Regulatory Pulse

Covered entities must notify Alabama residents and the Attorney General of qualifying data breaches.

Source: Alabama Attorney General

Businesses must notify Alaska residents of breaches of personal information.

Source: Alaska Department of Law

Entities must notify Arizona residents of unauthorized acquisition of unencrypted personal information.

Source: Arizona Attorney General

Businesses must notify Arkansas residents of security breaches involving personal information.

Source: Arkansas Attorney General

Qualifying entities must biennially report climate-related financial risks and mitigation measures under CARB oversight.

Source: California Air Resources Board

Large U.S. companies doing business in California must disclose Scope 1–3 greenhouse gas emissions with third-party assurance phases.

Source: California Air Resources Board

Creates a CPPA-operated mechanism for consumers to request deletion across registered data brokers, with phased compliance.

Source: California Legislative Information — SB 362

California fast-food workers receive a higher statewide minimum wage; sector council authority was narrowed after referendum.

Source: California Department of Industrial Relations

Businesses that sell personal information they did not collect directly must register with the CPPA and pay an annual fee.

Source: California Privacy Protection Agency

California Privacy Protection Agency regulations clarify opt-out signals, audits, cybersecurity, and automated decision-making disclosures.

Source: California Privacy Protection Agency

CPRA expands CCPA with new consumer rights, sensitive data limits, and contractor/service-provider obligations for businesses meeting thresholds.

Source: California Attorney General — CCPA/CPRA

Personal information collected in employment and certain B2B contexts is fully covered by CCPA/CPRA after exemption sunset.

Source: California Attorney General — CCPA/CPRA

Developers and deployers of high-risk AI systems face impact assessments, disclosure, and anti-discrimination duties.

Source: Colorado General Assembly

Colorado consumers gain access, correction, deletion, and opt-out rights; controllers need privacy notices and data protection assessments.

Source: Colorado Attorney General

Employers with Colorado employees must include compensation and benefits in public job postings.

Source: Colorado Department of Labor and Employment

Connecticut privacy law grants consumer rights and imposes controller obligations including data protection assessments.

Source: Connecticut Attorney General

Delaware-incorporated entities owe annual franchise tax and must file reports by March 1.

Source: Delaware Division of Corporations

Delaware regularly amends DGCL — recent changes affect stockholder rights, fiduciary duties, and entity governance.

Source: Delaware Division of Corporations

Persons conducting business in Delaware must notify residents and the Attorney General of qualifying breaches.

Source: Delaware Department of Justice

Delaware allows public benefit corporations with expanded director duties to stakeholders beyond stockholders.

Source: Delaware Division of Corporations

Privacy rights for consumers against large tech platforms; scope narrowed from original proposal — verify applicability thresholds.

Source: Florida Senate — CS/HB 3 (2024)

Telephone solicitation rules require licensing, calling-hour limits, and Do Not Call compliance for covered sellers.

Source: Florida Attorney General

Legislative packages address assignment of benefits, litigation costs, and Citizens Property Insurance eligibility.

Source: Florida Senate — Special Session SB 2-D

Marketplace providers must collect and remit Florida sales tax on facilitated sales.

Source: Florida Department of Revenue

Out-of-state corporations with substantial Florida sales may owe corporate income tax even without physical presence.

Source: Florida Department of Revenue

Businesses must notify Floridians and regulators of data breaches involving personal information within 30 days.

Source: Florida Attorney General

Marketplace facilitators must collect and remit Georgia sales tax on third-party sales.

Source: Georgia Department of Revenue

Qualified production companies may claim transferable tax credits — relevant for media and content startups.

Source: Georgia Department of Economic Development

Businesses must notify Georgia residents of unauthorized acquisition of personal information.

Source: Georgia Attorney General

Businesses must notify Hawaii residents of unauthorized access to personal information.

Source: Hawaii Office of Consumer Protection

Businesses must notify Idaho residents of unauthorized acquisition of personal information.

Source: Idaho Attorney General

Most Illinois employers must provide paid leave employees can use for any reason, accrued per hour worked.

Source: Illinois Department of Labor

Employers using AI to analyze video interviews must notify applicants and explain how AI is used.

Source: Illinois General Assembly — IVAA

Private entities need written consent and a retention policy before collecting fingerprints, face scans, or other biometrics.

Source: Illinois General Assembly — BIPA

Illinois requires reasonable security measures and breach notification for personal information.

Source: Illinois Attorney General

Businesses must notify Indiana residents of breaches of personal information.

Source: Indiana Attorney General

Businesses must notify Iowa residents of unauthorized acquisition of personal information.

Source: Iowa Attorney General

Businesses must notify Kansas residents when personal information is acquired without authorization.

Source: Kansas Attorney General

Businesses must notify Kentucky residents of security breaches involving personal information.

Source: Kentucky Attorney General

Businesses must notify Louisiana residents of breaches of personal information.

Source: Louisiana Attorney General

Businesses must notify Maine residents of security breaches involving personal information.

Source: Maine Attorney General

Maryland privacy law restricts sale of sensitive data and sets consumer rights for Maryland residents.

Source: Maryland Attorney General

Massachusetts employers and workers fund paid family and medical leave benefits administered by the Department of Family and Medical Leave.

Source: Massachusetts Department of Family and Medical Leave

Noncompetes must meet garden-leave or consideration requirements and cannot exceed 12 months for most employees.

Source: Massachusetts Courts

Businesses holding MA residents' personal information must maintain a written information security program (WISP).

Source: Massachusetts Office of Consumer Affairs

Businesses must notify Michigan residents and provide notice to the Attorney General for large breaches.

