The U.S. Privacy Patchwork in 2026: A Plain-English Guide for Data-Driven Teams

TL;DR

• 20 states have privacy laws in effect; 24 have passed them. There’s still no federal law.
• Most laws share the same core rights, so one good baseline covers most of the map.
• California is the outlier that matters most for B2B: business contacts are covered, and data brokers must now process deletion requests through DROP.
• AI agents are outrunning the rules. Expect the next wave of laws to be reactive.

The simple version

The U.S. has no single privacy rulebook. Instead, 20 states each wrote their own, and four more are on the way. If your team uses personal data to find, enrich or reach people, you’re playing by several rulebooks at once.

Think of it like driving across the country. Every state lets you drive, and the basic rules are the same: stop at red lights, stay in your lane. But speed limits change at each border, a few states ticket you for things others ignore, and California has its own highway patrol.

You don’t need to memorize every law. You need to know the shared rules, the handful of strict states, and where the road is heading.

Why there’s no national rulebook

Congress has tried and failed to pass a federal privacy law several times, so the states filled the gap. The federal bills (ADPPA, then the American Privacy Rights Act) stalled, largely over whether a national law should override stronger state laws.

What exists federally covers only specific slices of data:

• HIPAA for health data held by providers and insurers
• GLBA for banks and financial institutions
• COPPA for children under 13
• The FTC, which treats a broken privacy promise as a deceptive practice. Your own privacy policy is enforceable against you, even in a state with no privacy law.

In 2018, the number was one: California.

The shared DNA: what almost every state gives people

Most state laws are copies of Virginia’s template, so most of the work is the same everywhere. If someone lives in a covered state, they can generally:

1. Ask what you have on them. Confirm you hold their data and get a copy.
2. Fix it. Correct inaccurate information.
3. Delete it. Ask you to erase it.
4. Take it with them. Get it in a portable format.
5. Say “no thanks.” Opt out of sale, targeted ads, or automated profiling that affects them.
6. Say “yes first” for sensitive data. Most states require opt-in consent before you touch health, biometric, precise location or children’s data.

Businesses usually get 45 days to respond. Enforcement sits with the state attorney general almost everywhere, and regular people can’t sue under most of these laws.

The ELI5 version: people can ask “what do you know about me?”, “fix it”, “delete it” and “stop selling it.” You need a way to answer within about six weeks.

Where the states split

The differences live in five places: who’s covered, what counts as sensitive, automatic opt-outs, how much warning you get before a fine, and how big the fine is.

The trend points one way. Thresholds are dropping, cure periods are expiring, and GPC requirements more than doubled in two years. A state that looks lenient today often tightens on its next amendment.

The standouts you can’t ignore

If you build to the Virginia model, these are the states that will still catch you.

California (CCPA/CPRA)

The strictest and most active. It’s the only state with a dedicated privacy regulator plus the attorney general, and it allows lawsuits over data breaches. Its largest penalty so far: $12.75 million from General Motors in May 2026 for selling drivers’ location and driving data.

Texas and Nebraska

No volume threshold. If you do business there and aren’t an SBA-defined small business, assume you’re covered.

Connecticut

July 2026 amendments pulled in any business that sells data, banned targeted ads and sales for known 13-to-17-year-olds, and require privacy notices to say whether data trains large language models.

Maryland

The tightest data-minimization rule in the country. Collect only what’s reasonably necessary for what the person asked for. Selling sensitive data is banned outright, and inferences about sensitive traits now count too.

Minnesota

People can question the result of automated profiling and get an explanation of why the decision came out the way it did.

Illinois (BIPA) and Washington (My Health My Data)

Narrow laws with sharp teeth, because individuals can sue directly. BIPA covers fingerprints, face and voice scans, and produced a $650 million Facebook settlement. Washington’s law covers health data, including health inferences drawn from purchases or location, at any company size.

The B2B question: does any of this apply to business contacts?

