US State Privacy Laws in 2026: The In-House Compliance Baseline

The story most people tell about US privacy is a counting exercise: another state switched on, so the map is bigger. That framing is useless to an in-house team. You do not comply with a number. You comply with the strictest requirement you are subject to, on every dimension where the laws disagree, and 2026 is the year those disagreements got sharp enough to break a lazy "we follow CCPA" program.

Here is the real problem. The laws rhyme on the big rights (access, delete, opt out) but split on the mechanics that create liability: whether sensitive data needs opt-in consent or only an opt-out, whether you must honor a browser signal you never see in a demo, and whether a violation can be quietly cured or lands as a penalty on first notice. A company selling nationally has to satisfy the toughest version of each, not average them. This guide is about building that baseline, not memorizing statutes.

Reviewed and corrected on 12 October 2026. This is general information, not legal advice; check the cited statute or regulation before relying on it.

Official text, as of 12 October 2026

Rhode Island. R.I. Gen. Laws 6-48.1-8(b): "The attorney general shall have sole enforcement authority of the provisions of this chapter ..." The section has no cure-period language. Source: the Rhode Island General Assembly's statute page, read on 12 October 2026.

California. 11 CCR 7200(b): "A business that uses ADMT for a significant decision prior to January 1, 2027, must be in compliance with the requirements of this Article no later than January 1, 2027." Source: the CCPA regulations effective January 1, 2026 on the California Privacy Protection Agency's site, read on 12 October 2026.

What changed in 2026. Indiana, Kentucky and Rhode Island took effect on January 1. The CPPA's risk assessment, cybersecurity audit and ADMT regulations took effect the same day. Connecticut's expanded law took effect July 1 (Public Act 25-113) and more changes follow on October 1 (Public Acts 26-64 and 26-100). New Jersey amended its law on January 20 (P.L. 2025, c. 367). Oklahoma, Alabama, Louisiana and Vermont each enacted a comprehensive law that starts in 2027 or 2028.

What actually changed on January 1, 2026

These comprehensive laws took effect: the Indiana Consumer Data Protection Act, the Kentucky Consumer Data Privacy Act, and the Rhode Island Data Transparency and Privacy Protection Act. Two of them are unremarkable. Rhode Island's is the one to read.

Indiana and Kentucky copy Virginia's design, so a program that already meets the Virginia standard costs you little there. Kentucky also has a second act to plan for: 2026 Ky. Acts ch. 118 (HB 692), signed April 13, 2026, takes effect July 1, 2027 and amends the controller duties and definitions (it adds rules on "automatic content recognition data," the viewing data smart TVs collect).

Rhode Island is different in two ways. Its thresholds are low enough to pull in mid-market companies that clear the bar in few other places, and its enforcement section has no right to cure. In a cure state, an Attorney General notice is a repair window. In Rhode Island the same mistake is a violation the day it is found. Rhode Island also adds a fine of $100 to $500 for each intentional disclosure of personal data to a shell company or in violation of the chapter (6-48.1-8(a)), and a separate duty in 6-48.1-3: any commercial website with Rhode Island customers must designate a controller, and a site that collects, stores and sells personal data must post disclosures about the categories it collects and the third parties that buy it.

State privacy laws in 2026: the four mechanics that diverge

Counting states hides the real work, which is reconciling the places the laws disagree. Four dimensions decide your baseline. For a state-by-state table with citations, see State Privacy Laws: Which States Have One and Where to Read It.

1. Sensitive data: consent, notice and opt-out, or a right to limit

Most of the statutes read for this guide require consent before you process sensitive data: Connecticut (Conn. Gen. Stat. 42-520), Indiana, Kentucky, Montana (30-14-2812), New Jersey (C.56:8-166.12), Oregon (ORS 646A.578(2)(b)), Rhode Island, Texas (541.101(b)(4)) and Virginia (59.1-578(A)(5)). Iowa and Utah are the exceptions: they let a controller process sensitive data once it presents clear notice and an opportunity to opt out (Iowa Code 715D.4(2), Utah Code 13-61-302(3)).

California uses a third model. A business may use sensitive personal information without prior consent, but a consumer can direct it to limit that use to what is needed to provide the requested service (Civ. Code 1798.121, 11 CCR 7027). That is why a "CCPA-compliant" flow that offers only an opt-out link is not enough in Connecticut, Texas or the 2026 states. If you collect anything sensitive from consumers outside California, build the consent gate, not just the link.

