State Privacy Laws 2026: Every Consumer Privacy Law, Tracked

States passed these laws in bursts. 2023 and 2024 brought 7 new laws each, 2025 brought none, and 2026 added 4.

A law usually starts applying a year or more after it is signed. Laws already on the books take the count to 22 by the end of 2027 and 23 by the end of 2028.

The core rights show up everywhere: all 23 laws give people access, deletion, portability and a sales opt-out. Opt-in consent for sensitive data and risk assessments are common, at 20 laws each, but not universal.

The four comprehensive privacy laws signed in 2026

Source: Mayer Brown, Alabama Enacts Comprehensive Consumer Data Privacy Law; Davis Wright Tremaine, Louisiana Data Privacy Act (SB 386); Oklahoma House of Representatives, Major Data Privacy Bill Signed into Law (SB 546); Mayer Brown, Vermont Enacts Comprehensive Consumer Privacy Law; IAPP, US State Privacy Legislation Tracker 2026: Comprehensive Consumer Privacy Bills (chart). Download as image

All 23 signed comprehensive state privacy laws, by effective date

Source: IAPP, US State Privacy Legislation Tracker 2026: Comprehensive Consumer Privacy Bills (chart). Download as image

Comprehensive consumer privacy law by state

• 19Comprehensive law in effect
• 4Comprehensive law signed, not yet in effect
• 1Narrow privacy law only (not counted as comprehensive)
• 4No law; active bill as of 8 Sept. 2026
• 23No comprehensive law

Which states have privacy laws in 2026?

IAPP counts 23 states with a signed consumer privacy law. 19 are already in force. California went first: it signed in 2018 and its law took effect on 1 Jan. 2020. The newest to switch on were Indiana, Kentucky and Rhode Island, all on 1 Jan. 2026.

Florida is a special case. It has a privacy law, but it only reaches companies with more than $1 billion in revenue, so IAPP leaves it off the list. Trackers that count Florida report 24. For a small business, the narrower count of 23 is the more useful one.

That leaves 27 states plus DC with no broad consumer privacy law on IAPP's list. Four of them, Massachusetts, Michigan, North Carolina and Pennsylvania, had active bills as of 8 Sept. 2026. Expect the map to keep filling in.

Do state privacy laws apply to small businesses and freelancers?

Often not directly, and that surprises people. Most of these laws only kick in once you handle data on a set number of state residents or earn a share of revenue from selling data. The bar varies a lot from state to state.

Look at the four laws signed in 2026. Oklahoma covers businesses with data on more than 100,000 consumers, or 25,000 if most of their revenue comes from selling data. Alabama starts at more than 25,000 Alabama consumers. Louisiana adds a revenue test of over $25 million a year. Vermont starts at 35,000 residents, but drops to just 3,000 if you handle their sensitive data.

Here is the catch for freelancers and agencies. Even if no law covers you, your clients may be covered, and they have to push privacy duties down to their vendors through a contract. Say you build email campaigns for a regional retailer. The retailer is the business that decides how data is used. You are the vendor that handles it. Most of these laws require a written contract between the two, so a data processing addendum lands in your inbox whether or not you hit any threshold yourself.

Your customer mix matters more than your size. A two-person shop selling to people across many states can cross a line that a larger local business never reaches.

What changes in 2027 and 2028?

Three laws take effect in 2027: Louisiana and Oklahoma on 1 Jan. 2027, and Alabama on 1 May 2027. Vermont follows on 1 Jan. 2028. Once Vermont applies, all 23 signed laws will be live.

Vermont deserves a close look if you touch health data. Its consumer health data rules have no applicability threshold at all, so even a tiny wellness app can fall under them.

Startup grace periods also differ. Alabama gives businesses 45 days to fix a violation after notice, with no end date. Louisiana offers 30 days, but only from 1 Jan. 2027 through 31 July 2027. Vermont allows 60 days from 1 Jan. 2028 to 30 June 2029, then leaves it to the attorney general. Don't plan around a cure period that is about to expire.

Can you sue a company for breaking a state privacy law?

Almost never. Only 1 of the 23 laws gives consumers a private right of action, and that is California's, which is limited to certain violations. Everywhere else, the state attorney general or a state agency does the enforcing.

For a business, that cuts both ways. You are unlikely to face a wave of private lawsuits under these statutes. But a state investigation can still arrive, and your customers can still sue you under your contract with them. That is why the privacy terms in your service agreements matter as much as the statute does.

What should your vendor and client contracts say about privacy?

Statutes set the floor. Your contracts decide who pays when something goes wrong. Even a small company can have several tools holding customer data: a CRM, an email platform, a help desk, a payments app. Each one has terms you clicked through, and those terms often favor the vendor.

Read three things first. What the vendor may do with your data, how fast it must tell you about a breach, and what happens to the data when you cancel. Some agreements let the vendor use customer data to improve its own products, or keep it for an open-ended period after you leave. Neither fits well with laws that give your customers a right to delete.

If you are the freelancer or agency, flip it around. A client's privacy addendum may ask you to cover all of its losses from any data incident, with no cap. That can be far larger than the fee you earn. Ask for a cap tied to the contract value, limit your promises to data you actually touch, and make sure you can meet any deadline it sets for reporting an incident.

What should a small business do now?

You don't need a full compliance program to make real progress. Start with a few practical steps.

• Count your customers by state. Thresholds are set per state, so a rough number for each one tells you where you might be covered.
• List what you collect. Sensitive data, such as health details, needs opt-in consent in 20 of the 23 laws.
• Write down how a customer asks to see or delete their data, and who answers. All 23 laws give people those rights.
• Check every vendor that touches customer data, from your email tool to your payment processor, and confirm you have a signed data processing addendum.
• If you use data for targeted ads, profiling or other high-risk purposes, plan for a written risk assessment. 20 of the 23 laws require one.
• Put 1 Jan. 2027 and 1 Jan. 2028 on your calendar so new state rules don't catch you off guard.

Sources and method

Every number on this page comes from the sources below, each opened and read on or before October 17, 2026. A second, independent review checked every figure against its source and corrected anything that did not match. 51 of 51 state entries were confirmed; any that could not be are marked "Not yet confirmed" and left out of every count and chart.

1. IAPP, US State Privacy Legislation Tracker 2026: Comprehensive Consumer Privacy Bills (chart) (Tracker last updated 8 Sept. 2026)
2. IAPP, US State Privacy Legislation Tracker (landing page) (Last updated 8 Sept. 2026)
3. Florida Legislature, 2026 Florida Statutes, s. 501.702 Definitions (Part V, ch. 501, Data Privacy and Security) (2026 Florida Statutes)
4. Oklahoma House of Representatives, Major Data Privacy Bill Signed into Law (SB 546) (23 March 2026)
5. Mayer Brown, Alabama Enacts Comprehensive Consumer Data Privacy Law (28 April 2026)
6. Davis Wright Tremaine, Louisiana Data Privacy Act (SB 386) (25 June 2026)
7. Mayer Brown, Vermont Enacts Comprehensive Consumer Privacy Law (22 June 2026)
8. ACLU of Massachusetts, Data Privacy Now! campaign page (Massachusetts bill status) (Last updated 30 July 2026)