US state privacy laws have different applicability tests, consumer rights and implementation dates. A business serving people across several states needs to assess those differences before configuring its privacy notices, consent platform and advertising tools.
This tracker separates laws already effective from upcoming laws and selected amendments. It covers nineteen broad state consumer privacy laws already in effect, plus Florida's narrower Digital Bill of Rights, and four enacted laws scheduled for 2027 or 2028. Including Florida produces a count of twenty effective state frameworks; counts that exclude it differ for that reason.
Reviewed on 19 September 2026. The dates below are the initial general effective dates, not a claim that every provision started on that date or remains unchanged. The linked statutes and regulator guidance are the starting points for a business-specific assessment. Sector-specific laws, children's protections, biometric laws and breach notification requirements need separate review.
US state privacy laws already in effect
Each law or guidance link provides an official source. Exemptions, phased obligations and amendments can change the practical result for a particular organisation.
Indiana, Kentucky and Rhode Island are already effective at this article's review date. Their January commencement should not be presented as an upcoming deadline later in 2026.
Upcoming laws and changes to track
A signed law with a future commencement date belongs in a preparation plan, separately from current duties.
| Jurisdiction | Upcoming change | Date and source |
|---|---|---|
| Oklahoma | New consumer data privacy law, SB 546 | 1 January 2027. Oklahoma House announcement |
| Louisiana | New data privacy law, Act 502 / SB 386 | 1 January 2027. Official legislative record |
| Alabama | Personal Data Protection Act, HB 351 | 1 May 2027. Enrolled legislation |
| Vermont | Data Privacy and Online Surveillance Act | 1 January 2028. Act 145 as enacted, section 4 |
| Delaware | Expanded scope and protections under its 2026 privacy legislation | 1 January 2027. Governor's announcement |
| Connecticut | Additional privacy legislation and CTDPA changes | 1 October 2026. Attorney General's deadline notice |
This is a selected change calendar, not an inventory of every privacy-related bill or amendment. Record the enacted text, affected processing, commencement date and an internal owner for each applicable change. A proposal or a draft amendment is not an enacted obligation.
Which state privacy laws apply to your business?
Start with the residents whose data you process and the business activities connecting you to each state. The location of a registered office or server does not answer the entire question. Our CCPA territorial-scope guide explains the California example.
Assess these factors for each law:
- Covered people and activities: consumer, household, employment and business-contact contexts may be treated differently.
- Thresholds and measurement period: check annual revenue, residents' data, sale-related revenue and any excluded transactions.
- Entity and data exemptions: an exemption for particular regulated data is not necessarily an exemption for the whole organisation.
- Special triggers: sensitive information, children, health data and data sales can carry additional obligations.
- Role: responsibilities differ between the organisation deciding the purposes and a processor or service provider acting for it.
Threshold examples that change the answer
Connecticut: from 1 July 2026, its amended scope includes a 35,000-consumer route, a sensitive-data processing route and a personal-data sale route, subject to the statutory wording and exemptions. An older checklist using only the previous 100,000-consumer threshold can miss covered organisations. Current statute, §42-516
Texas: small businesses as defined by the federal Small Business Administration are generally exempt, but a consent requirement for selling sensitive data can still apply. Describing Texas simply as having “no thresholds” misses this distinction. Texas Attorney General's explanation
Nebraska: its applicability test also refers to the federal small-business classification, alongside the other statutory conditions. Check the remaining duties and exceptions before recording a complete exemption. Nebraska §87-1103
Florida: its controller definition is unusually narrow, using a revenue test above $1 billion together with specified business activities. This is why its inclusion changes headline counts. Do not extrapolate that controller threshold to every provision concerning technology or personal data. Florida SB 262
GPC and universal opt-out signals
Global Privacy Control, or GPC, communicates an opt-out preference. Whether a business must honour it depends on the applicable law, covered processing and relevant requirements. The main law's commencement and the signal requirement can have different dates.
For example, Colorado's universal opt-out requirement began on 1 July 2024, while Delaware's began on 1 January 2026. Oregon also requires qualifying opt-out signals from 1 January 2026. Colorado guidance, Delaware FAQs, Oregon guidance
A business can choose a consistent signal-handling policy across its US audience as an operational approach. It still needs to map that policy to the legal rights involved, rather than assuming every state defines sale and targeted advertising identically.
