Cybersecurity Policy Report, The Week in State Privacy and Cybersecurity Legislation—May 18-22, 2026, (May 27, 2026)

By WK Editorial Staff

Welcome back to The Week in State Privacy and Cybersecurity Legislation, your weekly update on the latest developments in proposed and amended privacy and data security legislation across the 50 states and the District of Columbia, as well as a summary of what’s on the schedule for the coming week. For comprehensive status and summaries of all state privacy and cybersecurity bills in play this year, please consult the State Privacy and Cybersecurity Legislation Tracker, located in the Spotlight Topics panel on the Wolters Kluwer Cybersecurity & Privacy dashboard.

Last week, Minesota and South Carolina enacted legislation imposing restrictions on social media companies regarding children’s online safety, and a new Florida law will create a grant program to assist with local cybersecurity initiatives, among other developments.

RECENT DEVELOPMENTS

Minnesota enacts children’s online safety law. On May 26, Minnesota Gov. Tim Walz (D.) signed H.F. 4138 (Ch. 111), Reg Sess. (Minn. 2026), into law. The legislation, which will take effect Nov. 1, requires large social media platforms to estimate the age of users based on their activity, using reasonable means and efforts, and treat users as children unless they can determine with high confidence that the user is older than 15. For children under age 15, platforms would have to obtain verifiable parental consent before creating or maintaining accounts. (For more information on the new law, see separate story in today’s CPR.)

Social media requirements targeted to children signed in South Carolina. Gov. Henry McMaster (R.) signed H.B. 4591, Reg Sess. (S.C. 2026), the Stop Harm from Addictive Social Media Act, on May 19. The law requires social media platforms to estimate the age of certain account holders, verify the age of certain account holders, and create default account settings for some users and other parental controls (CPR, May 20).

Local government grant program enacted in Florida. A bill that creates a grant program designed to help local governments strengthen cybersecurity was signed into law by Florida Gov. Ron DeSantis (R.) on May 22. H.B. 1085 (Ch. 115), Reg Sess. (Fla. 2026) establishes the Local Government Cybersecurity Protection Program to be administered by the Florida Digital Service to assist eligible local governments in mitigating and defending against cybersecurity threats, including ransomware incidents, by providing grants for information technology commodities and services (CPR, May 26). The law takes effect July 1.

Louisiana privacy proposal reaches governor’s desk. Legislation that would establish a comprehensive privacy and data protection regime in Louisiana is awaiting consideration by Gov. Jeff Landry (R.). The Louisiana Data Privacy Act (S.B. 386, Reg Sess.) would grant consumer rights and impose controller obligations similar to most states, with enforcement by the attorney general subject to a cure period (CPR, May 26). If enacted, the provisions of the bill would take effect on Jan. 1, 2027.

California bill to speed data deletion requests passes Senate. On May 19, the California state Senate voted to advance S.B. 1106, Reg Sess., a bill that would shorten the required timeframe for data brokers to access the accessible deletion mechanism provided by the California Privacy Protection Agency and process consumer deletion requests from 45 to 30 days (CPR, May 20). The bill has been assigned to the state Assembly Privacy and Consumer Protection Committee for further consideration.

Delaware privacy bills clear House. Two bills aimed at protecting consumer privacy passed the Delaware state House last week (CPR, May 26).

H.B. 380, Reg Sess., would, among other provisions, amend the Delaware Personal Data Privacy Act to lower the applicability threshold, making the law apply to entities that process the personal data of at least 10,000 consumers (down from 35,000) or 5,000 consumers if more than 20% of gross revenue is derived from selling personal data and includes third parties acquiring personal data, expand definitions of sensitive data to include neural data, financial account information, and government-issued IDs.

Meanwhile, H.B. 381, Reg Sess., would amend Delaware’s data breach notification law to require businesses to provide notice to the attorney general’s office within 60 days of the determination of a breach (previously such notification was required only when the breach involved 500 or more residents).

Both bills were approved by the full House on May 21, and each has been referred to the Senate Banking, Business, Insurance & Technology Committee for review.

WHAT’S COMING UP

There are no legislative hearings of note scheduled this week, but the California Privacy Protection Agency (CalPrivacy) released proposed rules on May 15 designed to implement S.B. 976 (Ch. 321), Reg Sess. (Calif. 2024), the Protecting Our Kids from Social Media Addiction Act. CalPrivacy launched a 45-day comment period regarding the proposed rules that will remain open through June 30, with a public hearing scheduled for that day, as well (CPR, May 18).

WHAT WE’RE TRACKING

Last Week:

Introduced Bills: 6

Enacted Bills: 5

Failed Bills: 0

2026 Total (including carryforward)

Introduced Bills: 696

Enacted Bills: 40

Failed Bills: 36

MainStory: DataPrivacy DataSecurity DataBreach StateLegislation