2026 Enforcement Trends: What Regulators Are Targeting
The enforcement actions of 2024 and 2025 are not random — they reveal a consistent set of operational failures that regulators are systematically pursuing.
Opt-out failures are the single most consistent trigger. Every California AG enforcement action has involved some failure to honour consumer opt-out rights — broken links, non-functional webforms, failure to recognise Global Privacy Control signals, or interfaces that made opting out disproportionately difficult compared to opting in. Honda's $632,500 settlement and Tractor Supply's $1.35 million settlement both centred on these failures. Implementing opt-out mechanisms is not enough — they must function correctly, respond to automated signals like GPC, and be tested regularly.
Health and sensitive data handling is a priority target for regulators at both state and federal level. Healthline Media's $1.5 million settlement arose from failure to honour GPC and misuse of health-related data for advertising purposes. Blue Shield of California triggered an investigation after misconfigured analytics tools shared health data affecting 4.7 million members. Any business operating in health, wellness, or adjacent digital spaces should treat sensitive data handling as a first-priority compliance area.
Vendor contract failures are increasingly prominent. Tractor Supply's enforcement order specifically cited insufficient service provider agreements and absence of required contractual provisions with advertising technology companies. The CPPA requires that every contract with a service provider or contractor processing personal information on your behalf include CCPA-mandated provisions — and auditing those contracts against current legal requirements has become a standalone compliance task. Managing vendor relationships at scale requires systematic approaches to data protection assessments and vendor risk documentation that spreadsheets cannot support.
Minors' data is an expanding frontier. Multiple states have moved to define minors as individuals under 18 — up from 13 — and are requiring enhanced consent, age verification, and design standards for services that may be accessed by younger users. Florida and Tennessee have enacted age-verification requirements for high-risk digital services. Texas and Virginia have strengthened youth protections in 2026 amendments. Any product or service with plausible minor-user populations needs a specific compliance review of these requirements.
Compliance Checklist for US Companies in 2026
Getting your house in order across nineteen state laws sounds paralysing. In practice, a structured approach to five core areas covers the majority of exposure.
Data mapping is the foundation. You cannot comply with access rights, deletion requests, opt-out mechanisms, or Data Protection Impact Assessments without knowing what personal data you collect, where it flows, under what legal basis, and which vendors have access to it. This is not a one-time exercise — it must stay current as your product and vendor stack evolves. Stale data maps are as dangerous as having none at all.
Consent and opt-out infrastructure must be jurisdiction-aware. California requires you to honour GPC signals. Twelve states now require honouring universal opt-out mechanisms as a de facto national standard. Sensitive data processing requires opt-in consent across Virginia, Connecticut, Colorado, Indiana, Kentucky, and Rhode Island. A single static consent banner cannot serve all these requirements simultaneously — geo-detection and jurisdiction-specific configuration are operational necessities, not nice-to-haves.
Privacy notices must be specific, readable, and accurate. Connecticut's enforcement action against an illegible notice and Connecticut's AG's emphasis on operational opt-out mechanisms being both present and functional should be treated as a universal standard. Privacy notices must list categories of data collected, disclosed, and sold; identify named or categorised third parties; explain consumer rights; and describe how those rights can be exercised. The CCPA privacy policy requirements that California enforces in 2026 — including specific retention periods and sensitive data disclosures — have become the benchmark standard for what a legally defensible US privacy notice looks like.
Consumer rights fulfilment requires documented, tested workflows. Access, deletion, correction, portability, and opt-out requests must be fulfilled within mandated timeframes — typically 45 days under CCPA and 30 days under Virginia-model laws. The intake, identity verification, data retrieval, redaction, and response steps must be documented and testable, not handled ad hoc.
Vendor and service provider agreements must be audited against current legal requirements in each state. CCPA mandates specific contractual provisions in every service provider agreement. Virginia, Colorado, Connecticut, and the newer state laws require data processing agreements with mandatory terms. Rhode Island requires specific third-party disclosures. If your vendor contracts were last reviewed in 2022 or 2023, assume they need updating.
The Common Mistakes That Generate Enforcement Risk
Assuming GDPR compliance is sufficient is the most widespread error among businesses with international operations. GDPR's opt-in model for consent is more stringent than CCPA's opt-out approach in some ways, but CCPA's specific requirements — opt-out links, GPC signal recognition, specific privacy notice categories, service provider contract provisions — are operationally distinct and not automatically satisfied by a GDPR-compliant program. Businesses discover this gap when they receive a cure notice from a state AG.
Ignoring smaller or newer state laws until they generate enforcement headlines is a systemic risk. Indiana, Kentucky, and Rhode Island were enacted in 2023 and 2024 — businesses with national footprints had two to three years to prepare. The January 1, 2026 effective date was not a surprise. Maryland, Minnesota, and New Hampshire have active laws that receive less coverage than California but carry real enforcement exposure for covered businesses.
