US state privacy law, tracked & explained
View on GitHubGeolocation, biometric, and data-broker rules as they move through the statehouses. Filter by state and data type; every entry carries a plain-English “what changed.”
SB 541
Among the strictest US privacy laws: imposes strong data-minimization duties, bans the sale of sensitive data outright, prohibits targeted advertising to anyone under 18, and treats precise geolocation as sensitive.
HF 4757
Grants standard consumer rights plus two novel ones: the right to question the result of automated profiling decisions and the right to obtain a list of the specific third parties a controller has shared data with.
HB 1181
Grants standard consumer data rights and is unique in offering businesses an affirmative defense if they maintain a written privacy program conforming to the NIST privacy framework.
S 1042
Would require data brokers operating in New York to register annually, disclose the categories of data they hold, and pay a fee funding state enforcement.
SB 384
Lowers the applicability thresholds of Montana's privacy law and adds opt-in consent requirements for processing the personal data of known minors.
HB 707
Would prohibit obtaining, retaining, or selling location data that identifies a person's presence at a reproductive- or sexual-health facility without express consent.
HD 3263
Would ban the sale of location data of Massachusetts residents and require a warrant for law enforcement to buy location data from brokers.
S 332
Establishes consumer data rights, requires recognition of universal opt-out signals, and mandates opt-in consent to sell or use for targeted advertising the data of consumers aged 13 to 17.
HB 154
Grants full consumer data rights with one of the lowest applicability thresholds in the country, and requires opt-in consent to process the data of consumers known to be aged 13 to 17.
SB 2105
Requires data brokers deriving revenue from processing Texans' data to register annually with the secretary of state, disclose their practices, and maintain a comprehensive information-security program.
HB 4
Gives Texans rights to access, correct, and delete personal data and to opt out of targeted advertising and sale; applies to most businesses regardless of revenue, unlike the revenue thresholds in other states.
SB 619
Establishes consumer data rights and, unusually, names specific biometric and precise-geolocation data as sensitive categories requiring opt-in consent before processing.
SB 262
Applies broad consumer-privacy duties to very large technology firms and restricts collection of precise geolocation and children's data, with the state attorney general as sole enforcer.
HB 24-1130
Amends the Colorado Privacy Act to add explicit protections for biometric identifiers, requiring a written policy, consent before collection, and retention limits tied to the purpose of collection.
HB 15
Closely tracks the Virginia model — access, correction, deletion, and opt-out rights with opt-in consent for sensitive data — and takes effect at the start of 2026.
HB 1155
Protects consumer health data — including location data that could reveal a visit to a health facility — with consent requirements, a geofencing ban around health-care sites, and a private right of action.
HB 2052
Requires data brokers that collect and sell Oregonians' personal data to register with the Department of Consumer and Business Services before doing business in the state.
SB 227
A deliberately business-friendly comprehensive law: consumers may access, delete, and opt out of sales and targeted advertising, but it omits rights to correct data and gives no universal opt-out mandate.
SB 362
Directs the California Privacy Protection Agency to build a single deletion mechanism that lets residents delete their data from every registered data broker with one request, and tightens broker-registration requirements.
SB 3
Extends Connecticut's privacy law with heightened duties for minors' data and new protections for consumer health and reproductive-health information.
SB 6
Grants standard consumer data rights with opt-in consent for sensitive data and, like Colorado, mandates recognition of a universal opt-out signal; among the stronger of the "Virginia-model" laws.
SB 21-190
Establishes access, correction, deletion, and opt-out rights and, notably, requires businesses to honor a universal opt-out browser signal for the sale of data and targeted advertising.
SB 5
A Virginia-model comprehensive law granting access, correction, deletion, and opt-out rights; enacted in 2023 with an unusually long runway before it takes effect at the start of 2026.
SB 1392
The second US comprehensive privacy law, and the template many later states copied: consumer rights to access, correct, delete, and opt out, plus opt-in consent for sensitive data, enforced solely by the attorney general.
AB 375 / Prop 24
The first comprehensive US consumer-privacy law: grants rights to know, delete, correct, and opt out of the sale or sharing of personal information, and — via the 2020 CPRA amendment — adds a dedicated enforcement agency and a sensitive-personal-information category.
HB 1493
Prohibits enrolling a biometric identifier in a database for a commercial purpose without notice and consent, and restricts selling or leasing that data; enforced by the attorney general.
Bus. & Com. Code 503.001
Bars capturing a person's biometric identifier for commercial use without consent and requires reasonable retention limits; unlike Illinois it is enforced only by the attorney general, with no private right of action.
740 ILCS 14
Requires private entities to obtain written consent before collecting fingerprints, faceprints, or other biometric identifiers, and creates a private right of action for violations — the strictest biometric regime in the country.
No statutes match those filters yet.
US state privacy law is a moving target. Every session, states introduce, amend, pass, and bring into force bills touching location tracking, biometric identifiers, data-broker registration, and comprehensive consumer-privacy rights. The signal that matters to a privacy or compliance team, which state just changed which obligation, is scattered across fifty legislatures and buried in statutory language few people have time to read.
Statute Watch collects those changes into one browsable dossier. Each entry records the state, the bill number, the data types it governs, where it sits in its lifecycle (introduced, passed, enacted, or in effect), and a short plain-English note on what the law actually requires. You filter by state and data type to see exactly the slice you own, instead of keeping fifty bill trackers open in browser tabs.
Pick a state to see everything tracked there, or a data type (say biometric or data-broker) to compare how states treat the same category. The stage filter separates laws already in effect from bills still moving, so you can tell a live compliance obligation from one worth watching. Every card links straight to the official bill record, because the dataset only tracks a state once an authoritative legislative source is registered for it. The whole thing is a static site and an open dataset: nothing to log into, and you can host or fork your own copy from the repository.
data.json built alongside this page, so you can query or import it directly.