An Iowa privacy bill opposed by consumer privacy groups passed the House in a 91-2 vote Monday. HF-2506 goes next to the Senate. Consumer Reports is disappointed, said Senior Policy Analyst Maureen Mahoney in a statement. “We opposed the weak bill as introduced, but the bill that advanced has been weakened further and won’t protect the privacy of Iowans.” CR, Common Sense, Electronic Frontier Foundation and other consumer groups opposed HF-2506 in a letter last week to House leaders. Like the Utah bill that recently passed, Iowa’s bill is a "far more business friendly" version of Virginia and Colorado laws, Husch Blackwell lawyer David Stauss blogged. If enacted, it would take effect Jan. 1, 2024. Maryland senators converted a proposed privacy law into a study bill. The Senate Finance Committee voted 11-0 Friday to clear SB-11 with an amendment, posted Tuesday, to establish a privacy workgroup that would review business practices with consumer data, analyze other state, federal and international protections, and recommend legislation. The amended bill received a second reading on the floor Tuesday, a procedural move that tees up a final vote.

The “regulatory framework” for data protection, privacy and information security is “evolving rapidly,” said Vizio’s 10-K annual report Thursday at the SEC. The California Consumer Privacy Act (CCPA) “prompted a number of proposals for federal and state privacy legislation,” it said. Virginia enacted the Virginia Consumer Data Protection Act (CDPA) March 2 and Colorado enacted the Colorado Privacy Act (CPA) July 7, “both of which are comprehensive privacy statutes that share similarities” with the CCPA and legislation proposed in other states, it said. “The CDPA and CPA will require us to incur additional costs and expenses in an effort to comply with these new laws before they become effective” Jan. 1, 2023, and July 1, 2023, respectively, it said. “The CDPA, CPA, and any other state or federal legislation that is passed, could increase our potential liability, add layers of complexity to compliance in the U.S. market, increase our compliance costs and adversely affect our business.” At least three states’ privacy bills appeared to fail last week as legislators struggled to reach agreement before their sessions ended (see 2203100062). Vizio settled with the FTC in 2017 over allegations the smart TV vendor collected viewing data on 11 million consumers without their consent or knowledge (see 1702080029). Vizio's "obligations" under the FTC settlement agreement remain in effect through 2037, said the 10-K.

Wisconsin’s privacy bill appears dead despite passing the Assembly last month (see 2202240003). “It’s looking like the bill won’t be receiving a vote in the Senate this session,” Mark Austinson, policy adviser to HB-957 sponsor Rep. Shannon Zimmerman (R), emailed us Wednesday. “We intend to continue working on the bill and reintroduce it in the beginning of next session.” The legislature adjourns Thursday. Florida’s privacy bill also looks dead; Washington state’s bill faces a Thursday deadline (see 2203070069).

The Florida House’s privacy bill might have hit a dead end in the state Senate. With lawmakers set to adjourn Friday, Rep. Fiona McFarland (R) legislative aide Clay Gunter told us Monday he doesn’t expect any more movement on HB-9, which passed the House last week by a wide margin (see 2203020069). The bill is now in the Senate Judiciary Committee, but the panel hadn’t scheduled HB-9 for hearing as of Monday. Senate President Wilton Simpson (R) and Judiciary Chairman Danny Burgess (R) didn’t comment. A Florida Senate privacy bill (SB-1864) hasn't moved since it was introduced Jan. 18. The chambers couldn't agree last year on enforcement. Wisconsin and Washington state privacy bills face Thursday legislative deadlines. In New York state, Attorney General Letitia James (D) listed data privacy and other internet-related problems Friday as the top consumer complaint she got last year, with more than 8,000 such complaints filed. Citing the AG list, New York Senate Consumer Protection Chairman Kevin Thomas (D) said Monday he will advocate to pass his privacy bill (S-6701). “New Yorkers should not have to sacrifice their safety or privacy when engaging in the digital world,” he said. Thomas’ committee cleared S-6701 last month (see 2202080051).

