Cybersecurity Policy Report, The Week in State Privacy and Cybersecurity Legislation—July 2025, (Jul 28, 2025)

By WK Editorial Staff

Welcome again to The Week in State Privacy and Cybersecurity Legislation, your update on the latest developments in proposed and enacted privacy and data security legislation across the 50 states and the District of Columbia, as well as a summary of what’s on the upcoming schedule.

As noted last month, we have scaled back to a monthly review of state privacy and data security legislation, thanks to the slowing of state legislative activity and the adjournment of sessions in most states. Keep in mind, however, that we continue to monitor activity on a daily basis and to update the State Privacy and Cybersecurity Legislation Tracker, located in the Spotlight Topics panel on the Wolters Kluwer Cybersecurity & Privacy dashboard, as new bills are introduced or move through the legislative process.

RECENT DEVELOPMENTS

ADMT rules adopted by CPPA. The California Privacy Protection Agency (CPPA) voted on July 24 to adopt rules regarding automated decision-making technology (ADMT) that the agency said would “strengthen Californians’ privacy rights, giving them more control over how their personal information is used and increasing transparency when businesses use ADMT.” The rules, which drew criticism from a variety of consumer groups based on the perception that they had been “watered down” due to lobbying efforts by Big Tech companies, have been submitted to the Office of Administrative Law for final approval (CPR, July 25).

Cyber incident reporting requirements amended in New York. On June 26, New York Gov. Kathy Hochul (D.) signed legislation that amends existing requirements regarding cybersecurity incident notifications and mandates cybersecurity awareness training for state employees. S.B. 7672 (Ch. 177), Reg Sess. (N.Y. 2025)) imposes cybersecurity incident reporting requirements on municipal corporations and public authorities, requires the Division of Homeland Security and Emergency Services to conduct a cybersecurity incident review of reports received from municipal corporations and public authorities to assess the impact of the reported incidents, establishes data protection standards, including incident management, and requires all employees of state agencies who use technology as part of their official job duties to take annual cybersecurity awareness training (CPR, July 2).

Rhode Island approves financial institution data security requirements. Rhode Island Gov. Daniel McKee (D.) has signed a pair of bills into law that impose data security and cybersecurity event notification requirements on specified financial institutions. The bills (S.B. 603, Reg Sess. (R.I. 2025) and H.B. 5415, Reg Sess. (R.I. 2025)), contain identical requirements, adding sections to the laws governing financial institutions to require covered licensees, among other mandates, to develop, implement and maintain a comprehensive information security program and to disclose cybersecurity incidents to the Department of Business Regulation (CPR, July 9).

Augmented data broker, data breach requirements advance in California. The California state Assembly Appropriations Committee voted on July 9 to pass a bill that would require data brokers in the state to disclose additional information regarding their data-collection practices. S.B. 361, Reg Sess., would, if enacted, require data brokers to provide additional information to the state, including whether a broker collects specified types of information and to report if they have, in the past year, shared or sold consumers’ data to a foreign actor, the federal government, other state governments, law enforcement, or the developer of an artificial intelligence system or model (CPR, July 10).

Meanwhile, on July 9, the California state House Judiciary Committee voted to approve S.B. 446, Reg Sess., a bill that would require businesses to disclose breaches of personal data within 30 days of their discovery and mandate the submission of notices affecting more than 500 Californians. The bill would also require that submission to the attorney general be made within 15 calendar days of discovery or notification of the breach (CPR, July 9).

Connecticut issues first enforcement action under CTDPA. Connecticut Attorney General William Tong (D.) reached a settlement with online ticketing provider TicketNetwork on July 8 after an investigation into the company’s alleged violations of the state’s comprehensive privacy and data protection law. The settlement is the first reached under the Connecticut Data Privacy Act (CTDPA), as the AG’s office has begun issuing notices of violation addressing privacy notice deficiencies after the cure period provision included in the CTDPA expired on Jan. 1 (CPR, July 8).

Bill to streamline opt-outs approved by California Senate committee. On July 2, the California state Senate Judiciary Committee passed a bill that would require web browsers to provide a clear, user-friendly opt-out setting for consumers to prevent the sale or sharing of their personal information. The bill (AB 566, Reg Sess.) is similar to a bill vetoed last year by Gov. Gavin Newsom (D.). In response to the governor’s concerns, the updated California Opt Me Out Act would not place obligations on operating systems but would limit its focus to browsers and browser engines (CPR, July 7).

Bill introduced in Pennsylvania proposes online children’s protections. Legislation introduced in the Pennsylvania state House on July 14 would establish comprehensive online safety and privacy protections for minors in the state, including implementing age verification and parental controls for online platforms used by children under age 18. Among other things, HB 1729, Reg Sess., would require mandatory age verification for users and default privacy settings that block unconnected users from messaging, viewing profiles, tagging, or conducting financial transactions with minors, as well as parental controls that allow parents to override these settings and receive notifications of any attempted changes (CPR, July 16). The bill has been referred to the House Communications and Technology Committee.

WHAT’S COMING UP

On Aug. 18, the California state Senate Appropriations Committee is scheduled to review five privacy bills that have already received House approval, including the following:

-- A.B. 869, Reg Sess., which would require California state agencies to implement “zero-trust” architecture by 2030, prioritizing federal-aligned cybersecurity measures and updating reporting requirements to enhance internal defenses;

-- A.B. 322, Reg Sess., which would require businesses to provide clear notice and limit the collection, retention, and disclosure of precise geolocation data under specified conditions;

-- A.B. 45, Reg Sess., which would restrict the collection and use of personal information at family planning centers and prohibiting certain geofencing practices;

-- A.B. 1331, Reg Sess., which would restrict employer use of workplace surveillance tools in certain areas, grant workers privacy rights, establish penalties for violations, and provide enforcement and anti-retaliation protections; and

-- A.B. 302, Reg Sess., which would mandate the confidential deletion of the personal information of California's elected officials and judges from data brokers and providing legal remedies for violations.

WHAT WE’RE TRACKING

This Month:

Introduced Bills: 7

Enacted Bills: 9

Failed Bills: 0

2025 Total (including carryforward)

Introduced Bills: 572

Enacted Bills: 66

Failed Bills: 60

MainStory: DataBreach DataPrivacy DataSecurity StateLegislation LitigationEnforcement CCPA