Cybersecurity Policy Report, The Week in State Privacy and Cybersecurity Legislation—March 24-28, 2025, (Mar 31, 2025)

By WK Editorial Staff

Welcome to The Week in State Privacy and Cybersecurity Legislation, your weekly update on the latest developments in proposed and amended privacy and data security legislation across the 50 states and the District of Columbia, as well as a summary of what's on the schedule for the coming week. For comprehensive status and summaries of all state privacy and cybersecurity bills in play this year, please consult the State Privacy and Cybersecurity Legislation Tracker, located in the Spotlight Topics panel on the Wolters Kluwer Cybersecurity & Privacy dashboard.

Last week, several state attorneys general issued warnings to the public regarding genetic information held by 23andMe in light of the company’s bankruptcy proceedings, and bills designed to enhance children’s online privacy advanced in North Carolina and Oklahoma, among other developments.

RECENT DEVELOPMENTS

AGs warn consumers to seek deletion of genetic data from 23andMe. Attorneys general from at least six states issued consumer alerts last week reminding consumers of their right to request deletion of their genetic data and samples from genetic testing provider 23andMe Holding Co., which declared bankruptcy last week. Although the company has sought to ensure customers that there will be no change to its protection of customer data, the AGs note that the company may attempt to transfer or sell the genetic data as part of the bankruptcy proceeding. Each consumer alert explains how 23andMe customers can delete their account and personal information (CPR, March 24 and 28).

Oklahoma children’s privacy bill approved by House. On March 25, the Oklahoma state House voted 75-14 to approve H.B. 1388, Reg Sess., a bill that would require certain organizations that offer online services to complete data protection impact assessments to evaluate how their platforms might affect children. Specifically, the bill directs specified entities to complete a data protection impact assessment for any online product, service, or feature that is “reasonably likely to be accessed and maintain documentation of the data protection impact assessment as long as the online product, service or feature is reasonably likely to be accessed” (CPR, March 26). The bill had its first reading in the Senate on March 26.

Social media proposal in North Carolina focuses on children.S.B. 514, Reg Sess., a bill that would establish the Social Media Control in IT Act, was introduced in the North Carolina state Senate on March 25. If enacted, the bill would address social media addiction and enforce data privacy for minor users on social media, prohibiting the use of minors’ data for advertising or algorithmic recommendations, requiring social media platforms to provide clear disclosures about data collection and usage, and requiring user consent through an opt-in mechanism for algorithmic recommendations (CPR, March 27). The bill has been assigned to the Senate Rules Committee.

Comprehensive privacy provisions under consideration in Wisconsin. On March 27, S.B. 166, Reg Sess., was introduced in the Wisconsin state Senate. The bill seeks to enact a comprehensive privacy regime in the state similar to those enacted in other states over the past few years, establishing consumer data rights, imposing data privacy and security requirements on data controllers, and vesting enforcement in the state attorney general (CPR, March 28). The bill, which would take effect on July 1, 2027, has been assigned to the Senate Licensing, Regulatory Reform, State, and Federal Affairs Committee.

WHAT’S COMING UP

The Vermont state House will hold committee hearings on April 1 on a pair of bills that seek to regulate the use of artificial intelligence in the context of privacy. H.B. 365, Reg Sess., which would require social media and AI providers to register annually, adhere to privacy and safety terms, and face penalties for non-compliance, and H.B. 340, Reg Sess., which would establish regulations to prevent algorithmic discrimination in automated decision systems, requiring transparency, independent audits, and risk management, with enforcement by the state attorney general, will be discussed in the House Commerce and Economic Development Committee.

Two bills pending in South Carolina that would enact privacy protections for children are on the agenda of the Senate Labor, Commerce, and Industry Committee on April 2. S.B. 268, Reg Sess., would protect minors on online platforms by regulating data use, providing parental controls, and requiring annual audits, with enforcement by the attorney general, and H.B. 3431, Reg Sess., which passed the House last month, would establish new regulations for social media companies designed to protect minors, requiring parental consent for minors' accounts, restricting access during certain hours, and prohibiting targeted advertising.

In Oregon, H.B. 3899, Reg Sess., which would amend the Oregon Consumer Privacy Act to lower the applicability thresholds at which businesses are subject to the law and to prohibit the sale and certain uses of sensitive personal data, among other changes, will be discussed in the House Commerce and Consumer Protection Committee on April 3.

WHAT WE’RE TRACKING

Last Week:

Introduced Bills: 26

Enacted Bills: 7

Failed Bills: 1

2025 Total (including carryforward)

Introduced Bills: 511

Enacted Bills: 16

Failed Bills: 21

MainStory: DataPrivacy DataSecurity StateLegislation LitigationEnforcement AINews