Connecticut tightened this from July 1, 2026. Under Public Act 25-113 a controller may not process sensitive data unless the processing is reasonably necessary for the purposes disclosed and the consumer has consented. Virginia added a ban on selling precise geolocation data in 59.1-578(A)(6) through 2026 Va. Acts ch. 820; the act sets no other date, so under Va. Code 1-214(A) it took effect on July 1, 2026. Oregon (HB 2008, effective January 1, 2026) bars selling precise location data and the data of consumers under 16.

2. The opt-out signal you never see in a demo

A browser-level opt-out preference signal, of which the Global Privacy Control (GPC) is the best known, tells every site a visitor visits that they opt out of targeted advertising and the sale of their data. No statute uses the name "GPC," and no statute gives a head count of states. What the statutes say differs by state, so read the mechanism, not a tally.

Explicit opt-out preference signal clauses. Colorado required it from July 1, 2024 (SB 21-190, C.R.S. 6-1-1306). Connecticut, Montana and New Hampshire from January 1, 2025 (Conn. Gen. Stat. 42-520; Mont. Code 30-14-2809(3)(b); RSA 507-H:6). New Jersey from six months after its January 2025 effective date (C.56:8-166.11), which is mid-July 2025. Minnesota from its July 31, 2025 effective date (325M.14). Delaware from January 1, 2026 (6 Del. C. 12D-106). Oregon from January 1, 2026 (ORS 646A.578(5)(c)). California's regulations require a business that sells or shares personal information to treat a qualifying signal as a valid opt-out (11 CCR 7025).

Authorized-agent clauses. Texas (541.055(e), from January 1, 2025), Montana (30-14-2809), Nebraska (87-1111), Colorado (6-1-1306), New Hampshire (507-H:5), Minnesota (325M.14) and Delaware (12D-105) let a consumer designate an agent, and the statutes name tools such as a link, a browser setting or extension, or a global device setting. Maryland (Com. Law 14-4706) names the same tools; its 14-4707(f)(3) lists an opt-out preference signal as one allowed way to offer opt-out, not a mandate. Rhode Island (6-48.1-6) lets an agent opt out for a customer without naming the tool. A controller must honor the request if it can verify the consumer and the agent's authority; Texas adds exceptions, such as a request that is not clear and unambiguous.

What is next. California's Opt Me Out Act (AB 566, Stats. 2025, ch. 465, Civ. Code 1798.136) becomes operative January 1, 2027 and bars a business from developing or maintaining a browser without a setting that sends the signal.

Regulators do test this. On August 24, 2022 the California Attorney General announced a $1.2 million CCPA settlement with Sephora. The Attorney General alleged that Sephora failed to disclose that it sold personal information, failed to process opt-out requests sent through global privacy controls, and did not cure within the 30-day period (press release). On September 9, 2025 the California Attorney General, the California Privacy Protection Agency and the Colorado and Connecticut Attorneys General announced a joint sweep sending letters to businesses that did not appear to honor GPC opt-outs (press release). On February 11, 2026 the California Attorney General announced a $2.75 million settlement with Disney over opt-out requests that did not stop sale or sharing across every device and service on a consumer's account, which the office called the largest CCPA settlement to date at that time (press release).

This is the requirement most in-house teams miss, because it shows up in the network tab, not in the privacy policy. If your consent-management platform is not configured to read the signal and suppress the sale-and-share tags, you are out of compliance in every state that requires it, and you will not know until someone tests you.

3. Cure periods: warning or penalty

Whether a violation can be fixed after notice varies, and it is one of the most useful facts for incident response. The table reflects the statutes as read on 12 October 2026.

Map this before an incident, not during one. The states where you have no cure window are the ones where a data issue is penalizable on day one, so they set your response priority.

4. Who actually enforces

"Each state Attorney General enforces" is a useful shorthand and wrong in several states. California has a dedicated regulator, the California Privacy Protection Agency, with administrative enforcement and rulemaking, alongside the Attorney General's civil actions (Civ. Code 1798.155, 1798.199.90). Colorado gives enforcement to the Attorney General and district attorneys (6-1-1311). Florida's enforcer is the Department of Legal Affairs (501.72). Delaware's is its Department of Justice (12D-111). Maryland enforces through its general consumer protection law, Title 13 of the Commercial Law Article (14-4713). Everywhere else in the statutes read here, enforcement sits with the Attorney General, usually with a cure period as a buffer where one exists.

California is also where the rules are moving.