In most states, no. In California, yes. That one difference shapes how every go-to-market team should think about contact data.

Almost every state law exempts people acting in a business or employment context. A VP of Marketing’s work email and title, used to sell to her company, generally falls outside “consumer” data in Virginia, Texas or Colorado. California is the only comprehensive law with no B2B or employee exemption. If that same VP lives in California, she has the full set of rights.

California’s Delete Act and DROP

California went further for data brokers: businesses that knowingly collect and sell personal information about people they have no direct relationship with.

• One request, every broker. Since January 1, 2026, Californians can submit a single deletion request through DROP that reaches every registered broker.
• Mandatory since August 1, 2026. Brokers must pull new requests at least every 45 days and resolve each within 90.
• Unverifiable requests still count. If a broker can’t verify one, it must treat it as an opt-out of sale or sharing.
• Real penalties. SB 361 doubled the fine for failing to register to $200 per consumer, per day.
• Audits are coming. Independent audits at least every three years, starting in 2028.

What it means for your lists: contact lists can shrink after each DROP cycle, so a list bought in July may not be the list you’re allowed to use in October. Ask every data vendor how they handle DROP and suppression. Connecticut’s own broker registry starts January 1, 2027, so this pattern is spreading.

The AI agent angle: the rules weren’t built for this

Most of these laws were written for websites, cookies and ad pixels. AI agents change the picture. An agent connected to your inbox, calendar, CRM and payment apps is like a helper holding a ring of keys to many houses. Useful, but if it gets tricked, a stranger can open a lot of doors at once.

Regulators are starting to catch up, mostly through rules on automated decisions:

• California requires risk assessments before using automated decision-making for significant decisions, with its full rules applying January 1, 2027.
• Colorado passed a separate automated decision-making law, effective January 1, 2027.
• Connecticut requires disclosure of whether personal data trains large language models.
• Minnesota lets people challenge a profiling-based decision.
• Utah sued Snap in 2025, alleging it didn’t disclose sharing My AI chat data with OpenAI, a sign that existing law already reaches AI features.

What’s still missing is a rulebook for agents that act on someone’s behalf across many apps: who’s responsible when an agent shares data it shouldn’t, and how consent travels from one app to the next.

Our view: more states will adopt California-style protections, and the agent-specific rules will likely be reactive. A major, public case of agentic fraud will probably move legislatures faster than any white paper. Teams that build agent-ready data practices now won’t have to scramble when that day comes.

What’s coming in 2027

A practical checklist for sales and marketing teams

You don’t need a 50-state legal memo. You need a defensible baseline that bends for the strict states.

• Map where your contacts live. Check your CRM against each state’s threshold. You’re likely covered in more states than you think.
• Treat California contacts differently. B2B data is in scope there, so honor access, deletion and opt-out requests from business contacts.
• Ask your data vendors about DROP. How often do they process deletion requests, and how fast do suppressions reach your list?
• Re-suppress after every list refresh. A deleted contact who reappears on a refreshed list is a fresh violation.
• Honor GPC on your website. Twelve states require it, and the list keeps growing.
• Run one intake for rights requests. A form, a 45-day clock, and a deletion checklist that reaches every system the data touched.
• Inventory your AI tools and agents. Know what data each one can reach, what it shares, and whether any of it trains a model.
• Keep receipts. Timestamped consent and opt-out logs turn “we have a process” into proof.

Sources

• U.S. State Privacy Laws: 2026 Tracker and Compliance Guide (Enzuzo)
• U.S. State Privacy Law Landscape Expands to 24 States (Byte Back)
• DROP for data brokers (California Privacy Protection Agency)
• DROP and the Delete Act (TrustArc)
• DROP Is Coming Due (Alston & Bird)
• Comprehensive Privacy Laws Taking Effect in 2026 (MultiState)

This article is for general information and isn’t legal advice. Privacy law changes quickly; check with counsel before making compliance decisions.