Privacy Law Blog
News, analysis, and practical guides on US state privacy laws.
Washington State Privacy Law 2026: MHMDA, Biometric Rules, and Business Checklist
Washington does not yet have a comprehensive consumer privacy act, but businesses still need to account for the My Health My Data Act, biometric identifier rules, health-data sale authorizations, geofence restrictions, and the stalled HB 1671 comprehensive privacy bill.
Read moreFlorida Data Breach Notification Law: Requirements, Timelines, and Compliance Guide
Florida Statutes §501.171 (FIPA) requires breach notification within 30 days — one of the shortest deadlines in the US. This guide covers the 30-day timeline, AG reporting for 500+ individuals, credit agency notification for 1,000+, penalties up to $500,000, third-party agent 10-day rule, and a practical incident response plan.
Read moreTexas Data Breach Notification Law: Compliance Requirements and 60-Day Deadline
Texas Business & Commerce Code Chapter 521 requires breach notification within 60 days. This guide covers who must comply, what triggers notification, AG reporting for 250+ residents, the Texas AG's $1.375B Google settlement, and a practical incident response plan.
Read moreCalifornia 30-Day Data Breach Notification Law: What SB 1223 Means for Your Business
California SB 1223 shortened the breach notification deadline to 30 calendar days. This guide covers who must comply, what triggers notification, California AG reporting requirements, CCPA private right of action for breaches, and a practical 30-day incident response plan.
Read moreCCPA Cybersecurity Audit Requirements 2026: Thresholds, Deadlines & ADMT Rules
New CCPA regulations effective January 1, 2026 require qualifying businesses to conduct annual cybersecurity audits and ADMT risk assessments. This guide covers who must comply, what audits must cover, the tiered certification deadline schedule, and a practical compliance roadmap.
Read moreState Privacy Laws for Nonprofits: Which Laws Apply to Your Organization in 2026
Not all state privacy laws exempt nonprofits. Colorado, New Jersey, Delaware, Maryland, Oregon, and Minnesota offer no or minimal exemptions. This guide maps which of the 20 US state privacy laws cover nonprofits, explains narrow exemptions in Indiana and Kentucky, and provides a compliance checklist.
Read moreApp Store Privacy Laws: How State Accountability Acts Are Changing Mobile App Compliance in 2026
At least four US states have enacted app store accountability acts requiring age verification, parental controls, and developer privacy obligations. This guide covers Alabama HB 161, Utah's expanded framework, California's Age-Appropriate Design Code, and practical compliance steps for app developers.
Read moreQ3 2026 Privacy Compliance Deadlines: Connecticut, Virginia, DELETE Act, and Nebraska
July through September 2026 brings major privacy compliance deadlines: Connecticut's sweeping SB 1295 amendments take effect July 1 dropping thresholds and adding neural data protections, Nebraska begins enforcing LB 504 with $50K-per-violation penalties, and California's DELETE Act DROP system opens August 1. Your compliance timeline and checklist.
Read moreAI and Data Privacy 2026: State Law Compliance Guide (CCPA ADMT, Profiling, AI Training)
At least 15 state privacy laws regulate AI through profiling and automated decision-making provisions. This guide covers data protection assessments, consumer opt-out rights, transparency requirements, sensitive data rules, and a 10-step compliance checklist for businesses deploying AI tools.
Read moreHow to Conduct a Privacy Impact Assessment: A Step-by-Step PIA Guide for US State Privacy Laws
Over 15 US state privacy laws now require data protection assessments for high-risk processing. This practical guide walks you through the 8-step PIA process, provides a reusable assessment template, identifies common triggers, and covers state-specific requirements from California to Maryland.
Read moreCOPPA Rule Update 2026: What Changed + Compliance Checklist
The FTC's amended COPPA Rule has applied in full since its April 22, 2026 compliance date, with expanded personal information definitions, mandatory data retention limits, separate parental consent for third-party sharing, and new consent verification methods.
Read moreFERPA vs COPPA Compliance: A Practical Guide to Student Data Privacy in 2026
FERPA and COPPA both protect student data but work differently. Compare the two federal laws, understand where they overlap for EdTech companies, learn how state privacy laws add a third compliance layer, and use our checklist to navigate all three after the PlayOn enforcement case.
Read moreCCPA Exemptions: Who Is Exempt and What Data Is Excluded
Complete guide to CCPA exemptions: entity-level exemptions (nonprofits, small businesses, government), data-level exemptions (HIPAA, GLBA, FCRA), the expired B2B and employee exemptions, common misconceptions, and how to determine if your business qualifies.
