The cure period is dead. The fines are real. And if you are still treating US privacy compliance as a check the box exercise, 2026 is going to be expensive.

Three more states — Indiana, Kentucky, and Rhode Island — activated their comprehensive privacy laws on January 1, 2026. That brings the total to 19 states with active consumer data laws on the books. State attorneys general are no longer sending warning letters. They are sending settlement offers with seven-figure price tags attached.

For marketers, this is not abstract legal territory. Every audience segment you build, every retargeting pixel you deploy, every CRM you enrich with third-party data has a jurisdiction attached to it.

The Landscape Has Shifted: 19 States, Not Just California

For years, marketers treated US privacy compliance as a California problem. CCPA was the big bad wolf, and everything else was noise you could ignore. That logic is now dangerously outdated.

The 2026 state privacy map looks like this:

  • Fully active and enforcing: California (CCPA/CPRA), Texas, Connecticut, Virginia, Colorado, Utah, Iowa, Montana, Tennessee, Oregon, Delaware, Nebraska, New Hampshire, New Jersey, Arkansas
  • Newly active as of January 1, 2026: Indiana, Kentucky, Rhode Island
  • Pending activation: Several additional states with laws on the books but not yet in effect

Texas secured a settlement of over $1 billion against a major technology company under the Texas Data Privacy and Security Act. Connecticut reached an $85,000 settlement with a ticket seller over an unreadable privacy notice and broken opt-out mechanisms.

California 2026: The Delete Act Changes Everything

California has always led US privacy law, but 2026 marks a qualitative shift in enforcement capability.

The California Delete Act DROP platform launched on January 1, 2026. DROP stands for Data Rights Requests Optimization Portal, creating a single centralized system for consumers to submit deletion requests to registered data brokers. The enforcement mechanism: $200 per unfulfilled deletion request, compounding daily, starting January 31, 2026.

The CPRA continues to expand CCPA obligations. Key requirements:

  • Right to correct: Consumers can demand accuracy corrections on their personal data
  • Right to limit use of sensitive personal information: Financial data, health data, precise geolocation, biometric data — all subject to explicit use limitations
  • Cross-contextual advertising: The sharing for targeted advertising pathway requires opt-out mechanisms that actually work
  • Global Privacy Control (GPC): You must honor the GPC browser signal as a valid consumer opt-out

Fines for CCPA/CPRA violations run up to $7,988 per intentional violation. The CPPA settled with a streaming company for $2.75 million in February 2026 over opt-out mechanism failures.

The CPRA vs CCPA Distinction Marketers Still Get Wrong

CPRA did not replace CCPA — it amended it. CCPA gave consumers the right to know, delete, and opt out of the sale of their personal information. CPRA added: the right to correct, the right to limit use of sensitive personal information, and the right to opt out of sharing (which is broader than sale and covers cross-context behavioral advertising).

If your compliance program was built around the original CCPA text, you are probably not handling sensitive personal information correctly. The opt-out mechanism for sharing needs to be technically separate from sale opt-outs in many implementations.

Texas: The Billion-Dollar Wake-Up Call

Texas has been operating under the Texas Data Privacy and Security Act (TDPSA) with increasing aggression. The billion-dollar settlement sent shockwaves through the industry in early 2026.

The TDPSA applies to businesses that conduct business in Texas or target Texas residents and meet one of these thresholds:

  • Annual revenue >$10M and process data of 50,000+ consumers, OR
  • Process data of 25,000+ consumers and derive 50%+ of revenue from data sales

What makes Texas particularly challenging for marketers: the definition of sale of data has been interpreted to include some common programmatic advertising arrangements. If you are buying audience segments in a DSP or using third-party data enrichment against Texas-resident profiles, your legal team needs to have reviewed the TDPSA applicability.

Connecticut, Colorado, and the Other States: No More Cure Periods

Connecticut and Colorado have been active enforcement states for some time, but 2026 marks a significant shift: cure periods are disappearing. California eliminated its 30-day cure period. Colorado is also gone for first-time violations. Rhode Island launched without a cure period at all.

Connecticut is enforcement has focused heavily on privacy notice accessibility and opt-out mechanisms. The $85,000 settlement against a ticket seller for an unreadable privacy notice and broken opt-out flows is a clear signal: technical implementation matters as much as legal documentation.

What This Means for Your Martech Stack

Every piece of your marketing technology stack that touches consumer data has privacy law implications:

Your CDP or CRM: Are you processing sensitive personal information? Do you have a lawful basis for every data enrichment? Does your system honor deletion requests within legally required timeframes?

Your programmatic and paid media stack: Cross-contextual advertising requires functional opt-out mechanisms. If your DSP, DMP, or data partners are not passing opt-outs through correctly, you are potentially processing data of consumers who have explicitly told you not to.

Your email and SMS marketing: Consent mechanics differ between US and European frameworks. US law generally operates on opt-out, but several state laws create opt-in or strict opt-out requirements for specific data types.

The Multi-State Compliance Problem No One Wants to Solve

A GDPR-compliant program does not equal a US-compliant program. GDPR operates on opt-in consent as a default. US state laws predominantly operate on opt-out. The definitions of personal information, sensitive personal information, sale, and sharing differ meaningfully between jurisdictions.

For a marketer operating nationally, your privacy program needs to be built to the highest common denominator — or you need a jurisdiction-aware consent and preference management system that can apply the right rules based on where each consumer is located.

Practical Steps: What You Should Be Doing in 2026 Right Now

1. Audit your data broker status: Are you selling, sharing, or providing access to consumer data to other parties? If yes, you may be a data broker required to register under California Delete Act. Failure carries $200/day compounding penalties.

2. Test your opt-out mechanisms end-to-end: Submit deletion and opt-out requests for yourself across every platform you use. How long did it take to acknowledge? To actually fulfill?

3. Review your programmatic data flows: Map every third-party data source in your paid media stack. Are those sources compliant with the state privacy laws where your audiences are located?

4. Build jurisdiction-aware consent logic: If you are still running a single global consent approach, you are probably over-collecting consent in some jurisdictions and under-collecting it in others.

5. Accelerate your first-party data strategy: Every third-party data source you eliminate today is a compliance problem you will not have tomorrow.

6. Get your legal team in the same room as your marketing technology team: Privacy compliance in 2026 is an engineering and operations problem as much as a legal one.

The Bottom Line

US state privacy law in 2026 is not a compliance exercise you finish. It is an operational function you run continuously.

The enforcement landscape has matured dramatically. Seven-figure settlements are no longer anomalies. The cure periods that gave businesses breathing room to remediate are disappearing. And the technical requirements fall squarely in the marketing technology domain, not just the legal one.

The 19 states are not waiting.