Major Privacy Laws Coming in 2026
Kentucky, Rhode Island, Indiana - January 1 & July 1, 2026
All three laws apply to businesses managing data of 100,000+ consumers annually or 25,000+ if deriving over 50% revenue from data sales. Consumer rights include confirm, access, correct, delete, portability, and opt-out of targeted advertising, sale, and profiling.
Sensitive data—health information, sexual orientation, immigration status, biometric identifiers, precise geolocation (within 1,750 feet), and children's data—requires consent. State Attorneys General enforce with 30-day cure periods and penalties up to $7,500 per violation.
Indiana provides six-month grace period (April 1 – July 1, 2026). All three mandate Global Privacy Control signal recognition - a necessary learning from the history of the failed Do Not Track (DNT) signal - and data minimization (collecting only reasonably necessary information).
Cybersecurity Audits: Organizations earning 50%+ revenue from selling/sharing personal information OR over $26.625 million revenue while processing 250,000+ consumers' data must conduct annual cybersecurity audits. Annual certification to California Privacy Protection Agency required.
Privacy Risk Assessments: Required for high-risk processing including data sales, sensitive data (now including under-16 minors), automated decision-making, profiling, AI training, and facial/emotional recognition. Annual summary report to CPPA mandatory.
Updated Penalties: Negligent violations $2,663 per violation; intentional violations $7,988 per violation. Removes automatic 30-day cure for intentional violations. Six-tier penalty system based on harm and intent.
New Sensitive Categories: Minors under 16, neural data, government-issued IDs now require consent.
Operational Changes: Global Privacy Control signal recognition with visible confirmation display. Third-party notification of opt-outs required.
Connecticut & Oregon Updates
Connecticut (July 1, 2026): Removes "solely" modifier from automated decision-making opt-out right, broadening scope. Adds neural data, genetic/biometric-derived data, financial information, and government IDs to sensitive categories. New transparency obligations for mobile apps, connected devices, AR/VR.
Oregon (January 1, 2026): Prohibits sale of data when controller knows consumer is under 16. Prohibits sale of precise geolocation within 1,750-foot radius. Significantly impacts automotive dealers and mobile advertising.
European Union: AI Act & GDPR Enforcement
AI Act Full Enforcement (August 2, 2026)
High-risk AI systems require risk management, model evaluation, cybersecurity protections, incident reporting, and documentation. Applies to AI affecting fundamental rights (employment, credit, law enforcement). Penalties: up to €15 million or 3% of global turnover.
General-purpose AI models face transparency, copyright compliance, system safety obligations. Penalties: up to €35 million or 7% of global turnover.
Organizations need full AI systems inventory, risk classification, DPIAs for high-risk systems, and human oversight documentation.
GDPR Transparency Enforcement (2026)
European Data Protection Board prioritizes Articles 12-14 transparency obligations. All EU authorities participating in coordinated enforcement. Regulators expect explicit identification of each third-country recipient, not generic categories. Common issues: unclear privacy notices, insufficient processing purpose detail, inadequate transfer disclosure.
Article 22 GDPR protections relaxed for non-sensitive data. Organizations can make solely automated decisions without explicit consent. Safeguards: provide decision information, right to contest, right to human intervention. Sensitive data maintains strict protections.
New lawful basis: "recognized legitimate interests" without balancing test (crime prevention, emergencies, safeguarding). Allows cookies without consent in low-risk situations. Fines increase to £17.5 million or 4% of global turnover.
India: DPDP Act Phase 3 - May 12, 2027
Phase 2 (November 13, 2026): Consent manager registration opens—only India-incorporated entities with ₹2 crore+ net worth qualify.
Phase 3 (May 12, 2027): Full compliance mandatory with no grace period. Requirements: standalone privacy notices, granular consent with one-click withdrawal, verifiable parental consent, end-to-end encryption, 72-hour breach notification, automated deletion with proof. Penalties: ₹50 crore to ₹250 crore per violation.
68% of companies admit incomplete DPDP understanding despite India operations. Operating shutdowns possible post-May 12, 2027 if non-compliant.
Australia: ADM Transparency - December 10, 2026
Privacy policies must disclose: personal information used in automated decision-making, decisions made solely by automated programs, decisions where automation substantially related. Applies to decisions affecting individuals' rights (adverse and beneficial). Broad definition includes routine processes (filtering, scoring, prioritization).
