China is increasingly on the minds of state legislators and regulators. Across the country, state legislatures and attorneys general have launched a growing wave of laws, enforcement units, and investigations targeting Chinese influence in American commerce, real estate, technology, and healthcare. The result is a rapidly expanding patchwork of state-level obligations that increasingly complements, and in some respect rivals, federal enforcement activity. Businesses, universities, and individuals with connections to China should not overlook this growing trend.
Link to Florida’s CHINA Prevention Unit: The First China-Specific State Enforcement Unit Florida’s CHINA Prevention Unit: The First China-Specific State Enforcement Unit
The most aggressive state-level initiative to counter China emerged in February, when Florida Attorney General James Uthmeier announced the creation of the Consumer Harm from International Nefarious Actors (CHINA) Prevention Unit. Uthmeier described the unit as the first of its kind in the country. It reallocates existing resources within the Attorney General’s Office to focus exclusively on investigating and prosecuting foreign corporations, particularly those with Chinese ownership or government ties, that collect consumer data from Florida residents.
The CHINA Prevention Unit’s mandate is broad. It is authorized to issue subpoenas, conduct audits, and bring civil and criminal enforcement actions under Florida’s consumer protection statutes. Its stated priorities include data privacy violations, money laundering, and cyber fraud linked to the Chinese Communist Party (CCP) and other foreign adversaries.
Uthmeier identified the health technology sector as the unit’s primary enforcement target, noting that patient data represents “the most sensitive of human data” and that Chinese-manufactured medical devices present unique data exfiltration risks under China’s 2017 National Intelligence Law, which requires China-based entities to cooperate with the government’s intelligence services. As Uthmeier stated in a recent demand letter to a medical device company, the law creates “a permanent backdoor” for the CCP into any entity linked to China.
Enforcement actions have already begun. The unit has issued a subpoena to Shein, the fashion e-commerce company, over alleged deceptive trade practices and data privacy violations affecting Florida consumers. The Attorney General’s Office has also sent at least nine demand letters to medical device companies with alleged CCP ties. Those letters seek information about companies’ connections to the Chinese government and any instances in which they have been asked or compelled to share data, proprietary information, or technical specifications.
This new unit builds on enforcement actions Uthmeier had already initiated, including subpoenas issued to an IT hardware manufacturer and a medical device company. Importantly, the unit’s mandate extends beyond companies located outside the United States to U.S. entities with foreign ownership, control, or data access arrangements. That scope significantly broadens potential exposure for American businesses with international corporate structures and meaningful connections to Florida.
Link to The Legislative Surge: Land, Technology, and Higher Education The Legislative Surge: Land, Technology, and Higher Education
Florida’s CHINA Prevention Unit is the most aggressive example of a much broader trend. During the past five years, more than 30 states have enacted legislation addressing foreign activity in the United States, much of it focused on China. These laws address issues including foreign ownership of land, access to data, and participation in higher education.
Restrictions on foreign ownership of real property have become the most common legislative approach, with activity accelerating into 2025. Of the bills addressing foreign ownership introduced in state legislatures and Congress during that period, nearly two-thirds specifically target Chinese citizens or entities. Florida has already enacted legislation restricting foreign ownership of land. Gov. Ron DeSantis signed SB 26, which prohibits certain Chinese citizens domiciled in China from owning real property in the state.
States have also increasingly targeted Chinese-linked technologies. At least 39 states have enacted some form of restriction on TikTok, including Florida.
Higher education institutions face their own compliance challenges. Florida’s SB 846 prohibits state colleges and universities, as well as their faculty, from accepting certain gifts or grants from or entering into agreements with institutions located in countries of concern. The law applies to individual researchers as well as institutions, creating compliance obligations for academics with international collaborations. It also restricts state institutions of higher education from hiring individuals from countries of concern.
Link to Federal Alignment: DOJ Data Security and the BIOSECURE Act Federal Alignment: DOJ Data Security and the BIOSECURE Act
Florida’s CHINA Prevention Unit was not designed to operate in insolation. Instead, it complements parallel federal initiatives.
The Department of Justice’s Data Security Program, which we discussed in a previous blog post, restricts transfers of sensitive personal data to countries of concern, including China. The program is intended to address concerns that bulk personal data could be used to develop artificial intelligence capabilities, conduct espionage, or identify individuals with sensitive federal government connections.
The BIOSECURE Act, which became law in December 2025, prohibits the federal government from procuring biotechnology equipment or services from designated companies of concern and initially drew its designations from the Pentagon’s list of Chinese military companies. Together, these initiatives represent a significant federal effort that Florida is reinforcing through its own civil and criminal enforcement authority.
Link to Compliance Implications: What Companies Should Do Compliance Implications: What Companies Should Do
- Map Corporate Ownership and Supply Chains: The CHINA Prevention Unit’s jurisdiction extends to U.S. entities with foreign ownership, control, or data access arrangements. Companies, particularly those operating in the health care and consumer technology sectors, should evaluate their corporate structures and global supply chains for connections to entities in China or other designated countries of concern.
- Data Flow Mapping and Disclosure: These developments underscore the importance of understanding where company data is collected, stored, transferred, and accessed. Companies should audit their information technology systems to identify foreign data transfers and ensure that privacy policies accurately disclose whether data is stored on, or accessible through, systems connected to entities in countries of concern. Transparency regarding international data practices is becoming increasingly important.
- Subpoena response: The CHINA Prevention Unit has broad authority to issue subpoenas under numerous Florida statutes and has pursued investigations publicly. Companies with operations in Florida should ensure they can respond promptly and accurately to investigative demands and should consider engaging counsel experienced in both Florida consumer protection law and national security matters.
- Prepare for other state initiatives: Uthmeier has stated that he expects other states to adopt Florida’s enforcement model. Companies should monitor legislative and enforcement developments in every state where they maintain significant operations or customer bases.
Link to Key Takeaways Key Takeaways
Companies with connections to China—whether through ownership, supply chains, data flows, or research partnerships— face an increasingly complex and overlapping set of state and federal compliance obligations. As Florida’s CHINA Prevention Unit demonstrates, state authorities are prepared to use existing consumer protection statutes aggressively and publicly, and other states are likely to follow.
Businesses should prioritize mapping their corporate ownership, supply chains, and data flows for connections to China and other countries of concern; ensuring that privacy disclosures are accurate and complete; and developing the internal processes needed to respond quickly to investigative demands. Given the pace of legislative and enforcement activity, monitoring developments in every state where a company has significant operations or customers will be essential to managing this evolving risk.