Cybersecurity Policy Report, The Week in State Privacy and Cybersecurity Legislation—May 12-16, 2025, (May 19, 2025)

By WK Editorial Staff

Welcome to The Week in State Privacy and Cybersecurity Legislation, your weekly update on the latest developments in proposed and amended privacy and data security legislation across the 50 states and the District of Columbia, as well as a summary of what's on the schedule for the coming week. For comprehensive status and summaries of all state privacy and cybersecurity bills in play this year, please consult the State Privacy and Cybersecurity Legislation Tracker, located in the Spotlight Topics panel on the Wolters Kluwer Cybersecurity & Privacy dashboard.

Last week, Indiana enacted a genetic information privacy law, and Texas reached a settlement with Google resolving violations of the state’s privacy and consumer protection laws.

RECENT DEVELOPMENTS

Indiana genetic privacy law enacted. On May 6, Indiana Gov. Mike Braun (R.) signed H.B. 1521 (P.L. 233), Reg Sess. (Ind. 2025), which will establish provisions regulating the collection and use of genetic information by consumer genetic testing providers, effective immediately. Specifically, the new law provides that a person may not discriminate against an individual on the basis of the individual's solicitation and use of consumer genetic testing services or on the basis of the results of genetic testing and adds a new statutory chapter that regulates the activities of consumer genetic testing providers (CPR, May 14).

Texas announces settlement with Google. Texas Attorney General Ken Paxton (R.) announced on May 9 that his office had secured a $1.375 billion settlement in principle with Google LLC to resolve a lawsuit originally filed in 2022 alleging various violations of the state’s privacy and consumer protection laws. The AG had accused Google of unlawfully tracking and collecting users’ private data regarding geolocation, data from users of Google Chrome’s “incognito” mode, and biometrics. AG Paxton maintained that the settlement far surpasses any other state’s claims for similar violations, noting that a multistate settlement reached by 40 AGs in 2022 secured $391 million, almost a billion dollars less than Texas’ recovery (CPR, May 12).

WHAT’S COMING UP

The New York state Senate Finance Committee will consider S.B. 1961, Reg Sess., on May 20. The bill would establish the Secure Our Data Act, relating to cybersecurity protection by state entities and requiring the Office of Information Technology Services to develop standards for data protection of state entity-maintained information.

In Oregon, the state House Judiciary Committee meets May 20 to discuss S.B. 1121, Reg Sess., a bill that would establish the crime of unlawful disclosure of private information as a “Class B” misdemeanor. It also would establish an exception for specified noncommercial educational broadcast stations from certain data privacy requirements.

H.B. 162, Reg Sess., a bill that would establish the My Child-My Chart Act, ensuring parental access to minors' health records while respecting minors' rights to consent to certain medical care independently, requiring health care providers to inform parents of these rights, and offering minors the option to consent to parental access, will have a hearing in the Ohio state House Health Committee on May 21.

Hearings on several Maine bills that we flagged last week had their scheduled work sessions in the Joint Judiciary Committee tabled last week, and they have been rescheduled to May 23. The bills include L.D. 1822, Reg Sess., which would establish the Maine Online Data Privacy Act, L.D. 1224, Reg Sess., which would enact the Maine Consumer Privacy Act, and L.D. 1088, Reg Sess., which would establish the Maine Consumer Data Privacy Act.

WHAT WE’RE TRACKING

Last Week:

Introduced Bills: 7

Enacted Bills: 3

Failed Bills: 0

2025 Total (including carryforward)

Introduced Bills: 546

Enacted Bills: 36

Failed Bills: 42

MainStory: DataPrivacy DataSecurity StateLegislation LitigationEnforcement