implementing the Colorado Privacy Act. They set detailed requirements for privacy notices, rights requests, universal opt-out mechanisms, valid consent and dark patterns, data protection assessments, profiling, and opinion letters. Amendments effective January 30, 2025 added biometric and opinion-letter rules, and amendments effective December 1, 2025 implemented the minors' (SB 24-041) and precise geolocation (SB 25-276) changes.

Commercial telephone sellers must register annually with the Attorney General and must honor a three-business-day cancellation right with refunds. Misleading prize and 'free' claims are prohibited.

Colorado is a one-party consent state. Recording or intercepting a phone or electronic communication is a crime unless the sender or a receiver consents, and recording an in-person conversation by someone not visibly present requires consent of at least one principal party. Using or disclosing unlawfully obtained contents is also prohibited.

Prohibits falsified routing information, misleading subject lines, and phishing-style fraudulent email, and requires unsolicited commercial email to be labeled 'ADV:' ('ADV-ADULT:' for sexually explicit content) and to offer a free opt-out that senders must honor. Violations are felonies and give recipients and email providers a damages claim.

Bars commercial email advertising that uses a third party's domain without permission, falsified or forged headers, or misleading subject lines, and lets recipients, email providers, and the AG sue. A separate provision bars unsolicited text message advertisements to California mobile numbers except with consent or a business relationship. Much of the broader state spam law is preempted by the federal CAN-SPAM Act, but these deception-based rules remain.

Bars publishers and websites from using booking or inmate photographs obtained from public agencies for a commercial purpose when removal requires paying a fee. A person who asked for removal can sue for an injunction, fees, and escalating daily damages.

Enacted by 2025 Md. Laws ch. 523 (HB 755), this law bars condominiums and other common ownership communities from requiring owners, occupants, guests, or children to hand over sensitive information, such as Social Security numbers, birth certificates, citizenship or immigration status, race or national origin, religion, or medical records, to use pools, playgrounds, game rooms, or similar recreational areas. Government photo ID may still be requested.

This chapter keeps medical and epidemiological information about reportable communicable diseases, including HIV, confidential. It may be released only in de-identified statistical form, with written consent, for public health or specified legal purposes, or to a nonprofit health data service during a declared public health response.

Requires companion chatbot operators to tell users when they might think they are talking to a human that the bot is AI, to keep and publish suicide and self-harm prevention protocols, and to report crisis referrals annually starting July 1, 2027. For users known to be minors it required AI disclosures, three-hour break reminders, and sexual-content safeguards; SB 1119 (2026) moves minors' protections into a new chapter operative July 1, 2027. SB 867 (2026) separately bans toys with companion chatbots until 2031.

Signed September 10, 2026. Beginning July 1, 2027, companion chatbot operators must determine users' ages through the Digital Age Assurance Act (or treat everyone as a child), run and document child-safety risk assessments before release, set protective defaults, and undergo independent child-safety audits. It bars behavioral advertising to children, selling children's chatbot data, and using it beyond what is needed.

Bars employers from asking job applicants or their former employers about pay history or screening applicants by past compensation. Employers may discuss pay expectations and may confirm history only after an offer with compensation terms has been accepted.

California's computer crime law. It makes it a crime to knowingly access and, without permission, take, copy, use, alter, or delete data or use computer services, and gives owners of the affected computers or data a civil claim for damage or loss.

Rhode Island's computer crime law covers unauthorized access and copying of computer data, forging email headers to send bulk spam, cyberstalking and cyberharassment, and online impersonation using another person's name, persona or identifying information (including biometric data) to harm, defraud, intimidate or threaten. Injured people, including email service providers, can sue for damages.

Criminalizes unauthorized display, use, disclosure, or copying of data obtained by accessing a computer system, and receiving or using such data. A civil remedy lets victims sue, and for misuse of private personal data (data about a person that a reasonable person would want kept private) actual damages can be recovered without proving financial loss.

Delaware makes it a computer crime to send unsolicited bulk commercial email without authorization, to forge email header information to send spam, or to keep sending commercial email after the recipient asks the sender to stop. All commercial email sent to Delaware addresses must explain how to unsubscribe. Note that the federal CAN-SPAM Act (15 U.S.C. § 7707(b)) preempts state commercial email rules except those targeting falsity or deception.

Montana requires businesses to notify Montana residents without unreasonable delay when unencrypted personal information is reasonably believed to have been acquired in a breach that causes or is reasonably believed to cause loss or injury. Copies of resident notices must be sent at the same time to the Attorney General's Office of Consumer Protection.

Requires businesses holding Delaware residents' personal information to keep reasonable security procedures and to notify affected residents of a breach within 60 days of determining it occurred, unless an investigation shows harm is unlikely. Breaches affecting more than 500 residents must also be reported to the Attorney General, and breaches of Social Security numbers require a free year of credit monitoring. HB 381 (signed and effective Sept. 2, 2026) adds the Attorney General to substitute notice, requires Attorney General notice within 60 days where residents' involvement is identified late, and limits the HIPAA/GLBA safe harbor to the timing rule.

Prohibits businesses from knowingly installing software on a consumer's computer and using it deceptively to hijack the computer, change browser or security settings, collect personal information through keystroke logging or similar means, block removal, or disable security software.

Iowa's spyware law makes it a crime to install software on someone else's computer that deceptively collects personal information (such as keylogging, browsing-history profiling, or extracting ID and account numbers), hijacks browser settings, disables security software, or resists removal. A 2023 amendment added ransomware offenses and a civil claim for ransomware victims.

Bars banks and their affiliates from disclosing a customer's financial records to anyone but the customer unless the request is a disclosure demand served on both the bank and the customer with an affidavit, a written customer authorization meeting statutory requirements, or another listed exception. It functions as Louisiana's state-level financial privacy act, supplementing federal GLBA and the Right to Financial Privacy Act. Act 142 of 2026 updated the supervisory-agency definition and service rules.

Two short Rhode Island employee privacy laws. One bars employers from releasing names, addresses or other confidential information obtained through an employee's participation in an employee assistance program; the other bars employers from asking job applicants for copies of their tax returns or W-2 forms as a condition of being considered.

Makes a Florida financial institution's books and records confidential and requires records of customers' trust accounts, deposits, and loans to be released only with the account holder's express authorization, subject to listed exceptions such as subpoenas, regulators, credit reporting, and disclosures allowed under the Gramm-Leach-Bliley Act.

Bars financial institutions from disclosing a customer's financial records to anyone other than the customer without authorization, except under listed legal processes, and requires that customers be served with subpoenas for their records at least ten days before disclosure so they can challenge them.

Rhode Island's general medical privacy law. It bars providers and anyone who receives patient information from releasing or re-disclosing confidential health care information without the patient's written consent on a compliant form, subject to listed exceptions such as emergencies, treatment coordination, insurers, research without identification and certain law-enforcement reports. It also gives patients rights to have adverse-decision records sent to a physician, to seek amendment, and to have insurers send communications to an address they choose.

Makes the results of every HIV test confidential and allows release only to persons or entities authorized to receive protected health information under state or federal law.

Prohibits anyone who obtains confidential HIV-related information from disclosing it except to the person, those with a signed release, and a limited list of health, legal and public-health recipients, and gives injured individuals a right to sue for wilful violations.

California's main medical privacy law. It bars health care providers, health plans, and their contractors from disclosing medical information without the patient's written authorization except as listed, requires confidential storage and disposal, and extends these duties to consumer health apps, mental health and reproductive health digital services, and employers. Recent amendments protect reproductive and gender-affirming care records from out-of-state disclosure and (SB 81, 2025) bar disclosure for immigration enforcement without a warrant or court order.

Makes all mental health and drug or alcohol treatment information, and the identity of people receiving such treatment, privileged and confidential. Disclosure generally requires a detailed written release or a court order (a subpoena alone is not enough), with limited minimum-necessary exceptions, and consumers have a right to access their own records subject to listed exceptions.

Makes confidential the fact that a person was admitted or certified for mental health treatment and all records compiled in providing services under Rhode Island's Mental Health Law, allowing disclosure only with written consent or in listed situations such as coordination among treating professionals, insurance claims, emergencies, approved research under confidentiality oaths, and court proceedings.

Oklahoma's state counterpart to the federal Driver's Privacy Protection Act for vehicle title and registration records. Personal information (name, street address, phone) is confidential and may be released only for listed permissible purposes, such as government functions, vehicle safety and recalls, verifying information in the normal course of business, litigation, and towing notices, and requesters must certify a lawful purpose and no further dissemination.

Barred the sale or marketing use of prescriber-identifying prescription records without the prescriber's consent. The U.S. Supreme Court held in Sorrell v. IMS Health Inc., 564 U.S. 552 (2011), that § 4631(d) violates the First Amendment, affirming the Second Circuit. The subsection still appears in the Vermont Statutes but cannot be enforced.

Makes Health Department records on reportable communicable and noncommunicable diseases, including HIV and hepatitis B, and public health investigation participants confidential, with release only in listed circumstances such as court order, written informed consent, or de-identified statistics. Anyone who wrongfully discloses such information faces criminal and civil liability.

Makes information, reports, and medical records about people infected with designated sexually transmitted diseases confidential. They are not open to public inspection or admissible in court except in commitment proceedings, and individual records may be released with the patient's written consent.

Colorado limits how businesses display and transmit Social Security numbers. They may not publicly post SSNs, print them on access cards or on mailings (with exceptions for forms and applications), or require them to be sent over unsecured internet connections or used alone to log in.

Limits how businesses display and use Social Security numbers: no public posting, no printing on access cards or on most mailings, no requiring SSN transmission over unsecured connections or as a sole website login, and no selling SSNs.

Before a connected device with a camera or microphone can be activated, the provider must show the initial purchaser a prescribed disclaimer and plain disclosures about recording, retention and sharing, and let them decline to activate the camera or microphone. Recordings may not be used or sold for targeted advertising without opt-in consent, and collected information must be reasonably secured.

Requires smart TV makers to tell users during setup that the TV has voice recognition, and bars selling or using recordings collected to improve voice recognition for advertising.

Lets adult survivors of domestic violence, sexual assault, stalking or trafficking require a car maker to cut off an abuser's remote access to a vehicle's connected services, including location tracking. The provider must act within two business days, deny the abuser newly generated data, and keep the survivor's information confidential.

A broad 2026 AI law signed May 27, 2026. For privacy purposes it requires AI companion operators to detect self-harm risk and bars manipulative, romantic or sexual interactions with minors; requires employers using automated employment decision tools to tell workers and applicants, including what personal data is analyzed; makes clear that using such tools is no defense to discrimination; and from 2028 bars personalized recommendation feeds for minors without parental consent, with limits on age-verification data use.

Connecticut's comprehensive consumer privacy law gives residents rights to access, correct, delete and port their data and to opt out of targeted advertising, sale and consequential profiling, and requires consent for sensitive data, privacy notices, recognition of opt-out preference signals, and data protection assessments. P.A. 25-113 (effective July 1, 2026) sharply broadened coverage (35,000-consumer threshold, any processor of sensitive data, any seller of data), added neural and financial-account data as sensitive data, added profiling rights and impact assessments, extended the teen targeted-advertising and sale ban to under-18s, and required disclosure of LLM training. P.A. 26-64 (effective October 1, 2026) bans the sale of precise geolocation data, restricts facial recognition used for security, and expands deletion rights over people-search profiles built from public information.

Based on the NAIC model, this act governs how insurers and agents collect, use and disclose personal and medical information: notices of information practices, limits on pretext interviews, access and correction rights, reasons for adverse underwriting decisions, and consent for most disclosures. It also bars anyone from selling individually identifiable medical record information.

Lets Tennessee consumers freeze their credit reports so that a consumer reporting agency cannot release the report or score for new credit without the consumer's authorization. A separate section lets a parent or guardian place a freeze for a child under 16 or an incapacitated adult, creating a record if no credit file yet exists.

Lets Alabama consumers place a security freeze on their credit reports so agencies cannot release them for credit purposes without the consumer's authorization. Agencies must place, lift, and remove freezes within set deadlines, give a PIN or password, and include an Alabama freeze-rights notice with the federal FCRA summary of rights.

