Three new state privacy laws took effect in 2026. Here is what starts next.
By Sid Varma, Founder - AllyMatter.com
Published September 26, 2026
The short version
- Indiana, Kentucky and Rhode Island's comprehensive privacy laws took effect on January 1, 2026.
- Rhode Island applies at 35,000 customers, or 10,000 if more than 20% of revenue comes from selling personal data, and its law has no cure period.
- Amendments that took effect in 2026 in Oregon, New Jersey, Virginia, Maryland and Connecticut restrict selling certain data, such as precise geolocation or sensitive data.
- Since July 1, 2026, Connecticut's law applies at 35,000 consumers, or to anyone processing sensitive data or offering personal data for sale.
- Oklahoma and Louisiana's new laws start on January 1, 2027, Alabama's on May 1, 2027 and Vermont's on January 1, 2028.
Three more states started enforcing comprehensive consumer privacy laws on January 1, 2026: Indiana, Kentucky and Rhode Island. Over the year, a run of amendments to older laws also took effect, most of them narrowing what a business may sell. And four states enacted new comprehensive laws in their 2026 sessions.
This page is a dated table to bookmark. Every row is taken from the statute or bill text on the state legislature's own site, or from the state attorney general's own page. California is left out; its regulations have their own article.
Which new state privacy laws took effect in 2026?
Indiana, Kentucky and Rhode Island, all on January 1, 2026. Indiana and Kentucky follow the same pattern: they apply to a business that controls or processes the personal data of 100,000 state residents, or 25,000 residents if more than half its gross revenue comes from selling personal data. Rhode Island reaches much smaller businesses.
| State and law | Applies to (during a calendar year) | Cure period | Maximum civil penalty |
|---|---|---|---|
| Indiana Consumer Data Protection Act, IC 24-15 (SEA 5, 2023) | At least 100,000 Indiana consumers, or at least 25,000 and more than 50% of gross revenue from selling personal data | 30 days after written notice from the attorney general; no end date | $7,500 per violation |
| Kentucky Consumer Data Protection Act, KRS 367.3611 to 367.3629 (HB 15, 2024) | 100,000 Kentucky consumers, or 25,000 and over 50% of gross revenue from selling personal data | 30 days after written notice; no end date | $7,500 per continued violation |
| Rhode Island Data Transparency and Privacy Protection Act, R.I. Gen. Laws ch. 6-48.1 | In the preceding calendar year, at least 35,000 customers (not counting data used only to complete a payment), or 10,000 and more than 20% of gross revenue from selling personal data | None in the statute | Up to $10,000 per violation under the state's deceptive trade practices law, plus $100 to $500 for each intentional disclosure in violation of the act |
The attorney general enforces each of the three laws alone, and none gives consumers a private right to sue. Consumer requests must be answered within 45 days, extendable once by another 45.
Data protection assessments are not retroactive. Indiana's apply to processing "created or generated after December 31, 2025", Rhode Island's to processing "created or generated after January 1, 2026", and Kentucky's to processing "created or generated on or after June 1, 2026".
Kentucky's law was amended before it started, by HB 473 of 2025, which added exemptions for certain health data.
Which amendments to existing laws took effect in 2026?
Nine that we confirmed, in seven states. The common thread is selling: several states now ban the sale of precise geolocation data or of sensitive data outright, with no consent exception. New Jersey's ban applies whatever the size of the business.
