Cybersecurity Policy Report, The Week in State Privacy and Cybersecurity Legislation—May 4-8, 2026, (May 11, 2026)

By WK Editorial Staff

Welcome back to The Week in State Privacy and Cybersecurity Legislation, your weekly update on the latest developments in proposed and amended privacy and data security legislation across the 50 states and the District of Columbia, as well as a summary of what’s on the schedule for the coming week. For comprehensive status and summaries of all state privacy and cybersecurity bills in play this year, please consult the State Privacy and Cybersecurity Legislation Tracker, located in the Spotlight Topics panel on the Wolters Kluwer Cybersecurity & Privacy dashboard.

Last week, significant updates to Connecticut’s privacy law were approved in the state House, and a proposal in New York to require warnings and the provision of opt-out information prior to biometric tracking advanced, among other developments. In addition, please check out our latest Vital Briefing from Senior Legal Analyst Tony Foley on the recent enactment of Alabama’s new privacy law.

RECENT DEVELOPMENTS

Connecticut privacy amendments clear House. The Connecticut state House voted 141-6 on May 4 to approve comprehensive privacy measures that seek to address new threats to consumer data, including imposing rules on data brokers, establishing an accessible deletion mechanism for personal data, prohibiting the use of surveillance pricing, and expanding other protections under the Connecticut Data Privacy Act. In addition, S.B. 4, Reg Sess., would require businesses using facial recognition in public spaces to disclose it at each entrance and provide a process for consumers to request removal of their images (CPR, May 5). The bill has now been cleared in both legislative chambers and is awaiting gubernatorial action.

New York committee approves biometric tracking restrictions. On May 5, the New York state Assembly Consumer Affairs and Protection Committee voted unanimously to advance A.B. 1558, Reg Sess., a bill that would require New York retailers to post clear warnings and provide opt-out information if they tracked customers or collected biometric data, with monetary penalties for violations (CPR, May 6). The bill has been referred to the House Rules Committee for further consideration.

Alaska social media ban receives committee approval. The Alaska state Senate Labor and Commerce Committee voted on May 4 to greenlight S.B. 262, Reg Sess., which would prohibit social media platforms from allowing minors under 16 to hold accounts. Specifically, the bill would require social media platforms to prohibit individuals under 16 from creating accounts and mandate the termination of existing accounts for such users, with a 90-day dispute period before final termination. The state attorney general would enforce the bill and seek remedies, including punitive damages, for patterns of knowing or reckless violations, and the bill provides for a limited private right of action for minors under 18 who are harmed by knowing or reckless violations, allowing them (through a parent or guardian) to seek up to $10,000 in damages within one year of discovering the violation (CPR, May 4). The bill is headed to the Senate Judiciary Committee for further review.

California agency signals support for privacy proposals. At its latest meeting, the California Privacy Protection Agency (CalPrivacy) board voted to support pending bills in the state’s legislature that would ban certain sales of sensitive personal information and would require data brokers to honor deletion requests from consumers within a shorter time frame. The board expressed its support for A.B. 1542, Reg Sess., which would expand protections for sensitive data by prohibiting the sale or sharing of consumers’ sensitive personal information, and S.B. 1106, Reg Sess., which would improve consumer rights under the Delete Act by requiring data brokers to process requests for deletions within 30 days instead of the current 45-day deadline (CPR, May 4). The board also expressed conditional support for A.B. 883, Reg Sess., which would provide an expedited process for elected officials and judges to have their personal information deleted by data brokers.

WHAT’S COMING UP

New York state Senate committees will take up bills seeking to regulate automated decisions in the financial sector and biometric privacy on May 12. The Senate Banks Committee will discuss S.B. 8115, Reg Sess., which would require state-licensed financial institutions in New York to conduct annual independent assessments of automated lending decision-making tools for fairness, bias, and transparency, and the Senate Consumer Protection Committee will review S.B. 1422, Reg Sess., which would establish comprehensive regulations for the handling of biometric data by private entities, including requirements for data retention, destruction, and restrictions on disclosure, with enforcement overseen by the attorney general.

The California state Assembly Appropriations Committee is scheduled to hold a hearing on May 13 that will assess three privacy and online safety proposals, including the following:

-- A.B. 1709, Reg Sess., which would prohibit online platforms with addictive features from allowing users under 16 to create or maintain accounts, mandate age verification and data deletion for underage users, establish civil penalties for violations, and create an e-Safety Advisory Commission to oversee and advise on online safety for minors;

-- A.B. 2169, Reg Sess., which would enact the Digital Choice Act, expanding consumer rights over personal data on social media and AI platforms by mandating data portability, interoperability, and user consent, while establishing regulatory oversight and enforcement mechanisms; and

-- A.B. 2246, Reg Sess., which would impose stricter requirements and higher penalties on businesses providing online services likely to be accessed by minors, with enforcement by the attorney general, building upon and strengthening the state’s Age-Appropriate Design Code.

In New Jersey on May 14, the state Assembly Commerce and Economic Development committee will consider A.B. 4085, Reg Sess., the Fair Price Protection Act, prohibiting the use of personal data-driven pricing strategies for groceries in New Jersey, restricting electronic shelf labels linked to such practices, and establishing enforcement mechanisms and a temporary moratorium to study their impacts.

WHAT WE’RE TRACKING

Last Week:

Introduced Bills: 6

Enacted Bills: 0

Failed Bills: 2

2026 Total (including carryforward)

Introduced Bills: 690

Enacted Bills: 33

Failed Bills: 36

MainStory: DataPrivacy DataSecurity DataBreach StateLegislation AINews