US State Privacy Laws Tracker (2026): Every Law, Deadline, and Amendment

As of 1 October 2026, 24 US states have enacted comprehensive consumer privacy laws, and 20 of them are in effect. Both figures shrink by one if you exclude Florida, which is how IAPP and the Future of Privacy Forum (FPF) count: 23 enacted, 19 in effect. Four laws are signed but not yet operative: Oklahoma's and Louisiana's take effect on 1 January 2027, Alabama's on 1 May 2027 and Vermont's on 1 January 2028. If those numbers disagree with the last tracker you read, check its date. In 2026 alone, Oklahoma (signed 20 March), Alabama (17 April), Louisiana (29 May) and Vermont (16 June) all became law within 88 days, so a chart saved before 20 March is four states short.

Law firms are careful, but they count differently and rarely say how. DLA Piper and Hunton both called Alabama the 21st state, which is a Florida-excluded count. Under the rule this tracker uses, Alabama is the 22nd. This tracker states its counting rule up front, then merges four layers that usually get tracked separately (statutes, amendments that changed them, deadlines that regulators created through rulemaking, and the cure-period sunsets that decide when enforcement bites) into two comparison tables and one dated calendar, with a visible changelog at the bottom. We wrote it for the counsel who maintains this exact table by hand today; it is one of the living trackers in our trackers and templates hub.

The counting rule this tracker uses. "Comprehensive" means a generally applicable consumer privacy statute that grants individual rights and puts obligations on controllers and processors. Enacted: 24. In effect: 20. That counts Florida's Digital Bill of Rights, which qualifies structurally but applies to sensitive-data sales by any for-profit business and to its other duties only above $1 billion in global revenue plus specific business models, which is why IAPP and FPF exclude it and land on 23 and 19. Sectoral laws, data-broker laws and children's codes never enter the headline count, though some appear in the calendar. On the Florida-excluded basis the 2026 signings were Oklahoma (20th), Alabama (21st), Louisiana (22nd) and Vermont (23rd). Never trust an ordinal ("the Nth state") from a source that does not state its rule.

The comparison tables cover every enacted state privacy law as of 1 October 2026

One row per enacted law, ordered by effective date. The "Amended since passage" column is where the compliance risk lives in 2025 and 2026. A dagger (†) marks a cell that rests on secondary summaries (FPF, IAPP, law-firm posts) because the state's own legislature or attorney general site blocked our fetchers or returned no text. The Indiana, Kentucky, New Hampshire, New Jersey and Rhode Island rows are wholly in that category, and several Utah cells are too. Confirm daggered cells against the statute before you rely on them.

In effect: 20 laws

Signed, not yet in effect: 4 laws

Reading notes. Thresholds are annual figures unless marked. "None found" in an enforcement cell means no public dated action turned up, which is not the same as no risk: several attorneys general run cure-notice sweeps that never become press releases, and Connecticut's had issued over two dozen cure notices across four sweeps by July 2025. The rows show what the statutes say; confirm your own applicability with counsel.

Amendments are now the main event: more than half of the states with laws have already changed them

FPF wrote on 3 September 2026: "More than half of the 23 states with comprehensive privacy laws have now amended their laws." If your tracker only logs enactments, it is already wrong many times over.

Delaware is the newest and the largest. Governor Meyer signed HB 380 on 2 September 2026, effective 1 January 2027. It cuts the applicability thresholds from 35,000 consumers (or 10,000 with over 20% of revenue from sales) to 10,000 (or 5,000 with over 20%), adds "third parties who acquire personal data from a controller" as covered persons, expands sensitive data, tightens minimization to "reasonably necessary and proportional" and adds assessments for profiling. A Delaware applicability call made in August is out of date on 1 January (FPF summary).

Connecticut has now amended its law twice in two years. Public Act 25-113 (SB 1295), signed 24 June 2025 and effective 1 July 2026, dropped the threshold from 100,000 to 35,000 consumers and removed it entirely for anyone processing sensitive data or offering personal data for sale, which, given how broadly "sale" reads, put most ad-supported businesses that touch Connecticut residents back into scope. It also imposed "reasonably necessary and proportionate" minimization and banned targeted advertising to, and the sale of the data of, consumers aged 13 to 17, with no consent exception. Public Act 26-64 (SB 4), signed 27 May 2026 and effective 1 October 2026, adds a ban on selling precise geolocation data, narrows "publicly available information" and creates a data broker registry with a 1 January 2027 registration date, per the Attorney General's advisory.

Montana went the same direction earlier. SB 297, signed 8 May 2025 and effective 1 October 2025, cut the thresholds to 25,000 consumers (15,000 with over 25% of revenue from sales), extended the minors' provisions to businesses with no consumer-count threshold, and eliminated a cure period that had been scheduled to end on 1 April 2026. A Montana assessment dated mid-2025 is now wrong.