Read moreDark Patterns and Privacy Opt-Out Compliance: What the CPPA Enforcement Actions Mean for Your Business
The CPPA is cracking down on dark patterns in privacy opt-out flows. Learn from the Disney, Ford, and PlayOn enforcement actions what counts as opt-out friction, how to audit your consent workflows, and a practical compliance checklist for multi-state compliance.
Read moreAutomated Decision-Making and Profiling Under US State Privacy Laws: What Businesses Must Know in 2026
US state privacy laws increasingly regulate AI and automated decision-making. Learn which states require profiling opt-outs, data protection assessments, and transparency — plus a practical compliance framework for businesses using algorithmic systems.
Read moreThird-Party Data Sharing Under US State Privacy Laws: Rules, Requirements, and Compliance Guide
Every US state privacy law regulates third-party data sharing. Learn what counts as "selling" vs. "sharing," the three consumer opt-out rights that govern data sharing, state-by-state differences, and how to build a compliant program — with lessons from recent enforcement actions.
Read moreCCPA Compliance Software 2026: 6 Controls to Test
Evaluate CCPA compliance software against six operational controls: consumer requests, GPC and sale/share opt-outs, notices, data mapping, vendor suppression, and 2026 risk governance.
Read moreVermont Data Broker Registry 2026: How to Opt Out + H 211 Update
Governor Scott signed Vermont H 211 on June 16, 2026 as Act 138 — a $900 broker registration fee, a $20,000 surety bond, and new disclosure duties, effective January 1, 2027. The Senate cut the universal deletion portal to a study. Bill status, opt-out steps, and what brokers should prepare for.
Read moreCookie Consent Requirements Under US State Privacy Laws: What You Actually Need in 2026
No US state privacy law requires a cookie consent banner — but 12 of the 20 laws in force require you to honor a universal opt-out signal automatically. A practical guide to CCPA/CPRA cookie rules and GPC obligations, with every in-force state law compared and an 8-point compliance checklist.
Read morePrivacy Law Cure Periods by State: Which States Still Allow Time to Fix Violations in 2026?
Cure periods are disappearing across US state privacy laws. New Hampshire and Delaware moved to discretionary cure offers in January 2026, New Jersey's temporary window has ended, and Tennessee retains a permanent 60-day period.
Read moreData Processing Agreements Under US State Privacy Laws: What Your Vendor Contracts Need in 2026
Every state privacy law requires written contracts with vendors who process personal data. Learn the core DPA requirements, how they differ across California, Virginia, Colorado, Texas, and Maryland, and use our 10-point checklist to audit your vendor agreements.
Read moreBiometric Privacy Laws by State: Which States Regulate Fingerprints, Face Scans, and Voiceprints in 2026?
A comprehensive state-by-state guide to biometric privacy laws — from Illinois BIPA's billion-dollar lawsuits to Texas CUBI, Washington's biometric law, and biometric provisions in all 21 comprehensive state privacy laws. Includes a 7-step compliance framework.
Read moreWorkplace Privacy Laws by State 2026: Employee Data Compliance Guide
Most state privacy laws exempt employee data — but California CCPA, Illinois BIPA, and state employee-monitoring notice laws create real HR obligations. Learn which states cover workplace information, what New York, Connecticut, and Delaware require for monitoring notices, why Maryland MODPA does not cover employment-context data, and how to build an employee data privacy program.
Read moreWhich States Ban the Sale of Location Data? Geolocation Privacy Laws Explained
Virginia SB 338 is poised to ban the sale of precise geolocation data, joining Oregon and Maryland. A complete guide to which states restrict location data sales, why regulators are cracking down, and the compliance steps every business should take now.
Read moreConnecticut SB 4 Is Now Public Act 26-64: CTDPA Expansion, Data Broker Registry, and Geolocation Ban
Connecticut SB 4 is now Public Act 26-64. The law adds data broker registration, a statewide deletion mechanism, surveillance-pricing disclosure, facial-recognition signage duties, genetic-testing protections, and a precise-geolocation sale ban.
Read moreDisney CCPA Settlement: $2.75M Fine and What Every Business Must Learn About Opt-Out Compliance
Analysis of the Disney $2.75M CCPA settlement — the then-largest California privacy settlement, later surpassed by General Motors — plus Ford's $375K fine and PlayOn's $1.1M penalty.
Read moreRight to Be Forgotten in the US: Do State Privacy Laws Give You Deletion Rights?
