Government Report - March 2026
March 2026 Report
Privacy, data use and digital advertising remain active areas of legislation nationwide. In Washington, AAF weighed in on proposals involving commercial email rules and consumer data, while continuing to advocate nationally on privacy, advertising taxes, AI and other issues affecting our industry.
Congress Considers Children’s Privacy
The U.S Senate unanimously passed the Children and Teens’ Online Privacy Protection Act (COPPA 2.0). The bill would impose new restrictions on online companies' ability to collect and use data from teens under 17. The legislation would expand the current children's privacy law by prohibiting website and app operators from knowingly serving targeted ads to users under 17 -- including ads based on those teens' online activity. The bill also would prohibit websites and apps from knowingly collecting personal data from users between the ages of 13 and 16 without their consent.
On the other side of the Capitol, the House Committee on Energy and Commerce reported eight pieces of legislation to the full House of Representatives, including the Kids Internet and Digital Safety (KIDS) Act and the App Store Accountability Act. Committee Chair Brett Guthrie announced the committee would not consider COPPA 2.0, saying lawmakers would continue to work toward a bipartisan agreement on the legislation.
Proposed Changes to Maryland Digital Advertising Tax Under Consideration
AAF, joined by AAF Baltimore, AAF Nebraska, and many others, has filed comments with the Comptroller of the Treasury in Maryland regarding proposed regulations to the state’s Digital Advertising Tax, which continues to be challenged in court. The comments argue that the proposed regulations do not reflect the intent of the Maryland General Assembly when it passed the law and would render the DAT unadministrable by creating artificial distinctions among advertisement types.
Indiana Advertising/Services Tax Introduced
Indiana Representative J.D. Prescott (R) introduced legislation to expand the sales tax base to include most services, including advertising. Rep. Prescott is a member of the tax writing House Ways and Means Committee.
Senate President Rodric Bray (R) has expressed the desire to reduce the personal income tax and has suggested that tax on services was “on the table”. However, when both chambers unveiled their 2026 legislative priorities, the sales tax base expansion was not included in either.
While the threat appeared minimal, AAF alerted our Indiana members to the measure advising monitoring, but no engagement unless a serious threat emerged. The legislature adjourned February 27 without passing HB 1288.
Washington Email Marketing Legislation
AAF signed a letter to Washington state legislative leaders in support of legislation that will prevent marketers and retailers from being sued for so-called “deceptive” email subject lines.
As background, in April 2025, the Washington Supreme Court considered a case involving the clothing retailer Old Navy that alleged its emails violated the Commercial Electronic Email Act (CEMA) since they contained false or misleading information about a sale that would last only one week, when in fact it extended into a second week. The Court held that under CEMA, marketers are prohibited from sending Washington residents commercial emails that contain any false or misleading information in the subject line. This expanded the previous view that CEMA only prohibited false or misleading information in the subject line as to the nature of the email as an advertisement. Under the more expansive view adopted by the state Supreme Court, the number of class action lawsuits against email marketers increased dramatically. Numerous major national retailers have been targeted.
SB 5976 would restore the original interpretation of CEMA. It would prevent marketers from sending emails that hide their commercial nature, rather than punishing them for harmless, commonplace marketing language that no consumer relied on or caused them harm. Specifically, the subject line must be likely to mislead a reasonable consumer about a fact material to the transaction and be material to the consumer completing the transaction. There is bipartisan support for the legislation.
Companion legislation has overwhelmingly passed the House of Representatives and is being considered in the Senate.
States Targeting “Surveillance Pricing”
A new trend in many states is to restrict or ban so-called “surveillance pricing,” the use of sometimes personally identifiable information from third parties to inform discounts and loyalty programs.
Rather than strengthening consumer protections, these bills risk higher prices, reduced choice, and fewer opportunities for consumers to benefit from discounts and incentives, while also limiting businesses’ ability to use third party data to offer competitive pricing and promotions.
AAF, often joined by our local chapters, has sent letters in multiple states opposing such measures, such as:
Maryland HB 148 and HB 895. Read the full letters here and here. Joined by AAF Baltimore.
Nebraska LB 1006 Read the full letter here. Joined by AAF Nebraska.
Pennsylvania HB 1942. Read the full letter here. Joined by AAF Pittsburgh and Ad 2 Pittsburgh.
FTC Examining Data Driven Economy
February 26, the Federal Trade Commission conducted a workshop on Consumer Injuries and Benefits in the Data-Driven Economy. The AAF supported Privacy for America submitted comments to the agency highlighting the many consumer and business benefits derived from the responsible use of data. We will remain engaged with P4A, the FTC and Congress to advocate for federal legislation that would clearly define prohibited data practices that make personal data vulnerable to breach or misuse, while preserving the benefits that come from responsible use of data.
