Privacy Bill Tracker Changelog

Archive

This is the archived privacy bill tracker changelog for the MARK37.COM US Privacy Bill Tracker. Entries in this privacy bill tracker changelog are 30+ days old and have been moved here from the main page to keep it readable. The most recent privacy bill tracker changelog entries are always on the main tracker.

For reference on active federal and state privacy legislation, see the IAPP US State Privacy Legislation Tracker and Congress.gov privacy legislation search.

---

July 27, 2026

• New Jersey FAIR Act (A 3497) — new entry; enacted July 20, 2026. The “Forbidding the Algorithmic Inflation of Rent Act” makes it a New Jersey Antitrust Act violation for a residential landlord to use an algorithmic rental-price-setting coordinator. One of the first AI rental-pricing restrictions in the country. Illinois passed a similar bill (SB 343) awaiting the governor.
• New Jersey data broker law (A 5328) — the Division of Consumer Affairs clarified registration and fees are not required until 2027, softening the earlier “enforcement paused” framing. Fair Price Protection Act bill number (A 4085) also added to the surveillance pricing reference.
• Hawaii SB 3001 — signed July 14, 2026, effective immediately. Moved from the pending State Bills table to the AI Companion Chatbots enacted section, status changed to ✅.
• Iowa SF 2417 — moved from pending table to AI Companion Chatbots enacted section (signed May 2, 2026, effective July 1, 2026).
• Idaho S 1297 (Conversational AI Safety Act) — new entry; signed April 2026, effective July 1, 2027.
• Tennessee SB 1580 — new entry; bans AI from representing itself as a licensed mental health professional; signed April 1, 2026, effective July 1, 2026; private right of action.
• Delaware HB 191 — new entry; bars AI from being licensed as a nurse, physician, or physician assistant; signed April 23, 2026.
• Massachusetts — corrected bill citation from the stale “S 9 / H 135 (MIPSA)” to the actual S 2619 / H 5479 (Massachusetts Data Privacy Act), now in conference committee after the House passed its version 146-0 on June 4, 2026.
• AI Accountability and Personal Data Protection Act (S 2367) — moved from the International Laws section (misplaced) to Federal AI Legislation, where this Hawley/Blumenthal federal bill belongs.
• Illinois SB 315 — fixed a stale pending marker in the bill-list column; now correctly shows signed throughout.

July 15, 2026

• New Jersey data broker registration law (A 5328) — signed by new Governor Sherrill early July 2026; covers data brokers and “data collectors”; registration fees up to $1.5M; bans sale of sensitive data. Enforcement paused within days: the administration will not enforce until the legislature fixes drafting defects. NJ Kids Code Act (A 4015) and grocery surveillance pricing ban also passed the legislature.
• Massachusetts S 2619 — both chambers have passed versions; conference committee negotiations began July 2026. Key sticking point: private right of action against large data holders.
• Nebraska AAODCA — added bill number (LB 504).
• California 2026 session — nine individual entries added with links: AB 883 (data brokers), SB 300 and SB 1119 (companion chatbots), AB 1609 (customer service chatbots), SB 903 (mental health AI), AB 2575 and AB 1979 (healthcare AI), SB 690 (CIPA amendments), SB 354 (insurance privacy). All in Appropriations; legislature in summer recess until August.

July 14, 2026

• KIDS Act (HR 7757) — Passed the full House on June 29, 2026 by a 267-117 bipartisan vote. Status updated from “Pending House Floor” to “Passed House, Pending Senate.” Senate sponsors immediately called it “dead” over removal of KOSA’s duty of care provision. Path to enactment now requires Senate negotiation.
• Florida FDBR — Added first enforcement action: Florida AG Uthmeier sued Roku on October 14, 2025 for collecting and selling children’s viewing habits and voice recordings. First FDBR action in the state’s history.
• Minnesota MCDPA — Added note that Minnesota’s 30-day cure period expired January 31, 2026; violations now immediately enforceable.
• Illinois SB 315 — Signed by Governor Pritzker July 6, 2026. Status updated 🟡 → ✅. Effective January 1, 2027.
• Arkansas — Reverted incorrect “APDPA correction” from prior update. Arkansas does not have a comprehensive adult privacy law. The Personal Information Protection Act is a 2005 breach notification statute only.
• Nebraska LB 383 — New entry; blocked by federal judge June 28, 2026.
• Nebraska AAODCA — New entry; AG enforcement began July 1, 2026.
• Virginia SB 854 — New entry; enjoined February 27, 2026.
• South Carolina H 3402 — New entry; enacted 2026, immediately challenged.
• Connecticut CTDPA — Major July 1, 2026 update: threshold dropped 100K → 35K; two no-threshold triggers; GLBA exemption removed; sensitive data expanded.

