Cybersecurity Policy Report, The Week in State Privacy and Cybersecurity Legislation—June 8-12, 2026, (Jun 15, 2026)

By WK Editorial Staff

Welcome back to The Week in State Privacy and Cybersecurity Legislation, your weekly update on the latest developments in proposed and amended privacy and data security legislation across the 50 states and the District of Columbia, as well as a summary of what’s on the schedule for the coming week. For comprehensive status and summaries of all state privacy and cybersecurity bills in play this year, please consult the State Privacy and Cybersecurity Legislation Tracker, located in the Spotlight Topics panel on the Wolters Kluwer Cybersecurity & Privacy dashboard.

Last week, significant amendments to Delaware’s privacy law advanced, and a proposal to prohibit sales of children’s information was passed by the New Hampshire House, among other developments. In addition, please check out our latest Vital Briefing from Senior Legal Analyst Tony Foley on the recent enactment of Louisiana’s new privacy law.

RECENT DEVELOPMENTS

Delaware privacy law amendments approved by Senate committee. On June 10, the Delaware state Senate Banking, Business, Insurance, and Technology Committee voted to support a bill to amend the Delaware Personal Data Privacy Act to expand consumer rights, lower applicability thresholds, strengthen protections for sensitive data, and require stricter contracts and due diligence for data-sharing. The bill (H.B. 380, Reg Sess.), which passed the House last month, would lower the law’s applicability threshold, making it applicable to entities that process the personal data of at least 10,000 consumers (down from 35,000) or 5,000 consumers if more than 20% of gross revenue is derived from selling personal data and includes third parties acquiring personal data (CPR, June 11).

New Hampshire bill prohibiting children’s data sales clears House. The New Hampshire state House adopted an amended version of a bill on June 10 that would, if enacted, amend the state’s privacy law to specifically prohibit the sale of children’s personal data in the state. H.B. 1460, Reg Sess., was introduced in January and approved by the House in February, with the Senate passing an amended version in April. It would make it unlawful to sell any personal data belonging to children, including location and other sensitive information, regardless of whether consent had been obtained (CPR, June 11).

Social media proposal advances in New York. The New York state Senate has passed a bill that would establish the Digital Choice Act, requiring social media companies to provide users with a copy of their social graphs when requested. The bill (S.B. 8850, Reg Sess.) defines a “social graph” as a shared set of a user’s actions on social media. Among other requirements, the bill would direct social media platforms to allow users to download their social graphs in an interoperable format so that users would be able to transfer their data elsewhere. Upon user request, companies would be required to deliver this data within five business days and maintain accessible methods for users to make such requests (CPR, June 8). The proposal now moves to the House, where it has been assigned to the Consumer Affairs and Protection Committee.

North Carolina social media and AI safety bill approved by Senate. On June 10, the North Carolina Senate passed a bill that would establish protections for minors under 16 from “harmful” social media content and require parental consent for account creation. The bill (H.B. 301, Reg Sess.) would mandate that social media platforms prohibit minors under 14 from creating accounts, require parental consent for those aged 14 or 15, and require termination of existing accounts of children under specified conditions (CPR, June 11). The bill also would direct the Department of Public Instruction to develop a model AI (artificial intelligence) policy for public schools as well as a suite of online training modules on AI fundamentals, responsible instructional use, verification, academic integrity, data privacy, bias, accessibility, and ethical considerations.

Age-appropriate design code bill advances in New Jersey. The New Jersey state Senate Law and Public Safety Committee voted to advance the New Jersey Kid’s Code Act, an age-appropriate design code proposal, on June 11. S.B. 3413, Reg Sess., mandates strict privacy, safety, and data protection measures for online services accessed by minors, including high default privacy settings, limits on data use, and new rights for minors and parents to control online interactions and report harms (CPR, June 12). The bill has been referred to the Senate Budget and Appropriations Committee for further review.

WHAT’S COMING UP

The California state Assembly Privacy and Consumer Protection Committee will consider S.B. 923, Reg Sess., a bill that would expand California consumers' rights to request deletion of all personal information held by businesses, regardless of its source, and strengthen requirements for businesses to provide accessible methods for submitting privacy requests, on June 16. The bill passed the Senate in May, but the version the committee will consider contains several amendments from the bill’s author.

Similarly, the California Assembly Privacy and Consumer Protection Committee will review S.B. 435, Reg Sess., a bill passed by the Senate last year and subsequently amended by the author, which would exclude publicly available information from the definition of “personal information” by removing the condition that the business have a reasonable basis to believe the information is lawfully made available and deleting a provision currently included in the definition of “publicly available” that brings in information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience.

The Delaware state Senate Banking, Business, Insurance & Technology Committee meets June 17 to take up S.B. 381, Reg Sess., which would amend existing data breach notification rules to ensure timely and consistent communications of a security incident.

WHAT WE’RE TRACKING

Last Week:

Introduced Bills: 6

Enacted Bills: 4

Failed Bills: 0

2026 Total (including carryforward)

Introduced Bills: 710

Enacted Bills: 46

Failed Bills: 38

MainStory: DataPrivacy DataSecurity DataBreach StateLegislation AINews