| Effective | State and bill | What changed |
|---|---|---|
| January 1, 2026 | Oregon HB 2008 (Or. Laws 2025, ch. 251) | No selling personal data of a consumer the controller knows, or willfully disregards, is under 16, or data that locates a consumer within a radius of 1,750 feet |
| January 1, 2026 | Texas HB 149 (2025) | Processors must help controllers secure personal data "collected, stored, and processed by an artificial intelligence system" (section 541.104 of the Texas Data Privacy and Security Act) |
| January 1, 2026 | Virginia SB 854 (2025, ch. 703) | Social media platforms must limit users under 16 to one hour per day by default. A federal court has blocked enforcement against members of the trade group NetChoice since early 2026; see the last section |
| June 30, 2026 | New Jersey A5328 (P.L.2026, c.25) | No sale of sensitive data, applying to every business "regardless of the number of consumers"; data brokers and data collectors must register with the Division of Consumer Affairs, and only the state's public registry of them starts later |
| July 1, 2026 | Connecticut SB 1295 (Public Act 25-113) | Threshold drops to 35,000 consumers; the law now also covers anyone who processes sensitive data or offers personal data for sale; the entity-level exemption for financial institutions under the Gramm-Leach-Bliley Act is removed |
| July 1, 2026 | Maryland HB 711 (ch. 874) | No knowing sale to a government unit that engaged in or supported civil immigration enforcement in the prior 6 months; data a controller infers can be sensitive data |
| July 1, 2026 | Virginia SB 338 (ch. 820) | No sale of precise geolocation data |
| July 1, 2026 | Utah HB 418 (2025) | Consumers gain a right to have inaccurate personal data corrected |
| October 1, 2026 | Connecticut SB 4 (Public Act 26-64) | No sale of precise geolocation data; data brokers must be registered to sell or license brokered personal data on or after January 1, 2027; the state must set up a deletion mechanism by July 1, 2028 |
Montana's 2025 amendment, SB 297, took effect earlier, on October 1, 2025. It lowered Montana's threshold to 25,000 consumers, or 15,000 plus more than 25% of revenue from selling personal data, and removed the cure period.
Which cure periods ended in 2026, and which end next?
Temporary cure periods ended in Oregon, Minnesota and New Jersey during 2026, after Delaware and New Hampshire's ended with 2025. A cure period is the window a business gets to fix a violation after the regulator writes to it, before any lawsuit.
| State | What happened | Date |
|---|---|---|
| Delaware and New Hampshire | Mandatory notice and cure ended; the state may still offer one | After December 31, 2025 |
| Oregon | Attorney general no longer required to offer a cure, except for certain noncommercial educational broadcasters until July 1, 2026 | January 1, 2026 |
| Minnesota | 30-day cure provision expired | January 31, 2026 |
| New Jersey | 30-day cure period ended ("the first day of the 18th month" after the January 15, 2025 start, by our count) | July 1, 2026 |
| Maryland | Discretionary cure of at least 60 days applies only to violations on or before this date | April 1, 2027 |
What takes effect in 2027 and 2028?
Four new laws and several amendments. Oklahoma, Alabama, Louisiana and Vermont enacted comprehensive laws in 2026. Louisiana's thresholds are unusual: they look like California's, including a revenue test, rather than the consumer counts most states use.
| Effective | State and law | Applies to | Cure period |
|---|---|---|---|
| January 1, 2027 | Oklahoma SB 546 (approved March 20, 2026) | 100,000 consumers, or 25,000 and over 50% of gross revenue from selling personal data; nonprofits exempt | 30 days; no end date |
| January 1, 2027 | Louisiana Data Privacy Act, SB 386, Act 502 (signed May 29, 2026) | Annual gross revenue over $25 million, or 75,000 or more consumers, households or devices a year, or 50% or more of annual revenue from selling personal information | 30 days, only from January 1 to July 31, 2027 |
| January 1, 2027 | Delaware HB 380 (signed September 2, 2026) | Threshold drops to 10,000 consumers, or 5,000 and more than 20% of gross revenue from selling personal data | Unchanged by this bill |
| January 1, 2027 | New Hampshire HB 1460 (2026, ch. 168) | Adds a ban on selling a child's personal data | Unchanged |
| January 1, 2027 | Utah HB 357 (2026) | Brings motor vehicle manufacturers that collect personal data through a vehicle data collection system under the Utah Consumer Privacy Act | Unchanged |
