Cybersecurity Policy Report, The Week in State Privacy and Cybersecurity Legislation—March 16-20, 2026, (Mar 23, 2026)

By WK Editorial Staff

Welcome back to The Week in State Privacy and Cybersecurity Legislation, your weekly update on the latest developments in proposed and amended privacy and data security legislation across the 50 states and the District of Columbia, as well as a summary of what’s on the schedule for the coming week. For comprehensive status and summaries of all state privacy and cybersecurity bills in play this year, please consult the State Privacy and Cybersecurity Legislation Tracker, located in the Spotlight Topics panel on the Wolters Kluwer Cybersecurity & Privacy dashboard.

Last week, Oklahoma became the 21st state to enact comprehensive privacy and data protection legislation, and a federal appellate court partially vacated a district court judgment blocking enforcement of California’s Age-Appropriate Design Code Act, among other developments.

RECENT DEVELOPMENTS

Oklahoma adopts comprehensive privacy law. Gov. Kevin Stitt (R.) signed a bill on March 20 that made Oklahoma the latest state to enact comprehensive privacy and data protection legislation. S.B. 546, Reg Sess. (Okla. 2026), which takes effect on Jan. 1, 2027, will apply to businesses that process the personal data of at least 100,000 Oklahoma consumers annually, or 25,000 consumers if more than 50% of gross revenue is derived from the sale of personal data. It exempts state agencies, financial institutions subject to federal privacy laws, health care organizations subject to the Health Insurance Portability and Accountability Act, nonprofits, institutions of higher education, and certain other categories (see separate story).

Injunction against enforcement of California Kid’s Code Vacated by Ninth Circuit. On March 12, the U.S. Court of Appeals for the Ninth Circuit (San Francisco) partially vacated a preliminary injunction that was issued by a district court preventing the state’s Age-Appropriate Design Code Act from taking effect. Parts of the California AADC will be allowed to go into effect under the ruling, in which the court concluded that the plaintiff in the case, NetChoice, wasn’t likely to succeed on its facial challenge to the law’s definition of which businesses are required to follow the law because they provide an online service that is “likely to be accessed by children” (CPR, March 16). Certain elements of the injunctive relief were upheld, including with respect to data use and dark patterns restrictions, with the court agreeing with the district court’s determination that they do not clearly delineate the proscribed conduct.

Bill to establish do-not-disturb registry introduced in New York. A bill that would create a “do-not-disturb” registry allowing residents to block unsolicited commercial marketing communications across multiple channels was introduced in the New York state Senate on March 12. The bill (S.B. 9440, Reg Sess.), would direct the Department of State to create a statewide list of residents who do not wish to receive unsolicited commercial marketing communications via call, text message, e-mail, facsimile, or physical mail to their home address, with exceptions for communications that consumers voluntarily opt into. It would establish enforcement mechanisms and provide for fines of up to $1,500 per infraction for violations (CPR, March 16).

State AGs sue to block demands for student information. A group of 17 state attorneys general joined in filing a lawsuit challenging the Trump administration’s data-collection mandate targeting colleges and universities. The lawsuit, filed in U.S. District Court for the District of Massachusetts, argues that the Education Department rushed the new requirements into effect without complying with the law in an attempt to target diversity, equity, and inclusion (DEI) initiatives, placing an unmanageable burden on colleges and universities and creating serious risks to student privacy. The suit asks the court to block the federal government from forcing institutions to submit the data (CPR, March 16).

WHAT’S COMING UP

Several states will conduct hearings this week on legislation designed to regulate algorithmic or surveillance pricing. In Illinois, the state House Consumer Protection Committee will take up H.B. 4985, Reg Sess., which would prohibit the use of surveillance data in automated pricing decisions for consumers, establish enforcement and penalties, and provide for private legal action, on March 24. On the same day, the Minnesota state House Workforce, Labor, and Economic Development Finance and Policy Committee will review H.F. 4131, Reg Sess., which would prohibit the use of surveillance data and automated decision systems to set individualized prices or wages in the state. On March 25, another Minnesota committee, the House Commerce Finance and Policy Committee, will discuss H.F. 3794, Reg Sess., which would prohibit the use of surveillance data in automated systems to set individualized prices or wages.

The South Carolina state House Judiciary Committee meets March 24 to discuss S.B. 5075, Reg Sess., a bill that would enact the Personal Privacy Protection Act, prohibiting public bodies from collecting or disclosing personal information about donors, members, and supporters of nonprofit organizations except as required by law.

On March 25, the New York state Senate Labor Committee will conduct a hearing on S.B. 3460, Reg Sess., a proposal to mandate employee access to their personnel records, with enforcement by the attorney general and fines of up to $2,500 for violations.

A genetic privacy bill regulating direct-to-consumer genetic testing companies, H.B. 639, Reg Sess., will be the subject of a hearing in the Vermont state Senate Economic Development, Housing, and General Affairs Committee on March 26.

WHAT WE’RE TRACKING

Last Week:

Introduced Bills: 23

Enacted Bills: 6

Failed Bills: 5

2026 Total (including carryforward)

Introduced Bills: 644

Enacted Bills: 14

Failed Bills: 27

MainStory: DataPrivacy DataSecurity StateLegislation