Key point: Last week, consumer data privacy bills advanced in Alabama and Kentucky, Vermont’s data broker amendment bill passed a committee vote, and Hawaii’s Senate passed a bill prohibiting the sale of geolocation information and internet browser information without consent.

Below is the ninth update on the status of proposed state privacy legislation in 2026. This post covers updates on proposed bills dealing with consumer data privacy, kid’s privacy, biometric privacy, data brokers, and consumer health data privacy. As always, the contents provided below are time-sensitive and subject to change.

What’s New

Alabama’s consumer data privacy bill inched closer to passing after an amended version was voted out of a Senate committee. The bill already passed the House. The amendments removed the requirement for controllers to recognize opt out preference signals and added exemptions. However, time is tight for the bill to get done this year with the legislature closing on March 27.  

Kentucky’s House quickly passed a bill last week to amend the state’s consumer data privacy law to add “automatic content recognition” (definition below) as an element of sensitive data. The bill passed through a House committee earlier in the week before unanimously passing the House.

Turning to data broker bills, Vermont Representative Monique Priestley’s data broker bill passed out of a House committee. The bill amends the state’s existing data broker registration law to add California Delete Act-like requirements. Meanwhile, in New York, data broker provisions were added to two budget bills.

Pivoting to other bills we are tracking, Hawaii’s Senate passed a bill to prohibit the sale of geolocation information and internet browser information without consent. The bill also prohibits the sale of data collected through eavesdropping or through an application operating in the background of a device that uses the device’s microphone.

Looking at the weeks ahead, Wisconsin’s legislature closes on March 19. The legislature has been considering consumer data privacy and App Store bills. Other states of note with upcoming closing dates are Alabama (closing March 27), Maryland (closing April 13), and Maine (closing April 15).

Finally, the Florida, Washington, and West Virginia legislatures closed last week.

More details on those bills plus updates on all bill movements last week in the below post.

Consumer Data Privacy

Alabama’s HB 351 was amended and passed out of committee in the Senate. The bill previously passed the House. The amendments removed the requirement for controllers to recognize opt out preference signals and added exemptions. Alabama’s legislature closes March 27.

Kentucky’s HB 692 unanimously passed the House after passing out of committee earlier in the week. The bill amends Kentucky’s consumer data privacy law relating to add “automatic content recognition” as a category of sensitive data. The bill defines automatic content recognition as “technology embedded or operating through a smart television or smart monitor with integrated internet connectivity and an operating system that identifies, in real time, the specific content displayed by analyzing audio or video fingerprints, including but not limited to content received through broadcast, cable, satellite, streaming services, or external inputs, through digital fingerprinting, watermark detection, or similar comparison techniques.”  

Virginia’s legislature closed for the year on March 14. Prior to doing so, the legislature tabled SB 85 (VCDPA amendment). Meanwhile, SB 338 was transmitted to the governor with an action deadline of April 13. That bill amends the VCDPA to prohibit the sale or offering for sale of precise geolocation data.

Kid’s Privacy

There were no updates for this category last week.

Biometric Privacy

In Minnesota, SF 4351 was introduced as a companion bill to HF 4005.

Data Broker

Vermont’s H 211 passed out of committee on March 13. In New York, data broker provisions were added to A 10008 and S 9008, which are budget bills.

Consumer Health Data Privacy

There were no updates for this category last week.

Other

Hawaii’s SB 1163 passed the Senate on March 10. The bill prohibits the sale of geolocation information and internet browser information without consent. It also prohibits the sale of data collected through eavesdropping or through an application operating in the background of a device that uses the device’s microphone.