State Privacy Action
In the absence of Congressional action, many states continue to look at passing their own privacy laws, some comprehensive and some more narrowly targeted, such as health, location data, or pricing programs. AAF does not support the enactment of any of these laws, believing a single national standard would better serve both consumers and businesses. However, in recognition that many states will pass their own laws, in addition to expressing our opposition we offer suggestions to lawmakers as to how they can make the measures more closely align with existing laws in other states.
Recent comments filed include:
1 12 26 California AB 833 An Act Relating to Data Brokers
We appreciate the Assembly’s focus on protecting personal information and addressing the unique risks faced by elected officials and judges. However, as currently drafted, AB 883 contains provisions that would remove access by elected officials and judges to essential services. In addition, the short five-day timeline for effectuating deletion requests in AB 883 would be an unnecessary burden for well-meaning data brokers endeavoring to comply with applicable laws. Read the full letter.
1 16 16 New Hampshire HB 1460 Prohibiting the Sale and Other Sensitive Data Regarding Children
HB 1460 would prohibit the sale of location and other sensitive data regarding children, but it is misaligned with existing New Hampshire law because it departs from the statute’s “known child” standard and uses the undefined term “location data” rather than the established concept of “precise geolocation data.” Read the full letter.
1 16 26 Vermont H. 211 An Act Relating to Data Brokers and Personal Information
Vermont law defines a data broker as a business that “knowingly collects and sells or licenses to third parties the brokered personal information of a consumer with whom the business does not have a direct relationship.” H. 211’s proposed amendment includes a definition of “direct relationship” that would unreasonably broaden the scope of businesses treated as data brokers, departing from both the existing law’s definition and the Legislature’s clear intent to regulate businesses whose core activity is the sale or licensing of personal data about consumers with whom they lack a meaningful relationship. Read the full letter.
1 21 26 New Hampshire HB 1694 Relative to the Regulation of and Protections for Personal Data Obtained by Websites and Data Brokers.
HB 1694 would significantly expand consumer opt-out rights beyond those provided under current New Hampshire law. The bill would also create a new data broker registry that would require registration by many companies not traditionally considered data brokers, including processors. Read the full letter.
1 29 26 Hawaii SB 1163 Relating to Privacy
SB 1163 would ban routine uses of browser information without consent and deviate from typical data privacy legislation by providing no exceptions. The bill would impede the ad-subsidization of the Internet for Hawaiians, increasing the cost for access to web-based and app-based services, because the bill’s language inadvertently limits responsible digital advertising. Read the full letter.
1 29 26 South Carolina H. 3431 Social Media Regulation Act – Request to Veto
We strongly believe minors deserve meaningful privacy protections supported by reasonable government policies and responsible industry practices. H. 3431, however, raises significant First Amendment concerns for South Carolina minors and businesses alike. The bill would directly harm South Carolina minors by restricting their access to content and information, leaving them at a clear disadvantage compared to their peers in other states. Read the full letter. The bill was signed into law on February 5, 2026.
1 30 26 Washington HB 2483 Creating a Data Broker Registry
If the Legislature chooses to establish a data broker registry, we encourage the Committee to harmonize HB 2483’s requirements with existing state approaches to ensure consistency for businesses operating nationally and to reduce the need for duplicative disclosures, while still achieving transparency goals for consumers. Read the full letter.
2 2 26 Virginia SB 338 Consumer Data Protection Act
SB 338’s prohibition on the sale of precise geolocation data would also have serious and unintended consequences for emergency alerts and public safety communications that Virginians rely on. Location data powers emergency notices, particularly AMBER alerts, severe weather notices, and other time-sensitive public safety messages, allowing these notices to be immediately displayed to users in the impacted area on any device they are using. Read the full letter.
2 4 26 Virginia HB 638 Regulation of Data Brokers
The registry requirements in HB 638 mandate that data brokers annually register with the Secretary of the Commonwealth and disclose information about their business practices. This information is already routinely disclosed by data brokers through their privacy policies and compliance mechanisms under existing state privacy laws, including the Virginia Consumer Data Protection Act (“VCDPA”), which similarly requires public transparency about data collection, sale, and consumer rights. Should the Committee establish a data broker registry, we urge you to align HB 638’s requirements with existing state standards. Read the full letter.
2 5 26 Virginia SB 338 Consumer Data Protection Act
SB 338 would amend the Virginia Consumer Data Protection Act (“VCDPA”) to include an explicit prohibition on controllers from “selling” or offering to “sell” precise geolocation data. If enacted, such an amendment to the VCDPA would deprive Virginia consumers of access to critical services and benefits that depend on location data. Read the full letter.
2 17 26 Maine LD 1822 Online Data Privacy Act
LD 1822 would make the state’s approach to privacy an outlier in ways that would harm consumers and businesses of all sizes. Maine should instead focus its efforts on harmonizing the bill with the approach to privacy in other states. A patchwork of differing privacy standards across the states would create significant costs for businesses and consumers alike. Efforts to harmonize state privacy legislation with existing privacy laws are critical to minimizing costs of compliance and fostering similar privacy rights for consumers no matter where they live. Read the full letter.
