Adding to the Count: The Latest in State Consumer Privacy Laws

The useful part

2026 started with 20 state consumer privacy laws (SCPLs), three of which went into force on January 1, 2026. During the first half of 2026, four new SCPLs were added, bringing the count to 24 – all since the California legislature passed the California Consumer Privacy Act (CCPA) in June 2018. Also, during the first half of 2026, state legislatures enacted significant amendments to their existing SCPLs.

How it works

• We cover the state privacy laws developments in this first of a three-part series on mid-year US data law updates – stay tuned for updates on teen online privacy and safety, as well as AI.
• At the same time, Senator Ron Wyden (D-OR) sent a letter to attorneys general in 11 states with SCPLs that require universal opt-out signals (like Global Privacy Control).
• Other than new double opt-in consent requirements in the Vermont and Louisiana SCPLs for certain data sales, the four new SCPLs do not add new "high watermark" requirements for most organizations but do...
• The trend among amendments enacted during the first half of 2026, is to add more restrictive requirements – particularly with respect to sensitive personal data (especially for minors and precise...
• The amendments do create new high watermark requirements, thereby making the SCPL patchwork more difficult to navigate, especially for an organization that intends to avoid certain high-water marks to...