California's counterpart to the federal Fair Credit Reporting Act. It governs who may obtain consumer credit reports and for what purposes, accuracy and dispute rights, and gives consumers the right to place, lift, and remove security freezes on their credit files.

Iowa's security freeze law lets residents block release of their credit reports, free of charge, and lets parents and guardians place a protected-consumer freeze for children under 16 and incapacitated adults, even creating a record if none exists. It sets short deadlines for credit bureaus to place, lift, and remove freezes.

Requires social media platforms to use commercially reasonable methods, such as a neutral age screen, to identify users under 16, and to limit those users to one hour per day per service unless a parent gives verifiable consent to change the limit. Age data may be used only for age determination. On February 27, 2026 the U.S. District Court for the Eastern District of Virginia preliminarily enjoined the Attorney General from enforcing it against any NetChoice member (NetChoice v. Jones, No. 1:25-cv-02067); the Fourth Circuit denied a stay on August 24, 2026 and set argument for October 28, 2026 (No. 26-1252).

Lets Rhode Island residents freeze their credit reports free of charge so credit cannot be opened in their name without authorization, and sets deadlines for credit bureaus to place, lift and remove freezes. It also restricts how businesses and agencies may display, mail or require transmission of Social Security numbers.

Enacted by HEA 1521 (2025) and effective on passage, this chapter regulates direct-to-consumer genetic testing companies. Before testing, they must give a written privacy disclosure. They need separate, specific consent for extra testing, secondary uses, third-party access, retention beyond 30 days, and genetics-based marketing, and they may never give identifiable genetic data to insurers or employers.

P.A. 23-56 added 'consumer health data' (including reproductive, sexual and gender-affirming health data) to the CTDPA as sensitive data and imposed threshold-free duties on anyone handling it. It bars selling consumer health data without consent and bans geofences within 1,750 feet of mental health or reproductive or sexual health facilities used to track or message consumers about their health data.

Makes identity theft and trafficking in stolen identities crimes, gives victims a civil action with statutory damages, and provides court orders confirming the victim's innocence. On such an order, consumer reporting agencies must block fraudulent information from the victim's credit report within 30 days.

Regulates mortgage solicitations based on 'trigger leads' sold by credit bureaus after a consumer applies for a mortgage. Solicitors must disclose up front that they are not affiliated with the consumer's lender and that they bought the consumer's information from a credit bureau, must comply with FCRA prescreening rules, and may not use trigger leads to reach consumers who opted out of prescreened offers or are on do-not-call lists.

Prohibits installing software on someone else's computer to deceptively collect personal information through keystroke logging or browsing tracking, hijack settings, or block removal. Private suits are limited to affected software providers, site and trademark owners, carriers, cable operators, and ISPs; botnet victims have a separate action.

Bars installing software on a Californian's computer that, through deception, hijacks browser settings, logs keystrokes or browsing history, extracts sensitive data, blocks removal, or disables security software.

Lets Florida consumers freeze their credit reports so agencies cannot release them to third parties without the consumer's authorization. Agencies must place freezes within 5 business days, lift them temporarily within 3 business days, and remove them within 3 business days of a request.

Lets Kentucky consumers freeze their credit reports so they cannot be released to new creditors without the consumer's authorization, and sets deadlines for placing, lifting, and removing freezes. A 2017 addition lets parents, guardians, and other representatives freeze the record or report of a child under 16 or an incapacitated person.

Lets Virginia consumers freeze their credit reports free of charge, with deadlines for placing and temporarily lifting freezes, and lets parents or guardians freeze or create a record for children under 16 and incapacitated adults. Since 2024 it also bars health care providers and collectors from reporting medical debt to credit bureaus.

Bars consumer reporting agencies from keeping information in their files about a criminal charge in a Kentucky court unless the charge resulted in a conviction.

Limits robocalls made with automatic dialing and announcing devices: prior consent is required, calls are limited to 8 a.m. to 9 p.m., random or sequential dialing and calls to unlisted numbers and emergency services are barred, and the recorded message must identify the caller. Telephone solicitors must keep an internal do-not-call list consistent with federal rules and may not block caller ID.

Enacted as sections 12-18 of LB525 (2026) and operative July 1, 2027, this law regulates companion-style AI chatbots. It requires AI disclosure where users could be misled, extra disclosures and content safeguards for minors, privacy and account-setting tools for minors and parents, and a crisis-referral protocol for self-harm prompts.

HB 26-1263, signed May 29, 2026, sets safety and disclosure duties for companion-style and general chatbots starting January 1, 2027. Operators must estimate users' ages, disclose that the service is AI, run suicide and self-harm referral protocols, and, for known minors, block sexual content and emotional-dependence tactics and offer privacy controls over memory and training use. The act itself took effect August 12, 2026.

Iowa's 2026 companion-chatbot law requires public conversational AI services to disclose to minors that they are talking to AI, block sexual content and human-like emotional or romantic manipulation of minors, avoid variable engagement rewards for minors, and give minors and parents privacy and account controls. For all users, operators must disclose AI status when a reasonable person could think it is human, keep suicide and self-harm referral protocols, and not present the bot as a licensed mental health provider. It applies from July 1, 2027.

Signed September 10, 2026, AB 1709 bars covered platforms from offering addictive features (addictive feeds, autoplay, and others the Attorney General defines) to users under 16. Platforms must verify age through the Digital Age Assurance Act before offering those features and must delete accounts and data of under-16 users unless the account is kept free of addictive features. It also creates an e-Safety Advisory Commission.

Bars merchants from printing more than the last five digits of a card number, or the expiration date, on electronically printed customer receipts. Applies to all electronic receipt devices since January 1, 2007.

Limits card receipts to the customer's name and five digits of the card number, requires destruction of fuller receipt copies within 36 months, and limits collecting card numbers or recording extra personal information on card slips.

Nebraska's credit freeze law lets consumers place, temporarily lift, and remove a security freeze on their credit files, and lets a parent or representative freeze the file of a child under 16 or an incapacitated person, creating a record if none exists. Freezes are free, and a frozen file cannot be released to third parties without authorization.

Montana consumers may place a security freeze on their credit reports so that reports cannot be released to new creditors without consent. Consumer reporting agencies must place, temporarily lift and remove freezes on set timelines and give consumers a notice of rights.

Licensed ambulance services may not report patients to credit bureaus over balance bills once the patient's insurer or health plan has paid based on plan charges, or when an uninsured patient has paid toward the bill and filed an AG complaint that it is not based on usual and customary charges. Bills sent to collections must carry the same limit.

Gives Louisiana consumers rights to copies of their credit reports, to dispute inaccurate items with a 45-day investigation deadline, to place free 90-day security alerts, and to place free security freezes that credit bureaus must apply within set deadlines. A separate section lets parents and guardians freeze the credit file of a child under 16 or an incapacitated person, including creating a file for that purpose.

Makes it a crime to intentionally publish someone's personal identifying information online intending that others use it to harass or harm the person, when the person is actually harassed or harmed. A second prong protects law enforcement officers, firefighters, and public servants, including against being impeded in their duties. Political speech and publishing officials' official contact information are carved out.

Makes it a felony to use the Internet to trick people into providing identifying information by impersonating a business without its authority. It gives prosecutors civil remedies and lets affected individuals and businesses sue.

Alabama is a one-party consent state: it is a crime to use a device to overhear, record, or transmit a private communication without the consent of at least one participant. The article also criminalizes secret surveillance while trespassing in a private place, planting eavesdropping devices, and using or disclosing information obtained illegally.

Prohibits employers from asking on job applications whether an applicant has ever been arrested, charged or convicted, except for law enforcement positions, jobs where law mandates disqualification for specified convictions, and jobs requiring a fidelity bond that specified convictions would bar.

Nebraska criminalizes identity theft, defined broadly to cover knowingly obtaining, possessing, or using another person's or entity's identifying information (such as name, birth date, SSN, license number, employer, account numbers, or biometric data) without consent to commit fraud, cause loss, obtain employment, or gain a benefit. Victims may report to their local law enforcement agency.

Montana makes it a crime to get someone's personal or confidential information by pretending to be that person, a practice often called pretexting. Posing as someone with their express consent is allowed.

Requires businesses to destroy customer records containing personal information when they no longer keep them, by shredding, erasing, or otherwise making the information unreadable.

Enacted by 2021 H.B. 80 and unchanged since, it gives a defense against claims of failing to implement reasonable controls, respond, or notify after a breach if the person had a written cybersecurity program reasonably conforming to NIST, CIS, ISO 27000, PCI DSS, HIPAA, GLBA, 13-44, or similar frameworks.

Enacted by LB241 (2025), this law raises the liability standard for data breach class actions against private entities. A cybersecurity event is unauthorized access to, or disruption or misuse of, an information system or nonpublic information such as SSNs, driver's license numbers, financial account numbers, access codes, or biometric records.

Gives small and mid-sized Texas businesses a defense against exemplary (punitive) damages in data breach lawsuits if, at the time of the breach, they maintained a cybersecurity program scaled to their size and conforming to a recognized framework such as NIST, CIS Controls, ISO 27000, SOC 2, or applicable HIPAA, GLBA, or PCI DSS requirements.

Enacted after the 2020 killing of Daniel Anderl, son of U.S. District Judge Esther Salas, Daniel's Law lets judges, prosecutors, law enforcement officers, child protective investigators, and their household family members demand that anyone stop publishing their home address or unpublished home phone number. After written notice, the recipient has 10 business days to stop disclosing and remove the information, or face civil liability (which can be pursued by an assignee) and possible criminal charges.

Governs how Tennessee's education agencies and schools collect and share student data. It requires the Department of Education to publish a data inventory and adopt privacy and security policies, gives parents the right to inspect their children's education records, bars schools from collecting data on students' political affiliation, religion, voting history, or gun ownership, and requires written consent before collecting student biometric or physiological data such as facial-expression analysis, brain waves, or eye tracking.

This 2026 law creates an annual registry of data brokers and data collectors that sell or license New Jersey consumers' personal data, with fees scaled by the number of consumers affected, and requires detailed disclosures about opt-out, deletion, breach history, and minors' data. It also bars data brokers and data collectors from selling or licensing sensitive data to anyone, backed by a $50,000-per-record penalty. The law took effect on signing, but the Division's public registry duty became operative 270 days later.

Creates Connecticut's first data broker registry: from January 1, 2027 no data broker may sell or license brokered personal data in the state unless registered with the Department of Consumer Protection. By July 1, 2028 the Department must launch a one-stop deletion mechanism, and from August 2028 registered brokers must check it at least every 45 days and delete participating consumers' data.

Requires data brokers to register every year with the California Privacy Protection Agency and disclose what data they collect. The 2023 Delete Act (SB 362) moved the registry from the Attorney General to the Agency and required a single, free deletion mechanism; the Agency launched DROP on January 1, 2026, and registered brokers must process DROP deletion requests every 45 days starting August 1, 2026. SB 361 (2025) added more registration disclosures.

Louisiana's breach law requires businesses and agencies to protect computerized personal information with reasonable security, destroy it securely when no longer retained, and notify affected Louisiana residents within 60 days of discovering a breach. An Attorney General rule adds notice to the AG within 10 days of notifying residents. Personal information is name plus SSN, driver's license or state ID number, financial account or card number with access code, passport number, or biometric data.

Bars campaigns, PACs and independent spenders from distributing, within 90 days of an election, AI-manipulated images, audio or video of a person that they know or should know are deceptive and fraudulent, unless the media carries a clear disclosure that it was manipulated or generated by artificial intelligence.

This 2025 law makes it a crime to create or spread AI-generated or other technically produced deepfakes to commit or further crimes such as harassment, sexual exploitation, or election interference. It also lets victims, including families of deceased victims, sue for damages.

Enacted in 2003, this chapter bans commercial email that uses a third party's domain without permission, misrepresents its origin or path, or has a false or misleading subject line. It also requires 'ADV:' and 'ADV:ADLT' subject labels on unsolicited ads and a free opt-out. Many of its labeling and opt-out rules likely overlap with, and may be preempted by, the federal CAN-SPAM Act, which preserves state laws only as to falsity or deception.

