On January 1, 2026, three more states switched on their privacy laws. Indiana, Kentucky and Rhode Island joined a list that now stands at roughly 20 states with comprehensive consumer privacy laws, and there is still no federal law to tidy the picture up. For a marketing team selling across the country, the headline reads like a threat: twenty sets of rules, twenty thresholds, twenty definitions, and a map that changes every year.
Here is the reframe that makes the wave manageable. Twenty laws do not mean twenty compliance projects. For a marketer, they boil down to about five recurring mechanics: opt-outs from targeted advertising, universal opt-out signals, consent for sensitive data, protections for minors, and handling consumer requests. The teams that cope best stop tracking the map state by state and instead build once, to the strictest version of each mechanic. This piece explains what changed in 2026, where the rules genuinely diverge, and how to turn a patchwork into one programme.
This is general guidance for marketers, not legal advice. State privacy laws differ in their details, thresholds and exemptions, and they change often. Confirm your obligations with a qualified privacy professional.
What changed in 2026
The January wave was the latest step in a trend that has been building since California went first. The three new laws follow the broad model most states have adopted: consumers get rights to access, correct, delete and port their data, businesses must offer opt-outs from targeted advertising and data sales, and sensitive data needs opt-in consent. Enforcement sits with each state's attorney general, with civil penalties in the range of several thousand dollars per violation.
Two details from the new laws matter more than the count. Rhode Island set a low bar, reaching businesses that handle data on about 35,000 residents, or fewer if a meaningful share of revenue comes from selling data. It also offers no cure period, so there is no grace window to fix a problem once regulators notice it. Alongside the new laws, several existing ones were amended to widen their reach. The direction is consistent: more states, lower thresholds, stricter treatment of sensitive data and minors, and fewer second chances. More states have already signed laws that take effect in 2027, so the list will keep growing. This is the state-level backdrop to the broader enforcement trend we covered in rising privacy fines in 2026.
Twenty laws, five mechanics
Read the laws side by side and the differences look endless. Read them as a marketer, asking only what they require you to do, and they collapse into a short list. Almost every obligation that touches your campaigns, your site and your data falls under one of five mechanics.
| Mechanic | What most states require | What marketers must do |
|---|---|---|
| Targeted-ad opt-out | Let people opt out of targeted ads and data sales | A working opt-out that actually stops sharing |
| Universal opt-out (GPC) | Treat browser signals as a valid opt-out (about 12 states) | Detect GPC and suppress ad and sharing tags |
| Sensitive data | Opt-in consent before processing | Consent before using health, location and similar data |
| Minors | Limits on targeting and selling teen data | Know when you may be reaching minors, and restrict it |
| Rights & assessments | Answer requests on deadline; assess high-risk processing | A request workflow and a targeted-ads assessment |
What varies between states is mostly the dial setting on each mechanic, not the mechanic itself. One state sets the applicability threshold at 100,000 residents and another at 35,000. One requires GPC and another doesn't yet. One defines sensitive data more broadly than its neighbour. That is why the practical strategy is to find the strictest setting of each dial and build to that. Our GDPR and CCPA checklist covers the foundations; the state wave mostly adds new settings to the same dials.
SaneBox
AI sorts, filters, and prioritizes your inbox across any email client — nothing to install.
Best for: Professionals drowning in email overload
The reframe Twenty state privacy laws do not mean twenty compliance projects. For marketers they come down to five mechanics. Build each one to the strictest standard once, and every new state becomes a small update instead of a new crisis.
The one to fix first: universal opt-out signals
If your team only has time for one change this quarter, make it Global Privacy Control. GPC is a signal that a browser or extension sends automatically to say "do not sell or share my data." Around a dozen states, including California, Colorado, Connecticut, Oregon, Texas, New Jersey and Maryland, now require businesses to treat it as a valid opt-out with no extra click. California has gone further and expects a visible confirmation that the request was honored.
