New Jersey has enacted Bill 332, becoming the 14th state to have a comprehensive state privacy law. The law, effective from January 2025, applies to controllers conducting business in New Jersey or targeting New Jersey residents. It includes obligations for controllers such as data minimization, privacy notice requirements (including a reasonably accessible, clear, and meaningful privacy notice), obtaining consumer consent for sensitive data, and implementing data security practices. The law also introduces a universal opt-out mechanism for targeted advertising or data "sale" and standard consumer rights.

The New York governor proposed a Buy Now Pay Later legislation, introducing a licensing requirement, limiting charges, and requiring an ability-to-repay analysis for BNPL products. The legislation also prohibits confessions of judgment, misleading advertisements, and excessive penalties or fees. It mandates clear disclosure of terms, costs, and the refund process for goods or services purchased with a BNPL loan.

Maryland's legislature is considering a bill, the Maryland Kids Code, that would prohibit companies from spying on minors and using their data for targeted ads or online manipulation. It mandates privacy by design and default for online products and services accessed by children and teens under 18. If passed, companies would be prohibited from profiling children for personalized ads and would be required to enable the highest privacy settings by default. The bill also defines and prohibits the use of dark patterns and other unfair, abusive, or deceptive trade practices.

The Illinois House of Representatives is considering a new privacy law prohibiting dark patterns. The law defines consent as a clear, freely given, specific, informed, and unambiguous act, and explicitly states that consent does not include agreements obtained through dark patterns or deceptive design patterns. Dark patterns are defined as UI designs that substantially subvert or impair user autonomy, decision-making, or choice.

Earlier this month, California introduced Assembly Bill 2863, proposing amendments to the state's Automatic Renewal Law (ARL). If passed, the amendments would impose stricter requirements on disclosures, consent, and cancellation processes. Businesses would be mandated to obtain a consumer's affirmative consent separately from other contract terms for any automatic renewal or continuous service offer, and keep records of this consent for at least three years, or one year after contract termination. The amendments would also prohibit businesses from employing dark patterns in contracts and misrepresenting material facts related to the transaction or the underlying goods or services.