Ad tech regulation calendar 2027: privacy law effective dates, deadlines and decisions to watch

Scope. Rules that change how advertising data is collected, shared, measured or sold, or how ad-funded platforms operate, in the US (federal and state), the EU and the UK. Industry standards that ad tech contracts depend on, such as the TCF and GPP, are included.

Inclusion rule. A row needs a fixed date in the calendar year and a source we could read by the check date in the header. Primary sources come first: legislature pages, the Federal Register, eCFR, EUR-Lex, legislation.gov.uk and court dockets. Where only a law-firm summary gave the date, the row says so.

Status labels. "Enacted" means signed but not yet effective. "In force" means the instrument applies already and the listed date is a later phase. "Pending" means a scheduled report or review. "On hold" means a date written in the rule that the agency is reconsidering.

Default columns. The published table shows six columns by default: date, jurisdiction, instrument, what happens, status and source. The CSV adds the citation pinpoint, the source type and the check date.

Update cadence. Monthly, and within a week of any signature, judgment or official-journal publication that moves a row.

Dataset: CSV /datasets/ad-tech-regulation-calendar-2027.csv, 26 rows, licensed CC BY 4.0, one row per dated entry. Columns: date (ISO 8601), date_type (effective, compliance, application, report, sunset), jurisdiction, instrument, citation_pinpoint, what_happens, status, status_checked_on, source_url, source_type (primary, law firm, trade press), notes.

The three new laws follow the model most states have used since Virginia. Oklahoma's data protection assessment duty covers only processing activities that start on or after the effective date and is not retroactive (Oklahoma SB 546, enrolled). Louisiana's law starts the same day under Act 502 (Louisiana Legislature). Alabama follows on 1 May with a 45-day cure period that does not sunset and civil penalties of up to $15,000 per violation (WilmerHale, 22 April 2026).

For ad tech, these laws matter through their opt-out rights for targeted advertising and sale, and through sensitive-data consent. Health inferences are the most exposed category. Our state health privacy laws tracker shows how each state treats health data. Vermont's law, signed on 16 June 2026, starts later, on 1 January 2028 (Vermont Legislature, S.71).

Amendments to older laws change more in 2027 than the new laws do. Delaware's HB 380 lowers the applicability thresholds and narrows the exemption for financial institutions from 1 January (Troutman, 10 September 2026). Connecticut's data broker registry starts the same day, and its surveillance-pricing rules on 1 July (Proskauer, 10 June 2026). New Jersey's data broker provisions wait 270 days from signature on 30 June 2026 (Covington, 23 July 2026).

Enforcement also tightens. Maryland's discretionary 60-day cure period sunsets on 1 April 2027 (Koley Jessen). Maryland also prohibits the sale of sensitive data unless the sale is necessary for a product or service the consumer requested, so the sunset matters most for health and location audiences.

California stacks five dates into 2027. The ADMT compliance date of 1 January covers businesses that already use automated decisionmaking technology for significant decisions, such as credit, housing or employment. Those businesses must give pre-use notices and honour opt-out and access requests (11 CCR 7200(b)). The definition states that a "significant decision does not include advertising to a consumer", although a model that decides who gets credit or insurance can still be covered. That line is the subject of our GLBA and bank advertising guide for financial media networks.

The cybersecurity audit cycle starts on the same day for the largest businesses. A business with 2026 revenue above $100 million audits calendar 2027 and reports by 1 April 2028 (11 CCR 7121(a)(1)). Risk assessments for processing that began before 2026, including selling or sharing personal information, must be done by 31 December 2027 (11 CCR 7155(b)).

Two consumer-side changes reach the bidstream. AB 566 requires browsers to offer a setting that sends an opt-out preference signal, so more California traffic will carry one (Orrick, 10 October 2025). And data brokers must pull deletion requests from the state's DROP platform every 30 days instead of every 45 (CalPrivacy). Our guide to GPP and TCF implementation covers how opt-out signals travel in bid requests.

The AI Act's original timetable no longer applies in full. Regulation (EU) 2026/1744 replaced the dates in Article 113. Annex III high-risk systems now follow the high-risk rules from 2 December 2027, and products covered by Annex I from 2 August 2028 (EUR-Lex, OJ L 2026/1744). The Commission's AI page, updated on 19 October 2026, gives the same dates (European Commission).

Two duties land earlier and matter more to advertisers. The Article 50 transparency rules have applied since 2 August 2026. Generative systems already on the market before that date have until 2 December 2026 to mark synthetic content (EUR-Lex). An AI-generated ad creative therefore meets its marking rules in 2026, not 2027. Our page on the EU AI Act and advertising covers targeting, creative and agents in depth.

In 2027 itself, the August dates concern general-purpose models released before August 2025 and national regulatory sandboxes (AI Act, Article 111(3)). The December date reaches ad tech only where a system feeds a decision listed in Annex III, such as creditworthiness.

The Data Act gives the year two dates. From 12 January 2027, a cloud provider may not charge for switching, including data egress (Article 29(1)). From 12 September 2027, its unfair-terms rules reach older long-term data-sharing contracts (Article 50). The Council's Digital Omnibus mandate would exempt some older custom-made and SME cloud contracts from most of the switching chapter, but it keeps the Article 29 charge rules for them (Council document 14756/26, p. 79). See our EU Data Act guide for ad tech.

