Cybersecurity Policy Report, The Week in State Privacy and Cybersecurity Legislation—February 17-28, 2025, (Mar 4, 2025)

By WK Editorial Staff

Welcome to The Week in State Privacy and Cybersecurity Legislation, your weekly update on the latest developments in proposed and amended privacy and data security legislation across the 50 states and the District of Columbia, as well as a summary of what's on the schedule for the coming week. For comprehensive status and summaries of all state privacy and cybersecurity bills in play this year, please consult the State Privacy and Cybersecurity Legislation Tracker, located in the Spotlight Topics panel on the Wolters Kluwer Cybersecurity & Privacy dashboard.

We’re back after a week off, and a lot happened in the interim, including the enactment of a bill in Idaho requiring enhanced security provisions by state agencies. In addition, a comprehensive privacy and data protection bill is working through the Washington state legislature, among other developments.

RECENT DEVELOPMENTS

Idaho law requires enhanced cybersecurity practices. On Feb. 25, Idaho Gov. Brad Little (R.) signed H.B. 35 (Ch. 6), Reg Sess. (Idaho 2025), legislation that requires state agencies to implement and maintain cybersecurity best practices, including the mandatory use of multifactor authentication for accessing information technology devices and services. The provisions of the bill take effect on July 1.

Washington House committee considers privacy bill. On Feb. 14, the Washington state House Technology, Economic Development, and Veterans Committee voted to advance H.B. 1671, Reg Sess., a comprehensive privacy and data protection bill. If enacted, the bill would grant consumer rights and impose obligations on data controllers and processors similar to those enacted in other states (CPR, Feb. 19). The bill is now under consideration in the House Appropriations Committee.

Connecticut bill would establish children’s data protections. A bill that would require social media platforms to enhance safety features for minors and take extra precautions to protect their personal data online is under consideration in the state House Children’s Committee. The proposal, H.B. 5474, Reg Sess., would require social media companies to establish cyberbullying policies that include, at a minimum, the manner in which a social media owner handles reports of cyberbullying on the platform, and modifies an existing definition of “heightened risk of harm to minors” to include any processing of minors’ personal data that could foreseeably harm their physical or mental health (CPR, Feb. 26).

Arizona bills would provide for online protections for children. The Arizona state House Appropriations Committee voted on Feb. 24 to approve H.B. 2861, Reg. Sess., a bill that would require a social media platform that is likely to be accessed by a minor to establish default settings that provide a “high degree of privacy protections” to each user. It would also allow a minor who uses an online service to opt out of the collection and use of the minor’s personal information beyond what is necessary. In addition, the bill would prohibit the use of a minor’s personal information for targeted advertising, with exceptions only for age and location (CPR, Feb. 25). On Feb. 26, the House Committee of the whole approved the proposal with some amendments.

Vermont committee approves age-appropriate design proposal. The Vermont state Senate Institutions Committee voted on Feb. 28 to approve S.B. 69, Reg Sess., a bill seeking to establish a comprehensive framework for protecting the privacy and personal data of minors who access online services, products, or features. The Vermont Age-Appropriate Design Code Act specifically would require businesses to provide tools for minors to manage their privacy settings and delete their accounts and would prohibit certain data practices, such as sending push notifications during late-night hours. It would also require businesses to configure all default privacy settings provided to a minor through the online service, product, or feature to the highest level of privacy (CPR, Feb. 24).

Caller ID restrictions proposed in Minnesota bill.S.F. 1860, Reg Sess., a bill that would restrict the display of false caller ID information, has been introduced in the Minnesota state Senate. Specifically, the proposal would make it unlawful to display or cause to be displayed, or to use a third party to display or cause to be displayed, a fraudulent or inaccurate name or telephone number, or the name or telephone number of the recipient of the telecommunication on a Minnesota resident’s caller identification service (CPR, Feb. 24). The bill has been referred to the Senate Commerce and Consumer Protection Committee.

Oklahoma bill to enhance children’s social media protection advances. On Feb. 27, the Oklahoma state Senate Technology and Telecommunications Committee voted to approve S.B. 931, Reg Sess., which aims to enhance the privacy and safety of children under age 18 on social media platforms by enforcing age verification, default privacy settings, and parental controls (CPR, Feb. 28). If enacted, the bill would take effect on Nov. 1.

WHAT’S COMING UP

In Missouri, the state Senate Insurance and Banking Committee will meet March 4 to consider S.B. 385, Reg Sess., a bill that would enact a version of the Insurance Data Security Act as devised by the National Association of Insurance Commissioners.

The Maryland state House Economic Matters Committee will review H.B. 1365, Reg Sess., on March 4. The bill would impose stricter limits on personal data collection by controllers, enhance data security practices, and simplify consumer consent revocation, effective Oct. 1.

A pair of New Hampshire bills will be considered on March 5: H.B. 195, Reg Sess., which would, among other provisions, outline the conditions under which personal information can be disclosed by third-party providers, such as utility companies, Internet service providers, and financial institutions; and H.B. 330, Reg Sess., which would establish penalties for violations of the confidentiality of motor vehicle records.

WHAT WE’RE TRACKING

Feb. 17-28:

Introduced Bills: 49

Enacted Bills: 1

Failed Bills: 0

2025 Total (including carryforward)

Introduced Bills: 423

Enacted Bills: 4

Failed Bills: 17

MainStory: DataPrivacy DataSecurity StateLegislation