Montana bars distributing AI-generated or synthetic 'deepfakes' of candidates or parties in election communications within 60 days of an election unless a prescribed disclosure says the content was significantly edited by AI. On September 16, 2026, a federal court preliminarily enjoined enforcement of the law, but only as to the plaintiffs, in Accountability in State Government v. Knudsen, No. 6:26-cv-00038-SPW (D. Mont.).

Delaware's employment discrimination law bars discrimination based on genetic information and bars employers, agencies, and unions from intentionally collecting genetic information about employees, applicants, or their family members unless it is job-related and consistent with business necessity or needed for retirement or benefit plan administration.

Delaware's online privacy law has three parts: it bars marketing listed adult products (alcohol, tobacco, firearms, lottery, tattoos, sexually oriented material, and others) to children under 18 on child-directed services and restricts use of children's personal information for such marketing; it requires any commercial website or app collecting personal information from Delaware users to post a conspicuous privacy policy; and it limits disclosure of e-book and book-service user records.

Delaware's comprehensive consumer privacy law gives residents rights to access, correct, delete, and port their personal data, to get a list of third parties that received it, and to opt out of targeted advertising, sale, and significant-decision profiling. It has low applicability thresholds, requires opt-in consent for sensitive data and for targeted advertising or sale of data about known 13-17-year-olds, and requires honoring universal opt-out signals from 2026-01-01. HB 380 (signed 2026-09-02, effective 2027-01-01) lowers thresholds further and adds third-party contract and diligence duties, adverse-action notices for profiling reports, automated-decision impact assessments, a broader sensitive-data definition (including neural data and financial credentials), and narrows the employee-data exclusion for profiling.

Requires telemarketing sellers and businesses reaching Delaware customers to register with the Department of Justice, make opening disclosures, and give written confirmation before a sale is final. It bars calling a customer about sales for 10 years after the customer says to stop, and gives harmed customers a right to sue.

Gives people a civil claim against anyone who knowingly or recklessly shares, or threatens to share, private intimate images of them without consent. A 2024 amendment (the Amelia Kramer Act) extends the claim to AI-generated sexual deep fakes and lets plaintiffs proceed with identifying details redacted.

Requires businesses that discard customer records they no longer need to keep to take reasonable steps to destroy the personally identifiable information in them. Personally identifiable information is defined broadly and includes contact details, SSNs, government ID numbers, and medical, financial, tax, and disability information.

Creates a device-level age signal. Operating systems must ask for the user's birth date or age at account setup and send app developers an age-bracket signal (under 13, 13-15, 16-17, 18+) on request; developers must request the signal and are treated as knowing the user's age range. AB 1856 (2026) broadened the account-setup duty, set a July 1, 2027 deadline for devices set up before 2027, and bars requesting a signal when not required by law. Other 2026 laws (AB 1709, AB 2246, SB 1119) rely on this signal.

Enacted by 2026 H.B. 276, effective January 1, 2027, it requires provenance data handling for AI-generated and captured content. It is a disclosure-standards law rather than a privacy-notice law.

Makes it a crime to secretly view, broadcast, or record someone who is dressing, undressing, or privately exposing their body where they expect privacy, or to record under or through their clothing, without their knowledge and consent. HB 1389 (2024) renamed the offense from 'video voyeurism' to 'digital voyeurism' and revised its elements.

Enacted by 2026 H.B. 276, effective January 1, 2027, it treats non-consensual counterfeit intimate images as a violation of the reasonable expectation of privacy. Generation services must verify consent and publish policies; covered platforms must offer a 48-hour takedown process.

Gives consumers a property right in, and exclusive control over, their biological samples and genetic test results held by direct-to-consumer genetic testing companies. Companies must obtain express consent for collection, use, transfer, secondary use and sample retention, may not share genetic data with employers, insurers or marketers, and must let consumers access and delete data and destroy samples.

This law protects customer financial records by providing that covered institutions cannot be required to disclose records they deem confidential except in listed situations, such as a court subpoena, summons, warrant, or order, a supervisory regulator's examination, an agency subpoena, a statutory requirement, discovery rules, or a law enforcement request where the institution is a crime victim. Requesters generally pay the actual cost of producing records.

Iowa bars mental health professionals, facilities, and data collectors from disclosing a person's mental health information except under written authorization or listed exceptions (emergencies, administrative needs, court orders, claims administration, limited family and law enforcement disclosures). Each disclosure must be logged, and recipients may not redisclose.

This short chapter makes GLBA Title V's limits on sharing nonpublic personal information with non-affiliated third parties part of Indiana insurance law. It authorizes the Insurance Commissioner to adopt rules consistent with, and no stricter than, GLBA.

Makes HIPAA's disclosure limits a matter of Vermont law by barring covered entities and business associates from disclosing protected health information unless HIPAA permits it. Amendments in 2023 and 2025 add shield-law protections: PHI about legally protected health care activity, such as reproductive and gender-affirming care, may not be disclosed to out-of-state governments for investigations or used in legal proceedings, except with patient authorization or in listed cases.

Indiana's breach law requires data base owners to notify affected Indiana residents, and the Attorney General, when a breach of computerized personal information could result in identity theft, identity deception, or fraud. Notice must go out without unreasonable delay and within 45 days of discovery. The article also requires reasonable security procedures and secure disposal of records containing personal information.

Makes it a crime to knowingly share nude or sexual images of an identifiable person without consent, with intent to harm, harass, intimidate, threaten or coerce, including realistic digitally altered or AI-generated images. Websites may not charge to remove such images, and victims have a civil cause of action.

Requires campaign communications that use realistic AI-manipulated images, audio or video of a person to carry a disclosure that the content has been manipulated.

Montana makes it an unlawful discriminatory practice for employers, businesses and government to deny services, jobs or access based on a person's vaccination status or whether they hold an 'immunity passport'. Health care facilities may ask employees to volunteer vaccination status only to plan accommodations.

Colorado businesses must have a written policy to destroy paper and electronic records containing personal identifying information when no longer needed, rendering it unreadable. Since 2018 they must also maintain reasonable security procedures appropriate to the data and the business, and require service providers to do the same.

Requires businesses to shred, erase, or otherwise make customers' personal identifying information unreadable when disposing of records, and to delete disputed dishonored-check records within 30 days of agreement or a police report.

Criminalizes distributing a sexually explicit image of an identifiable person without their written consent, and (since 2024) creating, recording, or altering such an image without consent, when the person had a reasonable expectation of privacy. The definition expressly reaches altered and AI-generated images that a reasonable person would believe depict a real, identifiable individual.

Prohibits knowingly distributing AI-generated media that falsely depicts a person's speech or conduct within 90 days of an election, with intent to harm a candidate and deceive voters. Distribution is allowed if the media carries a prescribed disclaimer that it has been manipulated and depicts speech or conduct that did not occur.

Criminalizes sharing another person's private sexual images without written consent when done to profit or to harm, harass, or coerce, and clarifies that consent to create an image is not consent to distribute it. Sites and apps that distribute such images must take them down at the depicted person's request without charging a removal fee, and face daily civil damages if they do not.

Requires businesses to destroy customer records containing personal information, such as SSNs, ID numbers and financial account numbers, when they no longer keep them, by shredding, erasing or otherwise making the data unreadable. Disposal companies must adopt and monitor policies that protect the information during collection, transport and disposal.

Enacted by HEA 1271 (2026) and effective July 1, 2026, this chapter limits claim downcoding by health insurers. Insurers may not use automated tools, including AI, as the sole basis for a medical-necessity downcode without human review of the medical record. Providers may not submit claims generated by automated tools without human review. Insurers must disclose when AI is used to deny prior authorization or downcode a claim.

Allows workplace drug, alcohol, and cannabis testing only under a written policy and only in listed situations (post-offer applicant testing, annual physicals with notice, random testing for safety-sensitive jobs, reasonable suspicion, and treatment follow-up). Laboratories may tell employers only whether substances were present, and test results are private and confidential, not usable in criminal cases against the employee.

Sets rules for employers that choose Florida's drug-free workplace program. Employers must give employees and applicants a written policy before testing, and drug-test information is confidential and may be released only with the tested person's signed written consent or when compelled in listed proceedings.

Applies the same limits as the K-12 law to technology used in preschool and prekindergarten: no targeted advertising, profiling, sale, or unauthorized disclosure of children's information; reasonable security; and deletion on request. AB 1159 (2026) extends and tightens it, including a bar on AI training.

Criminalizes wiretapping by a non-party without either party's consent and mechanically overhearing or recording an in-person conversation without the consent of at least one party (a one-party-consent rule for criminal liability), and bars obtaining or divulging call contents through telephone company employees. Civil liability for recording phone calls without all-party consent is separate (52-570d).

Bars Delaware colleges and universities from demanding students' or applicants' social media passwords, making them log in in front of staff, requiring them to add the school as a contact, accessing their accounts through their contacts, or installing tracking software on their personal devices. Campus police investigations and threat assessments are exempt.

Applies FERPA-style rights to Florida K-12 records and adds a 2014 rule barring schools and education agencies from collecting students' (or their parents' or siblings') political affiliation, voting history, religious affiliation, or biometric information. It mainly binds public schools and those that perform services for them.

Stops schools and colleges from demanding access to students' or applicants' personal social media accounts. Institutions may still investigate specific misconduct reports without login credentials and monitor their own networks.

Rhode Island's state counterpart to FERPA for K-12 schools. It gives parents and adult students rights to inspect student records within 10 days, get copies at no more than 15 cents per page, request amendment or expungement, add a statement to contested records, and keep records confidential absent written consent or a FERPA-authorized release.

Starting in 2027, edtech providers must give the Secretary of State more information whenever they make a filing, including links to each product's privacy policy, the schools they serve under paid contracts and a description of each product. They must also attest that each product meets Vermont's student privacy law, the Age-Appropriate Design Code, COPPA and other privacy laws.

Iowa is a one-party consent state: a person who is a party to a conversation, or openly present and listening, may record it, but secretly listening to or recording others' conversations without authority is a crime. A 2018 amendment added an exception for doorbell and outdoor security cameras on a person's own property.

Requires electronic health records of Texans to be physically stored in the United States and accessible only to staff who need them, bars recording credit scores or voter registration status in health records, gives parents immediate access to minors' records, and requires practitioners to disclose diagnostic AI use. It also adds biological-sex recording rules for records.

Iowa's anti-spam law targets bulk commercial email senders who forge or falsify routing and header information, and people who sell software built to do so. It carries criminal penalties that rise with volume, lets injured email providers and recipients sue for statutory damages, and treats violations as consumer fraud enforceable by the Attorney General. Much of state spam regulation is preempted by the federal CAN-SPAM Act, except for falsity and deception rules like this one.

Florida's anti-spam law. It prohibits unsolicited commercial e-mail that uses a third party's domain without permission, falsifies or hides routing information, carries a false or misleading subject line, or contains deceptive content meant to damage the recipient's device.

Rhode Island's anti-phishing law. It prohibits using websites, emails or other internet means to trick people into giving personal identifying information, such as SSNs, account numbers, passwords or biometric data, by pretending to be a business or person without authorization.

Lets nursing home and assisted living residents place cameras or audio recorders in their own rooms with written consent on a state form, including consent from any roommate. Facilities must post notices, may not retaliate or refuse admission over monitoring, and no one may access recordings without the resident's written consent; recordings are the resident's property and may be shared only for health, safety or welfare concerns.

Employers that electronically monitor employees on their premises (computers, phones, cameras and similar means) must give prior written notice of the types of monitoring, which can be done by a conspicuous posting. Covert monitoring is allowed when there are reasonable grounds to suspect illegal conduct, rights violations or a hostile work environment.

This 2024 law requires Iowa health care providers and facilities to give a minor's legal guardian access to the minor's electronic health information, or a free printed copy instead. It does not cover care the minor may legally consent to alone, or disclosures barred by other state or federal law.

Makes it a crime to place a GPS or other electronic tracking device on someone else's property without the owner's consent or legal authority. Doing so to surveil, stalk, or harass is a felony.

Louisiana's wiretap law makes it a crime to intercept wire, electronic, or oral communications, or to use or disclose intercepted contents, unless an exception applies. It is a one-party consent law: a private person may record a communication they take part in, or with one party's prior consent, unless the purpose is to commit a criminal, tortious, or other injurious act. Victims have a civil damages action.

