Six State Privacy Bills Are Moving Right Now: The March 2026 Tracker

TL;DR: Twenty states already have comprehensive privacy laws on the books. At least six more bills are advancing through state legislatures right now. Maine's MODPA cleared the Senate (18-16) with a controversial political party exemption. Alabama passed the House unanimously (104-0) and needs a Senate vote before March 27. Kentucky became the first state to target smart TV surveillance specifically. Connecticut's SB 4 brings California-style Delete Act provisions to the East Coast. Hawaii wants to ban the sale of your geolocation data entirely. Here's where each stands.

The Privacy Patchwork Gets Denser

Twenty states now have comprehensive privacy laws in effect. Indiana, Kentucky, and Rhode Island joined the club on January 1, 2026. But for anyone trying to track their rights, the picture keeps getting more complicated.

Each state takes a slightly different approach. Some mirror Virginia's business-friendly framework. Others (like Maine and Maryland) go harder with data minimization requirements. A few are carving out specific niches: Kentucky just passed the first law specifically targeting the surveillance tech inside your smart TV.

This tracker covers the bills that moved in March 2026. All of them are still advancing. Some will die. Others will become law by summer.

Maine: MODPA Clears Senate With Last-Minute Exemption

Bill: LD 1822, Maine Online Data Privacy Act
Status: Passed Senate 18-16 on March 5, 2026. Returning to House.
Effective Date: September 2027 (if enacted)

Maine's privacy bill would be among the strongest in the country, if it passes intact. The bill implements "data minimization," meaning companies can only collect data necessary to provide specific services. That's a higher bar than most states.

What the Bill Requires

Businesses can only collect data directly necessary for the product or service
Bans use of "sensitive data" (race, ethnicity, health conditions) without explicit consent
Restricts data collection from minors
Shifts burden from consumers to businesses on data sharing

The Political Party Problem

Democrats added a last-minute amendment that explicitly exempts political parties and committees from the restrictions. The vote was 18-16, with two Democrats joining all 14 Republicans in opposition.

Senator Jeff Timberlake called out the asymmetry: businesses face strict requirements while "the organization trying to influence who gets elected to office" gets a pass. Democrats argue the exemption protects constitutional free speech.

The bill returns to the House, which previously passed it 73-65 before the political exemption was added. That vote could change.

Industry Opposition

The Maine State Chamber of Commerce, Retail Association of Maine, and Hospitality Maine all oppose the bill. Their argument: data minimization requirements will limit targeted marketing and hurt Maine businesses competing with companies in less-regulated states.

Alabama: HB 351 Needs Senate Vote Before March 27

Bill: HB 351, Alabama Personal Data Protection Act
Status: Passed House 104-0 on February 25, 2026. In Senate committee.
Effective Date: May 1, 2027 (if enacted)
Deadline: Legislature adjourns March 27

Alabama's privacy bill sailed through the House with zero opposition. That's notable: privacy legislation usually draws at least some business pushback. The Senate has ten days to act.

What the Bill Covers

Applies to companies controlling data of 25,000+ Alabama consumers, or deriving 25%+ revenue from selling data
Grants rights to access, correct, delete, and opt out of data sales
Requires clear privacy notices and data security practices
Enforcement by Attorney General only, no private right of action
Penalties up to $15,000 per violation

What Got Stripped Out

The House voted 100-0 to remove all mentions of AI from the bill. Sponsor Rep. Mike Shaw was blunt about why: "Given the current nature of artificial intelligence and the executive order by President Donald Trump opposing state AI regulation, we wanted to take that out."

The Senate amendment also removed the requirement for businesses to recognize universal opt-out signals, the browser-based "don't sell my data" flags that California requires.

Why Consumer Reports Isn't Celebrating

Consumer Reports called the bill out for "many of the same issues that plague Virginia and Connecticut-style privacy legislation." The AG-only enforcement model means you can't sue if your privacy gets violated. You have to hope the state takes action.