The Digital Services Act generates reports, not new duties, in 2027. The Commission reports on its effect on smaller firms by 18 February and runs its first full evaluation by 17 November (DSA, Article 91). Either report may propose amendments. The DSA advertising transparency page tracks the ad repository and profiling rules.

The European Media Freedom Act's Article 20 applies from 8 May 2027 (EUR-Lex). It lets users change default settings that shape which media services they see on devices and interfaces, which can reach connected-TV home screens. The Cyber Resilience Act applies in full on 11 December 2027 (Article 71(2)).

The cookie rules themselves have no 2027 date. On the Council's text, new device-access rules would apply through national laws 24 months after adoption, and the file has not been adopted (Council document 14756/26). Follow it on our EU Digital Omnibus tracker.

The UK finished most of its 2025 reform in 2026. The cookie exemptions in section 112 of the Data (Use and Access) Act, the higher PECR fines and the recognised legitimate interests all commenced on 5 February 2026 (SI 2026/82). The Information Commission replaced the ICO on 30 September 2026, and the government's commencement page lists no 2027 dates (gov.uk, updated 12 October 2026). Our UK Data (Use and Access) Act guide explains what changed for advertising.

Competition rules may move faster than privacy rules. The CMA designated Google with strategic market status in general search on 10 October 2025 and has imposed several conduct requirements since. Its user-choice requirement is still under analysis after consultation (CMA case page).

Google ad tech. Judge Brinkema's order of 2 September 2026 rejected the proposed divestitures and accepted most behavioural remedies (CourtListener, docket entry 1857). Those remedies include integrations between Google's ad exchange and Prebid (DOJ, 16 September 2026). The parties filed a joint proposed final judgment on 2 October 2026 (CourtListener). Implementation dates will run from entry of judgment, so 2027 milestones cannot be fixed yet. Our Google ad tech remedies explainer tracks them.

CFPB Section 1033. The CFR still lists 1 April 2027 for the second compliance tier (eCFR). In August 2025 the Bureau said a court order had stayed the dates by 90 days and that it plans to propose extending them (Federal Register). We found no proposed rule published by 9 November 2026.

FTC. We found no FTC rule with a 2027 compliance date that targets advertising data. The amended COPPA Rule fell due on 22 April 2026 (Federal Register). The negative option rule is back at the proposal stage after the 2024 amendments were removed (Federal Register, 12 February 2026).

TCF and GPP. The TCF v2.3 deadline passed on 28 February 2026 (IAB Europe). We found no dated 2027 deadline from IAB Europe or IAB Tech Lab. IAB Tech Lab's GPP materials list the US Privacy String as deprecated but give no sunset date (IAB Tech Lab, GPP).

For the commercial side of the same year, see programmatic advertising in 2027. The ad tech compliance hub links every regulatory page in this library.

1. Oklahoma Legislature, SB 546 (2026 session), bill history (approved by the Governor 20 March 2026). http://www.oklegislature.gov/BillInfo.aspx?Bill=SB546&Session=2600
2. Oklahoma Legislature, SB 546 enrolled text, section 22 (effective date). http://webserver1.lsb.state.ok.us/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.PDF
3. Louisiana State Legislature, SB 386 (2026 Regular Session), Act 502. https://www.legis.la.gov/Legis/BillInfo.aspx?s=26RS&b=SB386
4. WilmerHale, "Alabama Enacts Nation's Twenty-First State Comprehensive Privacy Law" (22 April 2026). https://www.wilmerhale.com/en/insights/blogs/wilmerhale-privacy-and-cybersecurity-law/20260422-alabama-enacts-nations-twenty-first-state-comprehensive-privacy-law
5. Vermont Legislature, S.71 (2026), bill status (signed 16 June 2026). https://legislature.vermont.gov/bill/status/2026/S.71
6. Troutman Pepper Locke, "Delaware Significantly Amends Its Consumer Data Privacy Law" (10 September 2026). https://www.troutmanprivacy.com/2026/09/delaware-significantly-amends-its-consumer-data-privacy-law-what-businesses-need-to-know/
7. Connecticut General Assembly, SB 4 (2026), bill status (signed 27 May 2026). https://www.cga.ct.gov/asp/cgabillstatus/cgabillstatus.asp?selBillType=Bill&which_year=2026&bill_num=4
8. Proskauer, "From Data Brokers to DNA: Connecticut Enacts Sweeping Privacy Amendments" (10 June 2026). https://privacylaw.proskauer.com/2026/06/articles/data-privacy-laws/from-data-brokers-to-dna-connecticut-enacts-sweeping-privacy-amendments/
9. New Hampshire General Court, HB 1460-FN (2026), bill status (Chapter 168). https://gc.nh.gov/bill_Status/billinfo.aspx?id=2443
10. Covington, Inside Privacy, "State Comprehensive Privacy Law Round-Up: Several States Amend Their Privacy Statutes" (23 July 2026). https://www.insideprivacy.com/state-privacy/state-comprehensive-privacy-law-round-up-several-states-amend-their-privacy-statutes/