Since our reports on February 20, 2019 and April 30, 2019, no states have followed California in adopting comprehensive privacy legislation but three states have enacted targeted privacy laws. In May Nevada enacted a law giving consumers the right to opt out of the sale of their personal information. Maine put on its books a law restricting Internet service providers’ use of subscribers’ personal information. And Montana limited the use of data collected from sites designed, marketed, and used for K-12 school purposes.
As many state legislatures conclude their sessions for 2019, it is unclear whether any state will enact a comprehensive privacy law akin to the California Consumer Privacy Act (CCPA). Five bills based on the CCPA are still pending in states where the legislature remains in session—one each in Massachusetts, Pennsylvania, and Rhode Island, and two in New York—and it is possible that one of these could gain legislative traction.