The owners of a weight loss app marketed to kids as young as 8 illegally collected their data without parental consent, DOJ and the FTC announced Friday in a $1.5 million settlement. WW, formerly Weight Watchers, and its subsidiary Kurbo violated the Children’s Online Privacy Protection Act, the agencies said. They “marketed weight management services for use by children as young as eight, and then illegally harvested their personal and sensitive health information,” FTC Chair Lina Khan said. “Our order against these companies requires them to delete their ill-gotten data, destroy any algorithms derived from it, and pay a penalty for their lawbreaking.” DOJ filed the complaint on behalf of the FTC in U.S. District Court in San Francisco. The defendants “possessed actual knowledge” that its application collected personal information like names, numbers and emails, plus information like height, weight, food intake and physical activity, DOJ said: They didn’t notify parents about the collection, as required by COPPA. The settlement isn’t an admission of wrongdoing, said Kurbo General Counsel Michael Colosi in a statement: “Kurbo takes child privacy very seriously ... Data collected in Kurbo’s paid counseling program is used in strict compliance with parental consent solely to help children learn better eating habits.” Limited data received in the free app was “designed to be collected in an anonymous environment and used solely for the purpose of helping the users develop better eating habits,” he said. Kurbo didn’t target children with ads, sell data to third parties or monetize its users in any way, he added: “No parents or children ever complained that Kurbo used their personal data in an inappropriate manner.”

President Joe Biden’s State of the Union address spurred reaction from Democrats and Republicans looking to move comprehensive privacy and child privacy bills. Biden announced a sweeping agenda to address a social media-linked children's mental health “crisis” during his Tuesday speech, as expected (see 2203010072). “Protecting kids online starts by establishing a national privacy and data security framework and enacting legislation that stops Big Tech’s harmful abuse of power,” said House Commerce Committee ranking member Cathy McMorris Rodgers, R-Wash. Biden issued a “powerful call to action on the youth mental health crisis exacerbated by social media, which can be addressed by the Kids Online Safety Act, Senate Consumer Protection Subcommittee Chairman Richard Blumenthal, D-Conn., said of his bipartisan bill with ranking member Marsha Blackburn, R-Tenn. The president offered Congress a “blueprint,” and now it’s time to act, said Rep. Lori Trahan, D-Mass. Biden “clearly expressed what we know to be true: it’s time to prevent the abusive collection and retention of personal information online,” said Reps. Anna Eshoo, D-Calif., and Zoe Lofgren, D-Calif., in favor of their Democratic privacy proposal (see 2111180048). “If companies can’t collect data, they can’t use that data to manipulate Americans for profit.” Biden urged Congress to swiftly send him a compromise bill marrying elements of the House-passed America Creating Opportunities for Manufacturing, Pre-Eminence in Technology and Economic Strength Act (HR-4521) and Senate-passed U.S. Innovation and Competition Act (S-1260), which both include $52 billion in subsidies to encourage U.S.-based semiconductor manufacturing (see 2201260062). The House passed HR-4521 last month, but there has been no formal compromise between that measure and S-1260 (see 2202250054). “Let’s not wait any longer,” Biden said. “We used to invest 2% of our GDP in research and development. We don’t now. China is.” Biden praised Intel’s plan to build two new chip factories in Ohio, costing $20 billion (see 2201210027), as “the biggest investment in manufacturing in American history, and all they’re waiting for is for you to pass a HR-4521/S-1260 compromise. Biden also, as expected, touted the $65 billion in broadband money included in the Infrastructure Investment and Jobs Act as a way to provide "affordable high-speed internet for every American -- urban, suburban, rural and tribal communities." Biden's broadband shutout was praised by Mignon Clyburn, co-chair of the Incompas-backed BroadLand campaign. "By taking an all of the above approach to deployment, we can build new future proof networks that benefit all Americans, urban and rural, who need access to low-cost internet solutions," she said. Free State Foundation Senior Fellow Andrew Long said Biden and Congress haven't "paid much attention -- big picture -- to how the various appropriations, agencies, and programs relating to the construction of broadband infrastructure will interoperate in a manner that uses precious taxpayer dollars wisely and efficiently. This must change."