Makes it a crime to knowingly install or hide an electronic tracking device on a motor vehicle to monitor its occupants without the consent of all owners, and bars lessors from tracking leased vehicles without the lessee's consent. Exceptions cover law enforcement investigations, parents monitoring a minor child in a vehicle they own or lease, stolen goods or stolen vehicles, and manufacturer-installed systems.

Makes it a crime to secretly put or use a GPS or other electronic tracking device on a vehicle to follow its driver or passengers without the consent of the operator and all occupants. Exceptions cover law enforcement investigations, parents tracking minor children in vehicles they own, theft-recovery devices, dealers with written consent in credit sales or leases, and businesses tracking their own fleet vehicles driven by employees or contractors.

Gives employees the right to inspect and copy their personnel files and to add a rebuttal statement that must travel with any disclosure of the disputed information. Health and lifestyle information gathered for wellness programs may not be kept in personnel files.

Gives Minnesota employees the right to review their personnel records on written request (once every six months) and former employees the right to a free copy, and lets employees dispute information and attach a position statement. Records improperly withheld from review generally cannot be used against the employee in later proceedings, and retaliation is prohibited.

Bars employers from demanding access to workers' or applicants' personal social media accounts, forcing them to add the employer as a contact, or punishing them for refusing. Employers may still investigate specific misconduct reports and view public content.

Bars employers from requiring or asking employees or applicants for personal social media usernames and passwords, to open personal accounts in front of the employer, or to divulge personal social media, with limited exceptions for misconduct investigations and employer-issued devices.

Bars employers from requesting or requiring employees or applicants to disclose passwords to personal internet accounts, to add the employer as a contact, or to open a personal account in the employer's presence, and from retaliating when they refuse. Employers may still access employer-provided devices and accounts, investigate specific reports of misconduct or data leaks, monitor their own networks, and view public information.

Gives current and former employees the right to inspect and copy their personnel files and medical records, requires medical records to be kept separately, and forbids employers from disclosing identifiable personnel or medical file information to outsiders without written authorization, subject to listed exceptions. Participation in employee assistance programs is also confidential.

Makes it a misdemeanor to require employees or applicants, as a condition of employment, to be photographed or fingerprinted for the purpose of furnishing the images or prints to another employer or third party where they could be used to the worker's detriment. Often cited in biometric timekeeping cases.

Bars Oklahoma employers from requiring employees or applicants to hand over personal social media usernames and passwords or to open private accounts in front of the employer, and from retaliating or refusing to hire over a refusal. Employers keep access to employer-provided devices and accounts and may investigate specific reports of misconduct or data leaks.

Bars employers from requiring or asking employees and job applicants for passwords to personal social media accounts, from making them log in while the employer watches, from forcing them to add the employer as a contact or change privacy settings, and from punishing or refusing to hire anyone who says no.

Bars employers from requiring employees or job applicants to hand over passwords to personal online accounts, log in in front of them, or connect with them on social media, and from retaliating against those who refuse. Employer-provided accounts and devices and specific-information investigations are excepted.

Colorado employers may not ask or require employees or applicants to disclose usernames or passwords for personal online accounts on personal devices, or to add the employer as a contact or change privacy settings, and may not retaliate for refusal. Limited exceptions cover securities and financial compliance investigations and investigations of unauthorized downloads of proprietary data.

Montana employers may not require or ask employees or applicants for personal social media usernames or passwords, to open accounts in front of them, or to hand over account content. Narrow exceptions apply to specific workplace-misconduct, data-theft and regulatory investigations. A 2023 amendment also bars retaliation for lawful free speech on personal social media, subject to written policies and contracts.

New Jersey employers may not require or ask current or prospective employees to hand over usernames or passwords, or otherwise give access, to their personal social media accounts. Employers also may not retaliate against people who refuse or who report or oppose violations.

Forbids employers from using cameras or audio recording to monitor employees in areas meant for their health, comfort or belongings, such as restrooms, locker rooms and lounges, and bars either side from secretly recording employment contract negotiations without all parties' consent.

This 2001 law bars Nebraska employers, unless federal law requires otherwise, from requiring genetic tests or genetic information as a condition of employment or promotion and from hiring, firing, or classifying workers based on genetic information unrelated to job duties. Employees may voluntarily share health-related genetic information for workplace safety.

Restricts how Oklahoma employers handle employee Social Security numbers: no public posting, no printing on access cards or mailed materials, and no transmission over the Internet without encryption or use as a sole website login. Employees may consent in writing to otherwise prohibited uses.

Bars employers from subjecting workers or applicants to breathalyzer, polygraph, psychological stress, brain-wave or genetic tests, with narrow exceptions for consensual breath tests (or required tests on reasonable suspicion), consensual polygraphs in legal proceedings, and consented genetic tests for a bona fide occupational qualification.

Bars most employers from obtaining or using consumer credit report information to make hiring, firing, promotion, pay or other employment decisions, unless an exception applies.

Prohibits employers from requiring employees or applicants to consent to a credit report as a condition of employment unless the employer is a financial institution, the report is legally required, the employer suspects job-related illegal conduct, or the report is substantially related to the job.

Makes it an unlawful employment practice to seek, obtain or use genetic information about a worker, applicant or their blood relative to discriminate or deny any job right or benefit.

Bars Delaware employers from demanding access to employees' or applicants' personal social media, such as asking for passwords, requiring them to log in in front of the employer, or requiring them to add the employer as a contact. Employers may still investigate misconduct, access employer-provided devices and accounts, and view public information.

Enacted in LB674 (2007), this law restricts how Nebraska employers display and use employees' Social Security numbers. Employers may not post or share more than the last four digits publicly or with coworkers, use full SSNs as employee IDs or unsecured web logins, or keep them in unrestricted files.

New Jersey employers must give employees written notice before knowingly using a tracking device in a vehicle the employee uses. Federal motor carrier rules on electronic devices are not displaced.

Bars most Vermont employers from asking about or basing employment decisions on an applicant's or employee's credit report or credit history. Exempt employers may not use credit as the sole factor, and must get written consent, explain adverse actions and keep reports confidential.

Colorado employers may use consumer credit information for hiring or other employment decisions only when it is substantially related to the job, and may not require consent to a credit report except for banks, legally required reports, or disclosed bona fide job-related purposes. Employees must be told if credit information was the basis of an adverse action.

Tennessee's right-of-publicity statute gives every individual a property right in the use of their name, photograph, voice, and likeness. The 2024 ELVIS Act added voice (including simulated or AI-generated voice) as a protected right and created liability for publishing unauthorized voice or likeness replicas and for distributing tools whose primary purpose is cloning a particular person. Rights survive death and pass to heirs, subject to First Amendment fair-use exceptions.

Requires manufacturers to disclose event data recorders in the owner's manual and makes the recorder and its data (speed, location, braking, seatbelt use, crash transmissions) the property of the vehicle owner. Others may retrieve the data only with owner consent, a court order, for servicing, or for emergency medical response; subscription services must disclose recording in their terms instead.

Enacted by HEA 1133 (2024), this chapter requires campaign ads with AI-generated or deceptively altered audio, images, or video of a candidate to carry a disclaimer that elements were 'digitally altered or artificially generated.' Candidates depicted in unlabeled fabricated media may sue.

Enacted by 2020 Md. Laws ch. 446 (HB 1202), this law bars employers from using facial recognition services to create a facial template during a job interview unless the applicant consents by signing a plain-language waiver.

Signed July 23, 2026, this law bars retailers from using algorithms fed by personal data (including location, online activity, purchase history, biometric monitoring, or in-store sensors) to set individualized prices for groceries and household essentials. Cost-based price differences, publicly disclosed group discounts, and opt-in loyalty programs with uniform terms remain allowed. It also imposes a one-year moratorium on new electronic shelf labels.

Prohibits commercial email that spoofs a third party's domain, misrepresents its origin or path, or has a false or misleading subject line, and requires unsolicited commercial email to start the subject line with 'ADV' ('ADV-ADULT' for adult content) and to offer a toll-free number or return address for opt-outs. By its own terms the section expires when federal law preempting state regulation of such email takes effect; the federal CAN-SPAM Act (2003) preempts state email laws except those addressing falsity or deception, so the labeling and opt-out requirements are likely unenforceable while the anti-falsity provisions remain.

Nebraska's breach law requires businesses and government entities that own or license computerized personal information to investigate a breach promptly and, if misuse has occurred or is reasonably likely, to notify affected residents and the Attorney General. Since 2018 it also requires reasonable security procedures, including for disposal, and contracts requiring vendors to safeguard the data. Notice to the Attorney General and the username/email-and-password element were added by LB835, effective July 21, 2016.

Protects the confidentiality of bank and credit union customer records against disclosure to Oklahoma government authorities. An institution may release a customer's records to state government only with the customer's written consent for the specific record or in response to a lawful subpoena, and the customer must receive a copy and may move to quash. A 2026 amendment (SB 2067, effective November 1, 2026) adds a disclosure exception for reporting suspected financial exploitation of protected adults.

Prohibits financial institutions from disclosing a customer's financial records to anyone other than the customer or the customer's agent unless the customer authorizes it or a subpoena meeting the act's requirements is served. Listed exceptions cover supervisory examinations, tax reporting, credit information exchanges, anonymized data, suspected-crime reports to government, and (since October 1, 2024) records given to the TBI about suspected elder financial exploitation.

Virginia's only general biometric-type rule for businesses: unless the parties agree otherwise, anyone who requires fingerprints in a business transaction must return or destroy the prints and all copies, including electronic copies, within 21 days after the transaction ends. Virginia has no BIPA-style biometric privacy statute; biometric data used to identify a person is otherwise 'sensitive data' under the VCDPA.

Florida's debt collection law, which covers creditors as well as collection agencies. Several of its rules protect debtor privacy: limits on contacting employers, on disclosing debts to third parties, on publishing 'deadbeat lists' or using embarrassing envelopes, and a ban on contacting debtors between 9 p.m. and 8 a.m. without consent (revised in 2025 to exempt e-mails that otherwise comply).

Florida's comprehensive privacy law, enacted in SB 262 (2023). Unlike most state privacy laws, its core consumer-rights duties reach only very large companies (over $1 billion in revenue plus an ad-revenue, smart-speaker, or app-store test), but its rule against selling sensitive data without consent applies to for-profit businesses of any size. It also bars devices from surveilling users through voice, facial, video, or audio features when not in active use, and requires search engines to disclose ranking parameters, including political prioritization. The Attorney General's first enforcement action, against Roku (filed October 2025), was resolved in June 2026 with Roku committing to child-protection changes estimated at $25 million and no civil fine.

Added by SB 264 (2023, ch. 2023-33), this subsection requires providers using certified EHR technology to keep all patient information stored offsite, including with cloud vendors, physically in the continental United States, its territories, or Canada. It adds to the HIPAA Security Rule.

Florida's data breach and data security law. It requires businesses to reasonably secure electronic personal information and dispose of customer records securely, and to notify affected Floridians and, for breaches affecting 500 or more Floridians, the Attorney General, within 30 days. Personal information includes biometric data and geolocation (added by SB 262, effective July 1, 2024).

Licenses commercial telemarketers and sets conduct rules. Since 2021 it limits solicitation calls to 8 a.m. to 8 p.m. in the called person's time zone, caps them at three calls in 24 hours on the same subject, and bars blocking or spoofing caller ID. Those call-conduct rules apply even to sellers otherwise exempt from the Act.

Florida's telemarketing privacy law, which includes the state do-not-call list and, since 2021, a 'mini-TCPA' requiring prior express written consent for autodialed or prerecorded sales calls and texts. HB 761 (2023) narrowed the autodialer definition and added a pre-suit 'STOP' notice for text claims. Calls to Florida area codes are presumed to reach Florida residents.

Montana's anti-phishing law makes it identity theft to use a website, email or other internet means to trick people into giving up personal information by pretending to be another person or business. Victims, including impersonated website and trademark owners, can sue.

Criminalizes knowingly making or spreading AI-altered video, audio or other media of a real, identifiable person to harm, harass, defame, entrap or extort them, and lets the person depicted sue for damages. Platforms hosting third-party content, news reports that flag authenticity doubts, and satire are exempt.