2 17 26 Florida SB 482 Artificial Intelligence Bill of Rights
SB 482 would prohibit artificial intelligence (“AI”) technology companies from selling or disclosing personal information unless it is deidentified. This sweeping ban on sales and disclosures of personal information would diverge sharply from Florida’s existing privacy law, the Florida Digital Bill of Rights, which expressly allows the sale or disclosure of personal data subject to a consumer’s right to opt out of the sale or processing of personal data for targeted advertising or other purposes. Read the full letter.
2 20 26 Illinois HB 3494 Health Data Privacy Act
If enacted, the bill would hinder individuals in Illinois from accessing services and burden the operation of many businesses in the state. Our organizations support the enactment of meaningful privacy protections for Illinoisans. However, as presently drafted, HB 3494 would have far-reaching, unintended, and unfavorable consequences for individuals in Illinois and the business community alike. Read the full letter.
2 20 26 Maryland SB 616 Data Broker Registry
SB 616 would create a new registry that would require registration by many companies not traditionally considered data brokers and would not clearly define what the associated fee would be for such companies. Read the full letter.
2 20 26 Minnesota SF 2940 Minnesota Data Privacy Act Modification
SF 2940 would amend the MCDPA by adding a new, overly broad definition of “health data,” which could unintentionally impede Minnesotans from receiving useful and relevant information about products and services they may desire. As defined, the term “health data” would include any information that could possibly be related—however tangentially—to the health of an individual. The definition could be interpreted to include basic data points, such as the fact that an individual purchased non-prescription shampoo for individuals with dry hair at a local grocer, attended a fitness class, or signed up to receive promotional notices about specific clothing or footwear restocks. Read the full letter.
2 23 26 Virginia SB 338 Consumer Data Protection Act
Under the VCDPA, businesses may process or sell precise geolocation data only with a consumer’s consent. SB 338 would go significantly further by effectively prohibiting the sale of precise geolocation data altogether, even where consumers have knowingly and voluntarily consented to such sales. Read the full letter.
2 24 26 Florida SB 482 Artificial Intelligence Bill of Rights
SB 482’s proposed prohibition on certain businesses from disclosing personal information would significantly disrupt standard advertising practices that benefit consumers and contradict the approach of the Florida Digital Bill of Rights. In addition, SB 482’s proposed disclosure requirements for interactions between a user and bot do not clarify whether they apply to businesses that use platforms for advertising or platforms themselves. Read the full letter.
2 24 26 Hawaii SB 1163 Relating to Privacy
The bill would impede the ad-subsidization of the Internet for Hawaiians, increasing the cost for access to web-based and app-based services, because the bill’s language inadvertently limits responsible digital advertising. Read the full letter.
2 24 26 Minnesota HF 2700 Consumer Data Privacy Act
HF 2700 would amend the Minnesota Consumer Data Privacy Act (“MCDPA”) by adding provisions that would significantly frustrate Minnesota consumers and hinder businesses’ attempts to reach them with legitimate and lawful advertising. As presently drafted, the bill would have far-reaching, unintended, and unfavorable consequences for Minnesotans and the business community alike. Read the full letter.
2 24 26 New York “Part AA: Regulation of Data Brokers” in the Fiscal Year 2027 New York State Executive Budget on Transportation, Economic Development and Environmental Conservation
The Act would create new registration requirements for companies in ways that are duplicative of existing laws, are out-of-step with requirements in other states, and would create a significant fiscal burden for the state of New York. Read the full letter.
2 26 26 California CPPA Petition for Rulemaking Regarding Tiered Consent and Minimal Functional Mode for Essential Consumer Devices
The Petition proposes rulemaking that would extend well beyond the scope of rulemaking authority set forth in the California Consumer Privacy Act. Read the full letter.
3 2 26 Virginia SB 338 Consumer Data Protection Act
On behalf of the advertising industry, we write to request that you veto SB 338. SB 338 would amend the Virginia Consumer Data Protection Act (“VCDPA”) to include an explicit prohibition on controllers from “selling” or offering to “sell” precise geolocation data. If enacted, SB 338 would take an overly broad and blunt approach to regulating location data; any specific concerns can be addressed through more tailored legislation that protects Virginians without depriving them of access to important benefits and critical services that rely on such data. Read the full letter.
The AAF protects and promotes advertising at all levels of government through grassroots activities. Our nation-wide network monitors advertising-related legislation on local, state and federal levels. We put our members face-to-face with influential lawmakers while encouraging self-regulation as a preemptor to government intervention, when appropriate of course. To learn more about our advocacy efforts, click here.