Kentucky: First State to Target Smart TV Surveillance

Bill: HB 692
Status: Passed House unanimously. In Senate.
Effective Date: May 2027 (if enacted)

Your TV is watching you. Kentucky just voted to make it ask permission first.

HB 692 classifies automatic content recognition (ACR) data as "sensitive data" requiring opt-in consent. That's a first. No other state has specifically targeted the surveillance technology built into modern smart TVs.

What Is ACR?

Automatic content recognition is software that identifies what's playing on your screen, second by second. It captures exactly what you're watching, even content from HDMI-connected devices like game consoles or streaming boxes. The data goes to TV manufacturers, who sell it to advertisers.

Samsung settled a class action for $70,000 over ACR in 2025. Vizio paid $2.2 million to the FTC back in 2017. The practice continues because there's no law against it.

Why This Matters

Most people have no idea their TV is logging their viewing habits. The settings to disable ACR are typically buried three menus deep. Kentucky's bill would require explicit opt-in before any ACR data collection.

The bill passed the House unanimously. If it clears the Senate, Kentucky becomes the first state with smart TV-specific privacy protections.

Connecticut: Delete Act Comes East

Bill: SB 4
Status: Hearing held March 4. In committee.
Effective Date: TBD

Connecticut Senator James Maroney introduced SB 4 with California's Delete Act as the template. The bill creates a data broker registry and, critically, a one-stop deletion mechanism: submit once, delete everywhere.

What the Bill Includes

Data broker registration: Annual registration with Department of Consumer Protection, $200 fee
Centralized deletion: Single request deletes your data from all registered brokers
Algorithmic pricing disclosure: Requires disclosure when algorithms set personalized prices
Facial recognition restrictions: Amendments to Connecticut Data Privacy Act
Geolocation protections: Restrictions on precise location data

Industry Pushback

The Computer & Communications Industry Association testified at the March 4 hearing, asking legislators to narrow the data broker definition. They also want carve-outs for "legitimate" personalized pricing like loyalty programs and promotional discounts.

Translation: they're fine with surveillance pricing as long as it's sometimes in your favor.

Hawaii: Banning Geolocation and Browser Data Sales

Bill: SB 1163
Status: Passed Senate Commerce Committee 4-0
Effective Date: Listed as January 1, 2077 (placeholder, expected to be amended)

Hawaii's SB 1163 takes a targeted approach: ban the sale of specific categories of data outright.

What Gets Banned

Geolocation data: Mobile device location data that pinpoints where you are
Browser data: Web browsing history, application usage, device identifiers
Eavesdropping data: Any data collected through device microphones, including background apps

Exemptions

Law enforcement gets a carve-out for "lawful investigations." Telecom carriers also have exemptions for customer proprietary network information.

The 2077 Question

The bill currently lists an effective date of January 1, 2077. That's a placeholder. Hawaii legislators commonly use far-future dates that get amended before final passage. If the bill advances, expect a 2027 or 2028 effective date.

What's Actually Changing

Each of these bills targets a different piece of the surveillance economy:

Maine

Data minimization: companies can't collect more than they need

Alabama

Baseline rights: access, correction, deletion, opt-out

Kentucky

Device surveillance: smart TVs need consent to watch you

Connecticut

Data brokers: registry and one-stop deletion

Hawaii

Location tracking: outright sales ban on your movements

None of these solve the fundamental problem: the United States still has no federal privacy law. But each chips away at specific surveillance practices. The patchwork grows denser. Companies face more compliance requirements. And slowly, the baseline for what's acceptable shifts.

Key Deadlines to Watch

State	Bill	Next Step	Deadline
Alabama	HB 351	Senate vote	March 27, 2026
Maine	LD 1822	House re-vote (with amendment)	Session ongoing
Kentucky	HB 692	Senate passage	Session ongoing
Connecticut	SB 4	Committee vote	Session ongoing
Hawaii	SB 1163	Full Senate vote	Session ongoing

Track It Yourself

For real-time updates on state privacy legislation:

References

Published March 17, 2026