Cybersecurity Policy Report, The Week in State Privacy and Cybersecurity Legislation—August 2026, (Aug 31, 2026)

By WK Editorial Staff

Welcome again to The Week in State Privacy and Cybersecurity Legislation, your update on the latest developments in proposed and enacted privacy and data security legislation across the 50 states and the District of Columbia, as well as a summary of what’s on the upcoming schedule.

We have scaled back to a monthly review of state privacy and data security legislation, thanks to the slowing of state legislative activity and the adjournment of sessions in most states. Keep in mind, however, that we continue to monitor activity on a daily basis and to update the State Privacy and Cybersecurity Legislation Tracker, located in the Spotlight Topics panel on the Wolters Kluwer Cybersecurity & Privacy dashboard, as new bills are introduced or move through the legislative process.

RECENT DEVELOPMENTS

New Jersey enacts legislative package to enhance children’s safety online. A package of bills signed on Aug. 11 by New Jersey Gov. Mikie Sherrill (D.) will impose new requirements on online service providers to enhance the privacy and safety of minors online. Specifically, the bills (A.B. 4015 (Ch. 73), Reg Sess. (N.J. 2026), A.B. 4014 (Ch. 72), Reg Sess. (N.J. 2026) (substituting for A.B. 3411, Reg Sess.), and S.B. 3412 (Ch. 71), Reg Sess. (N.J. 2026)) will create social media mental health warning labels and a new state social media research observatory, in addition to adopting an age-appropriate design code that requires online service providers to implement measures concerning minors’ use of online services (CPR, Aug. 11). The bills take effect immediately.

California advances privacy proposals for sensitive information, children’s protections, and expanded consumer rights. The California legislature has approved A.B. 1542, Reg Sess., a bill that, if signed by Gov. Gavin Newsom (D.), would strengthen California’s privacy laws by prohibiting most sales or sharing of sensitive personal information, increasing transparency requirements for businesses, and enhancing consumer rights to limit the use of their sensitive data (CPR, Aug. 17). The bill cleared the Assembly in May, with the Senate passing an amended version of the bill on Aug. 26 that the Assembly concurred in two days later (see separate story).

The California state Senate approved an amended proposal (A.B. 2246, Reg Sess.) on Aug. 27 that would revise certain requirements for businesses providing online services likely to be accessed by minors and impose new restrictions and penalties. The bill seeks to amend the California Age-Appropriate Design Code Act in response to court challenges lodged against the legislation’s constitutionality, removing certain exceptions while imposing stricter privacy and data protection obligations (CPR, Aug. 28). On Aug. 30, the Assembly concurred in the Senate’s amendments. The bill has been sent for engrossment before being presented to Gov. Newsom for consideration.

On Aug. 27, the California state Senate approved Assembly amendments made to S.B. 923, Reg Sess., a bill that would expand consumer rights regarding personal information deletion and improve the accessibility of opt-out request submission methods. Specifically, the bill would amend the state’s Delete Act to implement a mechanism to make it easier for consumers to ask registered data brokers to delete their personal information and would expand “the right to delete to cover all personal information a business holds about them, and by requiring online businesses to provide consumers with a webform, online portal, or similar method, to submit requests to delete their personal information” (CPR, Aug. 28). The bill awaits Gov. Newsom’s review.

Washington data privacy report offers recommendations to fill privacy gaps. On Aug. 14, Washington state Attorney General Nick Brown (D.) released his office’s first-ever Data Privacy Report, focusing on concerns raised in the modern data economy and discussing potential policies to strengthen protections and improve enforcement. The report examines how the data economy incentivizes the collection and retention of personal information and the potential harms, including data breaches, surveillance, and harassment, that may result from these incentives, and makes recommendations to address these concerns and strengthen protections, enforcement, and public education (CPR, Aug. 18).

Rulemaking activities launched in Vermont, Washington. The Vermont Attorney General’s Office has scheduled three public hearings to inform its development of age-appropriate design code (AADC) administrative rules, according to an Aug. 14 announcement. The in-person hearings are scheduled for Sept. 9, 21, and 23, and comments can also be submitted before Oct. 2 via an online form (CPR, Aug. 19).

In Washington state, Attorney General Phil Weiser (D.) filed proposed rules with the secretary of state on Aug. 11 to implement recently enacted laws governing the use of automated decision-making tools and adding protections for users of AI (artificial intelligence) chatbots (CPR, Aug. 13).

WHAT’S COMING UP

As of press time, there are no legislative hearings scheduled on proposed privacy and cybersecurity legislation in September.

WHAT WE’RE TRACKING

This Month:

Introduced Bills: 3

Enacted Bills: 1

Failed Bills: 0

2026 Total (including carryforward)

Introduced Bills: 723

Enacted Bills: 59

Failed Bills: 41

MainStory: DataBreach DataPrivacy DataSecurity StateLegislation LitigationEnforcement CCPA