States Continue to Pass Major Privacy Legislation

By [ Austin Gold , Townsend Brown ]
04/25/2023

The flurry of states passing comprehensive privacy laws continues. Last Friday, Tennessee became the ninth state to pass comprehensive privacy legislation, quickly following Montana, which passed its bill earlier that day. The bill, titled the "Tennessee Information Protection Act," (TIPA) now heads to the desk of Governor Bill Lee (R), where it waits for his signature to become law. If signed, the law will take effect on July 1, 2025. TIPA is most closely mirrored by the Virginia Consumer Data Protection Act (VCDPA). Montana's Consumer Data Privacy Act contains elements of both the Virginia Consumer Data Protection Act (VCDPA) and the Connecticut Data Privacy Act (CDPA).

Last month Iowa became the first state this year to enact new comprehensive privacy legislation after Governor Kim Reynolds (R) signed SF 262. Since Iowa's signing, three other states have passed privacy legislation through two chambers, Indiana, Montana, and Tennessee. Assuming that the bills in Indiana, Montana, and Tennessee get signed into law, there will be a new total of nine states with comprehensive privacy laws in place, with the newcomers joining California, Colorado, Connecticut, Iowa, Utah, and Virginia. Refer to the map below for a snapshot of state privacy legislation so far in 2023.

Looking Ahead - The states we are watching most closely right now are Florida, New York, Oregon, and Texas. Lawmakers in Florida have introduced a pair of bills, HB 1547/SB 262, that are not based off of any of the established state models in CA, VA, UT, or CT. Florida's session adjourns on May 5. We expect to see a flurry of activity during Florida's last week of session with a possibility that Florida becomes the tenth state to pass privacy.

One of New York's proposed privacy laws (SB 365) was heard in the Senate Committee on Consumer Protection today. SB 365 is the only proposed NY privacy law to be scheduled for a hearing so far this year and we expect lawmakers in New York to give more attention to privacy after their budget negotiations are concluded. NY SB 365 includes a private right of action.

We are also closely monitoring Texas and Oregon. Texas's bill HB 4 has already passed in the House. Lawmakers on the Senate side in Texas have until the end of May to send the bill to Governor Abbott's desk, Texas adjourns on 5/29. Oregon's privacy law, SB 619, has made some progress in the committee process but was recently amended to remove the private right of action and conform to a number of more business-friendly provisions found in other bills. Oregon's adjournment date is set for 6/25.