The cure period is dead. The fines are real. And if you're still treating US privacy compliance as a "check the box" exercise, 2026 is going to be expensive.
Three more states — Indiana, Kentucky, and Rhode Island — activated their comprehensive privacy laws on January 1, 2026. That brings the total to 19 states with active consumer data laws on the books. State attorneys general are no longer sending warning letters. They're sending settlement offers with seven-figure price tags attached.
For marketers, this isn't abstract legal territory. Every audience segment you build, every retargeting pixel you deploy, every CRM you enrich with third-party data has a jurisdiction attached to it. And that jurisdiction likely has opinions about what you're allowed to do with people's information.
This is your operational guide to US state privacy laws in 2026 — what changed, what's being enforced, and what you need to do differently right now.
The Landscape Has Shifted: 19 States, Not Just California
For years, marketers treated US privacy compliance as a California problem. CCPA was the big bad wolf, and everything else was noise you could ignore.
That logic is now dangerously outdated.
The 2026 state privacy map looks like this: - Fully active and enforcing: California (CCPA/CPRA), Texas, Connecticut, Virginia, Colorado, Utah, Iowa, Montana, Tennessee, Oregon, Delaware, Nebraska, New Hampshire, New Jersey, Arkansas - Newly active as of January 1, 2026: Indiana, Kentucky, Rhode Island - Pending activation: Several additional states with laws on the books but not yet in effect
What's critical to understand is that enforcement is no longer concentrated in California. Texas secured a settlement of over $1 billion against a major technology company under the Texas Data Privacy and Security Act. Connecticut reached an $85,000 settlement with a ticket seller over an unreadable privacy notice and broken opt-out mechanisms. These aren't GDPR-era warnings — they're real numbers with real company names attached.
California 2026: The Delete Act Changes Everything
California has always led US privacy law, but 2026 marks a qualitative shift in enforcement capability.
The California Delete Act's DROP platform launched on January 1, 2026. DROP stands for Data Rights Requests Optimization Portal, and it creates a single centralized system for consumers to submit deletion requests to registered data brokers. The enforcement mechanism is brutal: $200 per unfulfilled deletion request, compounding daily, starting January 31, 2026 for registered data brokers who fail to honor deletion obligations.
This isn't a theoretical penalty structure. The California Privacy Protection Agency (CPPA) has already issued guidance and launched audits. The message is clear: if you're a data broker — or you're acting like one without registering — the DROP platform is your new accountability mechanism.
The CPRA continues to expand CCPA obligations. Key requirements that apply to businesses meeting California's thresholds (annual gross revenue >$25M, buying/selling/sharing data of 100,000+ consumers/households, or deriving 50%+ of revenue from selling/sharing personal information):
- Right to correct: Consumers can demand accuracy corrections on their personal data you hold - Right to limit use of sensitive personal information: Financial data, health data, precise geolocation, biometric data — all now subject to explicit use limitations - Cross-contextual advertising: The "sharing" for targeted advertising pathway requires opt-out mechanisms that actually work - Global Privacy Control (GPC): You must honor the GPC browser signal as a valid consumer opt-out, not a suggestion
Fines for CCPA/CPRA violations run up to $7,988 per intentional violation. The CPPA broke its own record in February 2026, settling with a streaming company for $2.75 million over opt-out mechanism failures — less than a year after the Tractor Supply settlement at $1.35 million.
The CPRA vs CCPA Distinction Marketers Still Get Wrong
CPRA didn't replace CCPA — it amended it. Here's what that means operationally:
CCPA (the original) gave consumers the right to know, delete, and opt out of the sale of their personal information. CPRA added: the right to correct, the right to limit use of sensitive personal information, and the right to opt out of "sharing" (which is broader than "sale" and covers cross-context behavioral advertising).
If your compliance program was built around the original CCPA text, you're probably not handling sensitive personal information correctly, and you may be treating "sale" and "sharing" as equivalent when they're not. The opt-out mechanism for sharing — particularly for marketers using data management platforms, CDPs, or programmatic advertising — needs to be technically separate from sale opt-outs in many implementations.
Texas: The Billion-Dollar Wake-Up Call
While California dominates the headlines, Texas has been operating under the Texas Data Privacy and Security Act (TDPSA) with increasing aggression. The billion-dollar settlement against a major technology company sent shockwaves through the industry in early 2026.
The TDPSA applies to businesses that conduct business in Texas or target Texas residents and meet one of these thresholds: - Annual revenue >$10M and process data of 50,000+ consumers, OR - Process data of 25,000+ consumers and derive 50%+ of revenue from data sales
For marketers, the TDPSA's opt-out mechanism is notably different from California's. Texas consumers can opt out of data processing, including targeted advertising. The enforcement arm — the Texas Attorney General — has demonstrated willingness to pursue large targets.
What makes Texas particularly challenging for marketers: the definition of "sale of data" in Texas is broad and has been interpreted to include some common programmatic advertising arrangements. If you're buying audience segments in a DSP or using third-party data enrichment against Texas-resident profiles, your legal team needs to have reviewed the TDPSA applicability yesterday.