The EU has a famous "right to be forgotten" — but does the US? Learn how 21 state privacy laws provide data deletion rights, how they compare to the EU right to erasure, and what businesses must do to comply with deletion requests.
Read morePrivacy Policy Requirements by State: What US Privacy Laws Require in Your Privacy Notice
A state-by-state guide to privacy policy requirements under US state privacy laws. Learn exactly what disclosures California, Virginia, Colorado, Connecticut, Texas, Maryland, and 15 other states require — with a 10-point compliance checklist and common mistakes that trigger enforcement.
Read moreCalPrivacy Fines PlayOn Sports $1.1M: 5 CCPA Compliance Lessons From the Student Privacy Case
The California Privacy Protection Agency issued a $1.1 million fine against PlayOn Sports for CCPA violations involving student data on the GoFan ticketing platform. Analysis of the enforcement action and five key compliance takeaways for any business.
Read moreCalifornia Delete Act (SB 362): What Businesses Must Know Before August 2026
The California Delete Act creates a one-click deletion mechanism for consumers to remove their data from all registered data brokers. Complete guide covering data broker registration, the DROP platform launching August 2026, enforcement actions already taken, and an 8-step compliance checklist.
Read moreData Retention Policy: What US State Privacy Laws Require and How to Build One
Learn what a data retention policy is, why 20+ US state privacy laws effectively require one, and how to create a compliant policy. Includes best practices, retention period examples by data category, a sample template structure, and a step-by-step guide.
Read moreData Minimization Under US State Privacy Laws: What It Means and How to Comply
Data minimization is becoming a defining requirement of US state privacy laws. Complete guide covering what it means, how Maryland MODPA sets the strictest standard, practical compliance examples, a step-by-step checklist, and how it compares to GDPR.
Read moreCOPPA Compliance 2026: The Amended FTC Rule, Now in Full Force
The FTC's amended COPPA Rule reached its main compliance date on April 22, 2026. This guide covers biometric data protections, updated parental consent methods, retention policies, third-party disclosure rules, and a step-by-step compliance checklist.
Read moreData Privacy Impact Assessments Under US State Laws: Complete 2026 Guide
At least 15 US state privacy laws require data protection impact assessments (DPIAs) for high-risk processing. Guide covering which states require them, what triggers an assessment, how to conduct one, and a free template checklist.
Read moreData Breach Notification Laws by State: A Complete 2026 Guide
All 50 US states have data breach notification laws with varying timelines, definitions, and penalties. Complete guide covering notification deadlines, AG reporting requirements, encryption safe harbors, and a multi-state response plan.
Read moreHow to Opt Out of Data Brokers in 2026: A Complete Step-by-Step Guide
Step-by-step guide to removing your personal information from data broker databases. Covers the California Delete Act DROP mechanism, your opt-out rights under 20+ state privacy laws, and DIY vs. service approaches.
Read moreSensitive Data Under State Privacy Laws: What Counts and Why It Matters
Not all personal data is treated equally. Learn how different US state privacy laws define sensitive data — from biometric to geolocation to neural data — and the opt-in consent requirements that apply.
Read moreVirginia Consumer Data Protection Act (VCDPA) 2026 Guide
VCDPA guide covering 2026 SB 338 geolocation ban, applicability thresholds, 8 consumer rights, permanent 30-day cure period, $7,500 penalties, and compliance steps.
Read moreConnecticut Data Privacy Act (CTDPA): Complete 2026 Compliance Guide
Major SB 1295 overhaul effective July 1, 2026 — lowered thresholds (35K), AI/LLM transparency requirement, GLBA exemption eliminated, expanded sensitive data categories, and strengthened minor protections.
Read moreColorado Privacy Act (CPA) 2026 Compliance Checklist
Colorado CPA checklist covering the six 2026 triggers: thresholds, GPC/universal opt-out, precise geolocation consent, minor-data rules, DPAs, rights workflows, and no cure period.
Read moreOCPA Compliance Checklist 2026 — 10 Steps + Oregon Privacy Law Calculator
Oregon's OCPA applies to nonprofits, uses a 25K-consumer plus 25% data-sale threshold, requires GPC, bans minor data sales, and has no cure period.
Read moreIowa ICDPA Compliance 2026: Checklist, Thresholds & 90-Day Cure
Iowa's ICDPA is the most business-friendly state privacy law — fewest consumer rights, longest cure period (90 days), and no GPC requirement. Complete guide to compliance.
Read moreHow to Respond to Consumer Privacy Data Requests: A Multi-State Compliance Guide
Practical guide to handling consumer data subject access requests (DSARs) under 20+ US state privacy laws. Covers response timelines, authentication, request types, and multi-state compliance strategies.