Virginia added a known-child data rule (HB 707, effective 1 January 2025), an under-16 social media time limit (SB 854, effective 1 January 2026 and enjoined for NetChoice members since 27 February 2026) and a ban on selling precise geolocation data (SB 338, approved 13 April 2026 and effective 1 July 2026). Colorado added neural data, biometrics, minors' protections and a consent rule for the sale of sensitive data across four bills in two sessions. Kentucky amended its law in March 2025 (HB 473), nine months before it took effect, exempting data collected by HIPAA-covered providers, so a program scoped from the 2024 enrolled bill was stale on day one.

Three more 2026 amendments belong in any register. New Jersey's data broker law, which took effect when it was signed on 30 June 2026, bans the sale of sensitive data by any controller, whatever its volume. New Hampshire's HB 1460 bans the sale of a child's personal data, with or without consent, from 1 January 2027. And Kentucky's HB 692 adds certain smart TV data to the definition of sensitive data from 1 July 2027.

In my view, for a company that mapped the first fifteen states in 2023 and 2024, amendment-watching is now higher value than new-state-watching. A new state gives you runway: the four 2026 laws gave about seven months (Louisiana) to eighteen (Vermont) between signature and effective date. The amendments above gave anywhere from no runway at all (New Jersey's took effect the day it was signed) to almost fifteen months (Kentucky's HB 692), and they change obligations you have already operationalized, which is what static charts miss.

California's regulators keep creating deadlines that never passed through a statehouse

Static trackers also drop a second layer, the deadlines set by rulemaking. The California Privacy Protection Agency (CPPA, which now uses the name CalPrivacy) announced on 23 September 2025 that the Office of Administrative Law had approved its regulations on cybersecurity audits, risk assessments and automated decisionmaking technology (ADMT), effective 1 January 2026. "Effective" and "enforceable now" differ, and compressing them is the most common error in coverage of these rules. The phasing in the regulation text: ADMT compliance for significant decisions by 1 January 2027; risk assessments conducted in 2026 and 2027 submitted to the CPPA, as an attestation plus a summary, by 1 April 2028; and cybersecurity audit certifications due on 1 April 2028 for businesses over $100 million in revenue, 1 April 2029 for $50 to $100 million and 1 April 2030 below that.

The Delete Act (SB 362) runs on its own clock. Data brokers had to register with the CPPA between 1 and 31 January 2026 (a $6,000 annual fee plus a processing fee). From 1 August 2026 every registered broker must access the DROP deletion platform at least every 45 days and process the requests waiting in it, and the penalty is a daily meter: $200 for each day a broker fails to register and $200 for each deletion request for each day it fails to delete. Unlike a one-time fine, that penalty compounds while nobody is watching. Two more California changes arrive in January 2027. SB 923, signed 27 September 2026, extends the right to delete to information a business obtained from third parties, allows suppression lists and requires online-only businesses to offer a webform. And AB 566, the Opt Me Out Act signed 8 October 2025, requires browsers to offer opt-out preference signals. The CCPA's revenue threshold, $26,625,000 since 1 January 2025, is due for another CPI adjustment in 2027, because the CPPA adjusts its monetary thresholds every odd-numbered year.

Enforcement actions are no longer hypothetical, and California has two enforcers; conflating them is a recurring error. The Attorney General announced the $2.75 million Disney settlement on 11 February 2026, then, with four county district attorneys, a $12.75 million General Motors settlement on 8 May 2026, the largest CCPA penalty to date and the Attorney General's first data-minimization case, over sales of driving data. The CPPA's Board has issued its own fines, including Tractor Supply ($1.35 million, 30 September 2025, the largest in the agency's history at that time), PlayOn Sports ($1.10 million, March 2026, the first case involving students and schools) and Ford ($375,703, March 2026, for unnecessary friction in the opt-out process), alongside a run of Delete Act actions against data brokers. The Disney theory should worry every multi-service consumer business: the AG said Disney failed to carry opt-out requests across all devices and streaming services tied to an account, and that for consumers who opted out through Global Privacy Control it limited the request to the specific device in use, even when they were logged in.

Cure periods are disappearing, and they never guaranteed safety anyway

When enforcement actually bites is governed by two mechanisms that comparison charts under-specify: cure-period sunsets and universal opt-out commencement dates.

The cure map as of 1 October 2026. Eliminated: Montana, on 1 October 2025, so the AG can sue on day one. Ended: Colorado and Connecticut on 1 January 2025 (Connecticut's mandatory period ran through 31 December 2024), Delaware's mandatory period on 31 December 2025, Oregon's on 1 January 2026, Minnesota's on 31 January 2026, and, if the reported dates hold, New Jersey's around 15 July 2026 and New Hampshire's on 31 December 2025†. California has required no cure from the AG since 1 January 2023, and Rhode Island's law has none†. Discretionary: Florida (45 days), Delaware since 2026 and Maryland through 1 April 2027. Permanent: Virginia, Texas, Nebraska and Oklahoma (30 days), Tennessee (60 days), Iowa (90 days) and Alabama (45 days), with Utah, Indiana and Kentucky reported to have one†. Sunsetting by design: Louisiana's mandatory 30 days ends on 31 July 2027, and Vermont's 60 days runs from 1 January 2028 to 30 June 2029. The states diverge in enforcement philosophy, which is one reason a posture keyed to the strictest state is becoming the only maintainable strategy.

