Home / Advocacy and Policy / Residential Policy Issues / State Data Protection Issues

State Data Protection Issues

Share to

MBA is providing this resource center to its member companies, state and local real estate finance associations, and partner trade groups to help engage with state policymakers working to strengthen their consumer data protection laws. As part of this debate, it is important to recognize not just the necessity of sharing and validating data in real estate finance, but to also appreciate that this system is already subject to robust federal consumer protection laws and rules. State data protection bills must not unintentionally impede homeownership. To help inform the policy discussion on these issues, MBA provides suggested legislative language for consideration in state bills and other support materials and information.

Resources:

State Data Privacy

Key

Enacted Data Privacy Law
Amendments to Law Introduced
Active Data Privacy Bill
No Current Activity

2025-2026 Activity Related to Data Protection Issues

  • April 16, 2026: Alabama HB 351 is enacted, exempting entity, affiliate, and GLBA data
  • April 14, 2026: Maine LD 1822 dies in concurrence. The bill, with incomplete industry exemptions (GLBA data and Maine-defined supervised financial institutions), ultimately lost support due to its broad applicability and fear of unintended consequences. 
  • February 23, 2026: Alaska introduces HB 367 which includes an exemption for a person, its subsidiary or data subject to GLBA. This legislation also includes a data broker registry which exempts disclosure within a transaction subject to GLBA. 
  • February 9, 2026: Arizona introduces SB 1815 without industry exemptions. 
  • February 2-6, 2026: Illinois introduces a handful of bills:  SB 3220, exempting GLBA entity, affiliates and data; SB 3890, exempting GLBA data and Banks/CUs; HB 5221, exempting GLBA data and Banks & CUs; SB 3548, exempting GLBA entities, affiliates and data. 
  • February 3, 2026: West Virginia introduces HB 5123 with no exemptions. **WV adjourned without enacting this bill
  • January 29, 2026: Alabama introduces HB 351 which exempts financial institutions, affiliates and data under GLBA.
  • January 16, 2026: Illinois introduces SB 2875, exempting GLBA data + Banks & CUs.
  • January 7, 2026: New York introduces A 8158, S 8524 & A 4947 exempting GLBA entity and data. As well as S 3044 & A 5827 exempting GLBA data only.
  • November 17, 2025: Massachusetts combines drafts of multiple bills into H 4746, exempting GLBA data and Banks/CUs.
  • September 25, 2025: S 2619 passes the Senate in Massachusetts, exempting GLBA data + Banks/CUs.
  • June 5, 2025: Michigan introduces SB 359 which exempts GLBA data as well as "Financial Institutions". Defined in the bill Financial Institutions includes banks, savings and loan associations, and credit unions insured by a federal agency and their affiliates primarily engaging in financial services.
  • May 8, 2025: Montana Governor Gianforte signs SB 297, revising the Montana Consumer Data Privacy Act to remove the entity-level exemption, leaving only depositories and GLBA data exempt.
  • April 29, 2025: HP 1220 / LD 1822 was referred to committee in Maine, exempting GLBA data and "supervised financial organization," which has the same meaning as in Title 9-A, section 1-301, subsection 38-A and "service corporation," which has the same meaning as in Title 9-B, section 131, subsection 37.
  • March 27 & April 9, 2025: Wisconsin introduces SB 166 with GLBA entity, affiliate and data exemption, as well as AB 172 with no exemptions. **Both bills failed to pass before adjournment and cannot be carried into 2027 session. 
  • March 21, 2025: Vermont amends S 71 and expands exemption to GLBA entity and data. Maine carried over LD 1088 / HP 799 with exemptions for GLBA entity, affiliates and data.
  • March 19 & 25, 2025: North Carolina files HB 462 & SB 757 for this legislative session. HB 462 only includes GLBA entity exemption while SB 757 provides GLBA entity, affiliate and data level exemptions. 
