USA – GEORGIA Trends and Developments Contributed by: Jason Loring, Andrew Lee and Lara Sevener, Jones Walker LLP
Jones Walker LLP 1221 Peachtree Street, N.E., Suite 400 Atlanta, Georgia 30361 USA Tel: +1 404 870 7531 Email: jloring@joneswalker.com Web: www.joneswalker.com
Comprehensive privacy legislation: two sessions, no law Georgia remains one of the largest states by popula - tion and economic output, yet lacks a comprehensive consumer data privacy statute. The General Assem - bly advanced such legislation in each of the past two annual sessions, each time falling short in a pattern reflecting sustained tension between a Republican- majority Senate committed to a business-friendly framework modelled after Virginia’s, and a House unwilling to pass it in that form. SB 473 (2024) The Georgia Consumer Privacy Protection Act (SB 473) passed the Senate on 27 February 2024, by a vote of 37–15 and was favourably reported by the House Technology and Infrastructure Innovation Com - mittee on 20 March 2024. The legislature adjourned in late March without a House floor vote, however, and the bill died without becoming law. SB 473 drew sustained criticism from consumer advocates. The Electronic Privacy Information Center (EPIC) assigned it an “F” grade, and the American Civil Liberties Union (ACLU) of Georgia characterised it as protecting technology companies rather than Geor - gia residents. The critiques focused on high applica - bility thresholds limiting coverage, enforcement that was limited to the AG with no private right of action, and provisions that arguably favoured data industry interests over consumer rights. The bill would have applied to entities exceeding USD25 million in annu - al revenue that either (i) processed data of at least 175,000 Georgia residents, or (ii) processed data of at least 25,000 residents while deriving more than 50% of gross revenue from data sales. Civil penal -
Georgia’s Privacy Landscape: Operating Without a Comprehensive Framework As comprehensive data privacy laws proliferate across the United States, Georgia has not enacted one, despite sustained legislative efforts in the 2024 and 2025 sessions that continue in 2026. Georgia’s most ambitious privacy law, the Protecting Georgia’s Children on Social Media Act (SB 351), was signed into law in 2024 but later blocked by a federal court just days before its July 2025 effective date. Mean - while, Georgia’s courts have been developing com - mon law doctrine imposing data protection obliga - tions on organisations in the absence of a statute requiring them. While Georgia has no omnibus consumer privacy statute, organisations operating in the state are not without obligations. The state’s breach notification law applies; evolving common law duties are being estab - lished through litigation; federal sectoral regimes gov - ern healthcare, financial and educational data; and the state attorney general’s (AG) office has maintained an active enforcement posture. For practitioners advis - ing clients with Georgia operations, this convergence of legislative inaction and legal developments across all three branches of government creates a compli - ance environment that is more demanding than it might initially appear. This article examines the key developments: the repeated failure of comprehensive consumer privacy legislation, the constitutional litiga - tion over children’s social media, a landmark com - mon law data breach ruling, the courts’ first encounter with AI-generated legal fabrication, and the state AG’s enforcement activity.
582 CHAMBERS.COM
Powered by FlippingBook