Data privacy news for May

It’s not every month that a new privacy law passes, but in April, we had a new law pass and a new privacy bill get released.

Plus, our podcast (Privacy Lawls) had one of its best months ever in terms of total listens and downloads. We had Jodi Daniels as our guest and You can listen to the episode, where we discuss how to create and implement privacy training the right way (including how to make it fun and engaging) here.

What’s new in privacy? 

Below are some of the most notable news in privacy from this month: 

1. Alabama Personal Data Protection Act (APDPA) signed into law. On May 16, 2026, the Governor of Alabama signed HB 351, enacting the Alabama Personal Data Protection Act, which will go into effect on May 1, 2027. Alabama’s new law will provide residents of the State with privacy rights and will require businesses who need to comply with this law to have a comprehensive and up to date Privacy Policy that includes the required disclosures. Read the Compliance Guide here.
2.  Nebraska passes agricultural data privacy bill. The new law ensures that farmers remain in control of their data. The law required any company seeking access to or use of agricultural data to first enter into a written consent agreement with the producer. Learn more here.
3. AI company deletes 3 million OkCupid user photos and models trained on them. The deletion comes after the FTC settled with OkCupid over privacy violations. The settlement took place because the company provided photos and demographic data of users to train Clarifai’s facial recognition models. Read more here.  
4. Roblox enters into a $10 million settlement with Nevada over children’s safety violations. The settlement stemmed from a lawsuit over claims that the platform lacked basic features to protect children from predators and exploitation. Learn more here. 
5. European Commission’s age verification app ready to be rolled out. The age verification app aimed at supporting the EU Digital Services Act implementation and broader European age-assurance goals is close to being rolled out. Read more here. 
6. Meta sued over AI smart glasses’ privacy concerns. Meta is facing a new class action lawsuit over its AI smart glasses after an investigation by Swedish newspapers found that workers at a Kenya-based subcontractor are reviewing footage from the glasses, which include sensitive content, like nudity, people having sex, and using the bathroom. Read more here. 
7. French DPA releases rules for tracking pixels in emails. CNIL’s guidance states that the use of tracking pixels embedded in emails requires prior consent, subject only to a limited number of narrowly defined exemptions. Learn more here. 
8. Montana Attorney General investigating data practices of car companies. The Attorney General is investigating Ford Motor Company and Stellantis N.V. for allegedly collecting and selling drivers’ vehicle data without adequate disclosure or consent. Read more here. 
9. CalPrivacy launching a roadshop to promote DROP. The roadshow is promoting the Delete Request and Opt-Out Platform that allows residents of California to request their personal information to be deleted from every registered data broker in a single request. Learn more here. 
10. Trader Joe’s settles privacy class action lawsuit for $7.4 million. The lawsuit alleged that the retailer violated federal privacy laws by printing too many credit card digits on customer receipts, which could pose an increased risk of identity theft. Learn more here. 

What privacy bills are we tracking? 

As part of our service, we keep track of privacy bills that would affect the way Privacy Policies are written. Below is our most recent list of privacy bill proposals in the United States. You can access the privacy bill tracker any time on our blog.

• Alaska – AK HB367;
• Arizona – AZ SB1815;
• Illinois – IL SB52;
• Illinois – IL HB3041;
• Illinois – IL SB2875;
• Illinois – IL SB3220;
• Illinois – IL HB5221;
• Illinois – IL SB3548;
• Illinois – IL SB3890;
• Massachusetts – MA SB33;
• Massachusetts – MA SB301;
• Massachusetts – MA SB2619;
• Massachusetts – MA HB4746;
• Michigan – MI SB359;
• Minnesota – MN SB4666;
• New York – NY S4276;
• New York – NY AB5827;
• New York – NY AB974;
• New York – NY AB4947;
• New York – NY SB8524;
• North Carolina – NC – HB462;
• North Carolina – NC – SB757;
• Pennsylvania – PA HB78;
• Pennsylvania – PA SB112;
• Vermont – VT H812;
• Washington – WA HB1671;
• West Virginia – WV HB5123.

Events

Here are some great virtual events that you can attend to learn more about the hottest issues in privacy and meet other privacy professionals: 

1. The Current Status of Privacy Laws in Oregon: Data Brokers and Consumer Privacy – May 4, 2026; 
2. Professor Dan Solove: On Privacy and Technology – May 13, 2026;
3. Cybersecurity and Data Protection for Lawyers and Law Firms – July 16, 2026.

Conclusion

That’s it for privacy-related news for the month of April. Stay tuned for next month as there are rumors that certain privacy bills may get signed into law this month.