Mainly limits police drone use, but it also bars any person from using a camera drone to record privately owned property or the people on it with intent to conduct surveillance in violation of their reasonable expectation of privacy, without written consent. People are presumed to have that expectation on private property when they cannot be seen from ground level.

Requires health care providers that use generative AI to write or speak to patients about clinical information to say so and to tell patients how to reach a human, unless a licensed provider reviewed the message first.

Requires developers of generative AI systems available to Californians to post documentation on their websites summarizing the datasets used to train the system, including whether the data contain personal information or copyrighted material, where it came from, and how it was processed.

Regulates direct-to-consumer genetic testing companies. They must publish plain-language privacy summaries, get separate express consent for each use, sample storage, secondary use, third-party transfer, and genetic-data-based marketing, honor consent revocation within 30 days, secure the data, and let consumers access and delete it. Disclosure to insurers or employers requires express consent.

Enacted alongside the consumer genetic testing chapter, this law bars discrimination against a person for using consumer genetic testing services or because of the results. It covers denying goods or services, charging different rates, or suggesting either will happen.

Bars health plan companies from requiring or asking about genetic tests of applicants or their relatives, or using test results or refusals, in underwriting. Life insurers that require genetic tests must obtain written informed consent, notify the person of results, and pay for the test.

Requires written informed consent before anyone obtains, keeps, or discloses a person's identifiable genetic information, requires prompt destruction of samples unless an exception applies, and gives individuals the right to see and correct their genetic records. Exceptions cover criminal and death investigations, paternity, court orders, the state DNA database, newborn screening, and anonymous research.

Bars medical and genomic research facilities from using genetic sequencers or software from foreign adversaries and from storing genetic sequencing data inside a foreign adversary. It requires encryption and access controls and sworn compliance statements to the Attorney General by December 31, 2028.

Makes it a discriminatory employment practice to request or require genetic information from employees, applicants or union members, or to discriminate based on it. From October 1, 2026, P.A. 26-15 adds that using an automated employment decision technology is no defense to a discrimination complaint.

Prohibits employment discrimination based on protected genetic information or requests for genetic services, bars employers from requiring, collecting, or buying employees' genetic information (with limited exceptions such as post-offer requests), and restricts disclosure. Genetic information must be kept as a confidential medical record separate from personnel files.

Requires written informed consent before anyone, whether a government entity or any other person, collects genetic information about an individual, and limits its use, storage period, and dissemination to what the individual consented to. Dissemination consents must be signed and dated and generally last no more than one year. Genetic information held by government is private data.

Shields genetic information from compelled disclosure in judicial, legislative, or administrative proceedings except in listed situations (paternity, the person's own claims, insurance disputes, law enforcement or fraud). Research records of genetic study subjects are confidential, not subject to civil discovery, and may not go to employers or health insurers without informed consent.

Florida extended its genetic nondiscrimination rule from health insurance to life and long-term care insurance in 2020. Covered insurers cannot use genetic test results, absent a diagnosis, to cancel, limit, or deny coverage or set rates, and cannot require or solicit genetic information for any insurance purpose.

Bars employers, unions, and employment agencies from discriminating based on genetic information or refusal to take a genetic test, makes genetic information confidential and privileged, and gives tested individuals a right to their results. Samples must be destroyed once their purpose is accomplished, with limited exceptions.

Maryland's employment discrimination law bars employers from discriminating based on genetic information or an individual's refusal to take a genetic test or share results, and from requesting or requiring genetic tests or genetic information as a condition of hiring or benefits.

Genetic information, including family history and genetic test results, is confidential and privileged in Colorado health insurance. Release for purposes other than diagnosis or treatment requires specific written consent, and health insurers may not seek, use, or keep genetic information for underwriting or require genetic tests.

Requires specific written authorization before asking an insurance applicant to take a genetic test, bars using genetic information in health coverage decisions, and bars using a blood relative's genetic information for any insurance decision.

Bars health insurers from refusing, limiting or pricing coverage based on genetic information, and bars life, disability, long-term care and similar insurers from using direct-to-consumer genetic test results without the tested person's informed written consent or requiring genetic testing as a condition of coverage.

Health insurers may not use genetic tests or genetic information to deny, limit, or price coverage, may not require genetic tests to decide coverage, and may not release identifiable genetic information outside the plan and its providers without authorization. The 2025 Genetic Testing Protection Act adds that life and disability insurers may not access genetic data or other sensitive medical information without signed written consent or require genetic testing for eligibility.

Enacted by LB308 (2024), this law regulates consumer DNA testing companies. It requires privacy notices, layered express consent for uses, transfers, sample retention, research, and marketing, a comprehensive security program, and consumer rights to access and delete genetic data and have samples destroyed.

Regulates direct-to-consumer genetic testing companies. It requires plain-language privacy notices, separate express consent for each use, storage, transfer, and marketing use of genetic data or samples, reasonable security, and ways for consumers to access and delete data and have samples destroyed. It also bars sharing genetic data with health, life, disability, or long-term care insurers or employers.

Regulates direct-to-consumer genetic testing companies. They must give clear notice of their genetic data practices, get express consent to collect and use genetic data, get separate consent for third-party transfers, secondary uses, sample retention, and genetic-data-based marketing, and let consumers access and delete their data and have samples destroyed. Disclosure to insurers or employers needs written consent, and law enforcement access requires valid legal process.

Vermont's 2026 genetic privacy law requires direct-to-consumer genetic testing companies to publish plain-language privacy terms, get separate express consent for each use, storage or transfer of genetic data and samples, protect the data, and let consumers access and delete data and destroy samples. It bans disclosing genetic data to insurers or employers, and requires a warrant or the consumer's consent before disclosure to the government.

Enacted in June 2026 and effective on passage, this law regulates consumer genetic testing companies such as ancestry and health DNA services. They must publish plain-language privacy information, get separate express consent for each use, storage, transfer and genetic-based marketing, let consumers access and delete data and destroy samples, secure genetic data, and not share it with insurers or employers.

Montana's direct-to-consumer genetic privacy law requires consent, notice, security and consumer control over genetic data and biological samples. A 2025 amendment (SB 163) extended every protection to neurotechnology (neural) data, making Montana one of the first states to regulate neural data this way. It also bars storing covered data in sanctioned or foreign-adversary countries and requires consent to store it outside the United States.

Part 1 regulates direct-to-consumer genetic testing companies: public privacy notice, express consent for use and sharing, separate consent for transfers, secondary uses, sample retention and marketing, and consumer access and deletion. Part 2 restricts employer and health-insurer use of genetic testing information and carries a private right of action.

Bars health insurers, health plans, and HMOs from using genetic information, or a request for genetic services, to deny, limit, cancel, condition, exclude, rate, or add waiting periods or riders to coverage, and bars agent commission differences based on genetic characteristics.

Prohibits employers from seeking, using, or requiring genetic tests or genetic test results to distinguish between, discriminate against, or restrict the rights of employees or job applicants, other than for insurance coverage determinations.

Bars health insurers from using genetic information (including family history and requests for genetic services) to deny, condition, or price coverage, and from requesting, requiring, or purchasing genetic information for underwriting or before enrollment. Insurers may not require genetic tests, with a narrow voluntary research exception.

Indiana bars health insurers and HMOs from requiring genetic tests, asking about genetic test results, or using those results to deny, cancel, limit, or price coverage. Favorable results that an applicant volunteers may be considered.

Enacted in LB644 (2025), this law bars Nebraska medical and research facilities from using genetic sequencers or sequencing software produced by foreign adversaries (as listed in 15 C.F.R. 791.4) or their state-owned or domiciled businesses, and requires existing equipment to be disabled or removed. Genetic sequencing data used in Nebraska may not be stored in, or remotely accessed from, a foreign adversary country.

Bars health plans and insurers from denying, cancelling, refusing to renew, or re-pricing coverage based on a genetic test for an unmanifested condition or on use of genetic services. Health and disability insurers may not ask applicants or members to disclose genetic test results, and health insurers may not disclose a member's genetic test without separate prior authorization for each disclosure.

Requires prior written informed consent before genetic testing and before disclosing that someone was tested or the results, with narrow exceptions (paternity, newborn screening, criminal investigations, medical examiner, clinical care). It bars employers and licensing bodies from requiring or using genetic tests and bars health insurers from requesting, requiring or rating on genetic test information.

Iowa bans employers, employment agencies, unions, and licensing agencies from requiring or administering genetic tests or taking action based on them, and requires informed written consent before anyone obtains genetic samples or tests, collects, keeps, shares, or uses genetic information, with limited exceptions. Health insurers may not release genetic information without written authorization or use it for underwriting.

Parallel provisions across Rhode Island's health insurance chapters forbid health insurers, hospital and medical service corporations and HMOs from using genetic tests or genetic information in coverage, pricing or eligibility decisions, from requiring or asking about genetic tests, and from releasing genetic results without the person's written authorization for each disclosure.

Bars employers, employment agencies and licensing agencies from requiring or administering genetic tests, from penalizing workers or applicants who refuse to take a test, give family health history or reveal results, and from using or revealing genetic information against them.

Bars health benefit plans from requiring a genetic test for cancer predisposition as a condition of coverage, and from using such test results to decide insurability or to discriminate in rates or benefits. It is narrow: it covers only genetic tests showing a predisposition to cancer.

Prohibits employers and employment agencies from administering genetic tests, or requesting, requiring, or collecting genetic information about a person or the person's blood relatives, as a condition of employment, and from basing employment decisions on such information. Third parties may not supply or interpret that information for employers.

Genetic test information is confidential and privileged and may be released for non-treatment purposes only with written consent. Group disability and long-term care insurers may not use it for underwriting, and life and individual disability insurers need specific written informed consent before requiring or performing a genetic test.

Bars employers from requesting, requiring, or administering genetic tests as a condition of employment and from taking adverse employment action based solely on a genetic characteristic or genetic test result, however obtained.

Bars compulsory genetic testing except in listed cases such as parentage, newborn screening, criminal investigations and the DNA data bank. Genetic testing needs prior written informed consent, and results may be disclosed only with written authorization. Employers, unions, licensing bodies and insurers may not require or use genetic tests or genetic information.

Requires express consent before anyone performs DNA analysis on a person, and makes the results the tested person's exclusive property, confidential, and not disclosable without express consent. Anyone who performs the analysis or receives results must tell the person and say whether the results were used in insurance, employment, lending, credit, or education decisions.

Bars insurers from discriminating in issuing, renewing, or pricing insurance based on genetic characteristics or genetic information. A 2024 law adds life insurance and annuity rules: no adverse decisions based solely on genetic test results outside the medical record, no requesting genetic tests, and no obtaining direct-to-consumer genetic testing data without written informed consent under 16 Del. C. § 1202.

Iowa's harassment statute makes nonconsensual sharing of nude or sexual images a first-degree harassment crime. A 2024 amendment extends it to images that were created, adapted, or modified from a recognizable person's face or likeness, which covers AI-generated sexual deepfakes, and requires adult offenders to register as sex offenders.

Prohibits collecting, using, selling, sharing, or keeping personal information of people at or within a precise geolocation (1,850-foot radius) of a family planning center except as needed to provide requested goods or services, and bans geofencing in-person health care providers to track, collect data from, notify, or advertise to patients or staff. AB 45 (2025) also shields identifiable health research records from out-of-state and law-enforcement demands tied to reproductive care.

This part supplements HIPAA for Montana providers covered by it, setting state rules on disclosures (for example to workers' compensation insurers and law enforcement), compulsory process and fees. HB 590 (Ch. 694, L. 2025), effective July 1, 2026, bars information blocking by providers ordering lab tests and requires certain sensitive results, including genetic-marker tests and positive HIV tests, to be released in the patient's electronic health record within 72 hours of finalization unless released earlier.

Requires licensed health facilities to prevent unauthorized access to patients' medical information and to report any unlawful or unauthorized access, use, or disclosure to the Department of Public Health and to the affected patient within 15 business days of detection.

Health insurance carriers may not keep personal information (name plus SSN, driver's license number, address, or identifiable health information) on laptops, desktops, mobile devices, or removable media, or send it over public networks, unless it is encrypted or otherwise unreadable. Password protection alone is not enough.

