Twenty-Four States Now Have Comprehensive Consumer Privacy Laws

In the absence of congressional action, states have continued to serve as laboratories for consumer privacy laws. After a year in which no states enacted new comprehensive consumer privacy laws, four joined the ranks this year: Alabama (AL HB 351), Louisiana (LA SB 386), Oklahoma (OK SB 546), and Vermont (VT SB 71). That brings the total to 24 states, depending on whether Florida's law, which applies to a narrow set of businesses, is included.

Massachusetts could still join them. Each chamber has passed a version of a privacy bill (MA S 2619), with a conference committee working this fall to resolve differences between the two versions. The House version would allow consumers to sue for violations against large data holders, a significant departure from the attorney general enforcement model used in most states.

Which States Enacted New Privacy Laws in 2026

Additionally, states with existing laws continued to amend provisions, including Connecticut (CT SB 4), Delaware (DE HB 380), Kentucky (KY HB 692), Maryland (MD HB 711), New Hampshire (NH HB 1460), and New Jersey (NJ A 5328). The new laws and amendments enacted in 2026 reflect five trends: broader coverage, restrictions that go beyond consent, expanded consumer rights, greater scrutiny of how data is used, and more data broker registration.

Broader Coverage Thresholds Extend Privacy Obligations

Lawmakers are extending privacy obligations to more businesses and more categories of information. Some are lowering numerical thresholds or using creative ways to define the scope. Alabama's new law sets relatively low coverage thresholds, applying to businesses that control or process more than 25,000 consumers' personal data or derive at least 25 percent of gross revenue from personal data sales. However, it exempts businesses with fewer than 500 employees that do not sell personal data.

Delaware lawmakers lowered the law's principal coverage threshold from 35,000 to 10,000 consumers. They also lowered its data-sales threshold from 10,000 to 5,000 consumers for businesses deriving more than 20 percent of gross revenue from personal data sales. Vermont's new law takes a different approach. It covers businesses that control or process at least 35,000 consumers' personal data, but instead of using a revenue-based test, they use separate thresholds covering businesses that process at least 3,000 consumers' sensitive data or sell at least 3,000 consumers' personal data.

Greater Protections for Sensitive Data

States are also providing stronger protections for sensitive data, information that can include health information, precise geolocation, biometric and neural data, financial account information, and information revealing a person's race, religion, sexual orientation, or immigration status. Concerns about government access to commercial data, including its use in civil immigration enforcement, have helped drive this debate. Maryland's amended privacy law restricts certain sales to government units involved in civil immigration enforcement.

Moving Beyond Consent to Outright Sales Bans

Increasingly, lawmakers are moving beyond requiring consent to prohibiting certain sales altogether. This shift reflects concerns that consumers may not fully understand how their information could be used or who could ultimately obtain it, particularly when sensitive data changes hands multiple times. Under this approach, consent alone is insufficient to justify sales that lawmakers consider especially risky. Connecticut and Virginia prohibit sales of precise geolocation information, regardless of consent. New Jersey's amendments prohibit the sale of sensitive data regardless of consumer consent, extending the ban even to businesses that fall below the privacy law's coverage thresholds.

California Gov. Gavin Newsom (D) bucked the trend by vetoing a bill (CA AB 1542) that would have banned selling or sharing sensitive data with a third party. In his veto message, he cited potential "unintended consequences" and warned enforcement measures would strain the budget.

Expanding Definitions of Sensitive Data

States are also broadening the definition of sensitive data under privacy laws. Delaware expanded its definition to include certain financial information, government identifiers, neural data, and inferences that reveal sensitive characteristics. For retailers, this means ordinary purchase data can qualify as sensitive when used to infer a customer's health condition or pregnancy, requiring additional protections.

