Privacy, Cyber & Data Strategy Advisory | State Privacy Laws Are Moving Beyond Disclosures: What Businesses Need To Know In 2026

Executive Summary

State privacy laws increasingly regulate how businesses collect, use, share, and govern personal information—not just what they disclose. Our Privacy, Cyber & Data Strategy Team highlights key compliance risks and practical steps as state requirements expand.

• State-law exemptions may not cover advertising, analytics, or other data outside traditional regulatory regimes
• Sensitive data is drawing greater scrutiny and requires stronger operational and technical controls
• Privacy notices and consumer-rights processes should match actual data practices

State privacy laws continue to reshape how businesses collect, use, share, and manage personal information. What began largely as disclosure-based compliance requirements is evolving into a broader set of operational requirements affecting product design, data governance, vendor management, and technology systems.

The key question is no longer simply whether a company’s privacy notice accurately describes its data practices. Companies must be able to demonstrate that their systems, third-party risk management, and business operations align with those disclosures and evolving legal requirements. Compliance failures increasingly arise from gaps between policy and practice, and regulators are taking notice.

As state privacy laws become more operational, businesses face compliance challenges extending well beyond privacy notices and disclosures. In our experience, enforcement risk is most concentrated in three areas: digital advertising and data sharing; sensitive data, particularly health and geolocation information; and operational or technical failures involving opt-out mechanisms and consumer rights. The level of risk varies based on a company’s business model, data practices, and geographic footprint.

Several themes are emerging across state privacy laws:

• Exemptions often provide less coverage than businesses expect, particularly for marketing, analytics, and digital advertising data.
• Children’s privacy requirements increasingly influence product design and advertising practices.
• Privacy notices must align with actual data practices and system functionality.
• Health, geolocation, and minors’ data remain areas of heightened regulatory focus.
• Compliance increasingly depends on technical capabilities, including opt-out signals, consumer rights fulfillment, and data governance controls.
• Consumer rights require greater transparency about third-party data sharing.
• Data minimization, purpose limitation, and necessity standards are becoming more significant compliance obligations.
• Appeals processes can create regulatory scrutiny and enforcement risk.

Applicability and Exemptions: Risk at the Edges

State privacy laws may apply to an organization even when it processes information subject to the Gramm-Leach-Bliley Act (GLBA) and the Health Insurance Portability and Accountability Act (HIPAA). In practice, these exemptions often apply more narrowly than businesses expect.

Many organizations operate in mixed data environments. While some data may fall within a regulatory exemption, other data processed by the same organization may remain fully subject to state privacy laws. Marketing data, website analytics, mobile app data, and advertising data frequently fall outside GLBA or HIPAA exemptions.

Organizations should not assume that an exemption applies to all personal information they collect or process. Data outside regulatory exemptions, particularly in advertising and analytics ecosystems, may present heightened compliance risk and should be evaluated carefully.

Businesses should:

• Map data based on type, source, and use.
• Trace data flows across systems and third parties.
• Validate actual practices through technical testing, vendor reviews, and other similar measures.
• Evaluate advertising and analytics data flows that may trigger sale or sharing obligations under applicable state privacy laws.

Children’s Data: Regulation Is Moving into Product Design

While most states follow a model aligned with the Children’s Online Privacy Protection Act (COPPA) for children under 13, several have expanded protections beyond the statute’s traditional scope. For example, Alabama, California, Minnesota, and New Jersey extend certain protections to teenagers ages 13 to 16; Oregon does the same for teenagers under 16; New Hampshire applies certain protections to consumers ages 13 to 15; and Colorado, Connecticut, Maryland, Montana, and Vermont impose certain requirements that may apply to minors under 18.

Many of these restrictions limit a business’s ability to sell personal information or use it for targeted advertising without consent. Colorado and Montana go further by requiring businesses that offer online services likely to be used by minors to exercise reasonable care to avoid heightened risks of harm.

Although most laws do not require age verification, they impose obligations when a business knows or should know that a consumer is a minor.

Risk is highest when companies design products that attract younger users but treat them as general-audience offerings, particularly when engagement features, profiling, or targeted advertising are involved.

Compliance is therefore becoming a product-design issue, not solely a legal or disclosure exercise. Companies may need to reevaluate engagement features, personalization tools, and advertising practices for products and services likely to be used by minors.

Businesses should:

• Assess whether products are intended for a general audience, mixed audience, or minors.
• Avoid “willful blindness” to signals that users are minors.
• Consider limiting or disabling advertising, profiling, and personalization features for minor users.
• Evaluate the potential impact of online services on minors as part of product-design and risk-management processes.

Privacy Notices: A Window into the Business

Regulators increasingly use privacy notices as evidence of how a business operates, not simply what it discloses.

Privacy notice requirements continue to expand. For example, some states require disclosure of sales of sensitive or biometric data (Texas and Louisiana), identification of specific third parties to which data is sold (Rhode Island), disclosures about the use of personal data to train large language models (Connecticut and Vermont), and detailed information about automated decision-making (California).