July 3, 2026

• NEW SECTION: Facial Recognition & Biometric Surveillance. Added five entirely missing federal bills: Facial Recognition Act of 2025 (HR 4695), Traveler Privacy Protection Act (S 1691, bipartisan), HR 3782 (federal facial recognition prohibition), ICE Out of Our Faces Act (S 3779), and Drone Surveillance Prohibition (HR 96).
• Montana SB 282 — new entry; first state to ban law enforcement from buying citizens’ data from data brokers without a warrant. Signed May 2025.
• Oregon HB 2008 (Jan 1, 2026) — added to Oregon’s entry: prohibits sale of personal data for known-under-16 users; bans sale of precise geolocation within 1,750-foot radius; joined universal opt-out mechanism states.
• Connecticut — updated: joined mandatory universal opt-out mechanism states in January 2026; SB 4 noted as signed.
• New Jersey A 5017 — added: signed by Gov. Murphy Jan 20, 2026, amending NJ privacy law with new exemptions.
• California SB 361 — added to California data broker entry: expands disclosure requirements to include whether data is sold to foreign actors, federal government, or generative AI developers.
• Wisconsin AB 172 / SB 166 — new pending entry: passed Assembly committee unanimously Jan 2026.
• Pennsylvania HB 78 — new pending entry: passed one chamber; active 2026.
• Minnesota Social Media Warning Labels — status corrected 🟡 → ✅; in effect July 1, 2026.
• Arkansas HB 1717 — status corrected 🔵 → ✅; in effect July 1, 2026.
• Don’t Sell Kids’ Data Act (HR 6292) — removed duplicate entry.
• Chatrie v. United States — added Supreme Court opinion link.
• ICE Out of Our Faces Act (S 3779), Rhode Island S 2197 — added missing links.
• State Bills section — renamed to “2026 Legislative Activity” with clarifying note for ✅ entries.

July 2, 2026

• NEW SECTION: Government Surveillance & Warrantless Data Access. Added four entirely missing federal entries: Chatrie v. United States (Supreme Court ruled Jun 29, 2026 that geofence warrants require Fourth Amendment warrant protection), Government Surveillance Reform Act of 2026 (S 4082, Wyden/Lee/Warren/Lummis), Protect Liberty and End Warrantless Surveillance Act (HR 7816, includes “Fourth Amendment Is Not For Sale Act”), and Surveillance Accountability Act (HR 8470, Massie/Boebert).
• GUARD Financial Data Act (HR 8398) — added as its own entry with description under new Financial Privacy section.
• AI Accountability and Personal Data Protection Act (S 2367) — new entry; Hawley/Blumenthal; creates a federal tort for data exploitation without consent. Only federal bill in 119th Congress with a private right of action for data misuse.
• SAFE for Kids Act (S 4741) — new entry; Sen. Banks; online pornography age verification bill. Note: not a general social media/internet age verification bill despite “commercial entities” framing.
• Arkansas HB 1717 — now in effect as of July 1, 2026.
• California Delete Act DROP portal — launched January 1, 2026; over 285,000 Californians already using it. Data brokers must begin processing requests August 1, 2026.
• Utah UCPA — July 1, 2026 amendments add right to correction and social media data portability requirements.
• Montana MCDPA — 60-day cure period expired April 1, 2026; violations now immediately enforceable.
• Delaware DPDPA — 60-day cure period ended December 31, 2025; violations now immediately enforceable.
• Oregon OCPA — January 1, 2026 amendments add stricter precise geolocation limits and expanded youth data protections.
• Connecticut SB 4 — correction: consumer deletion mechanism launches July 1, 2028, not January 1, 2027.
• Illinois SB 340 — passed both chambers by May 31, 2026 adjournment; awaiting Governor Pritzker. Added official ILGA link.
• Colorado HB 26-1263 (Chatbot Safety Bill) — new entry; signed by Governor Polis June 3, 2026 alongside HB 26-1195.
• New Jersey A 4733 — new entry; prohibits marketing AI as licensed professional. Passed Assembly Appropriations.
• Rhode Island S 2197 — new entry; mental health AI restrictions bill; passed Senate.
• New Mexico HB 430 — new entry; health data privacy bill failed committee March 22, 2025; marked ⚫.