| March 27, 2027 (our count) | New Jersey A5328, public registry of data brokers (section 2, subsection b.) | The Division of Consumer Affairs' public registry becomes operative 270 days after the June 30, 2026 enactment; the duty to register already applies | Not applicable |
| May 1, 2027 | Alabama Personal Data Protection Act, HB 351, Act 2026-552 | More than 25,000 consumers (not counting payment-only data), or more than 25% of gross revenue from selling personal data; businesses under 500 employees and nonprofits under 100 employees exempt if they do not sell personal data | 45 days; no end date |
| July 1, 2027 | Kentucky HB 692 (2026) | Consent needed before collecting automatic content recognition data (smart television and monitor viewing data) | Unchanged |
| January 1, 2028 | Vermont Data Privacy and Online Surveillance Act, S.71, Act 145 (signed June 16, 2026) | 35,000 consumers (not counting payment-only data), or sensitive data of 3,000, or offering for sale the data of 3,000; consumer health data rules apply with no threshold | 60 days where the attorney general decides a cure is possible, until June 30, 2029 |
The maximum penalties differ: $7,500 per violation in Oklahoma, $15,000 in Alabama, and up to $10,000 per violation in Vermont under its consumer protection act. Louisiana's act sets no figure of its own and relies on the state's unfair trade practices law. Oklahoma, Louisiana and Vermont expressly rule out a private right of action.
Alabama's act gives enforcement to the attorney general and creates no private right of action, but it does not rule one out in words.
Vermont requires controllers to honor an opt-out preference signal sent with the consumer's consent. Oklahoma's and Louisiana's texts do not mention such signals, and Alabama's act contains no data protection assessment requirement.
What are others saying?
These are the pieces we found best argued. Each takes a position of its own, and none of them is the basis for a fact in this article; every fact rests on the sources listed below.
A Perkins Coie post, which lists Alison Watkins and Peter Hegel as its contacts, argues that, for a business already meeting other state privacy laws, bringing Oklahoma and Alabama into scope "will likely be a light lift". It points out that both laws narrow protections in places rather than adding duties, and that both keep a cure period with no end date, unlike most states.
Oklahoma and Alabama Headline a Busy Spring for Privacy Legislation (Perkins Coie, May 8, 2026) ↗
Kirk J. Nahra, Samuel Kane and Blythe Riggan of WilmerHale single out Alabama's definition of a sale as unusual, because it turns on whether the recipient is restricted in how it may use the data. They also note that, unlike comparable laws, Alabama requires no data protection assessments and has no standalone duty to recognize opt-out preference signals.
Alabama Enacts Nation's Twenty-First State Comprehensive Privacy Law (WilmerHale, April 22, 2026) ↗
What we could not verify
The court status of Virginia's under-16 social media limit. NetChoice, the trade group that sued, reports that a federal court issued a preliminary injunction on February 27, 2026; MediaPost describes the ruling as made in March.
MediaPost reported on August 24, 2026 that the Fourth Circuit, by 2 to 1, refused Virginia's request to lift the injunction while its appeal proceeds, and that the order bars enforcement against NetChoice members. We did not read the court docket, so we report this as their account.
Several official sites (Indiana, Rhode Island, Louisiana, Vermont, Connecticut, Oregon, New Hampshire, Utah, and New Jersey's bill text server) did not load for us on September 25, 2026. For those rows we read archived copies of the official pages, dated between June 2025 and September 2026; a second attempt on September 26, 2026 also failed.
A change made after those dates would not show.
Signing dates for Oregon HB 2008, New Hampshire HB 1460 and Utah HB 357 and HB 418. The bills and their effective dates are confirmed; the day the governor signed is not. Alabama's legislative record shows the bill "Enacted" on April 17, 2026 without saying signed.
A 2025 Indiana amendment (P.L.236-2025) and a New Jersey bill on health data exemptions (A5017) that secondary sources describe. We could not open the enacted texts.
The number of states with a comprehensive law. Counts from 23 to 24 appear, depending on whether Florida's narrower law is included, so we give none.