Connecticut, Colorado, and the Other States: No More Cure Periods
Connecticut and Colorado have been active enforcement states for some time, but 2026 marks a significant shift: cure periods are disappearing. California eliminated its 30-day cure period. Colorado's cure period is also gone for first-time violations. Rhode Island's new law launched without a cure period at all.
A "cure period" gave businesses 30 days to fix a violation after receiving notice — essentially a free pass if you were ignorantly non-compliant. That grace period is being removed state by state, which means the first time a regulator notices a problem, you're potentially facing fines, not a friendly letter.
Connecticut's enforcement has focused heavily on privacy notice accessibility and opt-out mechanisms. An $85,000 settlement against a ticket seller for an unreadable privacy notice and broken opt-out flows is a clear signal: technical implementation matters as much as legal documentation.
What This Means for Your Martech Stack
Here's where this stops being a legal conversation and becomes an operational one.
Every piece of your marketing technology stack that touches consumer data has privacy law implications:
Your CDP or CRM: Are you processing sensitive personal information? Do you have a lawful basis for every data enrichment? Does your system honor deletion requests within legally required timeframes (California: 15 days for acknowledgement, 45 days for fulfillment)?
Your programmatic and paid media stack: Cross-contextual advertising — what CPRA calls "sharing" — requires functional opt-out mechanisms. If your DSP, DMP, or data partners aren't passing opt-outs through correctly, you're potentially processing data of consumers who have explicitly told you not to.
Your email and SMS marketing: Consent mechanics differ between US and European frameworks. US law generally operates on opt-out (implied consent for most commercial email), but several state laws and the Telephone Consumer Protection Act (TCPA) create opt-in or strict opt-out requirements for specific data types.
Your analytics and attribution: First-party data strategies aren't just good privacy hygiene — they're increasingly the only viable path as third-party cookies disappear and state laws restrict third-party data sharing. The marketers who invested early in first-party data relationships are in a meaningfully better position in 2026 than those who didn't.
The Multi-State Compliance Problem No One Wants to Solve
Here's the uncomfortable truth that most marketing teams haven't confronted yet: a GDPR-compliant program does not equal a US-compliant program.
GDPR operates on opt-in consent as a default. US state laws predominantly operate on opt-out. The definitions of "personal information," "sensitive personal information," "sale," and "sharing" differ meaningfully between jurisdictions. Consumer rights packages aren't identical — some states give consumers rights that others don't recognize.
For a marketer operating nationally, this means your privacy program needs to be built to the highest common denominator — or you need a jurisdiction-aware consent and preference management system that can apply the right rules based on where each consumer is located. Neither approach is simple.
Most marketing teams are running a patchwork of point solutions: a consent management platform (CMP) for some properties, manual opt-out processes for others, legacy third-party data relationships that haven't been reviewed since 2022. That patchwork is increasingly expensive to maintain and increasingly likely to generate regulatory complaints.
Practical Steps: What You Should Be Doing in 2026 Right Now
If you're a marketing leader reading this, here's your action list — ordered by urgency:
1. Audit your data broker status: Are you selling, sharing, or providing access to consumer data to other parties? If yes, you may be a data broker required to register under California's Delete Act. Failure to register and honor DROP requests carries $200/day compounding penalties.
2. Test your opt-out mechanisms end-to-end: Submit deletion and opt-out requests for yourself across every platform you use. How long did it take to acknowledge? How long to actually fulfill? If you can't answer those questions with certainty, neither can your legal team.
3. Review your programmatic data flows: Map every third-party data source in your paid media stack. Are those sources compliant with the state privacy laws where your audiences are located? Do you have contracts in place that require compliance?
4. Build jurisdiction-aware consent logic: If you're still running a single global consent approach, you're probably over-collecting consent in some jurisdictions and under-collecting it in others. Your CMP should support state-specific rules, not just GDPR/CCPA binaries.
5. Accelerate your first-party data strategy: Every third-party data source you eliminate today is a compliance problem you won't have tomorrow. First-party relationships also happen to produce better marketing outcomes — higher intent signals, better attribution, longer customer lifetime value.
6. Get your legal team in the same room as your marketing technology team: Privacy compliance in 2026 is an engineering and operations problem as much as a legal one. If your privacy counsel doesn't understand how your CDP, DSP, and CRM actually work, you're building on sand.
The Bottom Line
US state privacy law in 2026 is not a compliance exercise you finish. It's an operational function you run continuously.
The enforcement landscape has matured dramatically. Seven-figure settlements are no longer anomalies — they're the leading edge of an escalating pattern. The cure periods that gave businesses breathing room to remediate are disappearing. And the technical requirements — functional opt-outs, honor GPC signals, process deletion requests within 45 days — fall squarely in the marketing technology domain, not just the legal one.
Marketers who treat privacy as a risk to be managed alongside brand safety and attribution are already behind. The ones who are building operational privacy competence into their martech stacks, their data governance practices, and their first-party data strategies? They're turning a cost center into a competitive advantage.
The 19 states aren't waiting.