Source: Michigan Attorney General

Minnesota joins state privacy patchwork with consumer rights, consent requirements, and contractor obligations.

Source: Minnesota Attorney General

Businesses must notify Mississippi residents of breaches of personal information.

Source: Mississippi Attorney General

Businesses must notify Missouri residents when personal information is compromised.

Source: Missouri Attorney General

Montana privacy law provides consumer rights including opt-out of sale and targeted advertising.

Source: Montana Department of Justice

Businesses must notify Nebraska residents of breaches of personal information.

Source: Nebraska Attorney General

Consumers may direct operators not to sell certain covered information; operators must provide a designated request method.

Source: Nevada Attorney General

Businesses must notify New Hampshire residents of unauthorized access to personal information.

Source: New Hampshire Department of Justice

Certain public contractors must report employee compensation by gender, race, and job category.

Source: New Jersey Department of the Treasury

Businesses must notify New Jersey residents of breaches of personal information without unreasonable delay.

Source: New Jersey Office of the Attorney General

Businesses must notify New Mexico residents of security breaches involving personal information.

Source: New Mexico Attorney General

Data brokers meeting definition must register with the NY Attorney General and maintain a consumer opt-out.

Source: New York Attorney General

New York employees may take paid leave for prenatal healthcare appointments under the paid sick leave law.

Source: New York Department of Labor

NYC employers using AI for hiring must conduct annual bias audits and provide candidate notices.

Source: NYC Department of Consumer and Worker Protection

Employers must provide paid sick leave accrual based on employer size; covers diagnosis, care, and domestic violence leave.

Source: New York Department of Labor

Expanded breach notification and security program requirements for NY residents' private information.

Source: New York Department of Financial Services

Businesses holding private information of NY residents must implement reasonable administrative, technical, and physical safeguards.

Source: New York Department of Financial Services

Virtual currency businesses serving New York generally need a BitLicense or limited-purpose trust charter from NY DFS.

Source: New York Department of Financial Services

Employers fund unemployment insurance; new businesses register for NCUI tax accounts when hiring.

Source: North Carolina Division of Employment Security

Businesses must notify NC residents and the Attorney General of security breaches involving personal information.

Source: North Carolina Department of Justice

Businesses must notify North Dakota residents of unauthorized acquisition of personal information.

Source: North Dakota Attorney General

Entities must notify Ohio residents of breaches of personal information without unreasonable delay.

Source: Ohio Attorney General

Businesses must notify Oklahoma residents of unauthorized access to personal information.

Source: Oklahoma Attorney General

Oregon privacy law includes consumer rights, universal opt-out, and DPIA requirements for high-risk processing.

Source: Oregon Department of Justice

Businesses must notify Pennsylvania residents when personal information is disclosed without authorization.

Source: Pennsylvania Office of Attorney General

Businesses must notify Rhode Island residents of breaches of personal information.

Source: Rhode Island Attorney General

Businesses must notify South Carolina residents of security breaches involving personal information.

Source: South Carolina Attorney General

Businesses must notify South Dakota residents of breaches of personal information.

Source: South Dakota Attorney General

Businesses must notify Tennessee residents of unauthorized access to personal information.

Source: Tennessee Attorney General

Dedicated business court divisions handle large commercial disputes with specialized judges in major counties.

Source: Texas Judicial Branch — Business Court

Texas privacy law applies to many businesses without revenue thresholds; requires privacy notices, opt-outs, and data protection assessments.

Source: Texas Attorney General

Entities below the annualized total revenue threshold may file a no-tax-due report instead of owing franchise tax.

Source: Texas Comptroller of Public Accounts

Businesses must notify Texas residents of breaches of sensitive personal information and report large breaches to the AG.

Source: Texas Attorney General

Requires informed consent before capturing biometric identifiers and limits retention and disclosure.

Source: Texas Legislature — Business & Commerce Code Ch. 503

Certain cloud, SaaS, and data processing services are taxable in Texas when provided for consideration.

Source: Texas Comptroller — Data Processing Services

Utah consumers may access, delete, and opt out of sale of personal data; lighter obligations than CPRA for many businesses.

Source: Utah Department of Commerce

Data brokers must register annually with the Vermont Secretary of State and meet minimum data security standards.

Source: Vermont Secretary of State

Virginia consumers receive access, correction, deletion, and opt-out rights similar to other state privacy laws.

Source: Virginia Attorney General

Employers may not enter noncompete agreements with low-wage employees as defined by statute.

Source: Virginia Legislative Information System

Broad consumer health data privacy law with consent, geofencing, and deletion rights — beyond HIPAA-covered entities.

Source: Washington Attorney General

Most Washington workers contribute to a state long-term care insurance benefit; exemptions exist for out-of-state workers.

Source: Washington State WA Cares Fund

Large emitters must obtain allowances for greenhouse gas emissions; affects energy-intensive operations.

Source: Washington Department of Ecology

Entities must notify affected Washington residents and the Attorney General when personal information is compromised.

Source: Washington Attorney General

Employers and employees fund statewide paid leave for medical and family events; reporting required for covered employers.

Source: Washington Paid Family & Medical Leave

Noncompetes are void for employees below statutory earnings thresholds and banned for certain workers.

Source: Washington Department of Labor & Industries

Businesses must notify West Virginia residents of security breaches involving personal information.

Source: West Virginia Attorney General

Businesses must notify Wisconsin residents of unauthorized acquisition of personal information.

Source: Wisconsin Department of Administration

Businesses must notify Wyoming residents of unauthorized acquisition of personal information.

Source: Wyoming Attorney General