US State Privacy Laws in 2026: The In-House Compliance Baseline

The story everyone tells about US privacy in 2026 is a counting exercise: three more states switched on, so we are up to about twenty. That framing is useless to an in-house team. You do not comply with a number. You comply with the strictest requirement you are subject to, on every dimension where the laws disagree, and 2026 is the year those disagreements got sharp enough to break a lazy "we follow CCPA" program.

Here is the real problem. The laws rhyme on the big rights (access, delete, opt out) but split on the mechanics that actually create liability: whether sensitive data needs opt-in consent or an opt-out link, whether you must honor a browser signal you never see in a demo, and whether a violation can be quietly cured or lands as a penalty on first notice. A company selling nationally has to satisfy the toughest version of each, not average them. This guide is about building that baseline, not memorizing statutes.

What actually changed on January 1, 2026

Three comprehensive laws took effect: the Indiana Consumer Data Protection Act, the Kentucky Consumer Data Privacy Act, and the Rhode Island Data Transparency and Privacy Protection Act (Koley Jessen, January 2026). Two of them are unremarkable clones. The third is the one to read.

Indiana and Kentucky copy Virginia, so if your program already meets the Virginia standard, they cost you nothing new. Rhode Island is different in two ways that matter. Its thresholds are low enough to pull in mid-market companies that clear the bar nowhere else, and it has no right to cure. In the cure states, an Attorney General notice is a 30-day repair window. In Rhode Island, the same mistake is a finished violation the day it is found, which changes how you triage incidents: the RI-exposed issue jumps the queue because there is no grace period to fall back on. More lands in July, when Connecticut, Arkansas, and Utah amendments take effect (MultiState).

State privacy laws in 2026: the four mechanics that diverge

Counting states hides the real work, which is reconciling the places the laws disagree. Four dimensions decide your baseline.

1. Sensitive data: opt-in consent vs California's opt-out

This is the split that catches teams that standardized on CCPA. Most of the state laws follow the Virginia model: you need affirmative opt-in consent before you process sensitive data (precise geolocation, health, biometrics, data revealing race, religion, sexual orientation, immigration status). California is the outlier. Under the CCPA as amended, you can process sensitive personal information without prior consent as long as you disclose it and offer a "Limit the Use of My Sensitive Personal Information" link (Greenberg Traurig Data Privacy Dish, 2023).

The practical consequence: a "CCPA-compliant" consent flow that only offers an opt-out link is not compliant in Virginia, Colorado, or the 2026 states. The strict baseline is opt-in. If you collect anything sensitive and you touch consumers outside California, build the consent gate, not the opt-out link.

2. The universal opt-out signal you never see in a demo

The Global Privacy Control (GPC) is a browser-level setting that broadcasts a "do not sell or share" preference automatically. Ten states require businesses to detect and honor it as of January 2026, including California, Colorado, Connecticut, Delaware, Montana, Nebraska, New Hampshire, New Jersey, Oregon, and Texas, with Maryland and Minnesota bringing the total to twelve by mid-2026 (Didomi, 2026). California, Colorado, and Connecticut have confirmed GPC qualifies as that signal.

This is the requirement most in-house teams miss, because it is invisible in the marketing site and in the vendor demo. Nobody clicks it in a walkthrough. It only shows up when a regulator or a plaintiff's lawyer sends a test browser with GPC on and checks whether your ad pixels stopped. California's first public CCPA settlement, a $1.2 million action against Sephora in 2022, turned on exactly this: the retailer did not treat GPC signals as valid opt-outs and did not disclose the "sale" of data. State Attorneys General have since run coordinated GPC sweeps, sending test browsers with the signal on to see whose ad tags keep firing. If your consent-management platform is not configured to read GPC and suppress the sale-and-share tags, you are non-compliant in ten-plus states and you will not know until someone tests you.

3. Cure periods: warning vs penalty

Whether a violation can be fixed after notice varies, and it is quietly one of the most important facts for incident response. Indiana and Kentucky give 30 days. Several early states let their cure periods sunset, so they no longer apply. Rhode Island's 2026 law has none at all. Map this before an incident, not during one: the states where you have no cure window are the ones where a data issue is a reportable, penalizable event on day one, so they set your response priority.

4. Who actually enforces

The "each state Attorney General enforces" line is a useful shorthand and wrong in the one state that matters most. California has a dedicated regulator, the California Privacy Protection Agency (CPPA), that enforces alongside the Attorney General and writes its own rules (CPPA). That means California produces active rulemaking and administrative enforcement, not just occasional AG suits, so it is the jurisdiction whose interpretations you track most closely. Everywhere else, enforcement runs through the state Attorney General (in some states a consumer-protection division), usually with the cure period as a buffer.

Who is covered, and where teams mis-scope

Coverage turns on thresholds (the Virginia model is 100,000 consumers, or 25,000 with half of revenue from selling data; Rhode Island reaches lower). But the raw consumer count is where in-house teams most often get scoping wrong, in four predictable ways.

B2B and employee data. Most state laws (the Virginia model) exclude business-contact and employee data. California does not, so a B2B company can be out of scope in Virginia and squarely in scope in California for the same records.

Nonprofits. Most laws exempt nonprofits, but Colorado, Delaware, New Jersey, and Oregon pull some in. Do not assume a blanket carve-out.

HIPAA and GLBA exemptions are not uniform. Many Virginia-style laws exempt covered entities at the entity level (the whole company). Others, like Colorado, exempt only the regulated data itself, so the rest of your processing stays in scope.