Need a hand implementing it?
Find a consultant for US State Privacy Laws
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
From the publisher
Keep Your Written Policies in One Place
Whatever you are working toward, AllyMatter gets your policies approved, keeps every version and records who has read each one.
What people ask.
Does Rhode Island's law apply to a small business?
It can. It applies to a for-profit entity that controlled or processed the personal data of at least 35,000 customers in the preceding calendar year, not counting data used only to complete a payment, or 10,000 customers if more than 20% of gross revenue came from selling personal data. Separately, any commercial website or internet service provider doing business in Rhode Island that sells customers' personally identifiable information must list the categories of data it collects and the third parties it sells to, whatever its size.
Do Indiana and Kentucky give a chance to fix a violation first?
Yes. In both states the attorney general must give 30 days' written notice, and no action follows if the business cures the violation in that time and confirms it in writing. Neither cure period has an end date.
Which new laws start on January 1, 2027?
Oklahoma's and Louisiana's. Delaware's lower threshold, New Hampshire's ban on selling children's data and Utah's coverage of vehicle makers also start that day. Alabama follows on May 1, 2027 and Vermont on January 1, 2028.
Is Connecticut's threshold still 100,000 consumers?
No. Since July 1, 2026 the Connecticut Data Privacy Act applies at 35,000 consumers, and to anyone who controls or processes sensitive data or offers personal data for sale, whatever the count.
Who enforces these laws?
The state attorney general in every state covered here (in New Jersey, with the Division of Consumer Affairs). None of the new laws creates a private right of action; Alabama's is silent on the point, where the others rule one out expressly.
What each one is doing here.
Indiana General Assembly, Senate Enrolled Act 5 (2023), IC 24-15Indiana Attorney General, Consumer Data Protection Consumer Bill of RightsKentucky General Assembly, 2024 Acts ch. 72 (HB 15)Kentucky Revised Statutes 367.3613, 367.3615, 367.3621 and 367.3627Kentucky General Assembly, 2025 Acts ch. 13 (HB 473) and 2026 Acts ch. 118 (HB 692)Rhode Island General Laws, chapter 6-48.1, and section 6-13.1-8Oregon Legislature, HB 2008 (2025) enrolled text, and Oregon Department of Justice privacy law FAQs for businessesOregon Revised Statutes 646A.589 and note on 2025 c.417 (SB 1121)Texas Legislature, HB 149 (89th Legislature), enrolled textVirginia Legislative Information System, SB 854 (2025) and Code of Virginia 59.1-577.1Code of Virginia 59.1-578, as amended by 2026 ch. 820 (SB 338)New Jersey Legislature, A5328 bill history (P.L.2026, c.25)New Jersey P.L.2023, c.266Connecticut General Assembly, Public Act 25-113 (SB 1295)Connecticut General Assembly, Public Act 26-64 (SB 4)Maryland General Assembly, 2026 ch. 874 (HB 711) and 2024 ch. 455 (SB 541)Utah Legislature, HB 418 (2025) and HB 357 (2026) enrolled textsMontana Code Annotated 30-14-2817 and SB 297 (2025, ch. 567)Minnesota Statutes 325M.20Delaware General Assembly, HB 380 (153rd GA) and Delaware Code title 6, chapter 12DNew Hampshire RSA 507-HOklahoma Legislature, SB 546 bill page and enrolled textAlabama Legislature, HB 351 enrolled text (2026 Regular Session)Louisiana Legislature, SB 386 (2026 Regular Session), Act 502Vermont Legislature, S.71, Act 145 (2026) as enactedVermont Statutes 9 V.S.A. 2458MediaPost, Appeals Court Rejects Virginia Bid To Enforce Social Media Limit, August 24, 2026
What has changed on this page.
Changes
Corrections
None so far.
Found something wrong? corrections@policyandcompliance.com. We check it against the source, fix it, and record it here with the date.