US state privacy laws in 2026: what website owners need to know
The U.S. does not have an all-inclusive federal act on consumer privacy that applies to all personal information in the private sector. Rather, website operators now face a state-by-state regime of privacy regulations, together with specialized federal regulation and state statutes for specific types of information.
As of 5 October 2026, twenty-four U.S. states have passed comprehensive consumer privacy acts. Out of these twenty-four states, twenty consumer privacy acts are in force, while the remaining four have their acts set for the future dates. The state regime is inconsistent, as there are inconsistencies in applicability thresholds, exemptions, consumer rights, duties of controllers and processors, opt-outs, universal opt-outs, and enforcement measures.
Comprehensive State Privacy Law Tracker (2026)
| State | Law | Simplified Applicability | Consumer Rights | GPC / UOOM Relevance | Enforcement |
|---|---|---|---|---|---|
| California | CCPA / CPRA | Revenue, personal-data, or value-derived thresholds | Access, delete, correct, opt out of sale/sharing, limit certain uses of sensitive personal information, and other applicable CCPA rights | GPC recognized | CPPA + Attorney General |
| Virginia | VCDPA | 100,000 consumers or 25,000 plus sale-revenue threshold | Access, correction, deletion, portability, opt-outs | Limited | Attorney General |
| Colorado | CPA | 100,000 consumers or 25,000 plus sale-revenue threshold | Access, correction, deletion, portability, profiling opt-outs | UOOM required | Attorney General + DAs |
| Connecticut | CTDPA | 35,000 consumers plus expanded triggers | Access, correction, deletion, portability, profiling rights | UOOM required | Attorney General |
| Utah | UCPA | Revenue and consumer-processing thresholds | Access, deletion, portability, advertising opt-outs | Limited | Attorney General |
| Iowa | ICDPA | Consumer-data volume thresholds | Access, deletion, portability | Limited | Attorney General |
| Indiana | ICDPA | 100,000 consumers or sale-based threshold | Standard comprehensive rights | Limited | Attorney General |
| Tennessee | TIPA | 100,000 consumers or sale-based threshold | Standard comprehensive rights | Limited | Attorney General |
| Montana | MCDPA | 50,000 consumers threshold | Standard rights plus profiling opt-outs | Emerging | Attorney General |
| Oregon | OCPA | 100,000 consumers or sale-based threshold | Broad consumer rights | Emerging | Attorney General |
| Texas | TDPSA | Applies broadly to qualifying businesses processing or selling personal data, subject to statutory exemptions and SBA small-business rules | Standard comprehensive rights | Emerging | Attorney General |
| Florida | FDBR | Limited large-business applicability | Access, correction, deletion, opt-outs | Limited | Attorney General |
| Delaware | DPDPA | Consumer-volume thresholds | Standard comprehensive rights | Emerging | Attorney General |
| New Hampshire | NHPA | Consumer-volume thresholds | Standard comprehensive rights | Emerging | Attorney General |
| New Jersey | NJDPA | Consumer-volume thresholds | Broad privacy rights | Emerging | Attorney General |
| Kentucky | KCDPA | Consumer-volume thresholds | Standard comprehensive rights | Limited | Attorney General |
| Nebraska | NDPA | Broad applicability model | Standard comprehensive rights | Emerging | Attorney General |
| Minnesota | MCDPA | Consumer-volume thresholds | Enhanced consumer rights | Emerging | Attorney General |
| Maryland | MODPA | Consumer-volume thresholds | Strong data-minimization requirements | Emerging | Attorney General |
| Rhode Island | RIDTPA | Consumer-volume thresholds | Standard comprehensive rights | Emerging | Attorney General |
| Louisiana | LADPA | Enacted, future-effective | Comprehensive rights | To be determined | Attorney General |
| Alabama | APDPA | Enacted, future-effective | Comprehensive rights | To be determined | Attorney General |
| Oklahoma | OCPA | Enacted, future-effective | Comprehensive rights | To be determined | Attorney General |
| Vermont | DPOSA | Enacted, future-effective | Enhanced privacy and surveillance restrictions | To be determined | Attorney General |
Important status note: Louisiana's comprehensive privacy law is the Louisiana Data Privacy Act, enacted as Act 502 of 2026 (SB 386). It was signed into law on May 29, 2026, and takes effect on January 1, 2027. Louisiana also has separate earlier laws addressing specific categories of online activity and minors; those laws should not be confused with the 2026 comprehensive privacy statute.
The laws are similar in structure, but not identical
Many comprehensive state privacy laws use a controller/processor model or something that is very similar to it. Typical consumer rights include access, correction, and deletion, but there is also the right to opt out from the sale of personal information, the right to opt out from targeted advertising, or even the right to opt out from certain types of profiling. The covered businesses might also have obligations when it comes to privacy notices, purpose limitation, data minimization, security, dealing with sensitive information, processor contracts, and data protection impact assessments.
