Privacy Law Changes Before 2027: State Rules & Compliance Guide

Overview

In the U.S., general consumer privacy rules come from the states, while federal law covers specific sectors and groups such as health, finance, and children. Businesses should plan around January 1, 2027, when many new obligations begin. Although a comprehensive federal privacy law remains unlikely in the near term, four more states have passed comprehensive laws this year, bringing the total to 24, depending on whether Florida’s narrower law is counted.

The biggest changes in 2026 came from tougher amendments to existing state laws, new action by California’s legislature and regulators, and new rules for automated decision-making. Many of these take effect on or near January 1, 2027.

State laws: new statutes and tougher amendments

New statutes bring more businesses into scope, while amendments raise the bar for companies already covered. In practice, businesses should confirm the state rules that now apply and check whether amendments affect their practices.

New laws. Alabama, Louisiana, Oklahoma, and Vermont each enacted a comprehensive privacy law in 2026. The first three take effect in 2027, and Vermont’s follows in 2028 (StateScoop).

Amendments matter just as much for companies already covered:

Delaware. HB 380, signed September 2, takes effect January 1, 2027. It lowers the coverage threshold from 35,000 to 10,000 consumers, broadens “sensitive data,” and requires contracts and due diligence for third parties that receive personal data (MultiState). HB 381, effective on signing, adds Attorney General notice duties to the state breach law: notice within 60 days when a company cannot yet identify affected residents, or as part of substitute notice. The existing 500-resident trigger is unchanged.
Connecticut. Public Act 26-64 took effect October 1. It bans selling precise geolocation data and adds facial recognition rules and a data broker registration program.
New Jersey. Selling sensitive data is now prohibited even with consumer consent, including for smaller businesses (MultiState).

California: litigation reform, broader deletion, and active enforcement

California’s September bill signings change both litigation risk and privacy-request obligations.

SB 690 (effective January 1, 2027). Only the Attorney General can bring California Invasion of Privacy Act pen register claims over websites and apps, including claims already pending in cases filed on or after January 1, 2025 (signing message). It doesn’t make tracking lawful, and other wiretapping claims remain, so cookie, pixel, and session replay governance still matters. See our full analysis of SB 690 and our earlier post on chatbots and analytics.
SB 923 (effective January 1, 2027). The CCPA deletion right will reach data collected “from or about” a consumer, including data obtained from third parties, and online-only businesses must offer a web form for requests (CalPrivacy, bill text).
Workplace AI. AB 1883 limits AI-powered workplace surveillance tools, and SB 947 requires human review before AI-driven discipline or termination (Governor’s office).
Vetoed. AB 1542, a proposed ban on selling sensitive data (veto message).

Enforcement focuses on whether companies’ privacy practices match what they tell consumers, such as whether opt-outs and tracking controls work as promised. Recent examples include CalPrivacy’s $1.1 million fine against PlayOn Sports over tracking on a school ticketing platform, its first data broker action under both the CCPA and the Delete Act, and the Attorney General’s $12.75 million General Motors settlement, the office’s first action enforcing data minimization.

AI and automated decision-making

Colorado and California both require businesses to comply with automated decision-making rules starting January 1, 2027, though Colorado’s rules are less stringent than originally planned.

Colorado. The state repealed and replaced its 2024 AI Act in May with SB 26-189. The new law covers automated decision-making technology used in decisions about education, employment, housing, lending, insurance, health care, and essential government services, with developer and deployer duties starting January 1, 2027. The change followed a federal lawsuit by xAI challenging the original law.
California. The CPPA’s regulations took effect January 1, 2026. Risk assessments began then, and businesses using automated decision-making for significant decisions must comply starting January 1, 2027.

Businesses using automated tools for hiring, lending, housing, or similar decisions should inventory them now and plan for the notices, opt-out or access rights, and human review these laws require. Companies planning to train models on existing user data should also review their privacy policies first, as we explain in Your Old Privacy Policy Limits the Data Your AI Can Learn From.

Children’s and teens’ privacy

Federal rules for children under 13 have already tightened, even though Congress has not extended protections to teens. Operators had until April 22, 2026 to comply with the FTC’s amended COPPA Rule (Federal Register). It treats biometric identifiers as personal information, requires separate parental consent before disclosing children’s data to third parties, and limits retention (FTC).

COPPA 2.0, which would extend protections to teens, passed the Senate in March but has stalled in the House. Businesses with services aimed at children or teens should track both.

International developments

European regulators are issuing large fines and clarifying how they decide to impose them, while GDPR reform is still under negotiation.

Ireland. The Data Protection Commission fined Google €403 million on September 21 over location data settings, covering conduct from 2018 to early 2020, and ordered compliance within six months. Regulators can assess practices years after the fact.
EDPB. Guidelines adopted September 17 set a five-step method for deciding when to impose a fine. Comments are due November 13, 2026.
Digital Omnibus. The Commission proposed GDPR changes in November 2025. In October, EU member states agreed their negotiating position, which keeps the GDPR’s definition of personal data intact. Talks with the Parliament come next.
Italy. The data protection authority fined IQVIA €7 million after rejecting its claim that a patient database was anonymous (EDPB summary). We break down the reasoning in “Anonymous” Is a Test, Not a Checklist.