Read moreCCPA Penalties & Fines 2026: Amounts, Recent Cases, and Multi-State Enforcement
Complete guide to US state privacy law penalties across all 20 states. Per-violation amounts, real enforcement cases from 2026, cure period changes, and how to minimize your penalty risk.
Read moreCCPA Compliance Checklist: The Complete 2026 Guide for Businesses
Step-by-step CCPA compliance checklist covering consumer rights, opt-out mechanisms, GPC signals, privacy policy requirements, service provider agreements, and enforcement-ready documentation.
Read moreCCPA Notice & Privacy Policy Requirements: 2026 Checklist
Separate the CCPA Notice at Collection from the annual privacy policy, place each disclosure at the right collection point, and cover rights, retention, sharing, opt-outs, and GPC.
Read moreDo Not Sell or Share My Personal Information: State Rules (2026)
Comprehensive guide to CCPA "Do Not Sell" requirements, which states require it, what counts as a sale, how to implement opt-out links, honor GPC signals, and avoid dark pattern violations.
Read moreManaging User Consent in Compliance with Data Privacy Laws: A Practical Guide
With 21 states now having privacy laws, consent management is a legal necessity. Covers opt-in vs opt-out models, GPC signals, consent platforms, and state-by-state requirements.
Read moreUniversal Opt-Out Mechanism (UOOM) Compliance: What Every Business Needs to Know in 2026
12 US states now require businesses to honor universal opt-out mechanisms like Global Privacy Control. Which states, what the requirements are, and how to implement compliance.
Read moreHow Much Does Privacy Compliance Cost a Small Business in 2026?
Practical breakdown of privacy compliance costs: DIY vs. outsourced, state-by-state impact, cost-saving tips, and why non-compliance costs 100x more.
Read moreHow to Be CCPA Compliant in 2026: Business Compliance Guide
Everything businesses need to know about CCPA compliance: who it applies to, consumer rights, key requirements, recent $4M+ in enforcement fines, and a step-by-step compliance checklist.
Read moreMaine LD 1822 Failed: What the Online Data Privacy Act Would Have Required
Maine LD 1822 died between houses on April 13, 2026. Overview of the failed bill, the removed July 2026 deadline, and privacy themes to watch next.
Read moreConnected Car Data Privacy: How Your Vehicle Collects and Shares Your Data
Your connected car may be sharing driving data with insurers without your knowledge. Learn about the Texas vs Allstate lawsuit, state privacy protections, and what businesses and consumers can do.
Read moreData Broker Registration Requirements in 2026: State-by-State Guide
Five states require or have enacted data broker registration in 2026. Complete guide to California, Vermont, Texas, Oregon, and Connecticut requirements including fees, deadlines, and deletion mechanisms.
Read moreCCPA Opt-Out Requirements in 2026: What Businesses Must Do Now
Complete guide to CCPA opt-out requirements including mandatory confirmation, GPC compliance, symmetric design rules, and lessons from $4M+ in recent fines.
Read more2026 CCPA Enforcement Wave: Disney, PlayOn Sports, and Ford Fines Explained
California regulators issued over $4 million in privacy fines in early 2026. What your business can learn from the Disney, PlayOn, and Ford cases.
Read moreCCPA vs CPRA: What Changed and What It Means for Your Business
The CPRA amended and expanded the original CCPA. Learn the key differences including new consumer rights, stricter obligations, and the California Privacy Protection Agency.
Read moreState Privacy Laws vs. HIPAA: 21-State Chart
HIPAA sets a federal floor for health data privacy, but state laws can impose stricter requirements. Learn when state law takes precedence.
Read moreHow Many States Have Data Privacy Laws in 2026? Complete Guide
As of March 2026, 20 US states have enacted comprehensive data privacy laws. See the full list with effective dates, key thresholds, and what it means for your business.
Read moreCA/CO/CT Joint GPC Enforcement Sweep: Are You Ready?
Three states are actively checking websites for GPC compliance. Here's what they're looking for and how to prepare.
Read morePrivacy Compliance for E-commerce Businesses in 2026
A practical guide for online retailers navigating multi-state privacy requirements, from cookie consent to data deletion.
Read moreCCPA vs GDPR: Key Differences for US Businesses
Already GDPR compliant? Here's what you still need to do for California and other US state privacy laws.
Read moreStay Updated on Privacy Laws
Get monthly updates on new laws, enforcement actions, and compliance deadlines.
No spam. Unsubscribe anytime.