Key point: Last week, the Alabama legislature passed an App Store bill while Maine’s consumer data privacy bill crossed chambers.

Below is the fifth update on the status of proposed state privacy legislation in 2026. This post covers updates on proposed bills dealing with consumer data privacy, kid’s privacy, biometric privacy, data brokers, and consumer health data privacy. As always, the contents provided below are time-sensitive and subject to change.

What’s New

The big news last week was the Alabama legislature passing an App Store bill. App Store bills also advanced in Kansas, Wisconsin, and Iowa while new bills were filed in Maryland, Kentucky, and Georgia. App Store bills are now active in ten states.

The other big news last week was Maine’s consumer data privacy bill crossing chambers. The bill was voted out of the House by a narrow 73-65 margin with 11 absentees. Democrats hold a two-seat margin in the chamber. Maine lawmakers have long tried to pass a consumer data privacy bill with Democrats supporting a bill containing significant data minimization requirements and other consumer-friendly measures. Republicans and business interests have pushed back on the bill. Two years ago, Maine’s House passed a bill but it failed in a dramatic Senate vote.

In other consumer data privacy bill news, Alabama’s bill advanced out of a committee while two bills that amend Virginia’s law advanced as did a bill that amends New Hampshire’s law.

Finally, California lawmakers are considering a bill to amend the Delete Act to shorten the 45-day time periods in that law to 30 days. New data broker bills also were introduced in Maryland and Arizona. We are tracking data broker bills in nine states.

More details on those bills plus updates on all bill movements last week in the below post.

Consumer Data Privacy

Maine’s LD 1822/HP 1220 narrowly passed the House and is now with the Senate. About 1,500 miles southwest, Alabama’s HB 351 passed out of committee and is now on floor votes.

Meanwhile, two states advanced bills to amend their existing consumer data privacy laws. New Hampshire’s House passed HB 1460. The bill amends the state’s consumer data privacy law to prohibit the sale of location and other sensitive data regarding children.

In Virginia, two VCDPA amendment bills advanced last week. SB 85 passed the Senate on February 10. The bill requires social media platforms and operators to implement third-party interoperability interfaces to allow users to share social graph data and contextual data associated with AI systems as the user designates. SB 245 passed out of committee and is on floor votes. That bill also deals with social media platforms.

Turning to new bills, California’s SB 1104 amends the CCPA to require that a business that does not operate exclusively online make available to consumers an email address for submitting personal information requests.

In Kentucky, HB 633 amends the commonwealth’s existing consumer data privacy law to add children’s privacy provisions.

In Arizona, a Democrat Senator introduced a consumer data privacy bill (SB 1815).

Kid’s Privacy

2026 may turn into the year of the App Store bill. Alabama’s legislature passed its App Store bill (HB 161) with the House concurring in the Senate amendments. The bill next heads to Governor Kay Ivey for consideration. The bill passed the legislature unanimously.

Three states also advanced App Store bills last week. In Kansas, a committee amended and passed SB 372. A Wisconsin committee also passed an amended App Store bill (AB 962). In Iowa, a subcommittee recommended passage of its App Store bill (SF 2197).

Three other states introduced bills – Maryland (HB 1179), Kentucky (HB 632), and Georgia (SB 495).

Meanwhile, Virginia’s App Store bill (HB 757) was continued to 2027.

Turning to other types of kid’s privacy bills, Washington’s HB 1834 is now on floor votes. The bill deals with operators of addictive internet-based services or applications.

In New Jersey, companion bills were introduced to enact the New Jersey Age-Appropriate Design Code Act (AADC) (S 3413 / A 4015). Kansas lawmakers are also now considering companion AADC bills (HB 2772 / SB 499). Meanwhile, a group of ten Democrat Rhode Island House members introduced an AADC bill (H 7632).

Biometric Privacy

There were no developments for this category last week.

Data Broker

A California Senator introduced a bill (SB 1106) to amend the Delete Act to require data brokers to access the accessible deletion mechanism every 30 days and process deletion requests within 30 days. The law currently requires that those happen in 45 days.

There were two new data broker bills filed in Maryland. HB 1220 was introduced as a companion bill to SB 616. Meanwhile, two House Delegates introduced HB 1089.

Arizona lawmakers are considering a data broker bill (SB 1790) that was filed by four Democrats.

Consumer Health Data Privacy

There were no developments for this category last week.