Name: State privacy laws taking effect in the US in 2026
Creator: The Webhound Team
Published: 2026-05-06T19:20:15.841732+00:00
Keywords: A verified calendar of U.S. state privacy laws and major amendments that become effective during 2026.

State privacy laws taking effect in the US in 2026$1 spent

$1.41 spent

state	law_name	effective_date	status	applicability_thresholds	primary_source_url	notes
Rhode Island	Rhode Island Data Transparency and Privacy Protection Act	2026-01-01	Enacted Law	Applies to businesses controlling/processing data of at least 35,000 Rhode Island consumers, or 10,000 consumers if at least 20% of gross revenue is from the sale of personal data.	https://webserver.rilegislature.gov/BillText/BillText24/HouseText24/H7787.pdf	Has notably lower thresholds than other 2026 laws. Reportedly does not include a cure period. Covers commercial websites and ISPs.
Utah	Utah Consumer Privacy Act Amendment (HB 418)	2026-07-01	Enacted Amendment	Amends UCPA (applies to businesses with $25M+ revenue and 100k consumers or 25k if 50% revenue from sale). Specific provisions for social media companies.	https://le.utah.gov/~2025/bills/static/HB0418.html	Grants consumers the right to correct inaccurate personal data. Enacts data portability and interoperability requirements for social media services.
California	California Consumer Privacy Act Amendment (SB 361)	2026-08-01	Enacted Amendment	Applies to all registered Data Brokers in California (businesses selling personal info without a direct consumer relationship).	https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB361	Mandates use of the CPPA accessible deletion mechanism; requires processing of requests within 45 days. Expands disclosure to include GenAI sharing.
Arkansas	Arkansas Children and Teens' Online Privacy Protection Act	2026-07-01	Enacted Law	Applies to commercial operators of websites or online services targeted at children or teens, or those with actual knowledge of collecting their data.	https://arkleg.state.ar.us/Home/FTPDocument?path=%2FBills%2F2025R%2FPublic%2FHB1717.pdf	Prohibits targeted advertising to minors. Requires verifiable consent for teens aged 13-16. Modeled on "COPPA 2.0" framework.
Nebraska	Nebraska Age-Appropriate Online Design Code Act	2026-01-01	Enacted Law	Applies to online services with actual knowledge of minor users or where at least 2% of users are minors. Thresholds were reportedly broadened in 2026.	https://nebraskalegislature.gov/bills/view_bill.php?DocumentID=59284	Requires high default privacy settings for minors. Limits data targeting. Part of the Age-Appropriate Online Design Code Act.
Indiana	Indiana Consumer Data Protection Act	2026-01-01	Enacted Law	Applies to businesses that control/process data of at least 100,000 Indiana consumers, or 25,000 consumers if more than 50% of gross revenue is derived from the sale of personal data.	https://iga.in.gov/legislative/2023/bills/senate/5/details	Enforcement is exclusive to the Attorney General; provides no private right of action. Contains a 30-day right to cure.
Kentucky	Kentucky Consumer Data Protection Act	2026-01-01	Enacted Law	Applies to businesses that control/process data of at least 100,000 Kentucky consumers, or 25,000 consumers if more than 50% of gross revenue is derived from the sale of personal data.	https://apps.legislature.ky.gov/record/24rs/hb15.html	Enforcement is exclusive to the Attorney General. Includes a mandatory cure period and creates a specific consumer privacy fund.
Oregon	Oregon Consumer Privacy Act Amendment (HB 2008)	2026-01-01	Enacted Amendment	Amends the OCPA (which generally applies to businesses with 100k consumers or 25k if 25% revenue from sale). Specific 2026 prohibitions apply to minor data and precise geolocation.	https://olis.oregonlegislature.gov/liz/2025R1/Measures/Overview/HB2008	Prohibits sale of minor data (<16) and precise geolocation (1,750-foot radius). The OCPA 30-day right to cure expired Jan 1, 2026.
Connecticut	Connecticut Data Privacy Act Amendment (SB 1295)	2026-07-01	Enacted Amendment	Lowers the general processing threshold to 35,000 consumers (from 100,000) and removes numerical thresholds for certain types of high-risk processing.	https://www.cga.ct.gov/2025/act/pa/pdf/2025PA-00113-R00SB-01295-PA.pdf	Requires specific notices for data used to train AI models and implements new safety and design requirements for services used by minors.
California	California Consumer Privacy Act Amendment (SB 446)	2026-01-01	Enacted Amendment	Applies to any business conducting business in California that owns or licenses computerized personal information.	https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260SB446	Establishes a strict 30-day deadline for consumer breach notifications and a 15-day deadline for reporting to the Attorney General.
Maryland	Maryland Online Data Privacy Act	2026-04-01	Enacted Law	Applies to businesses controlling/processing data of at least 35,000 Maryland consumers, or 10,000 consumers if at least 20% of gross revenue is from the sale of personal data.	https://mgaleg.maryland.gov/mgawebsite/Legislation/Details/sb0541	Enforcement phase begins April 1, 2026. Bans the sale of sensitive data for individuals of any age. Considered one of the strictest US privacy laws.
Texas	Texas Responsible Artificial Intelligence Governance Act	2026-01-01	Enacted Law	Applies to entities using, developing, or deploying AI systems in Texas. Incorporates thresholds and requirements from existing Texas privacy statutes.	https://capitol.texas.gov/billlookup/text.aspx?LegSess=89R&Bill=HB149	Prohibits harmful AI uses and clarifies biometric consent rules. Establishes a regulatory framework for AI governance in the state.
Colorado	Colorado Privacy Act Amendment (HB 24-1130)	2026-02-01	Enacted Amendment	Applies to any entity controlling or processing biometric data of Colorado consumers, regardless of general CPA numerical thresholds.	https://leg.colorado.gov/bills/hb24-1130	Specific provisions for biometric identifiers and children's privacy become effective in February 2026. Requires explicit consent for biometric processing.
California	California Consumer Privacy Act Regulations (2026 Package)	2026-01-01	Enacted Amendment	Applies to businesses meeting CCPA thresholds ($25M+ revenue, 100k+ consumers, or 50%+ revenue from sale/share).	https://cppa.ca.gov/regulations/	Introduces mandatory risk assessments and cybersecurity audits. Establishes new rules for consumer consent and opt-out rights.

Made with Webhound · Ask questions about this research, build on it, or start your own