Four New State Privacy Laws in 2026: What Businesses Need to Know

Less than a decade after California enacted the California Consumer Privacy Act (CCPA) in 2018, privacy legislation has spread to nearly half of the United States. With Alabama, Louisiana, Oklahoma, and Vermont joining the list this year, 24 states now have their own comprehensive consumer privacy laws, with at least three more regulating privacy through more targeted legislation.

With privacy a clear legislative priority across the country, businesses should expect privacy compliance to remain an increasingly important operational and legal issue. But the growing number of laws is not the only challenge.

Although the four new laws generally follow the framework established by existing state privacy laws, they differ in important ways. Businesses with multistate privacy programs should consider whether those differences require updates to their existing notices, consumer-rights procedures, data inventories, and risk-assessment processes.

Oklahoma Consumer Data Privacy Act, effective January 1, 2027

Oklahoma’s law applies to businesses that operate in Oklahoma or target its residents and either:

control or process the personal data of at least 100,000 consumers; or
control or process the personal data of at least 25,000 consumers and derive more than 50% of gross revenue from the sale of personal data.

“Consumer” excludes individuals acting in a commercial or employment context, and “sale” is limited to exchanges for monetary consideration only. The law also exempts financial institutions and data subject to the GLBA, HIPAA-covered entities, and business associates, nonprofits, and higher education institutions.

Consumers receive familiar rights to access, correct, and delete personal data and opt out of targeted advertising, sales, and certain profiling. Businesses must obtain consent before processing sensitive data and conduct data protection assessments for certain higher-risk processing. Comparable assessments prepared for other state laws may be used.

There are, however, several differences businesses should note. Oklahoma requires authentication for consumer rights requests, including opt-out requests, and does not require businesses to recognize universal opt-out mechanisms. Its definition of personal data also expressly includes pseudonymous data when it is used with additional information that reasonably links the data to an identified or identifiable individual. And while the law generally excludes photographs and audio or video recordings from its definition of biometric data, that exclusion does not apply when data generated from those materials is used to identify a specific individual.

The Oklahoma Attorney General has exclusive enforcement authority. Businesses receive 30 days to cure alleged violations, and statutory damages may reach $7,500 per violation.

Alabama Personal Data Protection Act, effective May 1, 2027

Alabama’s law applies to Alabama businesses, or businesses targeting Alabama residents, that:

control or process the personal data of more than 25,000 consumers, excluding data processed solely for payment transactions; or
derive more than 25% of gross revenue from the sale of personal data.

The law also exempts businesses with fewer than 500 employees that do not sell personal data, among other entity- and data-level exemptions.

The law provides familiar consumer rights, including access, correction, deletion, and copies of their personal data, as well as opt-outs from targeted advertising, sales of personal data, and certain profiling. Businesses must obtain consent to process sensitive data. Alabama also provides additional protections for minors: businesses generally must obtain consent before using the personal data of consumers ages 13 through 15 for targeted advertising or selling that data.

However, Alabama differs from the other new laws in several respects. Its definition of a “sale” is broader than monetary consideration, but it generally does not treat certain disclosures or transfers for analytics or marketing services as sales of personal data. Alabama’s law also does not require formal data protection assessments, does not require businesses to recognize universal opt-out signals, and does not provide a consumer right to appeal a decision on a rights request.

Enforcement is limited to the Alabama Attorney General, with a 45-day cure period that does not sunset.

Louisiana Data Privacy Act, effective January 1, 2027

Louisiana’s law applies to businesses that operate in Louisiana or target its residents and meet any one of the following thresholds:

annual gross revenue exceeding $25 million;
annually processing, buying, receiving, selling, or commercially sharing the personal information of at least 75,000 Louisiana consumers, households, or devices; or
deriving at least 50% of annual revenue from the sale of consumer personal information.

Because the revenue threshold applies independently of the amount of personal information processed, the law may reach some businesses, including certain B2B companies, that would not otherwise expect to fall within a state comprehensive privacy law.

As with Oklahoma and Alabama, the law provides familiar consumer rights, including access, correction, deletion, portability, and opt-outs from targeted advertising, sales of personal data, and certain profiling. Although Louisiana does not provide consumers with the right to revoke consent, businesses must obtain consent before processing sensitive data and must conduct data protection impact assessments for certain higher-risk processing. Similar to Oklahoma, Louisiana also permits businesses to rely on comparable assessments prepared to comply with other state privacy laws.