This is the obligation marketing teams most often miss, because nothing about it is visible in a demo. The signal arrives silently, and honoring it means your site must detect it and then genuinely switch off the relevant advertising pixels and data-sharing tags for that visitor. A banner that records the preference but leaves the tags firing is not compliance. GPC failures have already featured in enforcement, which makes this the highest-value fix on the list. The work lives in your consent platform and tag setup, the same machinery covered in Consent Mode v2 and setting up cookie consent without killing your analytics. If you route tags through a server, the signal has to reach the server too, a point we unpacked in server-side tracking without crossing privacy lines.
Sensitive data is broader than you think
The US model is mostly opt-out: for ordinary personal data, you may market to people as long as you tell them and let them leave. Sensitive data is the big exception. Nearly every state requires opt-in consent before you process it, with Utah and Iowa using a lighter notice-and-opt-out approach and California using a right-to-limit model.
The trap for marketers is how wide "sensitive" has become. It typically covers health information, precise geolocation, biometrics, racial or ethnic origin, sexual orientation and religious beliefs, and it can include inferences drawn from behaviour, not just data people hand over. An audience built from visits to health-condition pages, a campaign using precise location, or a segment inferred from browsing can drift into sensitive territory without anyone labelling it that way. Review your segments and targeting logic with that lens, and put consent in front of anything that qualifies, ideally inside a well-designed consent collection flow.
Minors and the shrinking grace period
A growing number of states now restrict targeted advertising and data sales involving minors, with particular attention on teenagers. For most brands this is less about intentionally marketing to young people and more about knowing when you might be reaching them, through the platforms, content and audiences you choose, and making sure age-sensitive audiences are excluded from targeting that the law restricts.
The other quiet shift is the grace period. Early state laws often gave businesses a cure period, typically 30 days to fix a problem after being notified, before penalties applied. Those windows are shrinking or disappearing, and Rhode Island launched without one. The practical consequence is that "we'll fix it when someone complains" is no longer a strategy. Compliance has to be right before an attorney general looks, not after.
State by state, or build to the strictest?
Faced with a patchwork, teams tend to choose between two approaches. It is worth being explicit about the trade-off.
State by state: detect each visitor's state and apply that state's rules. It maximises data collection where rules are looser, but every new law or amendment means new configuration, testing and monitoring. The complexity grows with the map.
Build to the strictest: design each of the five mechanics to the toughest standard in force (honor GPC everywhere, opt-in for sensitive data everywhere, a real targeted-ad opt-out for everyone). You give up a little data in looser states, but a new law is usually already covered.
The rule of thumb: for most marketing teams, the strictest-standard default is cheaper, safer and easier to maintain. Reserve state-specific logic for genuine outliers, not as the foundation.
The strictest-standard approach also has a commercial upside. Respecting opt-outs and consent everywhere nudges your marketing toward data people have actually chosen to share, which is the durable asset behind a solid first-party data strategy. You lose a sliver of reach and gain a programme that doesn't need rebuilding every January.
What to do this quarter
Turn the patchwork into a short, concrete work list. Start by confirming which laws apply to you, since thresholds based on resident counts and data-sale revenue now reach many mid-sized businesses. Then fix the five mechanics in order of risk. Make GPC detection work end to end, so the signal actually turns off ad and sharing tags. Audit your audiences and targeting for anything that counts as sensitive data, and put consent in front of it. Check whether your campaigns could reach minors and restrict accordingly.
Next, make sure the back office keeps up. Your privacy policy should describe what you really do and how people can opt out. Your consumer request workflow should meet the tightest deadline you face. Your retention schedule should reflect data minimisation, which several newer laws emphasise. Finally, document an assessment for targeted advertising and profiling, because many states require one and an attorney general can ask to see it. Keep the tools and vendors that touch this data inside your regular access audits too. None of these is exotic, and each one covers every state at once when it is built to the strictest standard.