Bars health insurers from using genetic information, genetic services, or refusal of a genetic test to terminate, limit, or price coverage, and requires written informed consent before obtaining genetic information or a DNA sample. It declares an insured's genetic information the insured's property and forbids retaining it without authorization. Violations carry some of the largest statutory damages of any U.S. genetic privacy law.

This 2001 law bars health insurers and non-preempted self-funded plans from requiring covered persons, dependents, or asymptomatic applicants to undergo genetic testing before issuing, renewing, or continuing coverage. Insurers may still ask about family history.

Enacted by 2025 Md. Laws ch. 747 (HB 820), this law sets guardrails on AI and algorithms used by health insurers and their review agents to decide whether care is medically necessary. Tools must rely on the individual patient's clinical information rather than group data alone, may not deny, delay, or modify care, must not discriminate, must be auditable by the Commissioner, and may not use patient data beyond its stated purpose. Carriers must also report whether AI was used in adverse decisions.

Indiana's health records article gives patients a right to copies of their records and sets confidentiality rules for mental health records. It requires written consents with specified content, limits providers' business use of records, and requires providers to keep records for seven years. Since July 1, 2025, providers may not charge for digital copies or interoperability access to electronic health records.

When a health care provider or regulated professional abandons patient health records or other records containing personal information (including by treating them recklessly or negligently so strangers can reach them), the Attorney General may take, store, protect, and eventually destroy them. The AG notifies affected people and recovers costs from the provider.

Recognizes an individual's right of privacy in the content of his or her health records and bars health care entities from disclosing them except as the section or other state law allows. Patients may obtain their records (with audit trails on request) and direct transfers to other providers, and recipients may not redisclose records beyond the authorized purpose without specific authorization.

Requires licensed healthcare professionals to tell patients out loud, before recording any part of an appointment or treatment, that a recording device, software, or service will be used and the recording transcribed by artificial intelligence. Violations are handled by licensing boards rather than lawsuits.

HB 24-1136 would require large social media platforms, from January 1, 2026, to show users who say they are under 18 research-based pop-up information about social media's effects on youth after one hour of use in a day or when on between 10 p.m. and 6 a.m., repeating every 30 minutes. The U.S. District Court for Colorado preliminarily enjoined enforcement on November 6, 2025 in NetChoice v. Weiser on First Amendment compelled-speech grounds; the state appealed to the Tenth Circuit (No. 25-1456).

Extends K-12-style student data protections to college and university students: limits on targeted advertising, profiling, sale, disclosure, and AI training using student data, plus security and deletion duties. Operative July 1, 2027.

Sets consent rules for HIV testing (routine opt-out testing in clinical settings with notice and a chance to refuse; written informed consent in nonclinical settings; minors 12 and older may consent) and bars disclosure of the identity of anyone tested or of identifiable HIV-related test results except to listed recipients, including redisclosure by recipients.

Makes it unlawful to disclose a person's HIV test results to a third party without prior written consent, apart from listed reporting and treatment exceptions, and requires record holders to secure HIV information. It also requires advance notice to the person of certain permitted disclosures and bans HIV-based discrimination, including requiring HIV tests as a condition of employment.

Requires informed consent before HIV testing (a general medical consent suffices if it tells the patient HIV testing may be ordered) and requires confirmatory testing before a positive result is revealed. Anyone who knows an HIV test result may not disclose the tested person's identity or identifiable results except to listed recipients such as the patient, persons named in a release, treating providers, and public health authorities.

Requires insurers to get an applicant's prior written informed consent before HIV testing, and limits disclosure of applicants' HIV test results to the applicant's consent and narrow insurance purposes such as reinsurers and contracted medical personnel.

Requires informed consent for HIV testing and makes the identity of anyone tested, and their results, confidential. Results may be disclosed only to listed persons, and each authorized disclosure must carry a written warning against re-disclosure.

Iowa treats HIV-related test information as strictly confidential medical information. Test results may be released only to the person tested, to people with the subject's written release, to treating providers and staff with a medical need to know, to public health authorities, and under narrow court orders that use pseudonyms and weigh privacy interests.

Requires hospitals and federally qualified health centers to protect patients' citizenship, immigration status and country-of-birth information the same way as protected health information, and bars disclosing it for law enforcement purposes unless law or a court order requires. The act also requires hospitals to adopt policies for responding to law enforcement visits.

The facility-level counterpart to the practitioner records law. Licensed hospitals must give patients copies of their records after discharge on written request, and must keep patient records confidential unless the patient or representative consents or a listed exception applies.

Requires consent for HIV testing (with limited exceptions) and keeps the identity of people tested and their results confidential. Any entity, public or private, holding HIV test information must protect it from unwarranted disclosure, and it may be shared only with written authorization or in narrow clinical, blood-supply and public-health situations.

Indiana's core identity theft crime covers obtaining, possessing, transferring, or using someone's identifying information, with intent to harm or defraud, to pose as that person. It is the offense referenced by the breach notification law's risk-of-harm trigger and by the identity theft victim protections in IC 24-5-26.

Enacted by 2026 Md. Laws ch. 445 (SB 8), this amendment to Maryland's identity fraud statute makes it a crime to knowingly and fraudulently use AI or a deepfake to impersonate or falsely depict someone to cause harm, or to create false records to cause harm, obtain personal identifying information, or obtain something of value. It also lets victims sue for injunctive relief.

Criminalizes fraudulently obtaining or using another person's identifying information (name, SSN, date of birth, account and driver license numbers, and similar data) to obtain money, credit, or other benefits, and gives victims a civil damages action. Local law enforcement must take identity theft incident reports.

Creates a civil cause of action against anyone who, with fraudulent intent and without permission, obtains, records, possesses or uses another person's personal information or financial device. Victims can use court orders or convictions to clear fraudulent accounts and judgments.

This chapter protects identity theft victims: businesses may not deny credit or utility service, or cut credit limits, solely because a documented victim was defrauded. It also restricts unsolicited credit offers, such as convenience checks, that carry personal identifying information.

Requires businesses to protect and properly destroy sensitive personal information and to notify affected individuals and, for breaches affecting 250 or more Texans, the attorney general. Notice to individuals is due within 60 days and to the attorney general within 30 days of determining that a breach occurred.

To curb identity theft, credit card issuers must verify address changes on returned card applications that differ from the solicitation address, and must send change-of-address notices to the old address when a replacement card is requested close to an address change.

Consumers can place, lift, or remove a security freeze on their credit reports at New Jersey consumer reporting agencies, which must act within set deadlines and, since December 2018, may not charge any fee. Agencies must confirm changes to key identifying data while a freeze is in place, and creditors may not deny or cut credit solely because someone was an identity theft victim.

New Jersey's breach law requires businesses and public entities to notify New Jersey residents whose unencrypted personal information was, or is reasonably believed to have been, accessed by an unauthorized person, unless misuse is not reasonably possible. The New Jersey State Police must be notified before consumers, and consumer reporting agencies must be notified when more than 1,000 people are affected.

Businesses and public entities must destroy customer records containing personal information so the data is unreadable when the records are no longer kept. Anyone is barred from publicly posting Social Security numbers (or four or more consecutive digits), printing them on mailings or access cards, or requiring their transmission or use online without security.

Lets identity theft victims file police reports with the Attorney General or local police where they live, and requires creditors that extended credit to an identity thief to give the victim the application and transaction records needed to undo the fraud, after the victim submits a signed statement, police report, and ID.

Iowa gives identity theft victims who lose money a civil claim against the thief for the greater of $5,000 or triple damages, plus credit repair costs and attorney fees. Banks and insurers can sue on behalf of account holders.

Most aggressive US biometric privacy law. Requires informed written consent before collecting biometric identifiers. Private right of action has generated billions in settlements (Meta M, Google M, TikTok M).

Rhode Island's criminal identity fraud statute. It covers producing or trafficking false IDs, using another person's means of identification (including biometric data) or financial information to defraud, and impersonating a person or entity with intent to defraud. A 2026 amendment added 'digital forgery': creating or distributing AI-generated or other forged likenesses or voice recordings of real people to facilitate fraud.

Indiana's comprehensive consumer privacy law, modeled on Virginia's, took effect January 1, 2026. It gives Indiana residents rights to confirm and access, correct, delete, and obtain a copy or representative summary of their personal data, and to opt out of targeted advertising, sale, and significant profiling. Controllers must get opt-in consent for sensitive data, publish a privacy notice, maintain reasonable security, and conduct data protection impact assessments for high-risk processing.

Enacted in 2025 and modeled on the FTC Safeguards Rule, this law requires non-bank financial services licensees to keep a written, risk-based information security program for customer information, including encryption, multi-factor authentication, annual penetration testing, secure disposal and an incident response plan. Licensees must report qualifying security events to the Division of Banking within three business days.

Makes it a crime to knowingly install a tracking device or app on another person's property, or to use one to follow someone's location or movement, without consent. Consent is presumed revoked once a divorce petition or protective injunction is filed between the parties. Good-faith business use for a legitimate purpose is exempt.

Makes insurers and other TDI-authorized entities comply with the Gramm-Leach-Bliley Act's privacy notice and opt-out rules (15 U.S.C. 6802-6803) as if they were financial institutions, and directs the Commissioner to adopt privacy rules and safeguard standards.

Indiana's version of the NAIC Insurance Data Security Model Law requires insurance licensees to run a written, risk-based information security program, oversee vendors, and keep an incident response plan. They must investigate cybersecurity events and notify the Insurance Commissioner within three business days of certain events. Consumer notice follows the general breach law, IC 24-4.9.

Delaware's version of the NAIC model law requires insurance licensees to run a written, risk-based information security program, investigate cybersecurity events, and notify the Insurance Commissioner within 3 business days and affected consumers within 60 days. Domestic insurers must certify compliance to the Commissioner each year.

Oklahoma's version of the NAIC Insurance Data Security Model Law. Insurance licensees must maintain a risk-based written information security program with an incident response plan and vendor oversight, investigate cybersecurity events, and notify the Insurance Commissioner within three business days of determining a qualifying event, while notifying consumers under the Security Breach Notification Act. It is the exclusive state data security law for licensees.

Iowa's version of the NAIC Insurance Data Security Model Law requires insurance licensees to run a risk-based written information security program, oversee third-party service providers, investigate cybersecurity events, and report qualifying events to the Insurance Commissioner within three business days. Consumer notice follows the general breach law in chapter 715C.

Alabama's version of the NAIC Insurance Data Security Model Law. Insurance licensees must maintain a risk-based written information security program, oversee vendors, investigate cybersecurity events, and notify the Commissioner within three business days of qualifying events. They must also follow the state breach notification act for consumer notices.

New Hampshire's adoption of the NAIC Insurance Data Security Model Law requires insurance licensees to run a risk-based written information security program, oversee vendors, keep an incident response plan, investigate cybersecurity events and report qualifying events to the Insurance Commissioner within 3 business days. Consumer notice follows the general breach law, RSA 359-C:20.

Connecticut's version of the NAIC Insurance Data Security Model Law. Insurers, producers and other licensees must run a risk-based written information security program, oversee vendors, keep an incident response plan, certify compliance annually (domestic insurers), and report cybersecurity events to the Insurance Commissioner within three business days.

Louisiana's version of the NAIC Insurance Data Security Model Law. Insurance licensees must maintain a risk-based written information security program with board oversight and vendor controls, investigate cybersecurity events, and notify the Commissioner of Insurance within three business days of determining a qualifying event occurred. Consumer notice follows the general breach notification law.

Tennessee's version of the NAIC Insurance Data Security Model Law. Insurance licensees must run a risk-based written information security program, oversee third-party service providers, investigate cybersecurity events, notify the Commissioner within three business days of qualifying events, and notify affected Tennessee consumers within 45 days when an event is reasonably likely to cause them material harm.

Sets standards for how insurers and agents collect, use, and disclose personal information from insurance transactions. It requires notices of information practices, gives consumers access and correction rights, and limits disclosure without written authorization. SB 354 (2026), which would modernize the Act effective 2028, was on the Governor's desk as of September 25, 2026.

Montana's version of the NAIC insurance privacy model law governs how insurers, producers and insurance-support organizations collect, use and disclose personal and health information. It gives individuals notice, access, correction and adverse-decision explanation rights, limits disclosure and marketing use, and contains an insurance-specific data breach notification and security policy requirement.

