Cybersecurity Policy Report, The Week in State Privacy and Cybersecurity Legislation—May 5-9, 2025, (May 12, 2025)

By WK Editorial Staff

Welcome to The Week in State Privacy and Cybersecurity Legislation, your weekly update on the latest developments in proposed and amended privacy and data security legislation across the 50 states and the District of Columbia, as well as a summary of what's on the schedule for the coming week. For comprehensive status and summaries of all state privacy and cybersecurity bills in play this year, please consult the State Privacy and Cybersecurity Legislation Tracker, located in the Spotlight Topics panel on the Wolters Kluwer Cybersecurity & Privacy dashboard.

Last week, legislation was enacted in Montana that will revise definitions in the state’s privacy law and modify requirements regarding data access requests, a bill advanced in Connecticut that would expand the scope of entities subject to that state’s privacy law, among other developments, and Texas reached a $1.375 billion settlement with Google to resolve allegations of privacy law violations.

RECENT DEVELOPMENTS

Montana legislation revises privacy law. On May 8, Montana Gov. Greg Gianforte (R.) signed S.B. 297, Reg Sess. (Mont. 2025), a bill that makes a variety of revisions to the Consumer Data Privacy Act (CDPA). Specifically, the law adds definitions for “adult,” “minor,” and “sensitive information” subject to the CDPA, adds specific requirements related to the processing of minors’ data, requires controllers to add an accessible opt-out mechanism, and reduces the cure period for violations from 60 days to 30 days, among other changes (see separate story).

Privacy revisions advance in Connecticut. The Connecticut state Senate voted on May 5 to advance S.B. 1356, Reg Sess., a bill that would expand the types of entities covered under the Connecticut Data Privacy Act (CTDPA) by, among other revisions, lowering the law’s applicability threshold and including entities that control or process a consumer’s sensitive data or offer a consumer’s personal data for sale in trade or commerce. The bill also would expand what is considered sensitive data and prohibit controllers from selling a consumer’s sensitive data without the consumer’s consent and would revise specified exemptions (CPR, May 7).

Texas reaches settlement with Google over alleged privacy law violations. Texas Attorney General Ken Paxton (R.) announced on May 9 that his office had reached a $1.375 billion settlement with Google, resolving a lawsuit originally brought in 2022 in which the AG maintained that the company unlawfully tracked and collected users’ privacy data regarding geolocation, incognito searches, and biometric data. AG Paxton said the settlement represented the highest recovery nationwide against Google for any attorney general’s enforcement of state privacy laws (see separate story).

Breach notification amendments advance in Oklahoma. On May 7, the Oklahoma state House voted to advance S.B. 626, Reg Sess., a bill that seeks to amend the state’s breach notification law to require entities experiencing a data breach to notify the state attorney general of the breach within 60 days after providing notice to impacted residents, with exemptions for breaches affecting fewer than 500 residents or 1,000 residents in the case of credit bureaus (CPR, May 8). The bill was previously approved in the Senate on March 27.

Robocall bill passes North Carolina House. The North Carolina state House voted on May 7 to pass H.B. 936, Reg Sess., a bill that would modify the state’s telephone solicitation laws to require prior express written consent from subscribers to receive robocalls (CPR, May 7). The bill has been sent to the Senate, where it was referred to the Committee on Rules and Operations.

CPPA releases second enforcement action, approves revised CCPA rules. The California Privacy Protection Agency (CPPA) board announced on May 6 that it had fined national clothing retailer Todd Snyder, Inc., over alleged violations of the California Consumer Privacy Act (CCPA) related to its processing of consumer access requests and its failure to minimize data required to process such requests. Under the settlement, Todd Snyder agreed to pay a fine of more than $345,000 and implement specified remedies to its business practices (CPR, May 6).

The CPPA board also approved revised versions of its draft regulations on automated decision making technology (ADMT), cybersecurity audits, and risk assessment. The bulk of the changes to the revised draft of the proposed rules appear to be designed to remove perceived barriers to compliance with the rules by California businesses and to reduce the cost of compliance for such businesses (CPR, May 5). The CPPA board will accept feedback on the revised proposal through June 2.

WHAT’S COMING UP

Three bills that propose to enact comprehensive privacy and data protection law in Maine will be considered in the legislature’s Joint Judiciary Committee on May 14. L.D. 1822, Reg Sess., would establish the Maine Online Data Privacy Act, L.D. 1224, Reg Sess., would enact the Maine Consumer Privacy Act, and L.D. 1088, Reg Sess., would establish the Maine Consumer Data Privacy Act. The bills are similar in scope, providing for consumer data rights, imposing obligations on businesses, and vesting enforcement authority in the attorney general. Each bill provides for an effective date of July 1, 2026.

The New York state Senate Health Committee will meet on May 13 to discuss S.B. 1633, Reg Sess., a bill that would provide additional protections for sensitive health information and requires all health information networks, electronic health record systems, and health care providers to provide patients with a right to restrict the disclosures of such information, with specified exemptions.

In Oregon, the state Senate Judiciary Committee will review H.B. 3865, Reg Sess., on May 13. The bill, if enacted, would revise the state’s regulations related to telephone solicitation calls and text messages, including text messages in the definition of a “call” and expanding the definition of telephone solicitation, among other changes (CPR, May 9).

The Alaska state House State Affairs Committee will take up H.B. 146, Reg Sess., a bill that would protect public employee personal information from disclosure by making such a disclosure an unfair labor practice, on May 15.

WHAT WE’RE TRACKING

Last Week:

Introduced Bills: 1

Enacted Bills: 2

Failed Bills: 15

2025 Total (including carryforward)

Introduced Bills: 539

Enacted Bills: 33

Failed Bills: 42

MainStory: CCPA DataBreach DataPrivacy DataSecurity StateLegislation LitigationEnforcement