Topic · state-privacy

State privacy laws

State privacy laws — CCPA/CPRA, Virginia CDPA, Colorado, Utah, Texas, etc.

RSS feed ↗

trade-press
AI inferences outrun state privacy laws, experts warn
Collection rules miss the thing AI brokers increasingly sell: conclusions about people built from lawful scraps of data.
StateScoop reports that data-privacy experts on a recent panel warned state privacy laws often regulate what data brokers collect and sell, but not the conclusions those companies infer from it. Consumers and state privacy offices get the gap: a law can police the input while leaving the AI-generated profile largely outside the frame.
WED
trade-press
Health groups press cyber funding after Commerce clears Mythos, Fable
Hospitals are treating frontier AI as a funding problem because resilience mandates do not patch rural budgets or clinical downtime.
Health care advocates told Inside Health Policy they want federal cybersecurity funding and guidance after Commerce lifted controls on Anthropic’s Mythos and Fable models. The push targets hospitals, HIPAA covered entities and especially rural providers with scarce resources. Sen. Bill Cassidy’s Health Care Cybersecurity and Resiliency Act is moving as a fiscal 2027 NDAA amendment, while HHS lists HIPAA Security Rule final action for July 2027.
JUL 10
trade-press
Zabierek pushes state software liability for secure-by-design rules
The federal strategy keeps naming manufacturers, but the legal pressure may arrive first from state product and privacy law.
Former CISA secure-by-design co-lead Lauren Zabierek told Inside Cybersecurity that states should explore software liability rules, using privacy and product-liability frameworks to push manufacturers toward secure-by-default development. The argument lands on state procurement offices, legislatures and software vendors, especially around critical infrastructure. Her uncomfortable point is capacity: the Trump resiliency order puts more security and resilience on states she says do not yet have the resources.
JUL 9
judicial
FTC finalizes Illuminate order over student-data breach
The order moves data minimization from privacy housekeeping into the evidence file for school-district security reviews.
The FTC gave final approval to a modified order requiring Illuminate Education to implement a data-security program, limit data collection and retention, and delete unnecessary student data after a breach involving millions of students. EdTech vendors, school-district primes and subcontractors, and assessors reviewing student-data controls now have a clearer FTC enforcement marker. The sharp part is the remedy: excess retention sits inside the security failure, where procurement lawyers can find it.
JUN 5

State privacy laws

AI inferences outrun state privacy laws, experts warn

Health groups press cyber funding after Commerce clears Mythos, Fable

Zabierek pushes state software liability for secure-by-design rules

FTC finalizes Illuminate order over student-data breach