Virginia's insurance privacy law limits pretext interviews, requires notices of information practices, gives consumers access and correction rights and reasons for adverse underwriting decisions, and restricts disclosure of medical and privileged information without written authorization. The 2020 Insurance Data Security Act adds a written information security program, cybersecurity-event investigation, notice to the Commissioner within three business days, and consumer breach notice.

Directs Florida insurance regulators to adopt privacy rules for consumers' nonpublic personal financial and health information, modeled on and no stricter than the NAIC privacy model regulation and GLBA Title V. Health insurers and HMOs complying with the HIPAA privacy rules are deemed compliant.

Prohibits disclosure of nonpublic personal information in violation of Title V of the Gramm-Leach-Bliley Act and authorizes the Insurance Commissioner to adopt implementing privacy rules for the insurance industry.

Enacted in 2024 and effective January 1, 2025, this law adapts the NAIC Insurance Data Security Model Law. Insurers must keep a written, risk-based information security program for nonpublic consumer information with encryption, multi-factor authentication, training, vendor oversight and board oversight, and must notify the insurance commissioner within three business days of qualifying cybersecurity events.

SB 21-169 bars insurers from unfairly discriminating based on race, color, national or ethnic origin, religion, sex, sexual orientation, disability, gender identity, or gender expression, including through external consumer data, algorithms, and predictive models. The Commissioner adopts line-by-line rules requiring insurers to test and govern those models. SB 26-189 added authority for rules on notices and disclosures to consumers and deems compliant insurers compliant with the ADMT Act.

Iowa's wiretap act makes it a felony to willfully intercept wire, oral, or electronic communications, or to use or disclose unlawfully intercepted contents, and gives victims a civil damages claim. Interception is lawful when the interceptor is a party or one party consents, unless done to commit a crime or tort, and property owners may capture oral communications with consented surveillance systems for crime prevention.

Indiana's wiretap law is a one-party consent statute. 'Interception' means acquisition by someone who is neither a sender nor a receiver and lacks the consent of the sender or receiver, so a participant may record, or another person may record with one party's consent. The article also sets the warrant process for law enforcement wiretaps. It is framed around communications transmitted by wire, radio, or similar systems; purely in-person conversations are not expressly addressed by the definition.

Rhode Island is a one-party consent state: it is a crime to intercept a phone call, electronic communication or in-person conversation unless the interceptor is a party or one party has consented in advance, and even then not if the recording is made to commit a crime, tort or other injurious act. Chapter 12-5.1 sets the court-order procedure for law-enforcement wiretaps and gives victims of unlawful interception a civil damages claim.

Virginia is a one-party consent state: recording or intercepting a call or conversation is lawful if the recorder is a party or one party consented, and otherwise a felony. Victims can sue for liquidated damages. Service providers may not divulge communication contents in transit and may give subscriber records to law enforcement only under a subpoena, warrant, court order, or the customer's consent.

Criminalizes peeping into homes and other private places and surreptitiously installing or using devices to observe, photograph, record, or broadcast people there, including recording someone's intimate parts without consent in bathrooms, locker rooms, hotel rooms, and similar places. Penalties increase for repeat offenders and offenses involving minors.

Internet-connected baby monitors sold in New Jersey must include end-to-end encryption, certificate-based authentication, a ban on unauthenticated access, and security settings that consumers cannot disable. Selling a non-compliant monitor is a consumer fraud violation.

Criminalizes secretly viewing someone nude for sexual gratification, recording a person's intimate area without consent, and recording someone nude in a private place such as a bathroom or locker room. A companion civil action lets victims sue, and since September 2025 also reaches hotels and short-term rental hosts or platforms that record guests in private spaces.

New Jersey criminalizes secretly watching, photographing, or recording people who are nude, partly clothed, or engaged in sexual activity where they expect privacy, and disclosing such images (including online) without consent. Victims can sue for liquidated damages. Retailers may watch dressing-room entrances only with posted notice and may never observe or record inside private stalls.

Criminalizes non-consensual photography or video of intimate areas or of people in bathrooms, changing rooms, and similar private places, and promoting such recordings. Posted signs alone do not establish consent to recording in private places.

Regulates background reports on a person's character, reputation, and way of living, often used for employment and tenant screening. Agencies must limit reports to permitted purposes, maintain accuracy, and disclose on their websites whether personal information is sent outside the United States.

Iowa's comprehensive consumer privacy law gives Iowa residents the right to confirm and access their personal data, delete data they provided, obtain a portable copy, and opt out of the sale of personal data. It requires notice and an opportunity to opt out before processing sensitive data (and COPPA-compliant processing for a known child's data), rather than opt-in consent. It has no right to correct, no data protection assessments, and a 90-day cure period enforced only by the Attorney General.

Maryland generally bars employers from using an applicant's or employee's credit report or history to deny employment, fire, or set pay or terms. Employers may use it after a job offer for non-prohibited purposes, or where there is a bona fide, substantially job-related reason disclosed in writing, such as managerial, fiduciary, or personal-information-access roles.

Named for a Maryland judge killed in 2023, this law lets judges and their families, or the judiciary's Office of Information Privacy on their behalf, demand that anyone who has published their home address, phone numbers, personal email, financial or ID numbers, children's names, schools, or similar details online remove it within 72 hours. It also creates a judicial address confidentiality program and criminalizes threatening publication.

Protects K-12 students' data held by education technology operators. Operators may not use student data for targeted advertising, build non-school profiles, sell it, or disclose it except as listed, and must secure it and delete it on request. AB 1159 (signed Sept. 10, 2026, Chapter 182) widens coverage, bars using student data to train generative AI or develop AI systems, and adds a private right of action from January 1, 2027.

This law requires wireless carriers, on request of a law enforcement agency, to provide a device's call location information (including historical cell-site data) as soon as practicable in an emergency involving risk of death or serious physical harm. It makes a narrow, emergency-only exception to location privacy and shields carriers from liability for such disclosures.

Requires wireless carriers to give law enforcement a device's call location information on request in an emergency involving risk of death or serious physical harm, and to notify the user afterward. Carriers must register emergency contacts with the OSBI.

Kentucky's comprehensive consumer privacy law gives Kentucky residents rights to confirm, access, correct, delete, and port their personal data and to opt out of targeted advertising, sale, and significant-decision profiling. Controllers must minimize collection, secure data, obtain consent before processing sensitive data, publish a privacy notice, and conduct data protection impact assessments for higher-risk processing. A 2026 amendment (effective July 1, 2027) bars collection of smart-TV and smart-monitor automatic content recognition data without consent.

Kentucky is a one-party consent state: it is a felony to use a device to overhear, record, amplify, or transmit any part of a wire or oral communication of others without the consent of at least one party. The chapter also criminalizes installing or possessing eavesdropping devices, opening sealed private communications, and using or disclosing illegally obtained communications.

Makes public school students' education records confidential and bars their release to third parties, other than directory information, without parent or eligible-student consent except to listed recipients such as school officials, transfer schools, authorized government officials, de-identified researchers, and accreditors. Schools must preserve unedited master copies of recordings of school activities for set periods, and must log releases.

Kentucky's version of the NAIC Insurance Data Security Model Law. Covered insurance licensees must run a risk-based written information security program, oversee third-party service providers, investigate cybersecurity events, and report qualifying events to the Commissioner within three business days. Domestic insurers must certify compliance annually.

Requires businesses to notify Kentucky residents when unencrypted, unredacted computerized personal information (name plus SSN, driver's license number, or financial account or card number with its access code) is acquired without authorization in a way that causes or is reasonably believed to cause identity theft or fraud. Notice must go out in the most expedient time possible and without unreasonable delay, and consumer reporting agencies must be told when more than 1,000 people are notified.

Regulates telephone solicitation in Kentucky: callers must identify themselves at the start of the call, may not call numbers on the national Do Not Call Registry, may not call minors or outside 10 a.m. to 9 p.m., may not spoof caller ID, and may not sell information learned during a call without written consent. Telemarketing companies must register with the Attorney General and post a bond. Kentucky's former zero call list was folded into the national registry in 2007.

Imposes a duty of care on platforms, online games, messaging apps, and streaming services that contract with minors, requiring privacy-protective default settings: no adult connections without parental consent (or parental visibility into connections), no direct messages from unconnected adults, no sharing of a minor's precise geolocation, and private-mode accounts. Parents must get supervision tools, including limits on microtransactions, and only a linked parent can change the defaults. Act 552 of 2026 raised the covered age to under 18 and set the effective date at January 1, 2027.

Sets fast deadlines for providers to answer search warrants for records in domestic violence and stalking cases: 72 hours for social media platforms and five business days for other communications providers. It governs how quickly private providers must hand stored user data to law enforcement.

Added by SB 768 (ch. 2025-96), this subsection bars the Department of Health from allowing its public-health laboratories under s. 381.0202 to use genetic-sequencing software produced by China, Russia, Iran, North Korea, Cuba, the Maduro regime in Venezuela, or Syria, or by their state-owned enterprises or domestic companies. It is Florida's main 2025 genetic-data change. It covers state laboratory services, not private consumer genetic-testing companies, and does not amend s. 760.40.

Declares it Louisiana policy that online services should not contract with minors without a parent's or tutor's consent, and bars interactive computer services from entering contracts, including opening an online account, with anyone under 18 without that consent. Contracts made without express written consent are relatively null and can be annulled. Third parties may be used to collect consent.

Makes library records identifying users, including circulation, information system and electronic viewing records, confidential at both public and non-public libraries. Records may be disclosed only for library operations, with the user's consent, or under subpoena, court order or statute; a 2025 amendment effective Jan. 1, 2026 gives parents or guardians access to a minor's current borrowing records.

Forbids employers from requesting, requiring or subjecting employees or applicants to lie detector tests, which include polygraphs and any device or written test used by an examiner to judge honesty. Written honesty examinations may be used only if they are not the primary basis for an employment decision.

Montana bars employers from requiring a polygraph or other mechanical lie detector test as a condition of getting or keeping a job.

Stops life, long-term care, and annuity insurers from considering an applicant's or family member's participation in genetic or clinical research, or (since 2024) their genetic test results, for coverage or underwriting. Insurers may not cancel, refuse to renew, limit coverage, or raise premiums based on genetic testing or genetic services.

Regulates insurers that use AI to decide medical-necessity prior authorization requests. AI determinations must rest on the individual enrollee's medical history and clinical circumstances, not group datasets, and any denial, delay, or modification must be made by a licensed clinician. Plans must disclose their AI use and keep patient data used by AI within its stated purpose consistent with HIPAA. The effective date is October 1, 2026.

Bars employers from using consumer credit reports for employment decisions except for listed positions, such as managerial jobs, law enforcement, positions with access to large sums or sensitive financial data, and jobs where the law requires the check. Employers using a report must give advance written notice.

Louisiana's comprehensive consumer privacy law, enacted by Act 502 of the 2026 Regular Session and effective January 1, 2027. It gives Louisiana residents rights to confirm, access, correct, delete, and port their personal data and to opt out of targeted advertising, sale, and significant-decision profiling, and it requires controllers to minimize data, secure it, get consent for sensitive data, publish a privacy notice, and conduct data protection assessments. Unlike most state models, applicability turns on a $25 million revenue threshold (CCPA-style) rather than only a consumer-count threshold.

This 2026 criminal law makes it a serious misdemeanor to share the home address, personal phone number, or physical location of an Iowa legislator, judge, or their immediate family with intent to cause harm, to put them in fear of serious harm, or to interfere with their official duties. It is narrow: it covers only those officials and requires malicious intent.

The Maryland Kids Code requires large online businesses whose products children under 18 are reasonably likely to use to design those products in children's best interests. Covered entities must complete data protection impact assessments, set high-privacy defaults for children, and avoid default profiling, default precise geolocation tracking, unnecessary data collection, and dark patterns. NetChoice's First Amendment challenge (NetChoice v. Brown, D. Md. No. 1:25-cv-00322) survived a motion to dismiss in November 2025 and is in discovery; the law has not been enjoined.

Maryland's anti-spam law prohibits sending commercial email that uses a third party's domain or address without permission, falsifies its origin or transmission path, or has a deceptive subject line. Email providers may block suspected violating messages without liability.

