New Privacy Laws in 2026: What Changed and What It Means for You
Key takeaways
- Do not infer a new right from a headline; confirm enacted text, effective date, scope, and regulator guidance.
- Privacy laws vary by state and by the type of business or processing covered.
- Rights may include access, correction, deletion, or opt-out, with exceptions and eligibility requirements.
- A broker request is a practical action, not proof that a particular new law applies.
The Explosion of US State Privacy Laws
The US privacy landscape has changed dramatically. What started with California's CCPA in 2020 has become a nationwide movement. By the start of 2026, at least 18 states have enacted comprehensive consumer privacy laws: California, Virginia, Colorado, Connecticut, Utah, Iowa, Indiana, Tennessee, Montana, Texas, Oregon, Delaware, New Hampshire, New Jersey, Nebraska, Minnesota, Maryland, Rhode Island, and Kentucky. Several more states have bills in committee.
These laws share common elements: the rights to access, delete, and correct personal data; the right to opt out of data sales and targeted advertising; and requirements for data protection assessments. However, each state has taken a slightly different approach to enforcement, applicability thresholds, and definitions. This patchwork creates complexity for businesses but provides increasingly strong protections for consumers.
Spotlight: Texas, Oregon, and Montana
The Texas Data Privacy and Security Act (TDPSA) stands out because it has no minimum revenue or data volume threshold. Unlike most state laws that only apply to companies meeting certain size requirements, the TDPSA applies to any business operating in Texas that processes personal data, making it one of the broadest privacy laws in the country. It includes standard consumer rights plus specific provisions for biometric data.
Oregon's Consumer Privacy Act goes further than most by including nonprofit organizations in its scope, a rarity among state privacy laws. It also provides a specific right to obtain a list of third parties to whom a controller has disclosed personal data. Montana's Consumer Data Privacy Act, while similar to Connecticut's law in structure, is notable for applying to all businesses processing data of Montana residents, with a population threshold of just 50,000 consumers.
These newer laws reflect a trend toward broader applicability and stronger consumer rights. They also increasingly include provisions specifically targeting data brokers, requiring broker registration with state authorities and providing consumers with streamlined deletion processes.
GDPR Enforcement Reaches New Heights
European GDPR enforcement continued to accelerate through 2025. Major fines included a 1.2 billion euro penalty against Meta for transferring EU user data to the United States without adequate safeguards, and significant fines against several advertising technology companies for unlawful tracking practices. The cumulative total of GDPR fines surpassed 4.5 billion euros by the end of 2025.
Perhaps more significant than the headline fines is the increasing enforcement against smaller companies and specific data practices. Regulators have brought actions against data brokers operating in the EU, requiring them to demonstrate lawful bases for processing personal data. Several people-search services have been ordered to delete profiles of EU residents entirely, setting precedents that privacy advocates hope will extend to US enforcement.
The Push for Federal Privacy Legislation
The American Privacy Rights Act (APRA) was reintroduced in Congress in late 2025, representing the most serious attempt at comprehensive federal privacy legislation to date. The bill would establish a national standard for data privacy, potentially preempting the growing patchwork of state laws. Key provisions include consumer rights to access, delete, and correct data, restrictions on data collection to what is reasonably necessary, and a private right of action allowing individuals to sue for violations.
However, the bill faces significant political challenges. Industry groups have lobbied against strong preemption provisions that would override stricter state laws like CCPA. Privacy advocates argue that the bill's enforcement mechanisms are too weak and that it could actually weaken protections in states with strong existing laws. As of early 2026, the bill remains in committee, and experts predict that a comprehensive federal privacy law is still at least one to two years away.
What These Changes Mean for You
The practical impact of these new laws is significant. If you live in a state with a privacy law, you now have specific, enforceable rights to demand that companies reveal what data they have about you and delete it upon request. Even if you do not live in a covered state, many companies apply the same standards nationwide to simplify compliance.
For data broker removal specifically, the new state laws are a powerful tool. Several states now maintain public registries of data brokers and provide dedicated opt-out mechanisms. Vermont, California, and Oregon lead in this area, with their data broker registries making it easier to identify and submit removal requests to registered brokers. At protectmydata, we leverage these legal frameworks to strengthen our automated removal requests and ensure compliance.
Stay informed about your state's privacy laws and exercise your rights. The more consumers actively use these tools, the stronger the pressure on legislators to enact comprehensive federal protections. In the meantime, combining legal rights with practical tools like automated data removal provides the most effective privacy protection available.
How can you tell whether a privacy-law change affects you?
Check the enacted law and official state or regulator explanation rather than relying on a summary. Confirm whether the law is effective, who qualifies as a consumer, which businesses are covered, and what processing is in scope.
Proposals, signed laws, effective provisions, and enforcement guidance are different milestones. A headline that says a law 'passed' does not necessarily mean every right is immediately available.
Why do state privacy rights differ?
States define covered businesses, consumer rights, exemptions, and enforcement routes differently. Some rights concern targeted advertising or sale, while others concern access, correction, deletion, or sensitive information.
Read the relevant official text and regulator FAQ before making a request. A broker's status and its particular activity may affect which provision applies.
What should residents do now?
Identify the business and data use, then use its published privacy channel to exercise an applicable right. Keep the request and response, and avoid promising that a law requires deletion of every record.
Where rights are unclear or the response is disputed, follow the responsible regulator's complaint process. Obtain legal advice for high-impact matters rather than relying on general editorial guidance.
Does an update change what a removal service can promise?
No. A service's ability to submit requests depends on its own scope and each site's process, not just the existence of a privacy law. Legal rights can have exceptions and do not ensure a particular operational result.
Use a service to reduce covered broker exposure if that is useful, while treating regulatory rights and source-record changes as separate questions.
At a glance
| Milestone | What to verify | Why it matters |
|---|---|---|
| Enactment | Official statute text | Separates law from proposal |
| Effective date | Current official implementation status | Rights may not yet be operative |
| Coverage | Consumer, business, and processing definitions | Not every company or record is covered |
| Enforcement | Regulator and complaint route | Clarifies how to escalate |
Verify a reported law change
Find the official enacted text or regulator page.
Check enactment and effective-date status.
Review residency, business, and processing scope.
Identify the specific right and relevant exception.
Use the official request or complaint channel and retain records.
From law headline to usable right
Verify the legal milestone and scope before selecting a privacy request.
- Read headline
- Confirm enacted text
- Check effective status
- Assess scope and exceptions
- Use official request route
Frequently asked questions
Does a passed bill always create an active right today?
No. Verify effective provisions and current official guidance.
Do all state laws cover every data broker?
No. Business thresholds, definitions, and exceptions vary.
Does a service request prove legal compliance?
No. It is an operational request, not a legal determination.
Sources
Related privacy guides
- review removal operations
See how requests are handled separately from legal interpretation.
- check broker-site scope
Assess service coverage without assuming a law applies to every listed site.
- review service options
Compare practical assistance after verifying your rights and needs.
- browse privacy-law guides
Use related explainers alongside official current legal texts.
More on Privacy & Regulation
- Your Rights Under GDPR and CCPA: A Complete Guide
Privacy regulations give you powerful tools to control your personal data. Learn what rights you have under both GDPR and CCPA, and how to exercise them effectively to force companies to delete your information.
- Are Data Brokers Legal? What the Law Actually Says
Data brokers operate legally in most countries despite collecting and selling your information without your consent. Here is what privacy laws actually cover, and the significant gaps that remain.
- How to Stop Data Brokers Legally
About the author
European Privacy & Regulation. Theo covers privacy law and regulation, including how evolving rules affect people’s rights and the ways organizations handle personal data.