Privacy Legislation Update: Key Developments from 2026 and What's Ahead

The US privacy law landscape continued to expand and mature in the past twelve months as additional states enacted comprehensive consumer privacy laws, existing laws were amended, and regulators intensified enforcement activity. McDermott hosted a practical lookback of the legislative, regulatory, and enforcement trends that shaped consumer privacy compliance in 2026 and took a look ahead to what bears watching for in 2027.

Top takeaways included:

1. New privacy laws in Oklahoma, Louisiana, Alabama, and Vermont add familiar frameworks with important state-specific differences. Each of these laws will come into effect in the next 16 months. While they have many similarities to existing consumer privacy laws, there are nuances that require attention.
2. Amendments to existing privacy laws are becoming just as important as new privacy statutes. Each year, it seems reasonable to expect that states will amend their consumer privacy laws. State consumer privacy law compliance is not “set it and forget it.” For example, this past year saw material amendments in Virginia, Connecticut, and Delaware.
3. Not a Data Broker? Think Again. New Jersey’s new data broker law, which comes into effect in 2027 applies to “Data Collectors,” which are businesses with a direct consumer relationship, but who make that information available to data brokers. Companies should look closely at whether they are required to register under this new law, and whether New Jersey’s brand of data broker laws becomes a national trend bears watching.
4. Privacy enforcement on the rise. California, Texas, and even the Federal Trade Commission have all made big splashes in the last year with privacy-related enforcement actions. Regulators seem focused on not only sensitive data (e.g., health and children’s data), but the representations that companies make on their website and in their privacy policies.

View the webinar slides here.

Don’t miss our upcoming webinar

Elliot Golding and David Saunders will be hosting a 2027 horizon scan webinar on December 2 at 12:00 pm ET. They will give their views as to what the biggest privacy and cybersecurity issues will be in 2027. Secure your spot.