Maryland bars banks and other fiduciary institutions from disclosing a customer's financial records unless the customer authorizes it, a statutory exception applies (such as guardians, estate representatives, public assistance verification, adult protective services, child support, or tax liens), or a properly certified subpoena is served with notice to the customer. A 2026 amendment (ch. 510, effective 2026-10-01) adds disbursement-delay authority and disclosure duties to protect seniors and vulnerable adults from exploitation.

Maryland's medical records law requires health care providers to keep patient records confidential and disclose them only as the subtitle or other law allows, gives patients rights to see, copy, and seek corrections to their records, and criminalizes obtaining records under false pretenses. Recent amendments restrict health information exchanges and electronic health networks from sharing abortion, mifepristone, and other legally protected sensitive-service data, and require HIE opt-out consent management.

Maryland's credit reporting law limits when consumer reports may be furnished, bars reporting of stale information, criminal records that did not end in conviction or were expunged, and (since 2025) any medical debt, and gives consumers rights to free reports, disputes, and security freezes. Agencies must register and post a bond, and users must give adverse action notices.

Maryland bars employers from asking employees or job applicants for usernames, passwords, or other access to their personal online accounts, and from punishing or refusing to hire anyone who declines. Employers may still require credentials for company systems and may investigate securities-law compliance or leaks of proprietary data.

Enacted by 2022 Md. Laws ch. 501 (HB 866), this law requires direct-to-consumer genetic testing companies to publish clear privacy information, obtain separate express consents for each use, transfer, sample retention, and marketing, secure genetic data, and let consumers access and delete their data and have samples destroyed. It bars disclosure to insurers or employers without written consent. The same act also regulated forensic genetic genealogy in the Criminal Procedure Article.

Enacted by 2022 Md. Laws ch. 231 (SB 207), Maryland's version of the NAIC Insurance Data Security Model Law requires insurance carriers to run a risk-based written information security program, oversee vendors, investigate cybersecurity events, and notify the Insurance Commissioner within 3 business days of determining a qualifying event, along with consumer notice under the Personal Information Protection Act.

Maryland employers may not require a polygraph or similar test as a condition of employment, and every job application must carry a bold, capitalized notice of this right with a signed acknowledgment.

Maryland's comprehensive consumer privacy law gives residents rights to access, correct, delete, and port their personal data, to get a list of categories of third parties that received it, and to opt out of targeted advertising, sale, and significant-decision profiling. It is stricter than most state laws: data collection must be limited to what is reasonably necessary for a requested product or service, sensitive data may be collected only when strictly necessary and may never be sold, and minors' data may not be sold or used for targeted advertising. A 2026 amendment (HB 711, ch. 874) extends sensitive data to inferences and bars knowing sales of personal data to government units engaged in civil immigration enforcement.

This law bars anyone from installing or using a device that records the numbers or routing information of calls and electronic communications without first getting a court order, except for service providers protecting their networks and users.

Maryland's data security and breach notification law requires businesses holding Maryland residents' personal information to keep reasonable security, destroy records securely, and flow security requirements down to service providers. After a breach, a business must investigate and, unless misuse is not likely, notify affected residents within 45 days, notifying the Attorney General first. The 2022 revisions added genetic information and set the 45-day and 10-day deadlines.

Maryland's counterpart to the federal Stored Communications Act makes it a crime to access a communications facility without authorization to obtain, alter, or block stored messages. It also bars public communication and remote computing service providers from knowingly disclosing stored message contents except to recipients, with consent, or as the subtitle allows, and it gives aggrieved users a civil remedy.

Maryland's student data privacy law limits what education-technology operators working under contract with public schools may do with student information. Operators must secure covered information and delete it on school request, and may not use it for targeted advertising, build non-educational student profiles, sell it, or disclose it outside listed exceptions. The 2022 amendments (ch. 164) expanded covered information, added persistent identifiers, and tied coverage to school contracts.

This law makes any violation of the federal Telemarketing Sales Rule or the federal Telephone Consumer Protection Act and its FCC telemarketing rules (including the national do-not-call rules) a violation of Maryland law, enforceable by the Attorney General and by individuals for $500 per violation.

This older telemarketing law protects consumers from phone sales by making contracts formed through telephone solicitations unenforceable unless put in writing and signed by the consumer with required disclosures, and by barring charges to a consumer's account until the signed contract is received.

These laws make it a crime to watch or record people without consent in retail dressing rooms and restrooms, to conduct surreptitious surveillance with prurient intent of people in private places or of their private areas, and to place a camera on residential property to secretly observe people inside a home. Each gives victims a civil claim. A 2025 amendment (ch. 153) extended 3-902 to camera surveillance of private areas regardless of location.

Maryland is an all-party consent state: a private person may record or intercept a phone call, electronic communication, or private in-person conversation only if they are a party and every party has consented in advance. The Act also bars disclosing or using contents known to be illegally intercepted, and it sets out narrow exceptions for service providers, law enforcement investigations, and police and correctional body-worn cameras.

Since January 1, 2025, Rhode Island bars medical debt from appearing on credit reports. Providers may not furnish medical debt to credit bureaus and must bar their collectors by contract from doing so, credit bureaus may not record or report it, and collectors must tell consumers in writing that Rhode Island law prohibits medical debt reporting and must pause reporting and collection while insurance appeals are pending.

Maryland health care providers must keep medical records and lab and X-ray reports for 7 years (for minors, until age of majority plus 7 years) unless they notify the patient first. The notice, now allowed by email with a mail fallback under 2025 ch. 695, must give the destruction date and where to retrieve the record, and records must be available for retrieval for 60 days before destruction.

Louisiana has no general medical confidentiality act, but these statutes set the exclusive routes by which health care providers may disclose patient records: to the patient or authorized persons under R.S. 40:1165.1, under the health care provider-patient privilege of Code of Evidence article 510, or under a subpoena or court order that follows notice procedures protecting the patient. Patients may also get copies of information a provider has sent to third parties.

Declares medical information in provider records to be the patient's property, sets deadlines and fee caps for copies, and forbids providers from revealing confidential information without consent except as law requires. It adds state-law limits beyond HIPAA on using health information for marketing and fundraising, requires notice to patients of disclosures that HIPAA allows but state law forbids, and gives patients an opt-out from the state health information exchange.

Makes clinical records of mental-health patients confidential. The confidential status is not lost by authorized or unauthorized disclosure unless the patient or representative waives it, and the records may be released only in listed circumstances, such as patient authorization.

Makes communications with mental health professionals and their records of identity, diagnosis, evaluation, and treatment confidential, allows disclosure only under listed exceptions, and gives patients a right to access their records unless a professional documents that access would be harmful.

Minnesota's comprehensive consumer privacy law gives Minnesota residents rights to access, correct, delete, and port their personal data, to opt out of targeted advertising, sale, and significant-effect profiling, and to get a list of the specific third parties that received their data. It is unusual in giving consumers a right to question the result of a profiling decision, learn the reason for it, and have it reevaluated on corrected data, and it requires a data inventory and documented privacy policies. Enforcement is by the Attorney General only.

Gives Minnesota consumers the right to freeze their credit reports for free, with agencies required to place, lift, and remove freezes within three business days, and lets parents or representatives freeze a record for children under 16. It also requires written disclosure before an employer obtains a consumer report for employment purposes, adverse-action notices, and bars selling 'trigger lead' information about mortgage credit inquiries to third parties without an existing mortgage relationship.

Requires businesses to notify Minnesota residents whose unencrypted personal information (name plus SSN, driver's license or state ID number, or financial account or card number with its access code) was, or is reasonably believed to have been, acquired by an unauthorized person, in the most expedient time possible and without unreasonable delay. Service providers must notify the data owner immediately, and breaches affecting more than 500 people require notice to the nationwide consumer reporting agencies within 48 hours.

Requires direct-to-consumer genetic testing companies to give plain-language privacy notices, get express consent for collecting and using genetic data and separate consent for each third-party disclosure, secondary use, sample retention, research transfer, and genetic-data-based marketing, and to let consumers access and delete their data and have samples destroyed. Companies may not give genetic data to law enforcement without consent or a warrant or court order, or to insurers or employers without written consent.

Private companies that perform government functions under contract with a Minnesota government entity must handle the resulting data under the Minnesota Government Data Practices Act as if they were the government, and every such contract must say so. Government entities must notify individuals of breaches of private or confidential data and prepare an investigation report.

Minnesota's health privacy statute, stricter than HIPAA in key respects, generally requires a signed and dated patient consent before a provider (or anyone who received records from a provider) releases health records, even for many treatment and payment disclosures, with limited exceptions such as emergencies and current treatment within related entities. It also gives patients rights to see and copy their records within 30 days at capped fees, and lets patients sue for unauthorized release.

Minnesota's version of the NAIC insurance information privacy model law. It requires insurers and agents to give a written notice of information practices, lets individuals see and copy personal information held about them and learn who received it, lets them seek correction, requires reasons for adverse underwriting decisions, and bars disclosing personal or privileged information without authorization except in listed cases such as fraud prevention.

Enacted in 2002, this law bars Internet service providers from knowingly disclosing a subscriber's personally identifiable information, including the sites the subscriber visits and the contents of the subscriber's storage devices, except where disclosure is required by legal process or permitted for ordinary business, abuse reporting, or with the subscriber's authorization. The sections expire if federal law preempts state regulation of ISP disclosure of such information.

Prohibits businesses that accept payment cards from keeping the card security code, PIN verification code, or full magnetic-stripe track data after a transaction is authorized (48 hours for PIN debit). If a business (or its service provider) that violated the rule is breached, it must reimburse the banks and credit unions that issued the affected cards.

Minnesota's wiretap law makes it a crime, and a civil wrong, to intentionally intercept, disclose, or use the contents of phone calls, electronic communications, or in-person conversations without authorization. Minnesota is a one-party consent state: a participant, or someone with a participant's prior consent, may record a conversation unless it is done to commit a crime or tort.

Restricts how businesses use Social Security numbers: no public display, no printing on access cards or on mailed materials unless required by law, no unencrypted transmission over the Internet, no SSN-only website logins, no SSN-based account numbers (outside benefits and payroll), and no sale of SSNs. Businesses must also limit internal access to employees who need the numbers. The section applies to uses on or after July 1, 2008.

Modeled on the federal Stored Communications Act, these sections make it a crime to access an electronic communications facility without authorization and obtain or alter stored messages, and bar public email and cloud providers from knowingly divulging the contents of stored communications except to recipients, with consent, as needed to provide service, under legal process, or to law enforcement when contents were inadvertently obtained and relate to a crime.

Makes it an unlawful trade practice to handle consumer information in a way that is materially inconsistent with what a business says in a website privacy statement or consumer agreement. It works as Oregon's enforcement hook for privacy promises rather than requiring any particular policy.

Montana's comprehensive consumer privacy law gives Montana residents rights to access, correct, delete and port their personal data and to opt out of targeted advertising, sale and significant profiling, and requires opt-in consent for sensitive data. The 2025 amendments (SB 297, Ch. 567, L. 2025) lowered the applicability thresholds, narrowed the financial-institution exemption to entity-level exemptions for banks, credit unions and insurers, expanded privacy-notice rules, removed the cure period, and added a duty of care and design limits for online services offered to known minors under 18.

Montana's student privacy law bars edtech operators from targeted advertising, profiling pupils for non-school purposes, selling pupil information, and most disclosures of protected student information, and requires reasonable security and deletion on school request. It also sets mandatory terms for school-district contracts with vendors that store or use pupil records.

Montana requires most telemarketers and sellers to register annually with the Department of Justice before soliciting Montanans. The Act also requires call disclosures, record keeping and cancellation rights, and bans abusive practices such as calling outside 8 a.m. to 9 p.m. or calling people who have asked not to be called.

Maryland's counterpart to the federal Driver's Privacy Protection Act bars the MVA from disclosing personal information in its records except for listed purposes, and never for marketing or telephone solicitation without written consent. Businesses that receive the data may use it only for the permitted purpose, must log redisclosures for 5 years, and may not pass it to federal immigration enforcement without a court warrant; the 2026 Data Privacy Act (ch. 874) broadened the immigration-related limits.