Privacy Daily is providing readers with the top stories from last week, in case you missed them. All articles can be found by searching the title or clicking on the hyperlinked reference number.
Not only has General Motors (GM) and subsidiary OnStar unlawfully collected, processed and sold Nebraskans' sensitive data since 2015, but many residents unknowingly opted in to these data practices, Attorney General Mike Hilgers (R) alleged in a lawsuit against the companies Tuesday. The AG said GM and OnStar violated the Nebraska Consumer Protection Act and Uniform Deceptive Trade Practices Act.
Utah should consider amending its comprehensive privacy law, given the underwhelming number of consumer privacy complaints filed in the statute’s first 18 months, said Attorney General Derek Brown (R) and the Utah Division of Consumer Protection in a report obtained Wednesday by Privacy Daily. “Complaints have not been as forthcoming as anticipated,” it said, but “violations are likely occurring.”
Legislators in Texas, Maryland and Vermont say they will renew bipartisan efforts to regulate AI at the state level after the U.S. Senate on Tuesday dropped its proposed AI moratorium.
A comprehensive privacy law taking effect Tuesday in Tennessee may appear business-friendly compared with similar measures in other states, but privacy lawyers note that it also contains some of the highest penalties for noncompliance. Companies could avoid a Tennessee crackdown by taking advantage of a novel safe harbor in the law, Mintz’s Cynthia Larose told Privacy Daily.
Maine has joined a growing list of states in which comprehensive privacy bills stalled in 2025. However, Rep. Amy Kuhn (D), the Maine Judiciary Committee’s House chair, told Privacy Daily on Thursday that her LD-1822 will return in 2026.
Disclosing private data for certain unlawful reasons will be a crime in Oregon starting next year. Gov. Tina Kotek (D) on Tuesday signed SB-1121, which makes unlawful disclosure of private information a Class B misdemeanor.
Data brokers face new requirements starting Sept. 1 under two Texas bills that Gov. Greg Abbott (R) signed Friday.
Maine is expected to continue consideration of comprehensive privacy legislation in an extended session next week, state Rep. Rachel Henderson (R) told us Friday.
The New York Child Data Protection Act (NYCDPA), which took effect Friday, is unique for many reasons, including its age-flag requirement and because New York lacks a comprehensive law covering users of all ages, experts said in interviews. However, like a good deal of privacy and online safety regulations, it may face legal challenges, said Jason Oliveri, data privacy partner at Hinshaw & Culbertson.