Treating consent and opt-out as website features rather than operational infrastructure is a pattern in multiple settled enforcement actions. Cookie banners that load tracking technologies before consent is registered, opt-out forms that route to dead webforms, GPC signals that are detected but not actioned — these are technical failures that regulators identify through automated scans, consumer complaints, and investigative sweeps. They are preventable with the right infrastructure, not with policy documents.
Maintaining manual compliance processes at scale creates documentation gaps that become enforcement vulnerabilities. A business handling data subject requests by email, tracking vendor contracts in spreadsheets, and running DPIAs through shared document templates will struggle to produce the evidence of accountability that regulators now expect. The CPPA explicitly noted in its Tractor Supply enforcement that compliance must be demonstrable, not merely declared. A privacy governance program built on structured workflows and audit-ready documentation is what separates organisations that survive regulatory scrutiny from those that become the next case study.
Operationalising Multi-State Compliance
The practical challenge of multi-state compliance is not legal — it is operational. Most legal teams understand what the laws require. The problem is translating those requirements into systems, workflows, and evidence that function across nineteen state regimes simultaneously.
The starting point is a unified data inventory that maps personal data flows across your entire organisation and vendor stack, annotated with applicable state laws, legal bases, and retention schedules. From this foundation, every other compliance function — DSARs, DPIAs, consent management, vendor risk, incident response — draws its inputs. Without it, every compliance function operates on incomplete information.
Consent management infrastructure must support jurisdiction-aware configuration, automatically serving the appropriate consent mechanism to users based on their location. A California resident must see an opt-out link and have GPC signals honoured. A user in a Virginia-model state must see an opt-in gate for sensitive data processing. These are not interchangeable. The technical implementation of consent management is now a compliance function as much as a product feature.
Consumer rights workflows must be structured, documented, and measurably performing within mandated timeframes. This means automated intake systems, identity verification protocols, connected data retrieval across all processing systems, and completion tracking — not email inboxes and shared task lists. The CPPA's scrutiny of opt-out mechanism functionality, and the Connecticut AG's finding of "inoperable" mechanisms, signal that regulators are testing whether these systems actually work, not whether businesses claim to have them.
Vendor risk management at the scale required in 2026 demands systematic processes. Every service provider agreement must be reviewed against the applicable state laws' contractual requirements, tracked for currency, and updated when processing activities change or laws are amended. Automated vendor assessment questionnaires, contract analysis, and compliance tracking are how organisations with large SaaS stacks stay ahead of this obligation.
FAQ
Which states have comprehensive privacy laws in 2026?
Nineteen states have active comprehensive consumer privacy laws as of 2026: California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia.
Do small businesses need to comply?
It depends on the state. California, Texas, and most Virginia-model laws set applicability thresholds based on volume of data processed or revenue from data sales. However, Texas's TDPSA applies without revenue or volume thresholds to any business that conducts business in Texas or targets Texas residents — making small business exemptions narrower than in other states. Sensitive data processing or involvement with minors' data can trigger obligations regardless of business size in some states.
What triggers applicability?
The most common triggers are processing personal data of 100,000 or more consumers in a given state; processing data of 25,000 or more consumers while deriving over 50% of gross revenue from data sales; annual gross revenue thresholds (California); or operating in states like Texas that apply no revenue or volume minimum.
How do companies manage multi-state compliance?
The most effective approach is to build to the strictest common standard — typically California's — and supplement with jurisdiction-specific configurations for states with distinct requirements. Centrally managed consent infrastructure, unified data inventories, automated DSAR workflows, and standardised vendor assessment processes are the operational building blocks. Jurisdiction-aware automation is no longer optional at scale.
What happens if you don't comply?
Penalties range from $7,500 per violation under Indiana, Kentucky, and Virginia-model laws to $10,000 per violation in Rhode Island. California's CCPA/CPRA regime carries up to $7,988 per intentional violation, assessed on a per-violation basis — meaning a single compliance gap affecting thousands of consumers can compound rapidly. Beyond financial penalties, enforcement orders typically require extensive corrective action, operational reporting to the AG, and ongoing compliance monitoring — all of which carry indirect costs that often exceed the initial fine.
The patchwork is not getting simpler. The enforcement is not getting lighter. And the expectation that your compliance programme can be documented in a spreadsheet and reviewed annually no longer survives contact with a state AG's investigative team. If your current programme was built for a different era of US privacy enforcement, this is the year to rebuild it for the one you are actually in.
Stop managing multi-state privacy compliance reactively. See how Secure Privacy's consent management platform helps companies automate jurisdiction-aware compliance across US state privacy laws and beyond.
