TL;DR: Twenty states already have comprehensive privacy laws on the books.[8] At least six more bills were advancing through state legislatures in March 2026. Maine's MODPA cleared the Senate (18-16) with a controversial political party exemption.[1] Alabama passed the House unanimously (104-0) and needed a Senate vote before March 27.[2][3] Kentucky became the first state to enact a law specifically targeting smart TV surveillance.[6] Connecticut's SB 4 brings California-style Delete Act provisions to the East Coast.[4][5] Hawaii wants to ban the sale of your geolocation data entirely.[7] Here's where each stands.
The Privacy Patchwork Gets Denser
Twenty states now have comprehensive privacy laws in effect, with Indiana, Kentucky and Rhode Island joining the landscape on January 1, 2026.[8] But for anyone trying to track their rights, the picture keeps getting more complicated.
Each state takes a slightly different approach. Some mirror Virginia's business-friendly framework. Others (like Maine and Maryland) go harder with data minimization requirements. A few are carving out specific niches: Kentucky just passed the first law specifically targeting the surveillance tech inside your smart TV.
This tracker covers the bills that moved in March 2026. All of them are still advancing. Some will die. Others will become law by summer.
Maine: MODPA Clears Senate With Last-Minute Exemption
Bill: LD 1822, Maine Online Data Privacy Act
Status: Passed Senate 18-16 on March 5, 2026. Returning to House.
Effective Date: September 2027 (if enacted)
Maine's privacy bill would be among the strongest in the country, if it passes intact. The bill, LD 1822, implements data minimization, meaning companies can only collect information they need to provide a specific service or product rather than placing the onus on consumers to opt out of data sharing. Only two states have adopted that more restrictive standard, and the Maine bill has already won initial approval in both chambers.[1]
What the Bill Requires
- Businesses can only collect data directly necessary for the product or service
- Bans use of "sensitive data" (race, ethnicity, health conditions) without explicit consent
- Restricts data collection from minors
- Shifts burden from consumers to businesses on data sharing
The Political Party Problem
Democrats added a last-minute amendment that explicitly exempts political parties and committees from the restrictions. The Senate advanced the bill on a vote of 18 to 16, with two Democrats joining 14 Republicans to oppose it.[1]
Senator Jeff Timberlake called out the asymmetry: "A restaurant in Belfast has to follow the rules, a retailer in Presque Isle has to follow the rules. But the organization trying to influence who gets elected to office? They're exempt." Democrats countered that the exemption is needed to ensure the law does not violate constitutional protections for political speech.[1]
The bill returns to the House, which last month voted 73 to 65, with 10 members absent. But that was before the political-party amendment was added, so that vote could change.[1]
Industry Opposition
The Maine State Chamber of Commerce, the Retail Association of Maine, Hospitality Maine and the National Federation of Independent Business in Maine are all lobbying hard against the version of the bill that is advancing. Their argument: data minimization requirements will put Maine companies at a competitive disadvantage.[1]
Alabama: HB 351 Needs Senate Vote Before March 27
Bill: HB 351, Alabama Personal Data Protection Act
Status: Passed House 104-0 on February 25, 2026. In Senate committee.
Effective Date: May 1, 2027 (if enacted)
Deadline: Legislature adjourns March 27
Alabama's privacy bill sailed through the House with zero opposition. That's notable: privacy legislation usually draws at least some business pushback. The Senate has ten days to act.
What the Bill Covers
- Applies to companies that control the personal information of a threshold number of Alabama consumers, or derive a share of revenue from selling it. A House substitute amendment expanded that applicability threshold.[2]
- Grants rights to access, correct, delete, and opt out of data sales
- Requires clear privacy notices and data security practices
- Enforcement: Consumer Reports says the bill "should also include enforcement mechanisms that will actually incentivize companies to comply the first time around"[2]
What Got Stripped Out
The House voted 100-0 for sponsor Rep. Mike Shaw's floor amendment. Shaw was blunt about why: "Given the current nature of artificial intelligence and the executive order by President Donald Trump opposing state AI regulation, we wanted to take that out."[2]
Members then voted 104-0 to approve a substitute amendment, which expanded the applicability threshold, revised exemptions and delayed the proposed effective date to May 1, 2027 from October 1 in the original bill.[2]
Why Consumer Reports Isn't Celebrating
Consumer Reports called the bill out for "many of the same issues that plague Virginia and Connecticut-style privacy legislation." CR policy analyst Matt Schwartz said the bill contains "a number of loopholes and exceptions that will weaken its coverage" and "should also include enforcement mechanisms that will actually incentivize companies to comply the first time around."[2]
Kentucky: First State to Target Smart TV Surveillance
Bill: HB 692
Status: Passed House unanimously. Signed by the Governor on April 13, 2026 (Acts Chapter 118).
Effective Date: July 1, 2027
Your TV is watching you. Kentucky just voted to make it ask permission first.
The House version of HB 692 added automatic content recognition (ACR) data to the definition of "sensitive data" under Kentucky's privacy law. The enacted version, signed on April 13, 2026, amends the Kentucky Consumer Data Protection Act to define "automatic content recognition data" and "smart monitor" and to prohibit controllers from collecting ACR data without a consumer's consent. It takes effect July 1, 2027.[6] No other state has specifically targeted the surveillance technology built into modern smart TVs.
What Is ACR?
