State legislatures returned to data privacy in 2026 with familiar language and unfamiliar coalitions. The broad shape of a comprehensive privacy bill is now standard: notice, access, deletion, correction, opt-out of targeted advertising and a duty to protect personal data. What changes from state to state is who can enforce those rights, which businesses are exempt and how much sensitive data receives extra protection.
For voters, the meaningful question is not whether a bill says it protects privacy. It is whether the rights it creates can be exercised without hiring a lawyer, and whether anyone has the resources to enforce them. Those details are usually settled in committee, far from the press conference.
Key facts
- Most state privacy bills follow a common structure but differ sharply on enforcement.
- A private right of action lets consumers sue; agency-only enforcement relies on attorneys general.
- Small-business exemptions often depend on revenue, data volume or the type of data processed.
- Sensitive-data rules for health, biometric and children's information are the most contested provisions.
- Compliance costs fall hardest on firms that operate in several states with different thresholds.
Why states keep legislating privacy
There is still no comprehensive federal consumer privacy statute. A patchwork of sector rules covers health, financial and educational data, and the Federal Trade Commission polices deceptive practices, but the general consumer data economy operates largely under disclosure and consent. States have responded with their own frameworks, and the number with a comprehensive law has continued to grow.
The political logic differs by chamber. Consumer groups press for enforceable individual rights. Business associations ask for a single national standard and warn about compliance costs. Civil liberties organisations focus on government access and biometric surveillance. The result is a bill that usually passes only after the enforcement and exemption provisions have been narrowed enough to hold a coalition together.
The four fights inside every bill
First, scope: which entities are covered and which data is excluded. Employee and business-to-business data are often carved out, which can remove most of the records a worker cares about. Second, thresholds: revenue and data-volume triggers determine whether a small firm is regulated, and a low threshold can capture a surprising number of local businesses.
Third, sensitive data: health, biometric, precise geolocation, racial or ethnic origin, sexual orientation and children's data usually require consent or an opt-in. The definition of biometric data is especially contested, because it decides whether a photograph, a voiceprint or a gait analysis is covered. Fourth, enforcement: agency-only versus a private right of action. That single choice often determines whether the law changes corporate behaviour or produces a compliance manual.
Consumer rights that matter
Most bills grant a right to know what data is collected, to access it, to correct it, to delete it and to obtain a portable copy. They also grant a right to opt out of targeted advertising, the sale of personal data and some profiling. On paper, these are strong. In practice, the friction is in the request process: identity verification, response deadlines, authorised agents and whether a business can refuse.
Read the appeal provision. A good bill lets a consumer appeal a refused request and requires the business to explain its decision. Read the timeline. Forty-five days is common, with a possible extension. Read whether the right applies to derived data and inferences, not just the raw record. A privacy law that covers only the file and not the profile misses the part that drives the decision.
Small business exemptions
Small-business exemptions are popular and poorly understood. A typical bill exempts entities below a revenue threshold, or those that process data on fewer than a set number of consumers, or businesses that sell a narrow category of data. The exemptions may be tiered: a small firm might be exempt from some obligations but still bound by security and breach-notification duties.
The compliance burden also depends on how the state counts. A business that handles data for other companies may be a processor rather than a controller, with different obligations. A local retailer that runs a loyalty programme may cross a threshold it never considered. Trade associations often publish a decision tree; legislatures rarely do. If you run a small firm, read the definition sections before assuming the exemption applies.
A privacy right you cannot exercise without a lawyer is a right designed for people who already have one.
Enforcement: attorneys general and private lawsuits
Agency-only enforcement gives the attorney general authority to investigate, impose civil penalties and negotiate consent decrees. It concentrates expertise and reduces frivolous claims, but it depends on budget and political priorities. A private right of action allows individuals and class actions to enforce the law directly. It creates a stronger deterrent and a larger compliance industry, and business groups oppose it almost uniformly.
Some states split the difference: a limited private right after a cure period, or a right that applies only to certain violations such as a data breach. Watch the cure period. A 30-day right to fix an alleged violation can turn a meaningful penalty into a warning. Watch the penalty cap, too. A maximum that is low relative to the cost of compliance changes the incentives more than the headline fine suggests.
How to read a bill in ten minutes
Start with the definitions of "controller", "processor", "sale" and "sensitive data". Then find the exemptions, especially for employee data and nonprofits. Read the consumer-rights section and the appeal process. Then read enforcement: who investigates, who sues, what the penalties are and whether there is a cure period. Finally, check the effective date and any rulemaking deadline; a law that takes effect in 2027 may still require agencies to write rules first.
Ignore the press release and the floor speech. They describe intentions, not text. The bill's fiscal note can also be revealing: it shows how the state expects to fund enforcement and whether the attorney general has asked for additional staff. A privacy law without an enforcement budget is a statement of values, not a working regime.
What happens next
Expect more states to pass comprehensive laws, more battles over private rights of action and more attention to biometric and children's data. Expect also a continued push for a federal standard, which would preempt some state rules and almost certainly set a lower floor than the strictest states. The shape of that compromise is the most important privacy question of the next congressional session.
For readers, the practical advice is local. Find out whether your state has a law, when it takes effect and how to file a complaint. Check whether your employer or a service you use has published a privacy notice that actually describes its practices. And when a bill reaches a committee hearing, read the amendment text; the version that passes is rarely the version that was introduced.
This article is general information about legislation, not legal advice about your obligations under any particular state law.
Official source: NCSL — state privacy legislation. This article is general information, not legal advice.