The Utah Senate voted 28-0 Friday to pass a comprehensive privacy bill, about a week after it was introduced and with the legislature planning to adjourn at the end of this week. Industry supports SB-227, which is now in the House (see 2202240003). Nebraska Sen. Mike Flood (R) doesn’t expect his privacy bill (LB-1188) to advance from committee this year but hopes it starts a conversation, Flood told the unicameral legislature's Banking, Commerce and Insurance Committee at a livestreamed hearing Monday. LB-1188 is based on last year’s Uniform Law Commission proposal that hasn’t been implemented in any state, said Flood, acknowledging business and consumer privacy advocate concerns about his bill. Indiana’s Senate-passed SB-358 might have missed a Monday legislative deadline to pass Senate bills in the House. It wasn’t on that day's House calendar. In Washington state, the House Appropriations Committee was to weigh a sweeping amendment Monday -- with a proposed revision -- to HB-1850 that would make the law contingent on the Senate’s Washington Privacy Act (SB-5062) becoming law July 31, 2023. The panel didn’t vote by our deadline. HB-1850 as modified by amendments by Rep. Drew Hansen (D) would set up a state data privacy commission to enforce rules proposed in SB-5062, which regenerated last week (see 2202250017). The amended House bill would include a limited private right of action that would allow consumers to sue only after the commission determines a violation occurred and that the consumer suffered actual damages, meaning demonstrable economic loss or physical harm. Consumers would be able to sue only if the violator fails to comply with the commission's cease and desist order, the amendment said. The amendment also would tweak the proposed commission’s responsibilities and detail a proposed annual fee on processors and controllers. The surcharge would be 0.1% of intrastate gross operating revenue, capped at $10 million yearly. The American Civil Liberties Union, longtime opponent of the Senate privacy bill, is “very concerned that the proposed amendment to HB 1850 references a version of SB 5062 that has not yet been made available to the public,” and that the amended bill could let the privacy commission decide to reject a complaint in private, emailed Jennifer Lee, ACLU-Washington technology and liberty project manager.

The Florida House may vote Tuesday on the comprehensive privacy bill by Rep. Fiona McFarland (R) that cleared the Judiciary Committee last week (see 2202240003). The House added HB-9 Thursday to its Tuesday special order calendar. The bill will be heard Tuesday, confirmed McFarland’s legislative aide Clay Gunter. In Washington state, the Senate resurrected last year’s Washington Privacy Act by Sen. Reuven Carlyle (D). After adding SB-5062 Feb. 17 to the X-File, a list of bills that won’t go to the floor, the Senate moved the bill Thursday to its White Sheet, a list of bills that the Rules Committee can consider for further action. “There are a few steps that the bill would require before it could go to the floor, but we’re monitoring any action on the bill,” emailed Jennifer Lee, American Civil Liberties Union-Washington technology and liberty project manager. Carlyle’s other bill, SB-5813, looks dead, she said. The House’s bill (HB-1850) remains alive and next needs Appropriations Committee approval. The Connecticut Joint General Law Committee on set a March 3 hearing on the state’s comprehensive SB-6 (see 2202170028).

An Ohio House panel split by party as it narrowly advanced a comprehensive privacy bill Wednesday. The Government Oversight Committee voted 7-5 for HB-376 at the measure’s fifth hearing before the panel. All Democratic members voted no. Chairman Shane Wilkin (R) ruled as out of order an amendment by ranking member Richard Brown (D), who sought to remove a restriction on private lawsuits and language giving exclusive enforcement authority to the state attorney general. HB-376 can now be scheduled for a floor vote. In Connecticut, 19 Senate Democrats including Sen. Martin Looney and Majority Leader Bob Duff introduced a one-page privacy bill (SB-6) to raise funding to the attorney general’s office “to increase efforts to protect consumer personal information and data from unwanted sale and dissemination.” Edits to Virginia’s privacy law advanced Tuesday. The House Commerce Committee voted 21-1 for HB-1259, saying data about race, religion, sexual orientation, citizenship and certain other things is sensitive only “when used to make a decision that results in legal or similarly significant effects concerning a consumer.” The Finance and Appropriations Committee voted 13-2 for SB-534 to authorize the AG to pursue actual damages to consumers if a data controller or processor continues to violate the privacy law after the 30-day right to cure ends or if it breaches an express written statement it gave the AG. Also, it would clarify that political organizations are nonprofits exempt from the act. The AG may decide if a cure is possible, it said. And the bill would abolish the consumer privacy fund, placing all money collected by enforcement instead in a different state trust fund. The Florida House Commerce Committee plans a Thursday hearing on a comprehensive privacy bill (HB-9), resurrected from a failed 2021 bill, by Rep. Fiona McFarland (D). A New York state privacy bill advanced Tuesday (see 2202080051).

A proposed New York Privacy Act cleared the Senate Consumer Protection Committee by a 5-1 vote at a livestreamed meeting Tuesday. S-6701 is “all about accountability of social media companies,” said Chairman Kevin Thomas (D), the bill’s sponsor. Sen. James Tedisco (R) was the lone member to vote no during the voice vote. Sen. Mario Mattera (R) voted "aye with reservations." The bill goes next to the Internet and Technology Committee.