After a legislative lull last year, 2026 has brought a new wave of state privacy lawmaking activity.

A number of states have introduced comprehensive state privacy bills during the legislative cycle, reflecting a continued trend toward expanding individual privacy rights and creating new compliance obligations on businesses that collect and process personal data.

While many of these proposals follow established frameworks modeled after existing state privacy laws, several include new provisions addressing emerging issues such as artificial intelligence (AI) and consumer health data.

The tables below summarize certain key details of the state privacy bills introduced during the 2026 legislative cycle.

Comprehensive privacy bills (in progress as of March 2, 2026)

These bills largely mimic existing comprehensive privacy laws passed since 2018. Certain new provisions are summarized in the last column.

StateLink to billDate introducedTitleSummary of provisions
AlabamaHB 351January 29, 2026Alabama Personal Data Protection ActExpanded authority for authorized agents to exercise consumer rightsProvides an exemption for AI models in which no personally identifiable data is present in or extractable from the model
ArizonaSB 1815February 9, 2026N/ADefines “child” as someone under the age of 16
IowaHF 2048January 14, 2026N/AA standalone privacy regime separate from Iowa’s comprehensive privacy law that applies to significantly smaller businessesCovers companies that process personal data of at least 5,000 Iowa residents annuallyRequires affirmative opt-in consent for personal data processing, rather than relying on an opt-out framework  
IllinoisSB 2875January 16, 2026Illinois Consumer Data Privacy ActUses a definition of “specific geolocation data” based on latitude and longitude decimals, rather than feetRequires data inventory for controllersProvides a right to contest adverse profiling decisions
IllinoisSB 3220February 2, 2026Illinois Consumer Data Privacy ActDefines “biometric data” more broadly than the norm (covering data from photos, videos, and audio if used to identify an individual)Exempts pseudonymous data from consumer rights
IllinoisSB 3890February 6, 2026Illinois Data Privacy Protection ActRequires annual registration of data brokers with the Attorney GeneralMandates creation of a public, centralized deletion mechanism to allow consumers to delete personal data across all registered brokers
IllinoisSB 3548February 5, 2026Consumer Data Privacy ActEstablishes a Consumer Privacy Fund administered by the Attorney General and funded by enforcement proceeds
IllinoisHB 5221February 10, 2026Consumer Data Privacy ActExplicitly pre-empts home‑rule authority with respect to consumer data privacy regulation (i.e., only the State of Illinois - not cities, counties, or other home‑rule local governments - may regulate how personal data is processed)
New MexicoSB 53January 21, 2026Community and Health Information Safety and Privacy ActRequires highest-level privacy settings as the defaultRequires opt-in consent for sensitive data processingProhibits geofencing around healthcare and immigration services facilities
New MexicoHB 214January 29, 2026Consumer Information and Data Protection ActCombines comprehensive privacy law requirements with consumer health data law requirements into one billProvides protections for minors under the age of 18Restricts federal agency sharing of New Mexico residents’ sensitive data
New JerseyS2602January 13, 2026New Jersey Disclosure and Accountability Transparency ActCreates a new state agency
VermontH. 812January 29, 2026Vermont Duty of Data Loyalty ActIs largely based on the American Data Privacy and Protection ActDefines “sensitive covered data” to include “information identifying individual’s online activities over time and across third-party websites or online services”
West VirginiaHB 5123February 3, 2026Consumer Data Protection ActBans geofencing healthcare facilitiesProvides a private right of actionDamages for violations involving minors under the age of 16 can be tripled