These developments reflect a broader shift in how regulators view privacy notices. Rather than treating them as general disclosures, regulators increasingly view privacy notices as representations of a company’s actual data practices. Enforcement risk can arise when disclosures do not align with how data is collected, used, shared, or processed in practice.

For example, a company may describe limited data sharing while embedded software development kits (SDKs), cookies, or analytics tools collect, disclose, or use data in ways that may qualify as a sale, targeted advertising, or profiling under applicable law.

The greater the disconnect between disclosures and actual data practices, the greater the enforcement risk. In many cases, privacy notices effectively provide regulators with a compliance roadmap.

Businesses should:

• Treat privacy notices as operational documents rather than standalone legal disclosures.
• Validate disclosures against actual data flows and technology configurations.
• Incorporate privacy notice reviews into product launches, marketing initiatives, and vendor onboarding.
• Pay particular attention to disclosures involving sensitive data, minors’ data, advertising and data-sharing practices, and automated decision-making.
• Review and update privacy notices regularly to reflect evolving data practices.

Consumer Health Data

Mental and physical health diagnoses are generally treated as sensitive data and often require consumer consent before collection or processing, unless a HIPAA exemption applies to the entity or data.

Several states, including Connecticut, Maryland, and Vermont, impose additional requirements governing consumer health data. These laws generally define this data broadly and may apply to information that reveals, or could be used to infer, a consumer’s physical or mental health condition, including reproductive, sexual, and gender-affirming health information.

These requirements extend beyond traditional health care providers. Retailers, consumer-facing technology companies, wellness providers, and other businesses may be subject to these obligations when processing health-adjacent information, such as fertility-tracking data, health-related purchase information, or location data that could reveal visits to health care facilities or otherwise allow sensitive health information to be inferred.

Data monetization, targeted advertising, analytics, and profiling may present heightened compliance risk when they involve health-related information or inferences.

Businesses should:

• Identify data that may directly or indirectly reveal a consumer’s health condition.
• Evaluate whether enhanced notice, consent, or other compliance obligations apply to the collection and use of health-related information.
• Assess high-risk practices involving data sales, targeted advertising, profiling, or other secondary uses of consumer health data.
• Implement governance controls, including data inventories, risk assessments, and contractual restrictions on the use of health-related information.

Geolocation Data: A High-Sensitivity Category

Precise geolocation data is generally treated as sensitive data under state privacy laws and typically requires opt-in consent. Several states have adopted additional restrictions. Utah requires notice and an opportunity to opt out before collection; Connecticut, Virginia, and Oregon prohibit certain sales of geolocation data; and Maryland and New Jersey prohibit the sale of sensitive data, including precise geolocation data.

The greater compliance challenge, however, often arises from how geolocation data is used in practice. Companies frequently collect and share location data through mobile applications, SDKs, analytics tools, and other technologies in ways that may constitute a sale, sharing, targeted advertising, or profiling under applicable law.

For example, a mobile application may transmit precise location data to third-party advertising partners, enabling cross-context behavioral advertising or other downstream uses. In many cases, these data flows occur without full visibility into how the information is subsequently used or disclosed.

Organizations should therefore treat precise geolocation data as a high-risk category of personal information. Common uses of location data, particularly in digital advertising and analytics ecosystems, may present heightened compliance risk and require additional controls.

Businesses should:

• Limit the collection of geolocation data to specific, documented business purposes.
• Avoid continuous or background location tracking without a clear business justification.
• Carefully evaluate the use of precise geolocation data for advertising, analytics, and profiling activities.
• Ensure technical controls, vendor arrangements, and privacy disclosures accurately reflect how geolocation data is collected, used, and shared.

Universal Opt-Out Mechanisms: Compliance Is Technical

Most states require businesses to recognize universal opt-out mechanisms and global privacy controls. Even when these requirements are not explicit, some states require businesses to recognize authorized agents through technical means, including global device settings, as in Louisiana, Texas, and Nebraska.

These requirements are not simply procedural. They require businesses to deploy technical controls that detect opt-out signals and prevent personal data from being used or disclosed in a manner that conflicts with a consumer’s choice. Enforcement activity by the California Privacy Protection Agency and state regulators demonstrates an increasing focus on whether businesses have properly implemented and honored these signals.

In practice, compliance failures often occur when a website or application recognizes an opt-out signal, but downstream data sharing continues, or when third-party vendors are not configured to honor consumer preferences. These issues frequently arise in digital advertising and analytics ecosystems, where personal information may be shared across multiple technologies and service providers.

Recognizing an opt-out signal at the front end is not enough. Businesses must propagate the signal throughout their systems and suppress downstream data sharing and other covered processing.

Businesses should:

• Configure websites and mobile applications to detect and recognize universal opt-out signals.
• Propagate opt-out preferences across relevant systems, platforms, and vendors.
• Regularly test and monitor data flows to confirm that consumer preferences are being honored in practice.
• Review vendor configurations and contractual requirements to ensure downstream compliance with opt-out requests.

Consumer Rights: From Data Access to Data Transparency

The primary consumer-rights risk is not failure to offer rights, but inconsistent or incomplete delivery across systems and jurisdictions.

