Pull to refresh
Logo
Daily Brief
Following
Why Ranks Sign Up
Twenty states now enforce comprehensive privacy laws

Twenty states now enforce comprehensive privacy laws

Rule Changes

The 2026 Wave Reshapes Data Collection Across American Consumer Apps

January 1st, 2026: Indiana, Kentucky, Rhode Island Privacy Laws Take Effect

Overview

California passed the first comprehensive state privacy law in 2018. Eight years later, twenty states have followed, creating a regulatory patchwork that now covers roughly half the American population. Indiana, Kentucky, and Rhode Island's laws took effect January 1, 2026, joining a wave of amendments and enforcement actions that force every consumer-facing app to reckon with data collection practices.

The practical effect: companies can no longer treat privacy as a California-only compliance exercise. Universal opt-out signals are mandatory in twelve states. Data brokers face registration requirements, deletion mechanisms, and a California 'strike force' hunting non-compliance. Texas extracted $2.8 billion from Meta and Google in 2025 alone. The absence of federal legislation has created, paradoxically, a de facto national standard—most new state laws simply copy Virginia's template—while leaving companies to navigate jurisdiction-by-jurisdiction variations in sensitive data definitions, cure periods, and enforcement appetite.

Play on this story Voices Debate Predict

Key Indicators

20
States with Comprehensive Privacy Laws
Up from one state (California) in 2020, with more laws taking effect through 2026
12
States Requiring Universal Opt-Out Signals
Businesses must honor browser-based privacy signals like Global Privacy Control
$2.8B
Texas Privacy Settlements in 2025
$1.4 billion each from Meta and Google for biometric and location data violations
$7,500-$10,000
Per-Violation Penalty Range
State enforcement penalties vary; California fines now adjust automatically with inflation

Voices

Curated perspectives — historical figures and your fellow readers.

Ever wondered what historical figures would say about today's headlines?

Sign up to generate historical perspectives on this story.

Play

Exploring all sides of a story is often best achieved with Play.

Log in to play. Track your picks, climb the leaderboards. Log in Sign Up
Predict 4 ways this could play out. Contrarian picks score more — points lock when the scenario resolves. Log in to play
Timeline Five events from this story — drag them oldest to newest. Log in to play
Connections Sixteen names from the news. Find the four hidden groups of four. Log in to play

People Involved

Organizations Involved

Timeline

June 2018 January 2026

13 events Latest: January 1st, 2026 · 5 months ago Showing 8 of 13
Tap a bar to jump to that date
  1. Colorado Becomes Third State

    Legislation

    Colorado Privacy Act signed into law, effective July 1, 2023.

  2. Virginia Becomes Second State with Privacy Law

    Legislation

    Virginia Consumer Data Protection Act (VCDPA) signed into law, establishing a template that most subsequent state laws will follow.

  3. California Voters Approve CPRA

    Legislation

    Proposition 24 passes, creating the California Privacy Rights Act and establishing the California Privacy Protection Agency as the nation's first dedicated state privacy regulator.

  4. California Passes First Comprehensive State Privacy Law

    Legislation

    Governor Jerry Brown signs the California Consumer Privacy Act (CCPA), making California the first state with comprehensive consumer data protection rules. The law takes effect January 1, 2020.

Historical Context

3 moments from history that rhyme with this story — and how they unfolded.

May 2018

European Union General Data Protection Regulation (2018)

The European Union's GDPR took effect on May 25, 2018, imposing strict opt-in consent requirements, data portability rights, and penalties up to 4% of global revenue on any company processing EU residents' data. U.S. technology companies faced immediate compliance obligations regardless of their physical location.

Then

Companies worldwide scrambled to update privacy notices, implement consent mechanisms, and appoint data protection officers. Cookie consent banners became ubiquitous. Some U.S. news sites blocked European visitors rather than comply.

Now

GDPR became the global baseline for privacy legislation. California's CCPA, passed months later, explicitly drew inspiration from GDPR concepts while choosing an opt-out rather than opt-in model. The regulation demonstrated that regional laws could effectively constrain global technology companies.

Why this matters now

GDPR proved that comprehensive privacy regulation was enforceable against major technology platforms. Its extraterritorial reach showed that state-level U.S. laws could similarly force national compliance. The opt-in versus opt-out distinction between GDPR and U.S. state laws remains the key architectural difference.

July 2002

Sarbanes-Oxley State-by-State Precedent (2002)

Following the Enron and WorldCom accounting scandals, Congress passed the Sarbanes-Oxley Act establishing federal corporate governance standards. Prior to SOX, corporate governance was regulated primarily through a patchwork of state laws, with Delaware's corporate-friendly statutes dominating. The federal law preempted certain state rules while preserving others.

Then

Public companies faced significant compliance costs implementing new internal controls, audit committee requirements, and executive certification rules. Smaller companies complained the burden was disproportionate.

Now

SOX established that federal intervention could rationalize state-by-state regulatory patchworks when national interests were sufficiently compelling. The law's framework of allowing some state variation while establishing federal floors became a template for subsequent regulatory debates.

Why this matters now

Privacy legislation faces a similar state-versus-federal tension. The SOX precedent shows how federal legislation can emerge from state-level experimentation while preserving some state enforcement authority. Industry groups cite SOX compliance costs when arguing against privacy patchwork.

June-October 2003

Do Not Call Registry Implementation (2003)

The Federal Trade Commission (FTC) launched the National Do Not Call Registry, allowing consumers to opt out of telemarketing calls. The registry built on state-level do-not-call laws that had emerged in the 1990s. Implementation required coordination between federal and state enforcement, with the FTC handling national rules while states retained authority for intrastate calls.

Then

50 million phone numbers registered in the first three months. The telemarketing industry challenged the registry in court but lost. Legitimate telemarketing adapted while robocall operations moved offshore or ignored the rules.

Now

The registry demonstrated consumer appetite for privacy controls and the viability of opt-out mechanisms at scale. However, enforcement limitations—particularly against offshore violators—showed the limits of consent-based privacy frameworks against bad actors.

Why this matters now

Universal opt-out signals (like Global Privacy Control) mirror the Do Not Call Registry concept: a single consumer action that propagates across multiple businesses. The registry's partial success and enforcement challenges offer lessons for digital privacy opt-out implementation.

Sources

(12)