USA – GEORGIA Trends and Developments Contributed by: Jason Loring, Andrew Lee and Lara Sevener, Jones Walker LLP
ties ran up to USD7,500 per violation with a 60-day cure period. A notable affirmative defence applied to entities whose privacy programmes conformed to the National Institute of Standards and Technology (NIST) Privacy Framework. Whether NIST alignment would carry persuasive weight in a common law negligence action is a separate and open question. Like other Virginia-model bills, SB 473 excluded employment and business-to-business data from its “consumer” definition, a significant limitation for employers and commercial data operators. SB 111 (2025) The 2025 session brought Senate Bill 111, a sub - stantially similar measure. It passed the Senate on 3 March 2025, by 53–2 and crossed to the House before the 6 March crossover deadline. EPIC again assigned a failing grade; the ACLU of Georgia told a House committee the legislature would be “vot - ing in favour of the worst consumer protection act in the country”. The House withdrew and recommitted the bill on 27 March 2025, and comprehensive pri - vacy legislation died a second time when the Gen - eral Assembly adjourned on 4 April 2025. Whether sponsors will revive SB 111, negotiate amendments or introduce a successor measure is among the most closely watched questions in Georgia privacy law in this first quarter of 2026. Implications for organisations These failures do not leave organisations without data protection obligations in Georgia. The state’s breach notification statute applies; Georgia courts are actively developing common law data protection standards; and federal sectoral regimes – the Health Insurance Portability and Accountability Act (HIPAA), the Gramm-Leach-Bliley Act (GLBA), the Family Edu - cational Rights and Privacy Act apply regardless of the state-law void. Multistate businesses must implement consumer rights mechanisms for California, Virginia, Colorado and other regulated states regardless of Georgia’s posture. The structure of any 2026 succes - sor legislation will shape compliance obligations for healthcare systems, insurers and banks. The critical question is scope: will lawmakers exempt HIPAA-cov - ered entities and GLBA-regulated financial institutions from the statute entirely, or will they adopt narrower carve-outs that protect only regulated data while
leaving other AI-related activities subject to the new law? Organisations in those sectors should track the exemption architecture closely. SB 351 and the Constitutional battle over children’s social media While comprehensive privacy legislation stalled, Geor - gia enacted one of the nation’s most significant chil - dren’s online safety statutes. Governor Brian Kemp signed SB 351 (the Protecting Georgia’s Children on Social Media Act of 2024) on 23 April 2024, to be effective 1 July 2025. The law requires social media platforms to make commercially reasonable efforts to verify the age of account holders and to refuse account services to minors without parental consent. On advertising and data collection, the law is specif - ic: platforms may not display advertising in a minor’s account based on personal information (with age and location as the sole permitted exceptions) and must limit collection and use of personal information from minor accounts to what is adequate, relevant and rea - sonably necessary for disclosed purposes. The law also imposes K–12 school obligations on two tracks. Local governing bodies were required to adopt acceptable-use policies covering student access to obscene materials and content harmful to minors on school equipment by 1 October 2025, and adopt separate social media policies prohibiting student access to social media platforms on school-owned equipment (except under supervised educational use) by 1 April 2026. The State Board of Education could withhold state funding from non-compliant governing bodies. A separate civil liability provision creates dam - ages exposure for commercial entities that distribute material harmful to minors on public websites without performing reasonable age verification, with fines up to USD10,000 per violation; internet service providers, cloud service providers and news-gathering organisa - tions are exempt. Enforcement of the platform-facing requirements rests exclusively with the AG, who may seek damages of up to USD2,500 per violation fol - lowing a 90-day cure period; there is no private right of action. The preliminary injunction On 26 June 2025, just five days before SB 351’s imple - mentation date, Judge Amy Totenberg of the Northern
583 CHAMBERS.COM
Powered by FlippingBook