What's Happening?
In 2026, four additional U.S. states—Alabama, Louisiana, Oklahoma, and Vermont—enacted comprehensive consumer privacy laws, bringing the total number of states with such protections to 24. These new laws, along with amendments to existing legislation
in states like Connecticut, Delaware, Kentucky, Maryland, New Hampshire, and New Jersey, reflect several key trends in data privacy. Lawmakers are broadening coverage thresholds, extending privacy obligations to more businesses and categories of information. There's a growing movement beyond simply requiring consent for data sales, with some states now prohibiting certain sales of sensitive data altogether. Consumer rights are also expanding, including the right to view inferences drawn about them and whether their data is used for consequential profiling. Furthermore, there's increased scrutiny on how data is used, particularly concerning surveillance pricing and algorithmic decision-making, and data broker registration requirements are expanding. For instance, Connecticut and New Jersey have joined other states in mandating data broker registration, with Connecticut's law requiring disclosures about practices involving minors' information, precise location, and reproductive or sexual health data.
Why It's Important?
The proliferation of state-level consumer privacy laws signifies a significant shift in the regulatory landscape for businesses operating in the U.S. In the absence of a federal privacy law, states are acting as 'laboratories' for data protection, creating a complex patchwork of regulations that companies must navigate. This trend impacts various industries, particularly those heavily reliant on consumer data, such as technology, retail, and healthcare. Businesses face increased compliance costs and the need to adapt their data collection, processing, and sharing practices to meet diverse state requirements. The move towards outright bans on sensitive data sales, rather than just consent requirements, indicates a growing concern among lawmakers about the potential misuse of personal information, especially in areas like health, biometric, and financial data. This could lead to a re-evaluation of business models that depend on extensive data monetization. Moreover, expanded consumer rights empower individuals with greater control over their personal data, potentially fostering increased consumer trust in companies that prioritize privacy.
What's Next?
The trend of expanding and strengthening state privacy laws is expected to continue. Massachusetts is currently working on its own privacy bill, which could allow consumers to sue large data holders for violations, a departure from the attorney general enforcement model prevalent in most states. This could set a precedent for more aggressive enforcement mechanisms. Lawmakers are also likely to focus on how AI chatbots and generative AI services use conversation logs for commercial purposes, and children's privacy remains a major concern. The upcoming November elections could be a turning point, with potential Democratic gains possibly leading to the revival of stalled proposals and broader support for stronger privacy protections. The next phase of the debate may shift from establishing privacy rights to making them easier for consumers to exercise and harder for businesses to circumvent. States like Connecticut and Vermont are also exploring the creation of universal deletion mechanisms, similar to California's Delete Act, which would allow consumers to submit a single request to delete their data across multiple registered data brokers.
Beyond the Headlines
The fragmented nature of U.S. data privacy laws presents both challenges and opportunities. While it creates a complex compliance environment for businesses, it also allows for diverse approaches to data protection, potentially leading to innovative solutions. The increasing focus on sensitive data, including biometric and neural data, highlights growing societal concerns about the implications of advanced technologies on individual privacy. The debate over 'surveillance pricing' and algorithmic decision-making touches upon ethical considerations regarding fairness and transparency in how personal data influences economic opportunities and access to services. The push for data broker registration and universal deletion mechanisms reflects a broader societal demand for greater transparency and control over the vast ecosystem of data collection and sharing. This evolving legal landscape could ultimately reshape consumer expectations regarding data privacy, pushing companies towards more privacy-by-design approaches and fostering a more accountable data economy.
