{"page":"/blog/ad-tech-regulation-calendar","modified":"2026-11-10","license":"https://creativecommons.org/licenses/by/4.0/","columns":["Date","Jurisdiction","Instrument and citation","What happens","Status on 9 November 2026"],"rows":[["1 January 2027","Oklahoma","Oklahoma Consumer Data Privacy Act, SB 546 (2026), section 22 (enrolled text)","Effective date of a Virginia-style comprehensive privacy law","Enacted; approved by the Governor 20 March 2026 (bill page)"],["1 January 2027","Louisiana","Louisiana Data Privacy Act, SB 386, Act 502 of 2026 (Louisiana Legislature)","Effective date of a comprehensive privacy law","Enacted; signed as Act 502, effective date listed as 1/1/27"],["1 January 2027","Delaware","HB 380 (2026) amending the Delaware Personal Data Privacy Act","Amendments take effect: lower thresholds, wider sensitive data, narrower GLBA exemption","Enacted; signed 2 September 2026 (Troutman, 10 September 2026)"],["1 January 2027","Connecticut","Public Act 26-64 (SB 4, 2026)","Data brokers may not sell or license brokered personal data in Connecticut unless registered with the Department of Consumer Protection","Enacted; signed 27 May 2026 (Connecticut General Assembly); date per Proskauer, 10 June 2026"],["1 January 2027","New Hampshire","HB 1460-FN (2026), Chapter 168, amending RSA 507-H","Ban on selling a child's personal data takes effect","Enacted; signed 19 June 2026 (NH General Court)"],["1 January 2027","California","CCPA regulations, 11 CCR 7200(b) (CPPA approved text)","Compliance date for ADMT already used for significant decisions: pre-use notice, opt-out, access","Regulations in force since 1 January 2026 (CPPA)"],["1 January 2027","California","11 CCR 7121(a)(1) (CPPA approved text)","First cybersecurity audit period opens for businesses with 2026 revenue above $100 million; report due 1 April 2028","In force"],["1 January 2027","California","Delete Act as amended by AB 883 (CalPrivacy)","Data brokers must process DROP deletion requests at least every 30 days, down from 45","Enacted"],["1 January 2027","California","AB 566, California Opt Me Out Act","Browsers must offer a setting that sends an opt-out preference signal","Enacted (Orrick, 10 October 2025); statute text not read"],["1 January 2027","Colorado","SB 26-189, repealing and reenacting SB 24-205 (Colorado General Assembly)","New automated decision-making technology law applies to consequential decisions made on or after this date","Enacted; signed 14 May 2026"],["12 January 2027","EU","Data Act, Regulation (EU) 2023/2854, Article 29(1) (EUR-Lex)","Cloud and other data processing providers may not charge for switching, including egress","In force; the Council's Omnibus mandate keeps Article 29 even for older custom-made and SME contracts (Council document 14756/26, p. 79)"],["31 January 2027","California","Civil Code 1798.99.82 (CalPrivacy)","Annual registration deadline for data brokers that operated in 2026","In force; the 2027 date follows the annual cycle"],["18 February 2027","EU","Digital Services Act, Regulation (EU) 2022/2065, Article 91 (EUR-Lex)","Commission report on the DSA's effect on small and medium-sized enterprises, with the assessment of the Board and the supervisory fee","Pending"],["About 27 March 2027 (our calculation)","New Jersey","A5328 (2026) amending the New Jersey Data Privacy Act","Data broker and data collector provisions become operative 270 days after enactment on 30 June 2026","Enacted (Covington, 23 July 2026)"],["1 April 2027","Maryland","Maryland Online Data Privacy Act, cure provision","Discretionary 60-day cure period sunsets","In force since 1 October 2025 (Koley Jessen)"],["1 April 2027 (on paper)","US federal","CFPB, 12 CFR 1033.121(b)(2) (eCFR)","Second tier of Section 1033 data-access compliance: banks with $10 billion to $250 billion in assets and smaller non-banks","On hold: dates stayed by court order and under reconsideration (Federal Register, 22 August 2025)"],["1 May 2027","Alabama","Alabama Personal Data Protection Act, HB 351 (2026)","Effective date; 45-day cure period that does not sunset","Enacted; signed 16 April 2026 (WilmerHale, 22 April 2026)"],["8 May 2027","EU","European