US state privacy laws
With no federal privacy law, about 20 US states have their own comprehensive privacy laws in effect in 2026, each with its own thresholds and details.
California’s CCPA came first; Virginia, Colorado, Connecticut, Texas, Oregon and others followed, and Indiana, Kentucky and Rhode Island took effect on January 1, 2026; trackers such as the IAPP’s count around 20 depending on what they include, with more enacted for later years. Most share rights to access, delete and opt out of targeted advertising and sale, and opt-in for sensitive data. They differ in thresholds, whether they honor browser opt-out signals and cure periods.
Related terms
- CCPA and CPRA (California privacy law): California’s consumer privacy law: rights to know, delete, correct and opt out of the sale or sharing of personal data, browser signals included.
- Global Privacy Control (GPC): A browser signal that tells every site the person does not want their data sold or shared; California and other states treat it as a legal opt-out.
- DSAR (data subject access request): A person’s request to see, copy, correct or delete the data a company holds about them; under GDPR it must be answered within one month.
- GDPR: The EU regulation on personal data: lawful basis, minimal data, user rights and breach reporting, for anyone handling EU residents’ data.