But treat the cure column as risk-shaping, not immunity. Connecticut's TicketNetwork settlement, $85,000 plus compliance reporting and announced on 8 July 2025, began with a cure notice sent on 9 November 2023. The company had 60 days, until 8 January 2024, and "did not resolve these deficiencies well beyond the cure period," the Attorney General said. A cure notice starts a documented record that makes the eventual settlement write itself.

On universal opt-out mechanisms, FPF counts twelve states whose laws require controllers to recognize opt-out preference signals, and all twelve requirements are now in force: California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon and Texas. The commencement dates differ, and secondary sources get them wrong: Colorado on 1 July 2024, Connecticut, Texas and Montana on 1 January 2025 (Connecticut's SB 1295 is a separate 2026 change), Nebraska on 1 January 2025 through an authorized-agent technology clause, Minnesota on 31 July 2025, Oregon and Delaware on 1 January 2026, and Maryland by 1 October 2025 as one of two permitted opt-out methods, not as a stand-alone mandate. New Hampshire and New Jersey are counted on FPF's word†. The 2026 laws point in different directions: Oklahoma, Louisiana and Alabama have no such duty (Alabama removed its requirement before passage), while Vermont adds one from 1 January 2028. The CPPA and the California, Colorado and Connecticut attorneys general jointly swept for Global Privacy Control compliance in September 2025, and eleven state attorneys general plus CalPrivacy now coordinate through the Consortium of Privacy Regulators, which Vermont joined on 4 August 2026.

The compliance calendar lists the key dated obligations from January 2026 through 2030

Statutes, amendments, regulator deadlines, cure sunsets and enforcement markers in one chronological view, verified against the linked sources as of 1 October 2026. Rows marked ✓ have passed and stay because they define the state of play. A dagger marks a date resting on secondary sources.

Forward-watch notes. Federally, the SECURE Data Act (H.R. 8413) was referred to the House Energy and Commerce and Judiciary Committees on 21 April 2026, and FPF reads its preemption language as capable of displacing state comprehensive laws; on 3 June 2026 CalPrivacy said it had joined a coalition of 18 attorneys general and state agencies opposing it. On the state side, DLA Piper's 10 March 2026 update listed 13 comprehensive bills in eight states in progress as of 2 March, including five in Illinois; Alabama has since enacted its bill, and Vermont enacted a law through a different bill, S.71. Pending bills stay out of the tables until a governor signs (or, Rhode Island-style, declines to). And IAPP's US State Privacy Legislation Tracker, updated 8 September 2026, remains the best bill-status resource; it tracks legislative motion, not compliance deadlines.

Run this as a maintained register, not a bookmarked chart

Keeping these tables true means watching 24 statutes, amendments at more than half of the states that have one, three rulemaking bodies (IAPP names Colorado, California and New Jersey as the states that give rulemaking authority to an agency), the enforcement programs of at least a dozen attorneys general plus CalPrivacy, thirteen opt-out signal regimes counting Vermont's, cure-period sunsets that keep arriving, and the bills that could add rows mid-session. Any chart dated before 20 March 2026 is at least four states short, and the four signed within 88 days. Trust pages that show their work: this page's regulatory change log is at the bottom, with every row sourced.

If you maintain this register by hand, three practices carry most of the value: log the amendment layer separately from the enactment layer (Kentucky and Delaware prove that enactment-only logs go stale, before a law starts and after it does); record both signed and effective dates (Maryland's 1 October 2025 and 1 April 2026 split is the cautionary example); and source every row to the statute or regulator page, never to coverage of it. Our regulatory change tracker spreadsheet implements those columns, and the regulatory change management policy template turns the cadence (who reviews, how often, who signs) into something an auditor can test. Other tracking methods are compared in how compliance teams track regulatory changes.

And yes, the disclosure, because this page is a working demonstration of my company's category: this is the job RegWatch automates. A Watchlist per jurisdiction, scheduled monitoring of the primary Sources (the CPPA announcements page, legislature bill feeds, attorney general press rooms), each hit landing as a Finding with its source URL, dates and verbatim excerpt, triaged into an Alert with a written "Why this matters," and converted into an Obligation with an owner and a deadline. But the register logic above is tool-agnostic: a counsel with a disciplined spreadsheet and a Friday review block will beat a team with expensive software and no changelog.

The amendment layer (laws changing before and after they take effect, regulators out-legislating legislatures) has made every undated chart quietly dangerous, so ask any privacy-law tracker for its counting rule and its changelog.

The changelog records every revision to this tracker

---

This article is general information, not legal advice.