Cybersecurity Policy Report, The Week in State Privacy and Cybersecurity Legislation—July 2026, (Aug 3, 2026)

By WK Editorial Staff

Welcome again to The Week in State Privacy and Cybersecurity Legislation, your update on the latest developments in proposed and enacted privacy and data security legislation across the 50 states and the District of Columbia, as well as a summary of what’s on the upcoming schedule.

As noted last month, we have scaled back to a monthly review of state privacy and data security legislation, thanks to the slowing of state legislative activity and the adjournment of sessions in most states. Keep in mind, however, that we continue to monitor activity on a daily basis and to update the State Privacy and Cybersecurity Legislation Tracker, located in the Spotlight Topics panel on the Wolters Kluwer Cybersecurity & Privacy dashboard, as new bills are introduced or move through the legislative process.

RECENT DEVELOPMENTS

Data broker regulatory law adopted in New Jersey. On June 30, New Jersey Gov. Mikie Sherrill (D.) signed A.B. 5328 (Ch. 25) Reg Sess. (N.J. 2026), which establishes strict regulations and prohibitions on the sale and handling of sensitive personal data by data brokers and data collectors in the state. Among other requirements, the new law requires registration and transparency, and imposes significant penalties for violations, while providing exemptions for entities already regulated under federal privacy laws (CPR, July 8). The bill took immediate effect, except for provisions requiring the establishment of a public data broker registry, which take effect on March 27, 2027.

After enactment of the legislation, however, the New Jersey Attorney General’s Division of Consumer Affairs said data brokers and collectors would not be required to register or pay registration fees as required by the law until the agency was able to launch the required data broker registry in the spring of 2027 (CPR, July 14). The division added that it planned to issue guidance regarding other aspects of the new law.

Hawaii enacts law requiring social media account deletion mechanisms. Hawaii Gov. Josh Green (D.) signed a bill on July 14 that requires certain social media platforms in the state to provide users with a clear and accessible method to delete their accounts at any time. H.B. 1753, Reg Sess. (Haw. 2026), effective Jan. 1, 2027, requires social media platforms to permanently erase all personal information associated with the deleted account and notify the user once the deletion was complete upon receiving a user’s confirmed request to delete their account. Platforms will be required to complete the deletion process within 45 days of a confirmed request, unless otherwise mandated by law, and maintain records of deletion requests and confirmations for a specified number of years to demonstrate compliance (CPR, July 15).

Bill imposing obligations on social media companies to protect minors clears Massachusetts Senate. The Massachusetts state Senate voted 38-2 on July 2 to approve S.B. 3164, Reg Sess., a bill that would establish new requirements for social media platforms in Massachusetts to protect minors from potentially addictive features and enhance privacy. The bill also would require social media platforms to provide the state attorney general with quarterly de-identified aggregate data on minors’ usage, including age breakdowns, time spent, and changes to default settings, and require the state attorney general to make the data publicly available (CPR, July 10).

New Jersey legislature greenlights online children’s safety proposal. Both chambers of the New Jersey Legislature voted on June 30 to adopt the New Jersey Kids Code Act, which would limit the collection, retention, and use of minors’ personal data, requiring that only the minimum necessary data be processed for the specific service engaged by the minor (CPR, July 1). The companion bills (A.B. 4015, Reg Sess. and S.B. 3413, Reg Sess.) have been sent to Gov. Sherrill for her signature.

Strengthened telemarketing restrictions enacted in Pennsylvania. On July 20, Pennsylvania Gov. Josh Shapiro (D.) signed S.B. 992 (Act 47), Reg Sess. (Pa. 2026), which amended provisions of the state’s Telemarketer Registration Act to strengthen consumer protections against unwanted telemarketing communications. Specifically, the amendments expand the definition of telephone solicitation to include voicemails, ringless voicemails, and text messages; prohibits the use of artificial intelligence or fake caller IDs to deceive or defraud consumers; and introduces the requirement for “prior express written consent” for robocalls and certain telemarketing messages (CPR, July 21).

WHAT’S COMING UP

Legislative hearing activity is centered primarily in California over the first two weeks of August. Among the significant bills that will be reviewed are the following:

-- A.B. 1709, Reg Sess., which passed the state Assembly in May and would prohibit digital platforms from providing addictive features to users under 16, mandate age verification, establish enforcement penalties, and create an advisory commission to oversee and report on online safety for minors in California, will be discussed in the state Senate Appropriations Committee today.

-- A.B. 883, Reg Sess., passed by the Assembly in January, would accelerate deletion times for data brokers, establish special deletion request processes and enforcement rights for elected officials and judges, and enhance compliance and notification requirements. It’s the subject of a hearing in the Senate Appropriations Committee today.

-- S.B. 435, Reg Sess., which would narrow the definition of “publicly available” information under California privacy law, expanding the scope of data protected as “personal information,” is the subject of a hearing in the Assembly Appropriations Committee on Aug. 5. The bill passed the Senate last year and was carried over to the current session.

-- S.B. 923, Reg Sess., seeks to expand Californians’ rights to request deletion of all personal information held by businesses, regardless of its source, and strengthen requirements for businesses to provide accessible methods for submitting privacy requests. The bill passed the Senate in May, and will be reviewed on the Assembly Appropriations Committee on Aug. 5.

WHAT WE’RE TRACKING

This Month:

Introduced Bills: 6

Enacted Bills: 7

Failed Bills: 0

2026 Total (including carryforward)

Introduced Bills: 720

Enacted Bills: 58

Failed Bills: 41

MainStory: DataBreach DataPrivacy DataSecurity StateLegislation LitigationEnforcement CCPA