State Legislatures Push Forward on Consumer Privacy in 2025

As 2025 unfolds, lawmakers across the country remain actively engaged in shaping consumer privacy regulations. With 19 new privacy bills introduced across 10 states, legislators are working to address growing concerns about data security, consumer rights, and corporate responsibility. While most of these bills are still in the early stages, one proposal—Washington’s HB 1671—has already gained momentum, having been scheduled for a public hearing just days after its introduction.

Washington’s latest attempt at passing a comprehensive privacy law is significant, given the state’s repeated efforts in previous years. The primary roadblock has historically been whether such legislation should include a private right of action—a provision that would allow consumers to sue companies for privacy violations. The current version of HB 1671 does include this right, making it a focal point of debate, especially among industry stakeholders.

Emerging Privacy Trends in 2025

As new proposals take shape, states with existing privacy laws are also considering updates. For example, Virginia is working on multiple amendments to its Consumer Data Protection Act (VCDPA), including a bill that would restrict the sale of precise geolocation data—a growing trend in privacy legislation. Similarly, Iowa, whose Consumer Data Protection Act only took effect in January, is already considering a revision that would raise the legal definition of a "child" from 13 to 18 and expand protections for health-related data.

Meanwhile, some proposals have failed to gain traction. Mississippi’s SB 2500, modeled after Utah’s privacy law, has already died in committee. This reflects a broader challenge in states that aim to balance business interests with consumer protections, particularly when it comes to enforcement mechanisms and opt-out vs. opt-in data policies.

New Comprehensive Privacy Bills

Many of the 2025 privacy proposals share common features, including requirements for businesses to provide clear privacy notices, consumer rights to access, correct, or delete personal data, and the ability to opt-out of data sales and targeted advertising. However, some states have introduced distinct provisions that could set them apart:

Massachusetts – Comprehensive Massachusetts Consumer Data Privacy Act

• Applies to businesses processing personal data of either:

  • 100,000+ consumers OR

  • 25,000+ consumers if over 25% of revenue comes from selling personal data

• Requires businesses to provide clear opt-out mechanisms for targeted advertising and data sales.

• Enforcement falls under the Massachusetts Attorney General, with a 60-day cure period before action is taken.

  
  

Mississippi – Mississippi Consumer Data Privacy Act

• Targets businesses with:

  • $10M+ in revenue

  • Processing 50,000+ consumers’ personal data

  • Deriving 50%+ of revenue from selling consumer data

• Lacks a right to correct personal information, similar to laws in Utah and Iowa.

• Establishes a limited private right of action for data breaches, allowing affected consumers to seek damages.

  
  

New York – New York Privacy Act

• Requires data brokers to register and disclose data processing practices.

• Introduces strict consent requirements for certain types of data collection.

• Enforcement by the New York Attorney General, with penalties of up to $20,000 per violation.

Washington – HB 1671

• Expands consumer health data protections, aligning with the state’s My Health, My Data Act.

• Allows private lawsuits under the state’s consumer protection laws, which has sparked industry pushback.

• Requires businesses processing sensitive data to comply with stricter security and data assessment requirements.

What’s Next for State Privacy Laws?

As state legislatures continue to refine these proposals, the patchwork of privacy laws in the U.S. is becoming more complex. Some states, like Virginia and Massachusetts, are making steady progress toward stronger consumer protections, while others, like Mississippi and Maine, face challenges in getting their proposals across the finish line.

For a deeper look into these legislative efforts and their potential impact, legal analysts and privacy professionals continue to track developments closely. Insights from resources like the WilmerHale Privacy and Cybersecurity Blog, White & Case LLP, and Greenberg Traurig have been invaluable in understanding how these laws are evolving across different states.

Reference

• WilmerHale Privacy and Cybersecurity Blog (Hale & Dorr)r

• White & Case LLP

• Greenberg Traurig