Florida is a red herring. Florida's law is narrow, aimed at very large companies, so doing business in Florida rarely means being subject to it. Do not treat it as a general consumer-privacy statute.

Scope each state on its own exemptions, not on the consumer count alone.

The 2026 operating baseline, as a matrix

Turn the divergences into one program built to the strictest column. This is what a defensible national baseline looks like.

Where in-house teams actually fail (and it is rarely the statute)

The gap is almost never "we did not know California existed." It is operational, and it is the same five failures across small legal teams.

Marketing ships the pixel before legal sees it. A growth team adds a new ad or analytics tag, it starts sharing data, and there was no privacy review. This is the single most common source of a "sale or share" violation, and it happens because the tag lives in a marketing tool the legal team does not watch.

The GPC signal dies at the consent-management platform. The banner looks fine, but nobody configured it to read the browser signal and actually suppress the downstream tags. Compliant on the surface, non-compliant in the network tab.

Vendor DPAs get signed without controller/processor terms. Someone in procurement signs whatever the vendor sends to close the deal, and it is missing the processing instructions, the sub-processor list, or the breach clock. The DPA review field guide is the fix.

DSAR ownership is nobody's job. Requests arrive at a support inbox, sit, and blow the deadline. A rights request with no named owner and no calendar is a violation waiting for a slow week.

The opt-out link does not sync with the ad-tech stack. A consumer opts out, the preference is recorded in one system, and the ad platforms never hear about it. The promise on the page and the behavior of the pixels do not match.

None of these is a statutory subtlety. They are the seams between legal, marketing, and procurement, which is exactly where a in-house team has the least coverage.

The operating checklist (owner, artifact, deadline)

A checklist is only useful if each line names who owns it and what evidence survives an Attorney General request. Build it this way.

• Data map of where you have consumers. Owner: legal ops. Artifact: a current inventory of what you collect, where, and which vendors touch it. Assume national scope and build to the strict baseline.
• GPC honored end to end. Owner: legal plus web/marketing. Artifact: a documented test showing GPC-on suppresses the sale/share tags in the network tab. Re-test after any tag change.
• Sensitive-data consent gate. Owner: product. Artifact: the opt-in flow and a log of consent, not just a privacy-policy paragraph.
• DSAR process with a clock. Owner: a named person. Artifact: an intake, a log, and proof each request closed inside the deadline.
• DPIA on file for high-risk processing. Owner: legal. Artifact: the written assessment for targeted ads, sale, and profiling, kept current.
• Vendor DPAs on standard terms. Owner: legal. Artifact: signed DPAs run against your template, not the vendor's, with the sub-processor and breach clauses checked.

The test for each line is simple: if an AG asked for proof tomorrow, could you produce the artifact, dated? If the answer is a Slack search and a hope, that line is not done.

This is recurring, checklist-driven, evidence-producing work, which is where AI earns its place. In Vaquill AI, a compliance check runs a policy or contract against frameworks like CCPA and GDPR and flags the gaps, and contract review pulls the DPA and data clauses out of inbound vendor paper so the controller/processor terms and breach clock get read every time. For the broader picture, see AI compliance checks for CCPA, GDPR, and SOX.

FAQ

How many states have consumer privacy laws in 2026? About 20 states have comprehensive consumer privacy laws in effect after Indiana, Kentucky, and Rhode Island took effect January 1, 2026. The exact count depends on how you treat narrower and sector-specific laws, but for a national compliance program the number matters less than building to the strictest requirement across them.

What is the hardest part of complying with US state privacy laws? Reconciling the mechanics that differ: opt-in versus opt-out for sensitive data, honoring the Global Privacy Control signal, differing cure periods, and California's separate regulator. A program built to the strictest version of each covers the map; one built to a single state's rules leaves gaps.

Do I have to honor Global Privacy Control? Yes, in twelve states as of 2026 (ten from January 1), including California, Colorado, Connecticut, Texas, Oregon, and New Jersey, with Maryland and Minnesota adding it in July 2026. Your consent-management platform must detect the signal and actually suppress the sale-and-share tags, which is a common failure point that regulators test for.

Is opt-in consent required for sensitive data? Under the Virginia model that most states follow, yes: you need affirmative opt-in consent before processing sensitive data. California is the exception, using a disclosure plus a "limit the use" opt-out instead. The safe national baseline is opt-in.

Why does Rhode Island's 2026 law matter more than Indiana's or Kentucky's? Rhode Island has lower coverage thresholds, so it catches mid-market companies, and it has no cure period, so a violation is penalizable on first notice rather than fixable in 30 days. Indiana and Kentucky are Virginia clones that a compliant program already satisfies.

Is there a federal US privacy law? No comprehensive federal consumer privacy law exists as of 2026. Compliance is the growing state patchwork, plus sector-specific federal rules like HIPAA for health data and GLBA for financial data, which also carry their own exemptions from the state laws.

Who enforces state privacy laws? Each state's Attorney General, with per-violation penalties. California is the exception: the California Privacy Protection Agency enforces and makes rules alongside the AG, which is why California drives most of the active interpretation you need to track.

Start free trialBook a demo

For more, see AI compliance checks for CCPA, GDPR, and SOX, the DPA review field guide, and legal AI for in-house counsel.

Arshita Anand

Co-Founder & CEO · Attorney

Arshita leads product and strategy at Vaquill, building the legal AI suite that solo, small-firm, and in-house US lawyers use to run a matter end to end.