Cybersecurity Policy Report, The Week in State Privacy and Cybersecurity Legislation—August 2025, (Aug 25, 2025)

By WK Editorial Staff

Welcome again to The Week in State Privacy and Cybersecurity Legislation, your update on the latest developments in proposed and enacted privacy and data security legislation across the 50 states and the District of Columbia, as well as a summary of what’s on the upcoming schedule.

We have scaled back to a monthly review of state privacy and data security legislation, thanks to the slowing of state legislative activity and the adjournment of sessions in most states. Keep in mind, however, that we continue to monitor activity on a daily basis and to update the State Privacy and Cybersecurity Legislation Tracker, located in the Spotlight Topics panel on the Wolters Kluwer Cybersecurity & Privacy dashboard, as new bills are introduced or move through the legislative process. In addition, Wolters Kluwer Senior Legal Analyst Tony Foley has written a Strategic Perspective outlining three emerging issues in cybersecurity regulation, including the development of cyber incident reporting rules, efforts in Congress to harmonize the disparate cybersecurity provisions in current federal regulations, and the role artificial intelligence continues to play in cybersecurity, both as a weapon and as a shield (CPR, Aug. 20).

RECENT DEVELOPMENTS

Oregon amends telemarketing rules. On July 24, Oregon Gov. Tina Kotek (D.) signed H.B. 3865 (Ch. 580), Reg Sess. (Ore. 2025), which expands the definitions of telephone solicitations and auto-dialers to include text messages and restricts the time, frequency, and manner of such solicitations (CPR, July 28). The law further restricts the use of automatic dialing and announcing devices.

California Assembly advances bill amending data breach law. The California state Assembly Appropriations Committee voted on Aug. 20 to pass a bill that would amend state law regarding data breaches to require breaches to be disclosed to consumers within 30 calendar days of discovery or notification of the data breach and to the attorney general within 15 days after discovery or notification. Current law requires disclosures to consumers and the AG but does not specify a deadline (CPR, Aug. 21). The bill has had its second reading in the Assembly and has been placed on the consent calendar.

CPPA finalizes rules on risk assessments, cyber audits. The California Privacy Protection Agency (CPPA) finalized rules at the end of last month related to the conduct of risk assessments and required cybersecurity audit procedures. Specifically, the risk assessment rules require businesses to conduct a risk assessment for a variety of specified processing activities, including the sale or sharing of personal information, processing of sensitive data, using automated decision-making tools (ADMT) to make a “significant decision” concerning a consumer, using ADMT to infer or extrapolate characteristics of consumers (like intelligence, aptitude, economic or health situation, etc.) in specific educational and employment contexts and processing personal information of consumers that a business intends to use to train an ADMT used to make significant decisions. In addition, businesses whose processing presents a significant risk to consumers’ security must complete a cybersecurity audit (CPR, July 30).

Regulatory activity ramps up. Attorneys general in Colorado and New Jersey have advanced rulemaking activities in the past few weeks. On July 29, the Colorado Department of Law filed a set of proposed draft amendments to rules implementing the Colorado Privacy Act (CPA) that seek to clarify changes to the law made by a pair of recently enacted amendments to the CPA regarding online data protections for minors and definitions concerning sensitive personal information (CPR, July 31). Meanwhile, in New Jersey, the Division of Consumer Affairs extended the deadline for submission of comments on proposed rules designed to implement the state’s privacy and data protection law from Aug. 1 to Sept. 2 (CPR, Aug. 11). And back in California, the CPPA opened a formal comment period (since expired) on modifications to the text of proposed regulations implementing requirements regarding the provision an accessible deletion mechanism (CPR, July 31).

WHAT’S COMING UP

Several bills that were subject to committee hearings in California earlier this month, as reported in the July edition of The Week, continue to make their way through the legislature, with additional hearings scheduled for Aug. 29 in the Senate Appropriations Committee, as follows:

-- A.B. 869, Reg Sess., which would require California state agencies to implement “zero-trust” architecture by 2030, prioritizing federal-aligned cybersecurity measures and updating reporting requirements to enhance internal defenses;

-- A.B. 322, Reg Sess., which would require businesses to provide clear notice and limit the collection, retention, and disclosure of precise geolocation data under specified conditions;

-- A.B. 45, Reg Sess., which would restrict the collection and use of personal information at family planning centers and prohibiting certain geofencing practices;

-- A.B. 1331, Reg Sess., which would restrict employer use of workplace surveillance tools in certain areas, grant workers privacy rights, establish penalties for violations, and provide enforcement and anti-retaliation protections; and

-- A.B. 302, Reg Sess., which would mandate the confidential deletion of the personal information of California's elected officials and judges from data brokers and provide legal remedies for violations.

WHAT WE’RE TRACKING

This Month:

Introduced Bills: 1

Enacted Bills: 1

Failed Bills: 2

2025 Total (including carryforward)

Introduced Bills: 576

Enacted Bills: 67

Failed Bills: 62

MainStory: StateLegislation DataPrivacy DataBreach DataSecurity CCPA