Automatic content recognition is software that identifies what's playing on your screen, second by second. It captures exactly what you're watching, even content from HDMI-connected devices like game consoles or streaming boxes. The data goes to TV manufacturers, who sell it to advertisers.
Vizio paid $2.2 million to the FTC and the New Jersey Division of Consumer Affairs in 2017. The FTC said Vizio had "installed software on its TVs to collect viewing data on 11 million consumer TVs without consumers' knowledge or consent," capturing "second-by-second information about video displayed on the smart TV" and selling it to third parties who used it to target advertising.[9] The practice continues because there was no law against it.
Why This Matters
Most people have no idea their TV is logging their viewing habits. Kentucky's law now prohibits controllers from collecting automatic content recognition data without a consumer's consent.[6]
The bill passed the House unanimously and was signed into law on April 13, 2026. Kentucky is the first state with smart TV-specific privacy protections on the books.
Connecticut: Delete Act Comes East
Bill: SB 4
Status: Passed Senate 31-4 on April 23, 2026. In the House.
Effective Date: TBD
Connecticut Senator James Maroney, the General Law Committee co-chair and lead author, introduced SB 4 with California's Delete Act as the template. The bill creates a data broker registry and, critically, a state-run deletion mechanism: submit once, delete everywhere.[4][5]
What the Bill Includes
- Data broker registration: Registration with the Department of Consumer Protection by January 1, 2027. Registered brokers face civil penalties of up to $200 per day for failure to comply.[4]
- Centralized deletion: A single request eliminates your personal data across all registered data brokers[4]
- Surveillance pricing rules: Dynamic pricing stays permissible when based on neutral factors such as time, distance or supply and demand, rather than individualized consumer profiling[4]
- Facial recognition: Connecticut lawmakers shifted from proposing a ban to regulating facial recognition software use rather than banning it outright[5]
- Sensitive data: The bill governs the uses of geolocation data and protects individual biological and genetic data[5]
Industry Pushback
The Computer & Communications Industry Association testified that the measure "would place Connecticut businesses at a competitive disadvantage without meaningfully improving consumer privacy."[5] The Connecticut Business & Industry Association criticized the bill's definitions of "data broker" and "data service provider" as overly broad.[5]
The bill also carves out loyalty programs, uniform discounts, demand-based pricing and cost-based price differentiation.[4]
Translation: they're fine with surveillance pricing as long as it's sometimes in your favor.
Hawaii: Banning Geolocation and Browser Data Sales
Bill: SB 1163
Status: Passed Senate Commerce Committee 4-0
Effective Date: Listed as January 1, 2077 (placeholder, expected to be amended)
Hawaii's SB 1163 takes a targeted approach: ban the sale of specific categories of data outright. As of the March 2026 committee vote it would prohibit the sale of geolocation information, internet browser information, and data collected through eavesdropping or by applications running in the background using a device's microphone, without explicit consent.[7]
What Gets Banned
- Geolocation data: Mobile device location data that pinpoints where you are
- Browser data: Web browsing history, application usage, device identifiers
- Eavesdropping data: Any data collected through device microphones, including background apps
Exemptions
The bill provides exemptions for lawful investigations conducted by law enforcement agencies, for customer proprietary network information, and for certain telecommunication carriers.[7]
The 2077 Question
The bill currently lists an effective date of January 1, 2077.[7] That's a placeholder. Hawaii legislators commonly use far-future dates that get amended before final passage. If the bill advances, expect a 2027 or 2028 effective date.
What's Actually Changing
Each of these bills targets a different piece of the surveillance economy:
Maine
Data minimization: companies can't collect more than they need
Alabama
Baseline rights: access, correction, deletion, opt-out
Kentucky
Device surveillance: smart TVs need consent to watch you
Connecticut
Data brokers: registry and one-stop deletion
Hawaii
Location tracking: outright sales ban on your movements
None of these solve the fundamental problem: the United States still has no federal privacy law. But each chips away at specific surveillance practices. The patchwork grows denser. Companies face more compliance requirements. And slowly, the baseline for what's acceptable shifts.
Key Deadlines to Watch
| State | Bill | Next Step | Deadline |
|---|---|---|---|
| Alabama | HB 351 | Senate vote | March 27, 2026 |
| Maine | LD 1822 | House re-vote (with amendment) | Session ongoing |
| Kentucky | HB 692 | Signed April 13, 2026; effective July 1, 2027 | Done |
| Connecticut | SB 4 | House consideration | Session ongoing |
| Hawaii | SB 1163 | Full Senate vote | Session ongoing |
Track It Yourself
For real-time updates on state privacy legislation:
References
- Maine Senate advances controversial data privacy bill - Maine Public (March 6, 2026)
- Alabama House Passes Comprehensive Privacy Bill With No ‘Mention of AI’ - Privacy Daily (February 25, 2026)
- State privacy bill sprint: AL, KY, and HI move - ComplianceHub (March 14, 2026)
- Senate Advances Far-Reaching Data Privacy Bill - Connecticut Business & Industry Association
- Data privacy, consumer protection advances in CT Senate - CT Mirror (April 23, 2026)
- Kentucky Legislature: HB 692 bill record (signed April 13, 2026)
- Hawaii SB 1163 bill record - BillTrack50
- All of the Comprehensive Privacy Laws That Take Effect in 2026 - MultiState (February 4, 2026)
- VIZIO to Pay $2.2 Million to FTC, State of New Jersey to Settle Charges - FTC (February 6, 2017)
Published March 17, 2026. Last revised October 30, 2026.