Media Freedom Act, Regulation (EU) 2024/1083, Article 20 (EUR-Lex)","Users gain a right to customise the media offer on devices and interfaces, including default settings","Pending"],["1 July 2027","Connecticut","Public Act 26-64 (SB 4, 2026)","Surveillance pricing obligations take effect","Enacted (Proskauer, 10 June 2026)"],["2 August 2027","EU","AI Act, Regulation (EU) 2024/1689, Article 111(3) (EUR-Lex)","General-purpose AI models placed on the market before 2 August 2025 must comply","Law; unchanged by Regulation (EU) 2026/1744"],["2 August 2027","EU","AI Act, Article 57(1) as amended by Regulation (EU) 2026/1744 (EUR-Lex)","Each member state's AI regulatory sandbox must be operational","Law"],["12 September 2027","EU","Data Act, Article 50 (EUR-Lex)","Unfair-terms rules in Chapter IV extend to long-term contracts concluded on or before 12 September 2025","Law"],["17 November 2027","EU","Digital Services Act, Article 91 (EUR-Lex)","First full evaluation of the DSA, repeated every five years","Pending"],["2 December 2027","EU","AI Act, Article 113 as amended by Regulation (EU) 2026/1744 (EUR-Lex)","High-risk obligations apply to Annex III systems, such as those used in credit, employment and essential services","Law since the amendment took effect in July 2026"],["11 December 2027","EU","Cyber Resilience Act, Regulation (EU) 2024/2847, Article 71(2) (EUR-Lex)","Full application to products with digital elements, hardware and software","Law"],["31 December 2027","California","11 CCR 7155(b) (CPPA approved text)","Risk assessments due for covered processing that began before 2026 and continues; submission by 1 April 2028 under 7157(a)(1)","In force"]],"sourceUrls":[["http://webserver1.lsb.state.ok.us/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.PDF","http://www.oklegislature.gov/BillInfo.aspx?Bill=SB546&Session=2600"],["https://www.legis.la.gov/Legis/BillInfo.aspx?s=26RS&b=SB386"],["https://www.troutmanprivacy.com/2026/09/delaware-significantly-amends-its-consumer-data-privacy-law-what-businesses-need-to-know/"],["https://www.cga.ct.gov/asp/cgabillstatus/cgabillstatus.asp?selBillType=Bill&which_year=2026&bill_num=4","https://privacylaw.proskauer.com/2026/06/articles/data-privacy-laws/from-data-brokers-to-dna-connecticut-enacts-sweeping-privacy-amendments/"],["https://gc.nh.gov/bill_Status/billinfo.aspx?id=2443"],["https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf","https://cppa.ca.gov/regulations/ccpa_updates.html"],["https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf"],["https://privacy.ca.gov/data-brokers/"],["https://infobytes.orrick.com/2025-10-10/california-enacts-browser-opt-out-signal-legislation/"],["https://leg.colorado.gov/bills/sb26-189"],["https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng","https://data.consilium.europa.eu/doc/document/ST-14756-2026-INIT/en/pdf"],["https://privacy.ca.gov/data-brokers/"],["https://eur-lex.europa.eu/eli/reg/2022/2065/oj/eng"],["https://www.insideprivacy.com/state-privacy/state-comprehensive-privacy-law-round-up-several-states-amend-their-privacy-statutes/"],["https://www.koleyjessen.com/insights/publications/maryland-online-data-privacy-act"],["https://www.ecfr.gov/current/title-12/section-1033.121","https://www.federalregister.gov/documents/2025/08/22/2025-16139/personal-financial-data-rights-reconsideration"],["https://www.wilmerhale.com/en/insights/blogs/wilmerhale-privacy-and-cybersecurity-law/20260422-alabama-enacts-nations-twenty-first-state-comprehensive-privacy-law"],["https://eur-lex.europa.eu/eli/reg/2024/1083/oj/eng"],["https://privacylaw.proskauer.com/2026/06/articles/data-privacy-laws/from-data-brokers-to-dna-connecticut-enacts-sweeping-privacy-amendments/"],["https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng"],["https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L_202601744"],["https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng"],["https://eur-lex.europa.eu/eli/reg/2022/2065/oj/eng"],["https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L_202601744"],["https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng"],["https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf"]]}