HB 2212, titled the "Fourth Amendment is Not for Sale Act," prohibits Tennessee state and local government employees or contractors from purchasing or licensing personal data from companies instead of obtaining a warrant when legally required to do so. It creates a Class B misdemeanor offense for violations, with exceptions for emergency services, preventing imminent danger to individuals or the public, obtaining written consent, or complying with federal law. The law directly affects government entities handling sensitive data, ensuring they follow warrant procedures rather than bypassing them through data purchases. Key provisions clarify that "controller" (data companies) and "sensitive data" follow existing definitions in Tennessee law.
SB 2364 repeals outdated rules transferred from Tennessee's defunct Human Rights Commission to the Attorney General's office and strengthens privacy protections for people filing human rights complaints. The bill requires the Attorney General to keep all complaint records and investigation materials confidential without the filer's consent, except when shared with the complainant, respondent, their attorneys, or law enforcement agencies enforcing anti-discrimination laws. This directly affects individuals who file human rights complaints with the Attorney General’s office by ensuring their personal information remains private during investigations. The key provision prohibits disclosure of complaint materials to anyone else without explicit consent, clarifying existing protections under Tennessee law.
HB 2623 extends the time businesses must provide written responses to consumer appeals under Tennessee's Information Protection Act, increasing the deadline from 60 to 65 days. It directly affects consumers who appeal denied requests for their personal data and the businesses (referred to as "controllers") handling those requests. The bill amends Tennessee Code § 47-18-3304(c) to require businesses to explain their decisions in writing within the new 65-day window after receiving an appeal. This is a procedural change to the state's consumer privacy law, with no broader policy shifts.
HB 2225 creates a state-level "Do Not Call" registry that allows Tennessee residents to opt out of unsolicited telephone solicitations. It restricts automated calls (robocalls) and unsolicited sales calls, particularly during evening hours, and requires businesses to honor consumer opt-out requests. The Tennessee attorney general can enforce these rules, impose court-ordered fines for violations, and maintain the registry with input from federal systems. This directly affects consumers who receive unwanted calls and businesses making phone solicitations in Tennessee.
SB 2519 updates Tennessee's consumer protection laws to allow identity theft complaint submissions (regarding security freezes) via electronic means approved by the Federal Trade Commission and Tennessee Attorney General, instead of requiring only written submissions or website filings. This change directly affects consumers who need to report identity theft or request security freezes. The bill amends multiple Tennessee code sections (including Titles 4, 7, 39, and 47) related to private data protection to align with federal electronic filing standards. The key mechanism replaces restrictive language with flexible electronic submission options through authorized federal channels. This simplifies the process for consumers while maintaining compliance with federal guidelines.
SB 2616 extends the response time for businesses (referred to as "controllers") under Tennessee's Information Protection Act. It increases the deadline from 60 to 65 days for businesses to provide written responses to consumers who appeal a denied request for personal data. The bill requires businesses to explain their decision in writing within this extended timeframe. This change directly affects consumers filing appeals and the businesses responsible for handling those requests.
SB 2395, titled the "Fourth Amendment is Not for Sale Act," prohibits state and local government employees or contractors from purchasing or licensing personal data instead of obtaining a warrant to access an individual's information. It creates a Class B misdemeanor offense for violations, directly affecting government officials who handle personal data under existing warrant requirements. Key exceptions include emergencies (like life-threatening situations), consent from the individual, or federal law mandates. The law amends multiple Tennessee code sections to enforce this requirement, effective July 1, 2026.
HB 2057 requires Tennessee social media platforms to delete all personal information linked to a user's account when that account is deleted. This applies to data collected directly through the account by the account holder or other users, but excludes de-identified data and publicly available information. The law preserves existing data deletion rules under Tennessee's Information Protection Act (TIPA) for users who don't delete accounts, and allows lawsuits for violations with potential damages, attorney fees, and injunctions. The bill takes effect January 1, 2027, impacting both social media companies operating in Tennessee and their users who delete accounts.
HB 1877 prohibits all Tennessee state, county, municipal, and metropolitan government entities from requiring individuals to receive microchips or permanent identification markers as a condition for accessing benefits, services, or assistance programs. It defines "microchip" as a subcutaneous device transmitting personal data via radio frequency and clarifies that voluntary implantation for health-related monitoring or treatment remains permitted. The bill amends multiple Tennessee code sections (Titles 4, 5, 6, 7, 8, 40, 47, 50, and 56) to implement this ban across all government service contexts. This policy directly affects individuals seeking public assistance who might otherwise face forced identification requirements.
HB 1831 prohibits using or selling personal information (like home/work addresses, phone numbers, or Social Security numbers) obtained from Tennessee government records for business purposes. It requires individuals requesting such records to sign an affidavit promising not to commercialize the data. Violating this rule is a Class B misdemeanor punishable by a $500 fine per person affected. The law does not apply if an individual explicitly authorizes the commercial use of their information.