California's 2026 rules: risk assessments, audits and ADMT

The CPPA board adopted new CCPA regulations on July 24, 2025. The Office of Administrative Law approved them on September 22, 2025, and they took effect on January 1, 2026 (CPPA rulemaking page). Three parts matter to an in-house team.

• Risk assessments (11 CCR 7150 to 7157). A business must assess before selling or sharing personal information, processing sensitive personal information, using ADMT for a significant decision, and several other listed activities. For processing that began before 2026 and continues, the assessment is due by December 31, 2027 (7155(b)). Submissions to the Agency for assessments conducted in 2026 and 2027 are due by April 1, 2028 (7157).
• Cybersecurity audits (7120 and 7121). The duty applies to a business that derives 50% or more of its revenue from selling or sharing personal information, or that meets the revenue threshold and processed the personal information of 250,000 or more consumers or households, or the sensitive personal information of 50,000 or more consumers. First audit reports are due April 1, 2028 (2026 revenue over $100 million), April 1, 2029 ($50 million to $100 million) and April 1, 2030 (under $50 million).
• Automated decision-making technology (7200 to 7222). ADMT means technology that uses computation to replace or substantially replace human decision-making. The rules cover a "significant decision," defined as one that results in the provision or denial of financial or lending services, housing, education enrollment or opportunities, employment or independent contracting opportunities or compensation, or healthcare services. Compliance is due by January 1, 2027 (7200(b)), and the rules bring a pre-use notice, an opt-out and a right to access.

The revenue test in the statute is also not $25 million any more. The CPPA adjusted the figure in Civ. Code 1798.140(d)(1)(A) to $26,625,000 effective January 1, 2025 (CPPA notice); the adjustment repeats in odd-numbered years.

Who is covered, and where teams mis-scope

Coverage turns on thresholds, but the raw count is where in-house teams most often get scoping wrong. The Virginia design is 100,000 consumers, or 25,000 with over half of gross revenue from selling data (Va. Code 59.1-576(A)). Rhode Island reaches lower, and Connecticut since July 1, 2026 covers any business that processes sensitive data or offers personal data for sale. There are four predictable mistakes.

B2B and employee data. Virginia and Texas exclude data processed in an employment or commercial context (Va. Code 59.1-575 and 59.1-576(C)(14); Tex. Bus. & Com. Code 541.001(7) and 541.003(15)). California does not: it defines a consumer as a California resident, so a B2B company can be out of scope in Virginia and in scope in California for the same records.

Nonprofits. Virginia, Texas, Iowa, Indiana, Kentucky, Tennessee, Utah, Nebraska, Rhode Island, Connecticut and New Hampshire exempt nonprofit organizations outright. Colorado, Delaware, Minnesota, Montana, New Jersey and Oregon do not give nonprofits a blanket exemption. Colorado and New Jersey have no nonprofit exemption at all; Delaware, Minnesota, Montana and Oregon exempt only narrow groups, such as insurance-fraud nonprofits. Oregon's law has covered 501(c)(3) charities since July 1, 2025.

HIPAA and GLBA exemptions are not uniform. Virginia and Texas exempt covered entities and GLBA financial institutions at the entity level, meaning the whole company. Colorado exempts protected health information as data but exempts a GLBA financial institution or affiliate as an entity (6-1-1304(2)(a), (q)). Connecticut removes its blanket entity-level GLBA exemption from July 1, 2026 and keeps entity exemptions for insurers and for banks and credit unions engaged only in financial activities, on conditions (Public Act 25-113, sec. 7). Delaware's HB 380, signed September 2, 2026, does the same from January 1, 2027: it drops the blanket exemption for financial institutions, keeps exemptions for banks, credit unions, insurers and some securities firms, and leaves data subject to GLBA exempt as data (6 Del. C. 12D-103). Indiana and Kentucky exempt financial institutions and their affiliates at the entity level (Ind. Code 24-15-1-1(b)(2); KRS 367.3613(2)(b)). Read each exemption section; do not assume.

Florida is rarely the answer. Florida's controller definition requires more than $1 billion in global gross annual revenue plus one of three tests: 50% of revenue from online advertising, a smart-speaker service, or an app store with at least 250,000 apps (Fla. Stat. 501.702(9)). A separate section, 501.715, bars any for-profit business that meets the first three elements from selling sensitive data without consent.

Scope each state on its own exemptions, not on the consumer count alone.

The 2026 operating baseline, as a matrix

Turn the divergences into one program built to the strictest column.

Where in-house teams actually fail

The gap is rarely "we did not know California existed." It is operational, and the same failures repeat across small legal teams.