June 23, 2026

• New section added: AI Companion Chatbots & Therapy Bot Laws — covering enacted laws in California, New York, Oregon, Washington, Illinois, Nevada, Colorado, and Vermont, plus pending bills in Maine, Missouri, and Nebraska, and related litigation against AI chatbot companies.
• KIDS Act (HR 7757) — Guthrie and Pallone announced bipartisan agreement (Jun 22), consolidating 14 child safety bills. App Store Accountability Act, Don’t Sell Kids’ Data Act, and Sammy’s Law remain separate.
• Vermont — comprehensive privacy law signed June 16, 2026; moved from pending to enacted.
• Georgia SB 111 — moved from pending table to enacted (signed May 11, 2026). State count updated to 25.
• Connecticut SB 4 — signed May 27, 2026.
• Connecticut SB 5 — correction: actual citation is Public Act 26-15, not 26-65.
• Illinois SB 315 — correction: passed legislature May 27, 2026, not June 1.
• Hawaii SB 3001 — correction: AI Disclosure and Safety Act (AI companion chatbots, minor self-harm protocols), not a “geolocation” bill.
• Colorado SB 51 — correction: enacted (last action Jun 3, 2026), not pending a House floor vote.
• Colorado Privacy Act — added June 2025 amendment adding precise geolocation to sensitive data definition.
• Maine LD 2082 — correction: signed April 13, 2026, not “sent to Governor.”
• Illinois HB 1806 — correction: enacted August 4, 2025, not just “2025.”
• Arkansas HB 1717 — new entry; note that Arkansas has no comprehensive adult privacy law.
• Sammy’s Law (HR 2657) — new federal entry, previously missing.
• Florida v. OpenAI — new litigation entry (filed Jun 1, 2026).
• Michigan Kids Code Act, North Carolina SB 1022 — new pending entries.
• Missing links added — California CAADCA, Colorado biometric amendments (HB 24-1130), Louisiana app store law, Nevada AB 406, Colorado HB 26-1195, Pennsylvania v. Character.AI, Texas AG investigation, Maine LD 2082, Missouri HB 2372, Nebraska LB 525, Kentucky v. Character Technologies, 44 State AGs Joint Warning Letters, FTC Safety Report Orders, Florida v. OpenAI.
• Kentucky v. Character Technologies — correction: filed January 8, 2026, not just “January 2026.”

