Climate
Privacy
Bob Dylan
Drones
Data Centers
AI Governance
2026 Maine Senate Race
Last Update: 08/01/2026 at 1:00 PM EST
States Expand Privacy Protections
Coverage from JD Supra, WBUR, and others
Articles
36
Active Days
157
The Topic
U.S. states are continuing to enact, amend, and advance privacy laws covering consumer data, children’s online activity, data brokers, geolocation, biometric information, and app stores. Alabama enacted a broad consumer privacy law, while other states moved bills through legislatures or introduced new restrictions on sensitive data and youth-focused digital services. The overall direction is toward more state-specific obligations for businesses, but the fragmented legislative process and differing approaches to age assurance, enforcement, and covered data create an increasingly complex compliance landscape.
First Article: 02/17/26
Latest Article: 07/23/26
Summary
- Alabama enacted a broad consumer privacy law, becoming the twenty-first U.S. state identified in the material to do so.
- State bills increasingly target children’s data, age assurance, app stores, and social media access.
- Data broker regulation is expanding through registration requirements, disclosure rules, and more frequent access to California’s DROP system.
- Several measures restrict the sale or sharing of sensitive information, including precise geolocation and automatic content recognition data.
- Legislative outcomes remain uneven: some bills passed or advanced, while Maine’s broad privacy bill stalled on a procedural vote.
- Age-verification proposals are drawing privacy and civil-liberties concerns over identification uploads, facial recognition, and access for LGBTQ+ youth.
History
The update adds concrete legislative outcomes and setbacks, showing the privacy push is not just advancing but also unevenly landing across states. It also highlights stronger attention to age-verification tradeoffs, especially the privacy and civil-liberties concerns those measures raise.
The story has shifted from a broad account of state privacy-law activity to a more specific wave of legislation targeting youth protections, platform defaults, data brokers, and device-level privacy controls. Alabama’s enactment adds a concrete new milestone, while California, Connecticut, and several other states show the patchwork becoming more operational and prescriptive.
Featured
03-29-2026
In 2026, multiple US states advanced consumer privacy bills including Maine LD 1822, Maryland HB 711, New Hampshire HB 1460, and New Jersey A 3929.
04-06-2026
Maine’s LD 1822 consumer data privacy bill stalled in the House in 2026 while Kentucky HB 692 passed to add automatic content recognition as sensitive data.
05-14-2026
Massachusetts debate over House social media limits for minors centers on privacy risks in age verification methods and impacts on LGBTQ youth at Beacon Hill.
Timeline: 157 Days
Hover over any logo to see coverage summary, click for full article.
Additional Articles
⭐⭐⭐⭐⭐
Connecticut, Arkansas, and Utah updated state privacy laws on July 1, tightening consent and minors protections while adding a Utah right to correct inaccurate personal data.
Massachusetts lawmakers in October 2025 advanced a data privacy act in Massachusetts to limit data collection and empower enforcement.
In Boston, Massachusetts House leadership advanced bill H 5472 in June 2026, offering consumer opt-out and consent rights for targeted advertising and sensitive data processing.
Massachusetts House passed the Massachusetts Consumer Data Privacy Act, adding sensitive data and precise geolocation sale limits plus minors targeted advertising protections and stronger enforcement.
Massachusetts House passed the Massachusetts Consumer Data Privacy Act in the 2020s, expanding consumer rights and banning the sale of precise geolocation data for residents and visitors.
Massachusetts House passed a bipartisan consumer data privacy bill in June 2026 granting privacy rights and banning precise geolocation data sale, with enforcement led by the Attorney General.
Connecticut SB 1295, Arkansas HB 1717, and Utah HB 418 took effect July 1, expanding sensitive-data coverage, minors protections, and Utah correction and portability rights.
Connecticut lowered the Connecticut Data Privacy Act threshold and expanded sensitive data and children’s protections on July 1, 2026, with attorney general enforcement and increased penalties.
Connecticut, Arkansas, and Utah privacy-law amendments take effect July 1, 2026, tightening sensitive-data and minors rules and adding a Utah correction right.
