Technology & Privacy
How State AGs Are Policing Consumer Data Practices
September 18, 2026 | Max Rieper
State privacy law enforcement has accelerated in 2026, with attorneys general using both comprehensive privacy statutes and consumer protection laws to challenge how companies handle personal information. Sensitive data protection regulations are a top priority for state regulators, as shown by recent actions against 23andMe, TaxAct, and GM over improper handling of genetic, financial, and location data. State attorney general privacy actions increasingly target deceptive practices under consumer protection statutes, even in states without specific privacy laws, as demonstrated by Meta's $18 billion settlement over features designed to encourage compulsive use among children. Comprehensive privacy law violations are being enforced more aggressively, with California's Privacy Protection Agency issuing its first fines to data brokers for failing to register under the Delete Act. Consumer protection data practices face scrutiny across multiple states, with Texas Attorney General Ken Paxton leading enforcement actions against Netflix and LG for allegedly misleading consumers about data collection and sharing.