June 10, 2026

• KIDS Act (HR 7757) — New federal entry added. Passed full House Energy and Commerce Committee March 6, 2026. Omnibus children’s safety package. 44 state AGs filed opposition letter May 26, 2026.
• GUARD Financial Data Act (HR 8398) — Promoted from footnote to standalone entry in new Financial Privacy section.
• American Leadership in AI Act (HR 8516) — New federal AI entry added. Introduced April 27, 2026.
• Great American AI Act (GAAIA) — New entry added. Discussion draft released June 4, 2026 by Obernolte/Trahan. Would preempt state AI laws for 3 years.
• Virginia SB 338 — Added to Virginia’s state entry. Signed April 13, 2026; bans sale of precise geolocation data effective July 1, 2026.
• Vermont comprehensive privacy bill — New entry added. Passed legislature May 2026; awaiting Governor Scott (veto risk).
• Vermont S 71 — Description updated to clarify it adds California Delete Act-style single opt-out mechanism.
• Illinois SB 340 — New entry added. Comprehensive privacy bill with Maryland-style data minimization; passed Senate 54-3 and legislature May 31, 2026; awaiting Governor Pritzker.
• Delaware HB 380 — Status updated. Passed full House (30-9) May 2026; now pending Senate committee.
• SECURE Data Act (HR 8413) — House Subcommittee on Commerce, Manufacturing, and Trade held a formal hearing June 3, 2026. Coalition of 44 state AGs filed letter opposing preemption provisions June 2. Companion bill GUARD Financial Data Act (HR 8398) added to tracker.
• Louisiana Data Privacy Act (SB 386) — Signed into law by Governor Jeff Landry on May 29, 2026 as Act No. 502. Status updated from “awaiting signature” to enacted. Louisiana is the 22nd state with a comprehensive privacy law.
• Georgia — Major correction: previously listed as “session closed without passing.” Governor Brian Kemp signed SB 111 (Georgia Consumer Privacy Protection Act) on May 11, 2026. Georgia is now the 23rd state. Also signed SB 540 (chatbot disclosure law) same month. Both added to tracker.
• Connecticut SB 4 — Signed into law as Public Act 26-64. Status updated from “awaiting Governor” to enacted. Effective October 1, 2026. Adds data broker registration, geolocation sale ban, facial recognition protections, and surveillance pricing rules.
• Connecticut SB 5 — New entry added. Signed into law as Public Act 26-65 alongside SB 4. Covers AI companion chatbots and employment AI disclosure requirements.
• Colorado AI Act (SB 26-189) — Signed into law by Governor Polis on May 14, 2026. Status updated from “awaiting signature” to enacted. Replaces original SB 24-205 with narrower transparency-based framework. Effective January 1, 2027.
• Illinois SB 315 — Passed legislature June 1, 2026. Governor Pritzker indicated he will sign. Status updated; joins California and New York as states with a frontier AI model safety bill.
• Vermont S 71 — Conference committee report adopted by both chambers. Awaiting Governor’s signature. Status updated.
• New York Safe by Design Act — Confirmed signed by Governor Hochul as part of FY 2027 budget. Status updated to enacted in New York section.
• TAKE IT DOWN Act — Signed date corrected to May 19, 2025. Platform compliance deadline (May 19, 2026) noted as now passed — full enforcement in effect.
• Texas TDPSA — Corrected vague “major tech company” reference. Now correctly identifies two separate record-setting settlements: $1.4B against Meta (July 2024, biometrics) and $1.375B against Google (May 2025, geolocation/biometric data).
• Illinois BIPA — BNSF $228M corrected from “settlement” to “jury verdict.” Meta/Facebook $650M correctly attributed to Facebook (2020 settlement).
• AI Preemption Moratorium (10-year) — Corrected: entry previously said “Passed House, Pending Senate” — the moratorium was actually stripped from the final One Big Beautiful Bill before Senate passage. President Trump signed the bill July 4, 2025 WITHOUT the moratorium. States remain free to regulate AI. Entry updated to reflect this. Status changed to 🔴.
• Texas SB 2420 (App Store Accountability Act) — New entry added. Fifth Circuit lifted injunction on June 4, 2026 via stay pending appeal; Apple and Google activated enforcement same day — first time in US history a new app store account in any state requires identity verification before downloading apps. Utah SB 142, Louisiana app store law also added. Alabama description corrected (Utah was actually first, not Alabama).

May 28, 2026 — Initial Publication

May 28, 2026 — Initial publication. This privacy bill tracker changelog began when the tracker launched, covering federal bills, 22 state comprehensive laws, biometric laws, health data laws, data broker laws, children’s privacy laws, AI/automated decision-making laws, pending state bills, breach notification laws, and international laws.

Sources: IAPP US State & Federal Privacy Legislation Trackers · Troutman Pepper Privacy + Cyber + AI weekly state updates · DLA Piper Privacy Matters · Hunton Privacy Blog · WilmerHale Privacy Blog · Lexology · MultiState.us · Congress.gov · Secure Privacy · Last updated July 14, 2026.

Privacy legislation moves fast. Verify current status with primary sources before relying on any specific bill for compliance purposes.