Technology & Privacy
Twenty-Four States Now Have Comprehensive Consumer Privacy Laws
October 28, 2026 | Max Rieper
Four states enacted comprehensive consumer privacy laws in 2026, bringing the total to 24 states with such protections. Alabama, Louisiana, Oklahoma, and Vermont joined the ranks this year, while Massachusetts lawmakers continue working on a bill that would allow consumers to sue large data holders for violations. States are moving beyond consent requirements to prohibit certain sales of sensitive data altogether, reflecting concerns that consumers may not fully understand how their information could be used. Connecticut and Virginia now ban sales of precise geolocation information regardless of consent, while New Jersey prohibits the sale of sensitive data even with consumer consent. Delaware lowered its coverage threshold from 35,000 to 10,000 consumers and expanded consumer privacy rights to include viewing inferences drawn about them and whether their data is used for consequential profiling. The state also requires controllers to conduct reasonable due diligence on third parties receiving personal data. Data broker registration requirements expanded as Connecticut and New Jersey joined California, Oregon, Texas, and Vermont in requiring registration. Connecticut's law requires disclosures about broker practices involving minors' information, precise location, and reproductive or sexual health data, while lawmakers directed the creation of a universal deletion mechanism by 2028. Colorado's revised AI law will regulate automated technology that materially influences consequential decisions beginning in 2027, while several states advanced measures addressing surveillance pricing and algorithmic decision-making. Connecticut, Maryland, and New Jersey enacted bills regulating how businesses use personal data to make pricing decisions.