Massachusetts lawmakers moved forward a privacy bill on June 4, 2026, adding consumer data rights, a precise geolocation sale ban, and enforcement via Attorney General rulemaking and private actions.
Connecticut lowered CTDPA applicability thresholds and expanded sensitive-data and minors rules on July 1, alongside Arkansas teen-privacy and Utah correction-right updates.
Connecticut, Arkansas, and Utah updated privacy laws effective July 1, 2026, expanding sensitive data limits, strengthening minors protections, and adding a correction right in Utah.
Massachusetts House Ways and Means advanced H 5472, adding consumer opt-out and sensitive-data consent rights and attorney general enforcement authority.
Massachusetts House leadership advanced H 5472 in response to Senate action on S 2619, adding consumer opt-out and consent rights for personal-data processing and profiling.
Oklahoma and Alabama enacted new privacy laws in 2026 while Virginia, Kentucky, and California advanced restrictions on precise geolocation and sensitive data sharing.
Alabama, Louisiana, Oklahoma, and Vermont enacted comprehensive privacy laws in 2026 that set consumer rights, data protection assessments, and enforcement rules for personal data processing.
Alabama, Louisiana, Oklahoma, and Vermont enacted 2026 consumer privacy laws effective from 2027 to 2028, expanding controller obligations and consumer opt-out and data-rights mechanisms.
Louisiana, Oklahoma, and Alabama privacy laws advance in 2026 with attorney general-only enforcement, while Vermont’s proposed law would expand sensitive data and restrict geofencing near healthcare facilities.
State attorneys general met in Sea Island, Georgia in 2026 to discuss accelerating privacy enforcement, multistate regulator coordination, and proposed sensitive data and automated decision rules.
Massachusetts lawmakers advanced a bill after unanimous House passage to ban sale of precise location data, sending it to conference committee before Gov. Maura Healey signs it.
⭐⭐⭐
Kay Ivey signed Alabama HB 351 in 2026 as Kentucky, Virginia, Maryland, Delaware, Nebraska, and California also advanced consumer privacy law changes.
Connecticut SB 4 passed in 2026, expanding consumer data privacy and creating data broker registration, as California, Colorado, Delaware, and Louisiana advanced related privacy bills.
Colorado passed a 2026 age attestation privacy bill while Michigan advanced a Kids Code Act and California moved a consent-based privacy setting restriction toward third reading.
Maine Senate voted 18-14 in 2024 to revive LD 1822, proposing data minimization, biometric limits, and bans on selling and targeting children’s data.
Maine lawmakers consider LD 1822 Maine Online Data Privacy Act in the current session in Maine.
Legal experts and policy advocates discussed Washington, D.C. privacy regulation trends on April 9, 2026, including Maryland's ban on sensitive personal data sales affecting location data uses.
Massachusetts business advocacy organizations urged revisions to privacy bills H.5479 and S.2516 at Beacon Hill, criticizing private lawsuits and broad data-minimization limits.
New York passed a health-data privacy bill in 2024 as HIPRA and the American Privacy Rights Act of 2024 shaped U.S. consumer privacy rights and AI obligations.
Delaware, Connecticut, Maryland, New Hampshire, and New Jersey enacted or advanced 2026 privacy-law amendments adding restrictions on data sales, data broker registration, deletion mechanisms, and facial recognition requirements.
Elyse Wallnut describes lobbying tactics weakening Vermont and Massachusetts privacy bills and warns that a proposed SECURE Data Act could override stronger state protections.
CookieScript features are described for preparing companies for Kentucky, Rhode Island, and Indiana privacy laws effective January 1, 2026.
New Jersey enacted 2026 bills adding data broker registration, sensitive-data sale limits, Kids Code private enforcement, and a ban on surveillance pricing for groceries, while California advanced 15 privacy and AI bills out of committee.
⭐️⭐️
Maine senators advance data privacy bill in Augusta to regulate non public personal data and consider political group exemption ahead of upcoming votes.