Marketing ships the pixel before legal sees it. A growth team adds a new ad or analytics tag, it starts sharing data, and there was no privacy review. This is a common route to a "sale or share" problem, because the tag lives in a marketing tool the legal team does not watch.

The signal dies at the consent-management platform. The banner looks fine, but nobody configured it to read the browser signal and suppress the downstream tags. Compliant on the surface, non-compliant in the network tab.

Vendor contracts get signed without the statutory terms. Someone in procurement signs what the vendor sends to close the deal, and it is missing the processing instructions, the subcontractor terms or the deletion and return terms. The DPA review field guide is the fix.

Rights requests are nobody's job. Requests arrive at a support inbox, sit, and blow the deadline. A request with no named owner and no calendar is a violation waiting for a slow week.

The opt-out does not sync with the ad stack. A consumer opts out, the preference is recorded in one system, and the ad platforms never hear about it. The Disney settlement above turned on the same gap between accounts, devices and services.

None of these is a statutory subtlety. They are the seams between legal, marketing and procurement.

The operating checklist (owner, artifact, deadline)

A checklist only helps if each line names who owns it and what evidence survives an Attorney General request.

• Data map of where you have consumers. Owner: legal ops. Artifact: a current inventory of what you collect, where, and which vendors touch it.
• Opt-out signal honored end to end. Owner: legal plus web and marketing. Artifact: a documented test showing signal-on suppresses the sale and share tags in the network tab. Re-test after any tag change.
• Sensitive-data consent gate. Owner: product. Artifact: the opt-in flow and a log of consent, not just a privacy-policy paragraph.
• Rights-request process with a clock. Owner: a named person. Artifact: intake, log and proof each request closed inside the deadline.
• Written assessment on file. Owner: legal. Artifact: the assessment for targeted ads, sale, profiling and sensitive data, kept current. California businesses add the 11 CCR 7150 calendar.
• Processor contracts on standard terms. Owner: legal. Artifact: signed contracts run against your template, with the subcontractor and deletion terms checked.

The test for each line: if an Attorney General asked for proof tomorrow, could you produce the artifact, dated?

FAQ

How many states have consumer privacy laws? There is no single official count, and sources disagree on which laws to include, so this guide does not give one. Read the table in State Privacy Laws: Which States Have One and Where to Read It for each law's citation and start date. For a national program the strictest requirement matters more than the number.

What is the hardest part of complying with US state privacy laws? Reconciling the mechanics that differ: consent versus notice and opt-out for sensitive data, honoring opt-out signals, differing cure periods, and California's separate regulator and its 2026 rules. A program built to the strictest version of each covers the map; one built to a single state's rules leaves gaps.

Do I have to honor Global Privacy Control? In states with an opt-out preference signal clause, yes: Colorado, Connecticut, Montana, New Hampshire, New Jersey, Minnesota, Delaware, Oregon and California (through 11 CCR 7025). Texas, Nebraska, Maryland and several of the states above let a consumer use an authorized agent, including a browser setting, and require you to honor a verified request. Your consent-management platform must detect the signal and suppress the sale-and-share tags.

Is opt-in consent required for sensitive data? In most of the statutes read for this guide, yes (for example Connecticut, Texas, Virginia and Rhode Island). Iowa and Utah require notice and a chance to opt out, and California uses a right to limit. The safe national baseline is opt-in.

Why does Rhode Island's 2026 law matter more than Indiana's or Kentucky's? Rhode Island has lower coverage thresholds, so it reaches mid-market companies, and its enforcement section has no cure period, so a violation is not fixable in a warning window. Indiana and Kentucky follow Virginia's design, with a 30-day cure.

Do the CPPA's 2026 regulations apply to me? They apply to a business subject to the CCPA. Risk assessments are triggered by activities such as selling or sharing personal information, processing sensitive personal information and using ADMT for a significant decision. Cybersecurity audits depend on revenue and data volume (11 CCR 7120). ADMT rules apply from January 1, 2027.

Who enforces state privacy laws? Usually the state Attorney General. California adds the California Privacy Protection Agency; Colorado adds district attorneys; Florida uses its Department of Legal Affairs; Delaware uses its Department of Justice.

For the US statutes, regulations and court rules these laws sit in, see the US primary law API.

Arshita Anand

Co-Founder & CEO · Attorney

Arshita leads product and strategy at Vaquill AI, the US primary law data API. As an attorney, she decides which law we carry, how each section is sourced and cited, and what legal AI and compliance teams need from the data.