The short version
Roughly 20 US states now have comprehensive privacy laws, with Indiana, Kentucky and Rhode Island switching on in January 2026 and more signed for 2027. There is still no federal law, so the patchwork will keep growing. For marketers, the laws reduce to five mechanics: an opt-out from targeted advertising and data sales, honoring universal opt-out signals like Global Privacy Control, opt-in consent for sensitive data, limits on targeting minors, and handling consumer requests and assessments. The rules differ mainly in their settings: thresholds as low as about 35,000 residents, varying definitions of sensitive data, GPC requirements in around a dozen states, and cure periods that are shrinking or gone. Fix GPC first, because it is the most commonly missed and already enforced. Treat sensitive data broadly, including inferences from behaviour. Then build each mechanic once to the strictest standard rather than managing every state separately, so the next new law is a small update instead of a new project.
Want targeting that stays compliant in every state?
We help brands run performance marketing on consent-first data that holds up nationwide.
Explore Performance Marketing →Frequently asked questions
How many US states have comprehensive privacy laws in 2026?
Roughly 20 states have comprehensive consumer privacy laws in effect in 2026, with the exact count depending on how you classify narrower or sector-specific statutes. The most recent additions are Indiana, Kentucky and Rhode Island, whose laws took effect on January 1, 2026, joining earlier adopters such as California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota and Maryland. More states have signed laws scheduled to take effect in 2027, and there is still no comprehensive federal privacy law, so the state patchwork will keep growing. For a marketer the exact number matters less than it seems. Each law sets its own thresholds and details, but most of them ask businesses to handle the same small set of obligations, which is why many teams choose to build one programme to the strictest common standard rather than tracking every state separately.
What is Global Privacy Control and do marketers have to honor it?
Global Privacy Control, or GPC, is a signal that a browser or extension sends automatically to tell websites the user wants to opt out of the sale or sharing of their personal data, including for targeted advertising. Around a dozen states, including California, Colorado, Connecticut, Oregon, Texas, New Jersey and Maryland, now require businesses to treat that signal as a valid opt-out request, with no separate click needed. In practice that means your site must detect the signal and then actually stop the relevant tracking and data sharing for that visitor, for example by suppressing advertising pixels or data-sharing tags. California has gone further and expects businesses to show a visible confirmation that the opt-out was honored. GPC has already featured in enforcement actions, so if your site runs advertising or retargeting tags and you have visitors in any of these states, detecting and honoring GPC is one of the most important and most commonly missed compliance steps.
Do US state privacy laws require consent for marketing?
For ordinary personal data, generally not in the way Europe does. The US state model is mostly opt-out: you can process data for marketing, but you must tell people what you do and let them opt out of targeted advertising, the sale of their data and certain kinds of profiling. Sensitive data is the major exception. Nearly every state law requires opt-in consent before you process sensitive categories, which typically include health information, precise geolocation, biometric data, racial or ethnic origin, sexual orientation, religious beliefs and data about children. A few states, such as Utah and Iowa, use a notice-and-opt-out approach for sensitive data instead, and California uses a right-to-limit model. Many states also restrict targeted advertising and data sales involving minors, especially teenagers. So the practical answer is that marketing to adults on ordinary data usually needs clear notice and a working opt-out, while anything touching sensitive data or minors needs explicit consent first.
How should a marketing team comply with so many different state laws?
Most teams find it far simpler to build one programme to the strictest common standard than to maintain separate rules for each state. The laws differ in thresholds, definitions, cure periods and penalties, but they converge on a handful of obligations: a clear privacy notice, a working opt-out of targeted advertising and data sales, honoring universal opt-out signals like Global Privacy Control, opt-in consent for sensitive data, extra protections for minors, timely handling of consumer rights requests, and assessments for high-risk processing such as targeted advertising. If you design your consent tools, tag management, vendor contracts and request workflows to meet the toughest version of each obligation, you are largely covered everywhere, and a new state law becomes a small update rather than a new project. Geo-targeted variations can still make sense where a state is unusually strict, but the default should be one well-built system. Because the details carry legal weight, confirm your approach with a qualified privacy professional.