There are several other Louisiana-specific requirements to be aware of. The law requires authentication for consumer rights requests, including opt-outs, and requires recognition of universal opt-out mechanisms. The privacy policy must also include specific disclosures if a business sells sensitive personal data or biometric personal data. Unlike Texas, Louisiana does not expressly include certain pseudonymous data within the definition of personal data.

The law is enforceable only by the Louisiana Attorney General and provides a 30-day cure period, although that cure period sunsets on July 31, 2027.

Vermont Data Privacy and Online Surveillance Act, effective January 1, 2028

Vermont’s law is broader in several respects than the other state privacy laws enacted in 2026. It applies to Vermont businesses that:

control or process the personal data of at least 35,000 consumers;
control or process the sensitive data of at least 3,000 consumers; or
offer for sale the personal data of at least 3,000 consumers.

Vermont also provides narrower exemptions than many other states, including no blanket nonprofit exemption and a narrower financial-institution exemption.

Consumers receive the familiar rights to access, correct, delete, and obtain copies of personal data and to opt out of targeted advertising, sales, and certain profiling. Vermont goes further, however, by providing additional rights relating to profiling and automated decisions, including rights in certain circumstances to question a profiling result, obtain information about the reasons for the decision, and review the personal data used. Businesses must also conduct data protection assessments for certain higher-risk processing and separate impact assessments for certain profiling used to make decisions with legal or similarly significant effects.

The law also contains several requirements that businesses should flag for their existing compliance programs. Vermont uses a broader definition of biometric data that does not require the data to be processed for purposes of uniquely identifying an individual. Its definition of publicly available information is also narrower and generally excludes information aggregated into a consumer profile and inferences derived from that profile. In addition, privacy policies must disclose whether the business collects, uses, or sells personal data to train large language models.

Vermont provides additional protections for minors and consumer health data. Businesses generally may not sell personal data or use it for targeted advertising when they have actual knowledge, and willfully disregard, that a consumer is between 13 and 17 years old. The law’s consumer health data requirements are particularly broad because they apply without a minimum processing threshold and restrict, among other things, access to consumer health data, certain geofencing around health care facilities, and sales of consumer health data without consent.

The Vermont Attorney General has exclusive enforcement authority. Businesses receive 60 days to cure violations during the first 18 months after the law takes effect.

Common Requirements and Important Differences

The four laws generally follow the now-familiar state privacy framework: covered businesses must provide privacy notices, honor consumer rights, and address sensitive data, targeted advertising, sales of personal information, and certain profiling.

The laws differ in important ways that may require updates to existing multistate privacy programs.

Applicability thresholds vary substantially, from Oklahoma’s 100,000-consumer threshold and Alabama’s 25,000-consumer threshold to Louisiana’s $25 million revenue threshold and Vermont’s separate thresholds for personal data, sensitive data, and data offered for sale. The states also take different approaches to nonprofit and small-business exemptions, universal opt-out mechanisms, authentication of consumer rights requests, and the treatment of pseudonymous and biometric data.

The laws also differ in their assessment requirements. Louisiana, Oklahoma, and Vermont require data protection assessments for specified higher-risk processing, and Vermont separately requires impact assessments for certain profiling activities. Alabama does not require formal data protection assessments. Businesses should also consider whether existing assessments can be used to satisfy the requirements of multiple states.

Finally, businesses should not assume that a single privacy program will address all four laws without modification. Vermont in particular adds requirements relating to profiling, minors, consumer health data, biometric data, and disclosures concerning the use of personal data to train large language models. These differences reinforce the need to review existing privacy notices, consumer-rights procedures, data inventories, assessment processes, and other compliance controls as new state laws take effect.

The continued expansion of state privacy laws makes a consistent multistate framework increasingly valuable, but meaningful differences among states still require businesses to evaluate their practices state by state.

If your company needs assistance with any privacy issues, Coblentz Data Privacy & Cybersecurity attorneys can help. Please contact Scott Hall at shall@coblentzlaw.com for further information or assistance.