While all state laws provide core rights, their scope varies significantly. Most states require businesses to delete personal data about a consumer upon request. Utah and Iowa, however, require businesses to delete only personal data provided by the consumer making the request. As of October 1, 2026, Connecticut’s deletion right also covers publicly available information compiled into consumer profiles or offered for sale, along with inferences generated from that information.

The right to opt out of data sales also varies depending on how each state defines “sale.” Virginia, for example, defines a “sale” as the exchange of personal data for money. Connecticut and Nebraska also include the exchange of personal information for other valuable consideration.

At the same time, access rights are expanding beyond simply providing a copy of data. Many states now require transparency about third-party disclosures, sometimes at a granular level. Connecticut requires disclosure of the specific third parties to which a consumer’s personal data was sold. Minnesota and Oregon require disclosure of specific third parties to which a business has disclosed personal data. Beginning January 1, 2027, Delaware will require a list of third parties to which a business disclosed personal data. Effective January 1, 2028, Vermont will require disclosure of the third parties to which personal data was sold, or all third parties if the business does not maintain a list.

Inconsistent application of consumer rights and limited visibility into third-party data flows can create significant compliance risk. Each request, particularly when a denied request leads to a complaint filed with a regulator, may become a regulator-facing record and a source of scrutiny.

Businesses should:

• Consider standardizing compliance practices to meet the most stringent requirements when material state-law variations exist.
• Harmonize “sale” and opt-out determinations, and maintain a data-flow inventory to classify disclosures and implement appropriate rights mechanisms.
• Maintain a current inventory of third parties, the data shared with them, and the purposes of that sharing to support privacy disclosures and consumer-rights responses.
• Align back-end systems with privacy-rights policies and conduct periodic audits to confirm that those policies are operating as intended.

Data Minimization

All state privacy laws impose some form of data minimization requirement, typically tied to disclosed purposes. Maryland, however, takes a more restrictive approach by limiting data collection to what is reasonably necessary and proportionate to provide or maintain a product or service requested by the consumer. This represents a meaningful shift from disclosure-based compliance to a substantive limitation on data collection. Many common analytics and targeted advertising practices may not meet this standard unless they are clearly tied to a consumer-requested product or service.

Companies operating in Maryland must evaluate whether their data practices can be justified under this standard and determine whether to adopt a jurisdiction-specific approach or harmonize to a higher, uniform threshold.

Maryland, Connecticut, and Vermont also impose heightened minimization standards for sensitive data. Maryland prohibits processing sensitive data unless it is strictly necessary to provide or maintain a consumer-requested product or service. Connecticut and Vermont prohibit processing sensitive data unless it is reasonably necessary for the purposes for which the data was collected.

Meeting these requirements requires more than updating privacy notices and disclosures.

Businesses should:

• Tie data collection to clear business purposes and use cases.
• Implement purpose-based data controls, including data tagging and purpose-limitation rules.
• In states with heightened minimization standards, determine whether processing is strictly necessary before collecting or using sensitive data.
• Train product, marketing, and engineering teams to understand minimization standards and work with them to enforce those standards.

Appeals: Where Compliance Meets Enforcement

Nearly all state privacy laws give consumers the right to appeal a business’s denial of a consumer-rights request. These requirements generally include prescribed response timelines and, in some states, mechanisms allowing consumers to escalate complaints to an attorney general or other regulators. Minnesota also requires businesses to retain records of appeals and responses for at least 24 months.

The compliance risk often lies not in the appeal itself, but in what it reveals. A denied request may lead to a consumer complaint, creating a record that regulators can review during an investigation or enforcement inquiry.

Appeals can also expose weaknesses in a company’s privacy program, including inconsistent denial criteria, inadequate documentation, or an inability to clearly explain why a request was denied.

Businesses should therefore treat appeals as regulator-facing events. Each denied request may become a documented record of how the organization interprets and applies its privacy obligations.

Businesses should:

• Establish a centralized appeals process involving privacy and legal personnel to promote consistent decision-making.
• Develop and document clear criteria for denying consumer requests and apply those criteria consistently.
• Maintain documentation and audit trails that support appeal decisions and can withstand regulatory review.
• Conduct periodic reviews to confirm that appeals are handled consistently across business units, systems, and jurisdictions.

Conclusion: Privacy as Data Strategy

State privacy laws increasingly regulate how businesses collect, use, share, and govern personal information in practice. Across issues ranging from digital advertising and sensitive data to consumer rights and technical compliance, in addition to written policies, regulators are focusing on whether a company’s actual data practices satisfy legal requirements.

Organizations that rely on data-driven business models, particularly for advertising, analytics, and personalization, should expect growing pressure to understand, document, and govern their data practices.

As state privacy laws continue to expand and mature, regulators are likely to intensify their scrutiny of data flows, vendor relationships, consumer-rights processes, and technical controls. Businesses that maintain visibility into their data practices, align operations with their disclosures, and build scalable, demonstrable governance processes will be better positioned to manage compliance risk and adapt to changing requirements.