State Comprehensive Privacy Law Update

The opening weeks of spring have seen comprehensive privacy law proposals continue to progress in state legislatures across the country. Since our last update, the Kentucky Consumer Data Protection Act (HB 15) received a House concurrence and was signed by Governor Andy Beshear, thus becoming the nation’s fifteenth state comprehensive privacy law. Meanwhile, Maryland seems poised to follow with the nation’s sixteenth comprehensive privacy law, with the Maryland legislature passing SB 541 and sending that bill to the governor for signature. Finally, the Vermont House passed H. 121 — a proposal that notably contains a private right of action — while bills in Maine and Minnesota continue to move forward in the committee process. Notably, while we continue to see existing proposals progress through the legislative process, we have not identified any new legislative proposals to report since our last update, demonstrating a potential deceleration of legislative activity around state comprehensive privacy law as more state legislatures near their session end dates.

UPDATES ON EXISTING PROPOSALS

The Kentucky House concurred in Senate amendments to the Kentucky Consumer Data Protection Act on March 27. (You can read our analysis of that bill here). On April 4, the governor signed the bill into law, and it will take effect on January 1, 2026. Notably, the new Kentucky law, which was modeled on Virginia’s comprehensive privacy law, is a business-friendly one, including such provisions as a permanent 30-day cure period to support compliance efforts.

Elsewhere, Maryland SB 541 and HB 567 received their second chamber passages on April 4, and the legislature followed by passing SB 541 on April 6. That bill now moves to Governor Wes Moore’s desk for signature. (We will be publishing an analysis of this bill in the coming days, so be sure to check the WilmerHale Privacy and Cybersecurity Law Blog for further updates).

Finally, in other notable news, the Vermont House passed H. 121 on March 22. This bill contains a private right of action, but it remains to be seen whether that provision will survive Senate consideration.

Active Bills That Have Cleared Legislative Chamber

Maryland SB 541 and HB 567, which passed their original chambers on March 14 and March 16, respectively, were passed by their opposite chambers on April 4. The Senate then concurred in the House’s amendments to SB 541 and passed that bill by a unanimous vote, sending it to the governor’s desk for signature.
Pennsylvania HB 1201, which passed the House on March 18, was referred to the Senate Communications and Technology Committee on April 4.
Wisconsin AB 466, which was passed by the Assembly in November 2023, remains under consideration in the Senate, where it was approved by the Committee on Shared Revenue, Elections and Consumer Protection on February 15.

Recent Chamber Passages

The Vermont House passed H. 121 on March 22. The bill was referred to the Senate Economic Development, Housing and General Affairs Committee on March 27.

Committee Approvals

The Maine Data Privacy and Protection Act (LD 1977) was approved by the Committee on the Judiciary on March 26.
Minnesota SF 2915 was approved by the Senate Judiciary and Public Safety Committee on March 21 and referred to the Senate State and Local Government and Veterans Committee.
- Its companion bill (HF 2309) remains under consideration by the House Ways and Means Committee following previous approvals by the House Judiciary Finance and Civil Law Committee and the State and Local Government Finance and Policy Committee.

Committee Hearings

The Illinois Data Privacy and Protection Act (HB 3385) received a hearing before the House Cybersecurity, Data Analytics, and IT Committee on April 4 and was re-referred to the Rules Committee on April 5.

Bill Deaths

The Georgia legislative session closed on March 28 without passage of the Georgia Consumer Privacy Protection Act (SB 473), which was passed by the Senate on February 27.
The Rhode Island Data Transparency and Privacy Protection Act (HB 7787/S2500) was held for further study by the House Innovation, Internet, and Technology Committee and the Senate Commerce Committee on March 28 and March 19, respectively. This means that these bills are unlikely to advance further during this legislative session.