HB 1946, the "Curbing Harmful AI Technology (CHAT) Act," prohibits AI chatbots designed to mimic human relationships (called "companion chatbots") from being made available to minors in Tennessee if they could encourage self-harm, illegal activity, secrecy, or unsafe isolation. It requires companies to display clear disclaimers that the chatbot is not human during use and to notify users every 30 minutes. The bill also mandates that AI chatbots detect suicidal thoughts or self-harm expressions and redirect users to crisis services like the 988 Suicide & Crisis Lifeline. This directly affects companies developing or deploying companion chatbots in Tennessee that interact with minors, excluding standard customer service or internal business AI.
HB 1468 prohibits businesses in Tennessee from setting prices for specific goods or services using "personalized algorithmic pricing" - a practice where algorithms adjust prices based on personal data about individual consumers. The bill directly affects most businesses operating in Tennessee (including retailers, service providers, and online platforms) but excludes insurance companies, financial institutions under federal law, and subscription-based agreements. Violating this rule would be treated as an unfair or deceptive practice under Tennessee's Consumer Protection Act, subjecting violators to existing penalties and remedies like fines or consumer restitution. The law takes effect on July 1, 2026, and does not apply to price adjustments based on factors like mileage or trip duration in ride-sharing services.
SB 1807 prohibits businesses in Tennessee from using computer algorithms to set prices for specific goods or services based on personal data about individual consumers. This directly affects companies like ride-sharing apps, e-commerce platforms, or retailers that adjust prices using personal information such as location, browsing history, or purchase patterns. The bill exempts insurance companies, financial institutions under federal law, and existing subscription agreements. Violations would be treated as unfair business practices under Tennessee’s Consumer Protection Act, subject to penalties and remedies under that law, effective July 1, 2026.
SB 1339 extends the response time for businesses under Tennessee's data privacy law from 45 to 50 days when handling consumer requests for personal data. It specifically amends Section 47-18-3304(b)(2) of Tennessee Code to change the deadline for businesses to inform consumers of their decision to decline action on verified requests. This affects businesses that collect personal information of Tennessee residents and must comply with the Tennessee Information Protection Act. The change will take effect on July 1, 2025.
HB 1316 prohibits the use of digital driver licenses or digital photo IDs for voter identification purposes in Tennessee. The bill amends state law to require physical driver licenses for voting verification, while regulating data handling for digital license systems: it bans geolocation tracking, limits data retention to three days, and restricts biometric data collection (like facial scans) to only verifying identity against a physical license photo. These provisions directly affect Tennessee residents using digital driver licenses for non-voting purposes. The law, effective April 24, 2025, also mandates explicit user consent for biometric data and prohibits selling or sharing such data beyond law enforcement needs.
HB 630 allows Tennessee consumers to appoint an agent (like a family member or advocate) to opt them out of companies processing their personal data. Companies must verify both the consumer’s identity and the agent’s authority before honoring these requests. The bill requires companies to provide clear opt-out links on websites and implement a standardized "preference signal" system by 2026, ensuring consumers can easily opt out of data sales or targeted advertising without default settings. It also addresses conflicts with loyalty programs and clarifies rules around financial incentives for data sharing. The law takes effect July 1, 2025.
SB 195 prohibits vehicle manufacturers, corporations, and third parties from sharing, selling, or distributing a vehicle's driving data without the explicit, written consent of the vehicle owner. It defines "driving data" broadly to include information from sensors, infotainment systems, telematics, and connected devices (like brake events, location, or vehicle health). Entities must disclose how data is collected and obtain annual written consent, with easy mechanisms for owners to revoke permission. The bill does not apply to data shared with government agencies like the National Highway Traffic Safety Administration under federal law. (Note: The bill was withdrawn on February 5, 2025, per recent actions.)
HB 1033 (Tennessee) creates a legal defense for businesses that experience a data breach, provided they maintained a cybersecurity program meeting specific standards at the time of the breach. It applies to "covered entities" - businesses handling personal information, health data, or sensitive restricted information - requiring them to have written security protocols aligned with industry frameworks (like NIST). If compliant, these entities can use this defense against lawsuits alleging negligence in data security, excluding breaches from law enforcement requests or authorized employee transmissions. The bill does not change breach notification rules but offers legal protection for businesses meeting its cybersecurity criteria.
HB 367 (Consumer Protection) prohibits vehicle manufacturers and third parties from sharing, selling, or distributing a vehicle's driving data - including information from infotainment, telematics, or sensors - without the vehicle owner's explicit, written consent. It requires entities to disclose data collection practices to owners, obtain annual consent renewals, and provide an easily accessible way to revoke consent. The bill applies to all vehicle owners in Tennessee and exempts sharing with government agencies like the National Highway Traffic Safety Administration under federal law. The bill was introduced in January 2025 but was withdrawn on February 6, 2025, and never advanced further.
SB 1297 prohibits using digital driver licenses for voter identification in Tennessee, requiring physical licenses instead at polling places. It regulates digital license systems by banning geolocation data collection, limiting data retention to 3 days, and restricting biometric data (like face scans) to verification only. The law affects all Tennessee residents using digital licenses, particularly voters who would otherwise rely on them for ID. It also mandates strict data security and prohibits selling personal information collected through the system.
