States Expand Privacy Protections

The update adds concrete legislative outcomes and setbacks, showing the privacy push is not just advancing but also unevenly landing across states. It also highlights stronger attention to age-verification tradeoffs, especially the privacy and civil-liberties concerns those measures raise.

The story has shifted from a broad account of state privacy-law activity to a more specific wave of legislation targeting youth protections, platform defaults, data brokers, and device-level privacy controls. Alabama’s enactment adds a concrete new milestone, while California, Connecticut, and several other states show the patchwork becoming more operational and prescriptive.

• Alabama enacted a broad consumer privacy law.
• California proposals would require more protective default privacy settings.
• Connecticut is advancing expanded data broker registration requirements.
• Colorado passed an age attestation bill for computing devices.
• Massachusetts passed a youth social media restriction.

The story has shifted from a broad account of state privacy legislation moving unevenly to a more specific focus on 2026 laws tightening data-use controls, especially consent, sale, and targeted advertising limits. Massachusetts and Maine now stand out as the main policy battlegrounds, while the current version places more emphasis on enforcement design and consumer rights expansion.

• Several states have already enacted or updated privacy laws.
• Enforcement design is now a major fault line.
• New rights include correction, portability, and interoperability.
• Some laws require disclosures about AI training use.
• Maine is now a focal point alongside Massachusetts.

The story now shows a broader and more concrete state privacy push, with new emphasis on biometric surveillance, smart-display content recognition, and California data-broker tooling. It also reframes the debate as one increasingly shaped by implementation disputes over age verification and legal opposition, rather than just bill advancement.

The story has moved from a general wave of state privacy legislation to a more concrete set of enacted and advanced measures, highlighted by Alabama's new broad consumer privacy law. It also newly centers youth-access and age-verification debates, plus specific rules on app stores, privacy defaults, geolocation, and data brokers.

• Alabama enacted a broad consumer privacy law.
• Virginia banned sale of precise geolocation data.
• Kentucky classified automatic content recognition as sensitive data.
• California advanced privacy-default and consumer-preference requirements.
• Massachusetts debate highlighted age-verification concerns.

The story has broadened from a few leading state privacy bills to a much wider 2026 wave of state legislation, with more states, more data categories, and more concrete compliance obligations now in view. The emphasis has also shifted toward operational rules like data minimization, global privacy signals, and attorney general-led enforcement.

• Multiple bills were enacted, amended, advanced, or stalled across several states in 2026.
• Proposals now emphasize data minimization and service-necessity limits on collection.
• New compliance rules include data protection assessments and global privacy signal handling.
• Automated content recognition data is now treated as a restricted sensitive category.
• Activity now spans states including Oklahoma, Alabama, Vermont, Louisiana, Maryland, New Hampshire, New Jersey, Virginia, and California.

The story now centers more specifically on Massachusetts as the main active battleground, while the broader state privacy push has expanded to include data brokers and default privacy controls as important enforcement and compliance tools. The framing is also more clearly about tightening consumer rights and regulatory enforcement rather than just a general wave of state privacy bills.

The story has shifted from a broad pattern of state privacy bills to a more specific 2026 snapshot, with Massachusetts and Maine emerging as the main contested battlegrounds and several states now clearly enacting AG-enforced laws. The update also adds new policy fronts, especially technology-specific limits in Vermont and more explicit treatment of targeted advertising and child-focused tracking.

• Massachusetts bill may include a private right of action in one version.
• Louisiana is now listed among newly enacted privacy laws.
• Vermont proposal includes geofencing and large language model training notice rules.
• New laws differ on cure periods and impact assessments.
• Targeted advertising restrictions are newly highlighted.

The story has moved from broad state privacy lawmaking to a more concrete phase of enactment and enforcement design, with Oklahoma and Alabama newly joining the list of enacted comprehensive laws. It also now more explicitly centers on state attorneys general and specific limits on geolocation, minors' data, biometrics, and automated-content-recognition data.

• Oklahoma and Alabama have recently enacted comprehensive privacy laws.
• Virginia now prohibits sale of precise geolocation data.
• Kentucky now treats automatic content recognition as sensitive data.
• Biometric surveillance is explicitly targeted in several state proposals.
• State attorneys general are now the primary enforcement route.

The cluster is primarily about active U.S. state privacy lawmaking in 2026. The dominant pattern is incremental but broadening state-level tightening around sensitive data categories, children’s data, geolocation, biometrics, consent defaults, and data broker obligations. Most items reflect bills advancing, being enacted, or being amended rather than enforcement actions or litigation.