Cybersecurity Policy Report, The Week in State Privacy and Cybersecurity Legislation—June 22-26, 2026, (Jun 29, 2026)

By WK Editorial Staff

Welcome back to The Week in State Privacy and Cybersecurity Legislation, your weekly update on the latest developments in proposed and amended privacy and data security legislation across the 50 states and the District of Columbia, as well as a summary of what’s on the schedule for the coming week. For comprehensive status and summaries of all state privacy and cybersecurity bills in play this year, please consult the State Privacy and Cybersecurity Legislation Tracker, located in the Spotlight Topics panel on the Wolters Kluwer Cybersecurity & Privacy dashboard.

This edition of The Week will be the last weekly update for 2026 as we shift to a monthly review of state privacy and data security legislation for the remainder of the year. Look for the next edition of the report in the first week of August. We’ll return to a weekly format once state legislatures begin to convene for next year’s sessions. As always, high-profile legislation will be covered in detail in CPR as events warrant.

Last week, a Senate committee in Pennsylvania advanced a proposal that would establish a comprehensive privacy and data protection regime in the state, and legislation was signed in New Hampshire that prohibits the sale of children’s data, among other developments.

RECENT DEVELOPMENTS

Committee advances privacy bill in Pennsylvania. The Pennsylvania state Senate Committee on Communications and Technology voted on June 24 to advance a bill that would establish the Consumer Data Privacy Act and give consumers certain rights with respect to their online data. The proposal (H.B. 78, Reg Sess.) would allow consumers to opt out of the processing of their personal data for the purpose of targeted advertising or the sale of their personal data, in addition to giving consumers the right to correct their personal data and request that their data be deleted, and would impose several duties and responsibilities on data controllers, including data minimization and security requirements, with exclusive enforcement by the state attorney general (CPR, June 25). If enacted, the bill would take effect one year from enactment.

New Hampshire law prohibits sales of children’s data. On June 24, New Hampshire Gov. Kelly Ayotte (R.) signed H.B. 1460 (Ch. 168), Reg Sess., a bill that specifically prohibits the sale of children’s personal data in the state, effective Jan. 1, 2027. The law provides that any personal data belonging to children, including location and other sensitive information, may not be sold, regardless of whether the seller obtained consent from a child or parent (CPR, June 25).

California Assembly advances expanded privacy rights bill. The California state Assembly Privacy and Consumer Protection Committee voted on June 23 to approve S.B. 923, Reg Sess., a proposal that would establish the Expanding Privacy Rights Act. The proposal would expand on the state’s Delete Act to implement a mechanism to make it easier for consumers to ask registered data brokers to delete their personal information. In addition, with respect to personal information obtained from sources other than the consumer, the bill would allow businesses to retain only the minimum data necessary to ensure compliance with the deletion request and to prevent further use of the data (CPR, June 24). The bill, which passed the Senate in May, has been re-referred to the Assembly Appropriations Committee for further consideration.

Plan to expand data breach law approved by Delaware Senate. On June 25, the Delaware state Senate voted to approve H.B. 381, Reg Sess., a bill that would expand the state’s data breach law to better inform the state Department of Justice’s Fraud and Consumer Protection Division of security breaches. Under the proposal, businesses would also be required to provide notice to the attorney general’s office within 60 days of the determination of a breach. Currently, the attorney general’s office is informed only when a security breach affects more than 500 Delaware residents (CPR, June 26). The bill passed the House last month.

Arizona governor vetoes bills designed to limit use of Chinese tech. Arizona Gov. Katie Hobbs (D.) vetoed a pair of bills on June 19 that would have restricted the use of Chinese-produced software and equipment in critical infrastructure. H.B. 2134, Reg Sess., sought to prohibit the use of software produced by Chinese companies in critical infrastructure, including gas, oil, water, electricity, telecommunications, transportation, personal data storage, and emergency services, and S.B. 1046, Reg Sess., would have prohibited the use of telecommunications equipment produced by Chinese companies in critical infrastructure (CPR, June 23).

WHAT’S COMING UP

As is usually the case as state legislatures wind down their annual session, California remains comparatively active, with a variety of hearings scheduled to review privacy and data protection proposals. On June 30, the state Assembly Judiciary Committee will review S.B. 1114, Reg Sess., a bill that would strengthens the confidentiality and protection of sexual orientation, gender identity, and intersex status data collected by California state agencies, educational institutions, and the Department of Motor Vehicles.

Meanwhile, in the California state Senate Judiciary Committee, three bills are on the June 30 agenda: A.B. 1709, Reg Sess., which would prohibit online platforms with addictive features from allowing users under 16 to create or maintain accounts, mandate age verification and data deletion for underage users, and establish civil penalties for violations; A.B. 883, Reg Sess., which would accelerate deletion timelines for data brokers, establishing special deletion request processes and enforcement rights for elected officials and judges and enhancing compliance and notification requirements; and A.B. 2246, Reg Sess., which would impose stricter requirements and higher penalties on businesses providing online services likely to be accessed by minors, with enforcement by the attorney general.

On July 1, the California state Assembly Privacy and Consumer Protection Committee will take up S.B. 354, Reg Sess., a bill that would enact the Insurance Information and Privacy Protection Act, establishing stricter standards for the collection, use, retention, and sharing of consumer personal information by insurers and related entities, expanding consumer rights and regulatory oversight and aligning insurance privacy practices with broader state privacy laws. Also on the committee’s agenda that day is S.B. 435, Reg. Sess., which would narrow the definition of “publicly available” information under California privacy law, expanding the scope of data protected as personal information.

WHAT WE’RE TRACKING

Last Week:

Introduced Bills: 4

Enacted Bills: 1

Failed Bills: 1

2026 Total (including carryforward)

Introduced Bills: 714

Enacted Bills: 51

Failed Bills: 41

MainStory: DataPrivacy DataSecurity DataBreach StateLegislation