  • March 18 & 21, 2025: Pennsylvania introduces HB 78 and SB 112, both including exemptions for GLBA entity, affiliates and data. 
  • February 27, 2025: Vermont introduces a second data privacy bill, S 93,  which includes GLBA entity and data exemptions. 
  • February 25 & 26, 2025: West Virginia introduces additional data protection legislation, HB 2953, with no industry exemptions only to be followed by the introduction of HB 2987, which contains GLBA entity and data exemptions. 
  • February 20, 2025: Connecticut introduces SB 1356 which would remove the GLBA entity level exemption from current law and only provide a data level exemption. 
  • February 18, 2025: Vermont introduces S 71 only providing exemptions for federally or state chartered depositories and GLBA data. **This bill was amended in March 21st
  • February 14, 2025: West Virginia introduces HB 3498 with GLBA entity and data level exemptions.
  • February 13, 2025: Alabama introduces HB 283, a broad data privacy bill with some auto decision restrictions - and the GLBA entity, affiliate and data exemption. 
  • February 12, 2025: New Mexico introduces HB 410 with GLBA entity and data level exemptions while Vermont introduces H 208 only providing exemptions for GLBA data and state or federally chartered depositories and their affiliates. 
  • February 11, 2025: Montana introduces SB 297 which would remove the GLBA entity exemption only for independent mortgage banks, replacing it with GLBA data exemption and an exemption for federally or state charter banks, credit unions, or their affiliates. 
  • February 6, 2025: Illinois introduces HB 3041 with no industry exemptions. 
  • February 5, 2025: Georgia introduces SB 111, a broad data privacy bill that includes a GLBA entity, affiliate and data exemption. 
  • February 2 and 3, 2025: Oklahoma introduces two broad data privacy bills. HB 1012 includes MBA’s model. exemption for GLBA entities, affiliates and data – while SB 546 only includes exemptions for a GLBA entity and data.
  • February 2, 2025: New Mexico introduces HB 307 with no industry exemptions.
  • January 27, 2025: Washington introduces HB 1671, a broad data privacy bill with only a GLBA data exemption. **This legislation was re-introduced/carried over into 2026 session but was not passed. 
  • January 20, 2025: Mississippi introduces SB 2500 with GLBA entity, affiliate and data exemptions while SB 2779 was introduced without any industry exemptions. **Mississippi adjourned without passing either legislation.
  • January 17, 2025: Hawaii introduces SB 1037 with a GLBA data only exemption. Massachusetts files a draft, SD 2355, for a broad data privacy and artificial intelligence bill that only exempts GLBA data.
  • January 13, 2025: Illinois introduces SB 52, exempting only GLBA data.
  • January 8, 2025: New York introduced AB 974, a broad data privacy bill with exemptions for only GLBA data.
  • December 5, 2024: South Carolina prefiles HB 3401 with GLBA entity and data exemptions. 

Data Protection Laws

  1. Alabama Personal Data Protection Act
  2. California Consumer Privacy Act 
  3. Colorado Privacy Act 
  4. Connecticut Data Privacy Act 
  5. Delaware Personal Data Privacy Act
  6. Indiana Consumer Data Protection Act
  7. Iowa Consumer Data Protection Act
  8. Kentucky Consumer Data Protection Act
  9. Maryland Online Data Privacy Act
  10. Minnesota Consumer Data Privacy Act
  11. Montana Consumer Data Privacy Act
  12. Nebraska Data Privacy Act
  13. New Hampshire (SB 255)
  14. New Jersey (SB 332)
  15. Oklahoma (SB 546)
  16. Oregon Consumer Privacy Act
  17. Rhode Island Data Transparency & Privacy Protection Act
  18. Tennessee Information Protection Act
  19. Texas Data Privacy & Security Act
  20. Utah Consumer Privacy Act
  21. Virginia Consumer Data Protection Act

Watch MBA's Liz Facemire Discuss Advocacy and Data Privacy

MAA Social Media Graphic