Key points

• The United States still has no comprehensive federal privacy law, and roughly twenty states now have their own, with several taking effect in 2025 and 2026.
• The statutes share a common structure of consumer rights, controller duties and opt-outs for targeted advertising, sale and profiling, but differ in thresholds, sensitive data definitions, minors' protections and enforcement.
• Newer laws are stricter on data minimization, sensitive data and minors, and some regulators are moving from guidance to enforcement.
• Universal opt-out signals, data protection assessments and vendor contracts are the compliance workstreams most likely to be tested first.
• A single national program built to the highest common standard, with state-specific overlays, is usually more efficient than a state-by-state approach.

An expanding map

California adopted the first comprehensive state privacy law in 2018, and since 2020 it has been joined by a steady stream of states, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Florida, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota and Maryland. Indiana, Kentucky and Rhode Island laws took effect on January 1, 2026. The list continues to change, and legislatures have also amended earlier laws, so organizations should maintain an up-to-date tracker and check effective dates for each state in which they have customers.

Congress has debated a federal privacy statute for years without result. Companies therefore plan for a long-term state patchwork, with the added uncertainty of amendments and new sector-specific rules for children and health data.

What the laws have in common

Most state laws follow the Virginia and Colorado model. They give residents rights to access, correct, delete and port their personal data, and to opt out of targeted advertising, the sale of personal data and certain profiling. Controllers must provide a privacy notice, limit collection to what is adequate and relevant, secure the data, and conduct data protection assessments for higher-risk activities. Processors must be bound by contracts that set out the instructions and obligations. Most laws exempt certain entities or data already regulated under federal law, such as HIPAA and the Gramm-Leach-Bliley Act, though the scope of those exemptions varies, and not every state exempts the entity as a whole rather than the data.

Where they diverge

Applicability thresholds. Most laws apply by volume of consumers, often 100,000, with lower thresholds where a company derives revenue from selling data. Some states, such as Texas, apply to businesses that are not small businesses as defined by federal rules, and a few have no volume threshold for certain obligations.

Sensitive data. Definitions vary on health information, biometrics, precise geolocation, children's data and status such as transgender or nonbinary identity. Some states require opt-in consent to process sensitive data, while others require only notice and an opt-out. Maryland's law, effective October 2025, restricts collection of sensitive data to what is strictly necessary and prohibits its sale, a standard stricter than most others.

Minors. Several states have added specific duties for teens or require heightened care for known minors, and some have separate age-appropriate design or social media statutes. These often interact with amendments to the federal children's privacy rule.

Profiling and automated decisions. Rights to opt out of profiling in furtherance of significant decisions are widespread, and some states require explanation or review rights. California's regulations on automated decision-making technology add further obligations.

Enforcement and cure. Attorneys general enforce most laws, with civil penalties often between US$2,500 and US$7,500 per violation. California has a dedicated agency with administrative powers. Mandatory cure periods have been phased out in several states, and only California provides a limited private right of action, for certain data breaches.

Enforcement is no longer theoretical

Regulators have begun to use their authority. California's attorney general and its privacy agency have announced settlements concerning opt-out failures, notice defects and vendor contracts. Connecticut and Texas have taken action on data practices, and states have coordinated through a consortium of privacy regulators. Sector focus areas have included advertising technology, location data, connected devices and health-adjacent data. Companies should assume that investigations can begin from consumer complaints or from public scans of websites for opt-out functionality. See our note on universal opt-out signals.

Building a program that scales

A practical approach starts with data mapping, since every right and assessment depends on knowing what is collected, where it goes and who receives it. Next, design one privacy notice and rights process to the strictest common standard, with clear disclosures about sensitive data, profiling and sale or sharing. Third, implement opt-out mechanisms, including recognition of browser-based signals where required. Fourth, run data protection assessments for targeted advertising, sensitive data and profiling, and keep them current. Fifth, review vendor and processor contracts against each state's required terms. Sixth, train staff who handle requests, and test the process.

Where state rules conflict or differ materially, such as the treatment of sensitive data, consider whether to apply the strictest rule nationally or to implement state-specific logic. The answer depends on the data, the business model and the cost of segmentation.

Looking ahead

More effective dates fall in the coming months, and several states have amended their laws to expand coverage or tighten obligations on minors and sensitive data. Legislative sessions in 2027 are likely to bring further proposals, including on data brokers and AI. The most useful discipline is a regular review cycle, so that changes are captured and the program stays aligned.

Corvane Ryle's Privacy & Cyber practice advises on multistate compliance, assessments and regulatory inquiries. Tomás Ellery-Vance in Washington, D.C. and Helena Strand in London are available to discuss how the 2026 map affects your business.