U.S. State Privacy Enforcement: Anticipating a Surge in 2026

As we head into 2026, the landscape of privacy enforcement across U.S. states is poised for significant changes. On January 1, new regulations will take effect, primarily driven by a series of California privacy measures and the introduction of comprehensive privacy laws in Indiana, Kentucky, and Rhode Island. This upcoming wave of legislation is set to reshape compliance requirements for businesses while also enhancing consumer rights.

California’s Updated Privacy Landscape

California has long been at the forefront of privacy reform in the U.S., and the upcoming regulations are creating a buzz in corporate circles. The California Consumer Privacy Act (CCPA) regulations will specifically focus on automated decision-making technology (ADMT), risk assessments, and cybersecurity audits, prompting companies to reevaluate their compliance strategies.

One critical aspect of these regulations is the requirement for opt-outs when utilizing ADMT to make decisions that significantly replace human judgment. This means that if companies implement these technologies, they must ensure that there is human oversight capable of interpreting and modifying automated outputs. This shift emphasizes that the human element remains essential, even as technology evolves.

Additionally, any business processing data that poses a potential risk to consumer privacy must conduct a risk assessment. Examples of scenarios that would trigger these assessments include selling personal information, processing sensitive data, or using automated decision-making for significant choices regarding consumers. This proactive approach aims to mitigate risks before they impact consumers.

The cybersecurity audit rule will further specify what constitutes “significant risk” and outline reasonable security measures for safeguarding personal information. As detailed by Jim Dempsey, Managing Director of the IAPP Cybersecurity Law Center, these audit requirements will play a pivotal role in reinforcing data security measures nationwide.

New Requirements for Data Brokers

Another aspect receiving attention is the newly launched California Delete Act’s opt-out and deletion request platform, known as DROP. Data brokers will now be obliged to comply with opt-out requests submitted through this system, raising the stakes for noncompliance. The associated penalties for non-adherence to these regulations extend beyond simple registration failures, with fines of USD 200 per incident. As highlighted by CalPrivacy Executive Director Tom Kemp, this can quickly accumulate into hefty financial liabilities for non-compliant brokers.

Moreover, the California Privacy Protection Agency (CalPPA) has noticed some brokers may not fully disclose their trade names or websites on the state’s registry. This lack of transparency makes it hard for consumers to discern who holds their data, further underscoring the importance of clear compliance with state regulations.

Fast-Tracking Comprehensive Laws in Other States

Alongside California’s initiatives, states like Indiana, Kentucky, and Rhode Island are joining the privacy legislation wave. Enacted in 2023 and 2024, these new laws are set to take effect in January 2026, and while they don’t introduce overwhelming complexity for businesses, they do require attentiveness to specific compliance frameworks.

For instance, Indiana and Kentucky mirror Virginia’s Consumer Data Protection Act, requiring businesses that either process data from over 100,000 consumers or rely on data sales from at least 25,000 consumers to come into compliance. Both laws usher in provisions like data protection impact assessments and rights for user opt-outs concerning targeted ads and data sales.

On the other hand, Rhode Island’s version is tailored for entities managing personal information for more than 35,000 residents or generating 20% of their gross revenue from personal data sales, although it lacks some elements commonly found in other state laws, such as universal opt-out mechanisms.

Enforcement Guidance and Broader Implications

As we close in on 2026, the Indiana attorney general’s office has already rolled out a Data Consumer Bill of Rights. This document elucidates consumer rights and delineates business obligations under the new comprehensive law, offering clarity for both consumers and businesses during a time of significant transition.

Additionally, Rhode Island’s law opts for unique exclusions, such as enhanced children’s privacy protections and the right to cure deficiencies, which must be understood deeply to ensure compliance. Similarly, Oregon’s updated comprehensive law underscores the need to adhere to UOOM (Universal Opt-Out Mechanism) signals and reinforces limits on processing data for children.

As attention turns to these new privacy commitments, companies must prioritize understanding the operational impact of various regulations while preparing to meet the stipulated requirements. The landscape may appear fragmented, but the coordinated enforcement actions from state attorneys general signal an increasing urgency for compliance and consumer protection.

Navigating the New Normal

With the clock ticking down to January 2026, companies across different states will need to ensure that they not only understand these laws but also adapt their practices accordingly. Staying ahead of compliance failures will be crucial as increasing scrutiny from regulators creates a landscape that is not just about following the law, but about respecting consumer rights and building trust in data management processes.

As state privacy regulations continue to develop, businesses are encouraged to be proactive in reviewing their operations, understanding the nuances of the various laws, and ensuring they remain compliant in this new era of privacy enforcement.