Test the signal through the full flow: browser, consent platform, tags, server destinations and subsequent visits. Receiving a signal without changing the affected processing does not implement an opt-out. See our GPC and universal opt-out guide for the implementation review.
Sensitive data needs its own assessment
A California sale-or-sharing opt-out does not automatically satisfy another state's sensitive-data requirements. Definitions and permitted purposes differ.
Connecticut requires consent for covered sensitive-data processing. Maryland prohibits sensitive-data sales and restricts collection, processing and sharing to what is strictly necessary for a specific requested product or service, subject to the law's scope and exceptions. Consent is not a general override for a prohibition. Connecticut guidance, Maryland guidance
Oregon's 2026 changes include a prohibition on selling precise geolocation data and additional restrictions involving consumers under sixteen. Review these before treating an advertising flow as acceptable merely because a preference centre offers consent. Oregon business FAQs
Our sensitive personal information guide explains the classifications and website examples.
Enforcement and private claims
Avoid treating a regulator's enforcement power, an opportunity to cure a violation and a consumer's right to sue as the same issue.
California's CCPA provides a limited private action for specified security breaches involving covered personal information and the required statutory circumstances. It is not a general right to sue for every CCPA violation. The statute permits statutory or actual damages as specified; describing actual financial loss as universally required is incorrect. California Civil Code §1798.150
It is also incorrect to say that no other state privacy law permits private claims. Washington's separate My Health My Data Act is enforceable through the state's Consumer Protection Act, including private actions subject to the relevant requirements. Washington Attorney General's explanation
Check current enforcement provisions and any expired or discretionary cure periods in the applicable law. A historical opportunity to fix a violation is not a safe implementation deadline.
A practical website compliance review
Use the following as a work plan, then add the requirements from the laws that apply to your organisation.
| Workstream | Evidence to examine |
|---|---|
| Applicability | Resident counts, revenue tests, business activities, exemptions and legal roles |
| Data inventory | Browser and server events, personal-data fields, recipients, purposes and retention |
| Notice | Accurate descriptions of collection, disclosures, rights and contact methods |
| Opt-outs | Sale, sharing, targeted advertising and applicable profiling controls, including recognised signals |
| Sensitive information | Necessary processing, permissions, limitations and prohibited uses |
| Consumer requests | Intake, appropriate verification, response deadlines, exceptions and appeals where required |
| Vendors | Contractual restrictions, recipient roles and actual downstream behaviour |
| Assessments | Applicable risk or data protection assessment duties and records of decisions |
Do not apply one response deadline to every kind of request. An access-request workflow and a browser opt-out can have different requirements. Similarly, offering rights in a form is insufficient if connected systems continue the affected processing.
For an illustrative advertising review, follow a test visitor's journey from the first page load to a sale or targeted-advertising opt-out, a return visit and a server-forwarded conversion. Compare the observed destinations with the intended restrictions. Use synthetic data, and document what changed after the choice.
Our CCPA sale-versus-sharing guide helps classify California advertising disclosures. For implementation support, see CCPA and GPC banners.
FAQ
How many US states have privacy laws in effect in 2026?
This tracker lists nineteen broad consumer privacy laws already effective and Florida's narrower Digital Bill of Rights, making twenty when Florida is included. That count excludes separate sectoral and subject-specific laws. Four additional enacted frameworks listed here are scheduled for 2027 or 2028.
Which state privacy laws took effect on 1 January 2026?
Indiana, Kentucky and Rhode Island introduced their general consumer privacy frameworks on that date. Existing laws also have separate amendments and phased requirements, so a new-law list alone is insufficient for planning.
Does complying with CCPA cover every US state?
No. Applicability, definitions, sensitive-data rules, consumer rights and assessment obligations differ. Reuse shared technical controls where suitable, but assess the relevant state requirements separately.
Does every US state require GPC?
No. Signal obligations vary. Check whether the business and processing are covered and when the relevant requirement began. Businesses may choose broader signal support as a policy, but should not describe that policy as a universal legal mandate.
Are small businesses exempt from state privacy laws?
Not automatically. Some laws use revenue or resident-data thresholds; others use small-business classifications or special processing triggers. An exemption from a general framework also does not remove separate health-data, children's, security or breach-notification duties.
Can a business outside the United States be covered?
Potentially. State-law applicability can depend on doing business in the state, targeting its residents and processing their data under the relevant thresholds and conditions. Review the statutory scope rather than deciding from the office or hosting location alone.
