{"page":"/blog/us-state-privacy-laws-tracker","modified":"2026-11-10","license":"https://creativecommons.org/licenses/by/4.0/","columns":["State","Change or action","Date","Source"],"rows":[["California","Regulations on risk assessments, cybersecurity audits and automated decisionmaking approved; in force 1 January 2026","23 September 2025","CPPA"],["California","California Opt Me Out Act (AB 566): browsers must offer an opt-out preference signal from January 2027","Signed 8 October 2025","CPPA"],["California","Expanding Privacy Rights Act (SB 923): deletion reaches data bought from third parties, from 1 January 2027","Signed 27 September 2026","CalPrivacy"],["Connecticut","SB 1295 (2025) amendments in force: 35,000 threshold, sensitive-data trigger, minors' ad ban, profiling impact assessments","1 July 2026","CT AG 2025 report"],["Connecticut","Public Act 26-64: precise geolocation sale ban (1 October 2026); data broker registration before selling from 1 January 2027","Approved 27 May 2026","PA 26-64"],["Delaware","85 Del. Laws c. 463 lowers thresholds from 1 January 2027","In the code on 9 November 2026","6 Del. C. 12D-103"],["Maryland","Chapter 874 of 2026 (HB 711): bars knowingly selling personal data to government units engaged in civil immigration enforcement; widens \"sensitive data\" to inferred data and device and vehicle location","Effective 1 July 2026","Maryland General Assembly, HB 711"],["Montana","Chapter 567, Laws of 2025: lower thresholds, duties toward minors, no cure provision","2025 session","MCA 30-14-2803"],["Oregon","Chapter 417, Oregon Laws 2025: cure period ends 1 January 2026 for most controllers","Effective 24 June 2025","ORS 646A, note"],["New Hampshire","HB 1460: sale of a child's personal data prohibited from 1 January 2027","Chapter 168 of 2026","NH General Court"],["Utah","Chapters 95 and 193 of 2026 add motor vehicle data rules from 1 January 2027","2026 session","Utah Code 13-61"],["Virginia","2025 c. 703: social media users under 16 limited to one hour a day; 2026 c. 820 amends the children's section","2025 and 2026 sessions","Va. Code 59.1-577.1, 59.1-578"],["Texas","First lawsuit under a state comprehensive privacy law, against Allstate and Arity","13 January 2025","WilmerHale, 21 January 2025 (secondary)"]],"sourceUrls":[["https://cppa.ca.gov/announcements/2025/20250923.html"],["https://cppa.ca.gov/announcements/2025/20251008_2.html"],["https://privacy.ca.gov/2026/09/california-expands-privacy-protections-by-strengthening-deletion-rights/"],["https://portal.ct.gov/-/media/ag/reports/ctdpaenforcementreportcy2025.pdf"],["https://www.cga.ct.gov/2026/ACT/PA/PDF/2026PA-00064-R00SB-00004-PA.PDF"],["https://delcode.delaware.gov/title6/c012d/index.html"],["https://mgaleg.maryland.gov/mgawebsite/Legislation/Details/hb0711?ys=2026RS"],["https://leg.mt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0030/0300-0140-0280-0030.html"],["https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html"],["https://gc.nh.gov/bill_Status/billinfo.aspx?id=2443"],["https://le.utah.gov/xcode/Title13/Chapter61/C13-61_2022050420231231.pdf"],["https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/"],["https://www.wilmerhale.com/en/insights/blogs/wilmerhale-privacy-and-cybersecurity-law/20250121-texas-ag-brings-first-ever-lawsuit-under-a-state-comprehensive-privacy-law"]]}