Similarities do not equate to a national standard. First, the business should understand whether a specific state's law applies and what specific rights and obligations result from it. Thresholds and exemptions could be determined based on various factors including the volume of consumers' information processed, revenue, sale of personal information, type of business, type of information, and other federal or state privacy law applications.
Why cookies and tracking matter to website owners
To determine if a website is in line with the privacy policy, it is inadequate to just read the policy itself. By use of cookies, pixels, analytical tools and session replay, data could be collected about the user’s activity, and such data may be regarded as personal according to the laws of the state. That is why it is essential for the website owner to identify what tracking mechanism is utilized, to know what information it collects, what vendor it shares the data with, the purpose of how the data will be used, whether the information will be sold or shared, and whether the consumer will have the right to opt-out from this process. The options provided to the user should be studied or tested to make sure they have been correctly implemented.
Importantly, U.S. state comprehensive privacy laws do not establish one uniform nationwide “cookie consent” requirement. Depending on the applicable state law, the business, the information collected and the purpose of the processing, cookies, pixels, SDKs, session-replay tools and other tracking technologies may create obligations relating to notice, sale or sharing, targeted advertising, sensitive-data processing, consent or opt-out mechanisms. Website operators should therefore assess the actual data flow and the applicable state requirements rather than assuming that one cookie banner creates nationwide compliance,
California: the most developed website-focused example
The California Consumer Privacy Act (CCPA) grants consumers several entitlements such as right to access, right to deletion of personal data and right to opt out of the sale or disclosure of personal private information. As stated in the California Privacy Policy, there is a method called Global Privacy Control (GPC) for consumers to opt out of selling personal data.
California's CCPA remains enforceable in 2026, while significant new CCPA regulations became effective on January 1, 2026. The updated regulations address, among other matters, privacy risk assessments, cybersecurity audits, automated decision-making technology (ADMT), and related CCPA requirements. Some obligations have phased implementation dates, including requirements that apply from 2027 onward.
California's 2026 Delete Act developments are also relevant to businesses that qualify as data brokers. California's Delete Request and Opt-out Platform (DROP) launched on January 1, 2026. Beginning August 1, 2026, data brokers are required to access DROP at least once every 45 days and process applicable consumer deletion requests. This requirement is particularly relevant to businesses that operate as data brokers rather than ordinary websites that merely use advertising or analytics technologies.
Enforcement demonstrates the significance of actual implementation. The Attorney General of California revealed in July 2025 that there had been a settlement worth $1.55 million with Healthline Media LLC regarding violations of the CCPA regarding online tracking technology, third-party data, targeted advertising, and no opt-out strategy. According to the state agency, Healthline's consent feature wasn't working correctly, hence tracking cookies still being enabled.
In the early part of the following year in February 2026, the Attorney General of California announced another settlement of $2.75 million involving Disney consisting of allegations about the implementation of consumer opt-out procedures that had not been working correctly across either streaming services or devices associated with Disney accounts. Later on, in May 2026, the Attorney General also reported about another settlement of $12.75 million concerning General Motors over claims about the unlawful sale of California citizens' location and movement activity to data brokers and stated that this was the highest amount of money paid to settle a case related to CCPA violation.
For the owners of websites, this also means that the implementation needs to operate in the technologies and not just on the paper in the privacy statement.
Universal opt-out mechanisms and Global Privacy Control
Universal mechanisms for opting out allow consumers to communicate their privacy preferences across websites, instead of making individual requests on every site. A good example of this is Colorado. As mentioned by Colorado's Attorney General, the provisions of the Colorado Privacy Act (CPA) mean that consumers are entitled to opt out from both the sale of and targeted advertising regarding their personal information directly or through the universal opt-out systems.
Beginning January 1, 2025, controllers subject to the CTDPA must honor valid universal opt-out preference signals indicating a Connecticut consumer's intent to opt out of targeted advertising or the sale of personal data. The CTDPA provides separate opt-out rights for certain profiling activities that may produce legal or similarly significant effects.
Applicability thresholds must be checked before assuming coverage
The presence of a website in a state does not necessarily imply that every privacy law in that state is applicable. Each privacy law dictates what it covers and what happens when any stipulated conditions are met.
For instance, the Connecticut Department of Consumer Protection clarifies that the CTDPA is applicable to businesses operating in or targeting consumers in Connecticut and that process personal data of not less than thirty-five thousand consumers (with certain exceptions), using sensitive data in the circumstances described in the statute, or selling consumer personal data. There are also specific provisions for consumer health data controllers.
Another suitable example can be given from Texas. According to the Texas Business & Commerce Code, Chapter 541, some organizations and information are excluded from regulation. These include specific financial institutions and different types of data protected by the Gramm-Leach-Bliley Act and HIPAA covered entities or business associates. Texas also provides provisions for small businesses, thus demonstrating the relevance of reading the statute carefully, and not assuming that a particular business is covered.
