New California laws will ban selling and buying illicitly obtained data, regulate the data practices of direct-to-consumer genetic testing companies, and amend the California Consumer Privacy Act (CCPA), California Privacy Rights Act (CPRA), Confidentiality of Medical Information Act (CMIA), and data breach notification laws.

The Department of Health and Human Services (HHS) has issued Q&A guidance addressing how requirements under the Privacy Rule of the Health Insurance Portability and Accountability of 1996 (HIPAA) apply regarding vaccinations for COVID-19 (the disease that results from SARS-CoV-2). Among other topics, the guidance addresses the ability of HIPAA covered entities and business associates to require employees to disclose whether they have received COVID-19 vaccines.

Previously, New York had protection against unwanted robocalls, but texting was exempted.

The TDPA requires the owners of Class A multifamily dwellings with smart access systems to protect the personal information of occupants by providing tenants with a privacy policy, limiting the right to collect and retain data from smart access systems and from tenants' usage of utilities and internet services, and creating a private right of action for violations.

The new law amends New York's existing right of publicity protections to add a post-mortem right of publicity. This allows a decedent's successor-in-interest to bring an action to protect against commercial exploitation or unauthorized use of the decedent's publicity rights.