Expanding Consumer Rights

Most state privacy laws have a familiar template of consumer rights — rights to access, correct, delete, and obtain copies of personal data, as well as opt out of certain processing. Vermont adds a right to obtain a list of third parties to whom personal data has been sold, similar to provisions already in law in Connecticut, Oregon, and Minnesota. Consumers may understand what a business collects while knowing little about where that information goes.

Delaware lawmakers added a right to see inferences a business has drawn about consumers and whether their data is being used for certain consequential profiling. Connecticut lawmakers amended their privacy law to strengthen deletion rights involving profiles assembled from publicly available information. Although public information generally falls outside comprehensive privacy protections, businesses cannot necessarily rely on that exclusion when using it to build profiles or draw inferences. These changes reflect greater scrutiny of the ever-growing practice of building consumer profiles.

Scrutiny of How Data Is Used

Lawmakers are holding businesses more accountable for what happens after they collect and disclose personal data. Delaware lawmakers added a provision that requires controllers to conduct reasonable due diligence on third parties receiving that data and enter into binding contracts governing its use and protection. California already requires contracts for third-party data sales and sharing and considers due diligence in determining liability, but Delaware now makes that diligence an explicit obligation.

Surveillance Pricing and Algorithmic Decision-Making

Lawmakers are increasingly scrutinizing how businesses use personal data to make decisions about consumers. Surveillance pricing drew significant attention, but debates over preserving loyalty programs, coupons, and ordinary price changes complicated efforts to regulate it. Lawmakers enacted bills in Connecticut (CT HB 5563), Maryland (MD HB 895), and New Jersey (NJ A 4085), with New York lawmakers approving a bill (NY A 9349/S 8623) that would replace the disclosure law enacted last year with a ban on using an algorithm that uses personal data to offer different prices to different customers for the same goods.

States also advanced measures regulating how data is used in algorithms and automated decision-making technology. Beginning in 2027, Colorado's revised AI law (CO SB 189) will regulate automated technology that materially influences consequential decisions. Delaware will require more detailed assessments of consequential profiling, including the data used, system outputs, risks, performance measures, and limitations.

Data Broker Registration

Data broker registration is expanding as well. Connecticut (CT SB 4) and New Jersey (NJ A 5328) joined California, Oregon, Texas, and Vermont in requiring registration. Connecticut requires disclosures about broker practices, including their handling of minors' information, precise location, and reproductive or sexual health data. New Jersey also reaches certain data collectors that sell information, meaning a direct customer relationship does not automatically eliminate registration obligations.

Centralized Deletion Mechanisms

Registration is increasingly linked to centralized deletion. Under California's 2023 Delete Act (CA SB 362), registered data brokers are now required to access the state's Delete Request and Opt-out Platform, or DROP, at least every 45 days to retrieve and process deletion requests. Consumers can use the platform to submit one request covering registered brokers rather than contacting each individually.

Other states are looking to California as a potential model to emulate. Connecticut lawmakers directed the creation of a universal deletion mechanism by 2028. Vermont lawmakers approved a feasibility study (VT SB 70) to determine if they could create a similar mechanism, with California officials expressing a willingness to work with other states.

Looking Ahead to 2027

Consumer data increasingly powers algorithmic decision-making, inviting closer scrutiny of how businesses collect and use it. As consumers turn to AI chatbots and generative AI services, lawmakers are likely to focus on whether conversation logs can be used for targeted advertising and other commercial purposes. Children's privacy also continues to be a major concern, with many state AGs filing actions against businesses for mishandling data or misleading consumers about privacy practices.

Many of the strongest consumer protection proposals have emerged in Democratic-led states, making November's elections a potential turning point. Democratic gains could revive stalled proposals and broaden support for stronger protections. The next debate may center less on establishing privacy rights than on making them easier to exercise and harder for businesses to sidestep.

Tracking State Technology and Privacy Legislation

MultiState's team is actively identifying and tracking technology and privacy issues so that businesses and organizations have the information they need to navigate and effectively engage. If your organization would like to further track these or other related issues, please contact us.

Frequently Asked Questions