Sensitive data and children's data
Sensitive personal data enjoys heightened protection under state privacy law, although the definition and required safeguards varies. Sensitive data may include precise geolocation, biometric information, health information, information concerning racial or ethnic origin, religious beliefs, sexual orientation and information concerning children or other minors depending on the state law.
Website owners should separately identify in forms, account systems, advertising, location features, personalization and analytics any processing of sensitive data subject to consent or other heightened requirements depending on the state and the purpose of processing.
Children's and teenagers' privacy is another area where state requirements increasingly exceed conventional privacy-policy disclosure. Website owners should determine if their service is directed to minors or is reasonably likely to be accessed by minors and then review the applicable state's age-related provisions.
Sector-specific laws can apply outside the comprehensive-law framework
A successful privacy compliance program cannot consider only the 24 comprehensive state laws. Many states also have laws that apply to categories of information or sectors of the economy. For instance, Washington's Health My Data Act is an important law that regulates consumer health data through Chapter 19.373 RCW, which covers privacy policies, collection and disclosure, consumer rights, security, processors, and authorization for sales of consumer health data and geofencing restrictions. This law's scope and exemptions are distinct from the state's general consumer privacy statutes.
This is relevant to website owners because a service may be exempt from a comprehensive privacy statute but have additional obligations under a more limited state law that covers health, biometric, children's, genetic, financial or other protected information.
Practical 2026 compliance checklist for website owners
- Map personal-data collection across forms, accounts, purchases, newsletters, chat, analytics, cookies and advertising technologies.
- Inventory every third-party script, pixel, SDK and tag and document what information is transmitted and to whom.
- Determine whether each applicable state treats the activity as a sale, sharing, targeted advertising or another regulated processing activity.
- Verify the business's applicability thresholds and statutory exemptions for each state rather than assuming nationwide coverage.
- Review the privacy notice against the website's actual data flows and purposes.
- Create operational procedures for access, correction, deletion, portability and applicable opt-out requests.
- Test opt-out controls technically, including applicable universal opt-out signals such as GPC.
- Review processor/service-provider contracts and confirm that required privacy terms are actually present.
- Identify sensitive-data and children's-data processing and apply the additional requirements that the applicable state law imposes.
- Monitor amendments, regulations and enforcement guidance because state privacy requirements continue to evolve.
What website owners should expect next
The state privacy framework is continuing to grow. Alabama's Personal Data Privacy Act is set to take effect May 1, 2027; Oklahoma's comprehensive privacy law is set to take effect January 1, 2027; and Vermont's Data Privacy and Online Surveillance Act is set to take effect January 1, 2028. The goal for businesses should be to think of privacy compliance as an ongoing governance effort rather than a one-time privacy policy initiative.
The goal is not to necessarily have a different program for each state. Instead, the best practice is to look at the shared requirements, determine the more stringent state-specific requirements applicable to the business, and confirm the actual statutory and regulatory requirements in each jurisdiction.
Bottom line
US state privacy laws in 2026 are uneven, but growing up. Twenty-four states have adopted comprehensive consumer privacy laws, of which twenty are already effective, and the remaining four are set to take effect in the future. Website owners facing these laws should ask themselves what personal information they collect and process, including information that they receive from other sources; why they collect and process personal information; who gets this data, if any; do they sell or share personal information; do they target advertisements; what rights consumers have; and whether the website’s technology infrastructure enables the exercise of these rights.
A privacy policy should reflect the website’s privacy practices, but it does not constitute a privacy program. Website owners must invest more effort in developing and documenting their privacy program. Management of cookies and trackers, vendor agreements, consumer request procedures, opt-out mechanisms, and technical testing are essential elements for compliance with privacy laws.
Primary and authoritative sources checked
- California Privacy Protection Agency – Laws and Regulations
- California Attorney General – CCPA
- California Attorney General – Healthline enforcement (July 1, 2025)
- California Attorney General – Disney settlement (Feb. 11, 2026)
- California Attorney General – General Motors settlement (May 8, 2026)
- Colorado Attorney General – Colorado Privacy Act
- Colorado Attorney General – Universal Opt-Out / GPC
- Connecticut Attorney General – Connecticut Data Privacy Act
- Iowa Legislature – Senate File 262 / Consumer Data Protection Act
- Kentucky Legislature – House Bill 15 / KCDPA
- Texas Constitution and Statutes – Business & Commerce Code Chapter 541
- Washington Legislature – My Health My Data Act, Chapter 19.373 RCW
- Vermont Legislature / enacted SB 71 – Data Privacy and Online Surveillance Act
- IAPP – U.S. State Privacy Legislation Tracker (cross-check only; last updated Sept. 8, 2026)