Cybersecurity Policy Report, The Week in State Privacy and Cybersecurity Legislation—May 26-30, 2025, (Jun 2, 2025)

By WK Editorial Staff

Welcome to The Week in State Privacy and Cybersecurity Legislation, your weekly update on the latest developments in proposed and amended privacy and data security legislation across the 50 states and the District of Columbia, as well as a summary of what's on the schedule for the coming week. For comprehensive status and summaries of all state privacy and cybersecurity bills in play this year, please consult the State Privacy and Cybersecurity Legislation Tracker, located in the Spotlight Topics panel on the Wolters Kluwer Cybersecurity & Privacy dashboard.

Last week, Oklahoma enacted amendments to its data breach notification law, and Nebraska adopted its version of an age-appropriate design code law, among other developments.

RECENT DEVELOPMENTS

Oklahoma breach notification amendments become law. On May 28, S.B. 626, Reg Sess. (Okla. 2025), a bill amending Oklahoma’s data breach notification statute, became law without the signature of Gov. Kevin Stitt (R.). The law requires entities experiencing a data breach to notify the state attorney general of the breach within 60 days after providing notice to impacted residents, with exemptions for breaches affecting fewer than 500 consumers (fewer than 1,000 in the case of credit bureaus) (CPR, May 29). The new law takes effect on Jan. 1, 2026.

Age-appropriate design code law enacted in Nebraska. Nebraska Gov. Jim Pillen (R.) signed legislation on May 30 that establishes the Age-Appropriate Design Code Act. Under the new law (L.B. 504, Reg Sess. (Neb. 2025)), a covered online service is required to protect user data of known minors under age 18 and provide options to limit certain design features. It also requires a covered online service to provide covered minors with “easy-to-use” tools that prevent other individuals from viewing a minor’s personal data (CPR, May 30). The law takes effect on Jan. 1, 2026.

Vermont age-appropriate design code bill advances. Vermont’s version of an age-appropriate design code, S.B. 69, Reg Sess., was approved by the state House on May 29. The bill seeks to establish a comprehensive framework for protecting the privacy and personal data of minors who access online services, products, or features (CPR, May 30). If approved, the bill’s provisions would take effect on July 1, 2026.

California data breach amendments pass Assembly. The California state Assembly voted on May 28 to approve S.B. 446, Reg Sess., a bill that would amend state law regarding data breaches to require breaches to be disclosed within 30 calendar days of discovery or notification of the data breach (CPR, May 29). In addition, existing provisions requiring individuals and businesses suffering a breach involving more than 500 California residents to send a copy of the notification sent to such individuals to the attorney general to require this submission to be made within 15 calendar days of discovery or notification of the breach.

Oregon privacy law amendments approved by Senate. A bill that would update the Oregon Consumer Privacy Act to strengthen protections regarding the collection, processing, and sale of personal data, especially for consumers under 16 years of age, was approved by the state Senate on May 29. S.B. 2008, Reg Sess., would specifically prohibit the tracking and profiling of digital data for minors under 16 years of age and prohibit the sale of information that can identify a consumer’s location within a 1,750-foot radius, among other amendments (CPR, May 29).

Cybersecurity requirements for state entities approved by New York Senate. On May 28, the New York state Senate voted to advance S.B. 1961, Reg Sess., a bill that would enact the Secure Our Data Act. If ultimately enacted, the bill would require state entities to enhance cybersecurity measures, including creating “immutable backups and conducting regular vulnerability assessments” (CPR, May 29). The bill now moves to the state Assembly, where it has been assigned to the Governmental Operations Committee.

WHAT’S COMING UP

It’s a light week for legislative committee hearings coming up, but in Ohio, a pair of cybersecurity proposals will be discussed in committee on June 3. The state House Technology and Innovation Committee will review H.B. 283, Reg Sess., which would require local government entities to implement cybersecurity programs following best practices, mandate incident reporting, and restrict ransom payments without legislative approval. Meanwhile, in the Senate, the Financial Institutions, Insurance, and Technology Committee will consider S.B. 203, Reg Sess., which would impose similar cybersecurity requirements on political subdivisions.

WHAT WE’RE TRACKING

Last Week:

Introduced Bills: 0

Enacted Bills: 6

Failed Bills: 1

2025 Total (including carryforward)

Introduced Bills: 555

Enacted Bills: 42

Failed Bills: 51

MainStory: DataBreach DataPrivacy DataSecurity StateLegislation