Avalanche of privacy legislation for US states tightening biometrics rules

The Computer & Communications Industry Association (CCIA) has released its 2023 State Privacy Landscape Report, reviewing the most recent legislative session for U.S. states along with predictions for next year’s advancements in privacy law.

Biometrics providers take note: In 2023, over 140 bills pertaining to consumer data privacy have been introduced across 37 states, while 80 bills were introduced across 33 states last year. The 2023 legislative year also saw a shift from privacy legislation being enacted in predominantly blue states to the addition of red states like Indiana, Montana, and Texas.

Types of data privacy legislation

Because the U.S. lacks a comprehensive federal data privacy framework, states have had to enact their own laws in its absence. Currently, twelve states have implemented comprehensive consumer data privacy laws.

There is, however, a federal standard for handling the data of minors. The Children’s Online Privacy Protection Act set a standard on how children’s data can be used in marketing. However, tech companies would benefit from having more guidance on how to comply with these laws. At a minimum, they should include cure provisions to give companies the opportunity to course correct.

States like Massachusetts, New York, Nevada and Washington have all passed legislation preventing private entities from collecting biometric information without informed consent.

The report notes that drawing a hard line on the use of biometric information except in situations where it is “strictly necessary” could result in consumers being denied access to products and services that incorporate biometrics.

Key states moving toward privacy legislation

Maryland considered a comprehensive consumer data privacy bill that would include biometric data protections but it was not passed. It is expected that conversations will follow into the 2024 legislative session.

Massachusetts has considered multiple bills to give privacy protections for consumer health data and geolocation data. These bills received a hearing in June in the Consumer Protection Committee but have not moved forward in legislation since then. The state’s legislation tends to be more active in the second session year, so it is expected that more progress will be made in 2024.

Maine considered multiple privacy bills in 2023, including two related to health data and one focused on biometric data. The Judiciary Committee has been conducting sessions to decide how to move forward for 2024.

Article Topics

biometric identifiers  |  data privacy  |  legislation  |  Maine  |  Maryland  |  Massachusetts  |  United States