December 31, 2025

How Organizations Can Prepare for U.S. Privacy Laws in 2026

The U.S. privacy landscape is evolving quickly, with an increasing number of states enacting and enforcing data privacy laws. The United States does not have a single federal privacy law; instead, each state has its own legislation, with varying effective dates, compliance thresholds, and requirements. For organizations operating across multiple jurisdictions, technologies, and markets, proactive planning is essential to manage risk, streamline operations, and safeguard long-term business continuity and growth.

This article highlights the key privacy law changes that took effect in 2025 and examines how they will influence compliance requirements in 2026. It also outlines the new laws and regulatory trends organizations should prepare for in the coming year.

Key U.S. Privacy Developments in 2025

Ongoing concerns about the processing, storage, and protection of personal data, along with the increasing impact of artificial intelligence (AI), continued to drive the passage of state-level privacy regulations in 2025. Eight new state laws went into effect, each granting consumer rights and imposing obligations on data controllers. Requirements varied but often included data minimization, confidentiality, opt-out mechanisms, consumer rights, and data protection assessments.

Notable State Laws Effective in 2025

The Delaware Personal Data Privacy Act (DPDPA) went into effect on January 1, 2025.
The Iowa Consumer Data Protection Act (ICDPA) went into effect on January 1, 2025.
The Nebraska Data Privacy Act (NDPA) went into effect on January 1, 2025.
New Hampshire Data Privacy Law (NHDPL) went into effect on January 1, 2025.
The New Jersey Data Privacy Act (NJDPA) went into effect on January 15, 2025.
The Tennessee Information Protection Act (TIPA) went into effect on July 1, 2025.
The Minnesota Consumer Data Privacy Act (MCDPA) went into effect on July 31, 2025.
Maryland Online Data Protection Act (MODPA) went into effect on October 1, 2025.

Stronger Enforcement Postures

Regulators also intensified enforcement in 2025:

Google and YouTube settled for $30 million over violations of children’s privacy laws stemming from the collection of data without parental consent.
Healthline Media settled for $1.55 million over alleged CCPA violations involving deceptive opt-outs and improper data sharing.
Tractor Supply Company was fined $1.35 million for CCPA violations, including failing to maintain a privacy policy and failing to provide consumers with an effective mechanism to opt-out of the selling and sharing of their personal information, with mandated corrective measures.
Paddle settled with the FTC for $5 million regarding alleged violations of the Telemarketing Sales Rule.

Global Privacy Control Recognition

By the end of 2025, twelve states will legally require businesses to honor Global Privacy Control (GPC) opt-out signals, with enforcement already underway in California, Colorado, and Connecticut. States where GPC recognition will be mandatory include: California, Colorado, Connecticut, Texas, Montana, New Hampshire, Nebraska, Oregon, Delaware, New Jersey, Minnesota, and Maryland.

GPC is a universal opt-out mechanism that allows consumers to easily prevent the sale or sharing of their personal information across websites and devices. Businesses that collect personal information online must honor these signals as valid opt-out requests under applicable state laws.

Protection of Children’s Data

In 2025, the U.S. strengthened protections for children’s data online. Michigan House Bill 5357 introduced new rules for online services aimed at minors, focusing on privacy, safety, and prohibited practices. Updated COPPA rules took effect on June 23, 2020, reinforcing safeguards for the collection and use of children’s personal information. Meanwhile, Florida filed a lawsuit against Snap, Inc. on April 22, 2025, alleging that Snapchat misled parents about the risks their children face on the app. Organizations should anticipate additional state-level laws, stricter regulations, and increased enforcement targeting the protection of minors online.

What to Expect in 2026

Several new privacy laws will take effect in 2026, introducing expanded consumer rights and additional obligations for organizations across multiple states.

Indiana Consumer Data Protection Act (INCDPA): Effective January 1, 2026, granting residents comprehensive privacy rights and imposing controller obligations.
Kentucky Consumer Data Protection Act (KCDPA): Effective January 1, 2026, establishing opt-out rights for targeted advertising or data sales.
Rhode Island Data Transparency and Privacy Protection Act (RIDPA): Effective January 1, 2026, providing residents more control over personal data.
Delaware Universal Opt-Out Requirement: GPC recognition mandatory from January 1, 2026.
Minnesota Consumer Data Privacy Act (MCDPA): Mandatory right-to-cure period expires January 1, 2026.
Montana Consumer Data Privacy Act (MTCDPA): Right-to-cure period expires April 1, 2026.
Louisiana Kids Online Protection and Anti-Grooming Act: Effective June 1, 2026.

Other Trends

Data brokers: States are increasing oversight of data brokers, with laws that require registration, consumer consent for data use, and stronger security practices. Vermont’s House Bill 211 is one example, setting requirements for data broker registration, consent, and security. In Texas, Senate Bill 2121 expanded the scope of regulated entities acting as data brokers. In California, the Delete Request and Opt‑Out Platform (DROP), established under the Delete Act, will launch in 2026 to allow consumers to submit a single deletion request through a central platform, and data brokers will be required to process those deletion requests beginning in August 2026. The California model, particularly the accessible deletion mechanism, is likely to influence other states, which may adopt similar deletion and opt‑out tools, broaden deletion obligations, and increase scrutiny of third‑party data use.
AI and sensitive data: The CCPA now includes neural and AI-derived personal data in its definition of sensitive data, reflecting a growing regulatory focus on AI-driven profiling. Given the growing use of AI in data processing, several states may adopt similar definitions and requirements in 2026, signaling continued emphasis on oversight of AI‑related personal data.

How Organizations Should Prepare for 2026

To navigate the expanding and fragmented U.S. privacy landscape, organizations should adopt an integrated and proactive strategy. Here are some of the main steps to consider:

Map Jurisdiction-Specific Requirements: Identify which state laws apply based on where your organization processes personal data, and document the specific obligations under each law, including consumer rights, opt-out mechanisms, data breach notification, and sensitive data handling.
Develop a Unified Privacy Policy: Implement a single privacy policy that covers core principles and processes for all states, while incorporating specific provisions to reflect unique requirements where necessary.
Honor Opt-Out Signals: Implement systems to accept universal opt-out signals, including Global Privacy Control, in all applicable states.
Conduct Privacy and Data Protection Impact Assessments: Implement DPIAs for high-risk processing, such as the collection of sensitive data or AI-driven profiling, aligned with applicable state requirements.
Review Vendor Contracts and Third-Party Processing: Confirm that all vendors and processors comply with privacy standards across states, updating contracts and performing due diligence as needed.
Implement Operational Compliance Tools: Use consent management platforms, rights request workflows, and privacy management systems that support a unified policy while handling state-specific requirements.

Conclusion

The rapid changes of 2025 set the stage for a transformative 2026 in U.S. privacy regulation. With new laws taking effect, cure periods expiring, and automated opt-out mechanisms becoming standard; multinationals must adopt a proactive, integrated approach to privacy management. Early action reduces regulatory risk and strengthens operational resilience across the United States and globally.

Organizations seeking structured guidance across this evolving landscape may benefit from partnering with a trusted privacy advisor such as VeraSafe, which specializes in multinational privacy compliance strategy and operationalization.

Related topics: US Privacy Laws