Vendor access and breach readiness

Third-party access is a recurring source of breach risk, so companies should review their vendor terms and incident plans. Contracts should require prompt incident notice and forensic cooperation, and vendor and API access should be limited and monitored. Response plans should also be updated to account for Delaware’s new Attorney General notice requirement. For contract terms, see our guide to DPAs when a vendor is international.

A checklist before January 1, 2027

Re-check applicability. Delaware’s lower threshold and the new Alabama, Louisiana, Oklahoma, and Vermont laws may bring you into scope.
Review data sales and sharing. Look at precise geolocation and sensitive data first, given the Connecticut and New Jersey prohibitions.
Update privacy request intake. Extend deletion workflows to data obtained from third parties, and add a web form if you rely only on email (California SB 923). Our post on finding where personal data lives is a good starting point.
Audit website tracking. SB 690 narrows one litigation theory, but cookies, pixels, session replay, and chat tools still carry risk under other claims.
Inventory automated decision tools. Cover hiring, lending, housing, and workplace monitoring ahead of the Colorado and California dates.
Revisit vendor contracts and incident response. Build in notice, cooperation, and Delaware’s Attorney General notification.
Check children’s data practices. Confirm alignment with the amended COPPA Rule.

If you would like help mapping these changes to your business, contact General Legal’s privacy team. This article is general information, not legal advice.

Sources

Key takeaways

Twenty-four states now have comprehensive consumer privacy laws, with Alabama, Louisiana, Oklahoma, and Vermont adding statutes in 2026 that take effect in 2027-2028.
Delaware lowered its coverage threshold from 35,000 to 10,000 consumers, while Connecticut banned selling precise geolocation data and New Jersey prohibited selling sensitive data even with consent.
California's SB 690 limits private litigation under the Invasion of Privacy Act to Attorney General enforcement, while SB 923 expands deletion rights to data obtained from third parties starting January 1, 2027.
Colorado and California both impose automated decision-making compliance obligations beginning January 1, 2027, covering hiring, lending, housing, and similar decisions.
The FTC's amended COPPA Rule now treats biometric identifiers as personal information and requires separate parental consent before disclosing children's data to third parties.
European regulators continue issuing large fines years after conduct occurs, with Ireland fining Google €403 million for 2018-2020 location data practices.

TL;DR

State law expansion	Four new state privacy laws in 2026 bring total to 24; Delaware threshold drops to 10,000 consumers January 1, 2027
California litigation changes	SB 690 restricts private pen register claims to Attorney General; other tracking claims remain actionable
Deletion rights broadened	California SB 923 extends deletion to data obtained from third parties; online businesses must offer web forms
Automated decision-making	Colorado and California require compliance for AI in hiring, lending, housing by January 1, 2027
Children's privacy	Amended COPPA Rule now covers biometric identifiers and requires separate consent for third-party disclosures
Sensitive data sales	Connecticut bans selling precise geolocation; New Jersey prohibits selling sensitive data even with consent
Enforcement trends	California fined GM $12.75M for data minimization failures; Ireland fined Google €403M for 2018-2020 conduct
Vendor management	Delaware adds Attorney General breach notice; contracts should require prompt incident notice and forensic cooperation

FAQs

Does California SB 690 eliminate tracking liability for websites?

No. SB 690 only restricts private pen register claims under the California Invasion of Privacy Act to Attorney General enforcement. Other wiretapping claims remain, so cookie, pixel, and session replay governance still matters.

What changes to deletion requests does California SB 923 require?

Starting January 1, 2027, deletion rights extend to data collected from or about a consumer, including data obtained from third parties. Online-only businesses must also offer a web form for requests, not just email.

When do Colorado and California automated decision-making rules take effect?

Both states require compliance starting January 1, 2027. Businesses using automated tools for hiring, lending, housing, or similar decisions should inventory them now and plan for required notices, opt-out or access rights, and human review.

What did Delaware's HB 380 change about privacy law coverage?

Effective January 1, 2027, the law lowers the coverage threshold from 35,000 to 10,000 consumers, broadens the definition of sensitive data, and requires contracts and due diligence for third parties that receive personal data.

What are the key changes to the COPPA Rule for children's data?

The amended Rule, which operators had until April 22, 2026 to comply with, treats biometric identifiers as personal information, requires separate parental consent before disclosing children's data to third parties, and limits retention.

Can European regulators fine companies for conduct that occurred years ago?

Yes. Ireland's €403 million fine against Google on September 21, 2026 covered location data practices from 2018 to early 2020, demonstrating that regulators can assess practices years after the fact.

Privacy Law Developments: What to Do Before 2027