As the privacy landscape continues to evolve, companies may find it difficult to manage regulator expectations of compliance and consumer demands as outlined in lawsuits, said Julie Rubash, chief privacy officer for Sourcepoint, a vendor.
Despite stricter court rulings and limits on the use of older statutes to regulate newer technologies, 2025's increase in privacy litigation, especially around tracking technologies, looks set to continue into 2026, said privacy lawyers in interviews. Additionally, the potential for lawmakers clarifying the California Invasion of Privacy Act (CIPA) could push litigators to bring cases at even faster rates this year as they hope to file before an amendment becomes effective, one lawyer said.
Many states that have had leading roles in the privacy space will continue to do so in 2026, but several newcomers will be noteworthy owing to laws coming online, potential enforcement and litigation, privacy lawyers said.
A California bill amending the state’s current data breach notification law becomes effective Thursday, creating a 30-day timeline for reporting a discovered breach. The change puts a premium on prompt response and preparation, lawyers told us, including complying with a 15-day reporting requirement under certain circumstances.
Businesses that use tracking technologies must ensure they have the proper information and language in their disclosures and consent mechanisms to avoid legal risk, said Marc Roth, marketing and privacy advisor at Cobalt, during a webinar hosted by the Practising Law Institute Monday.
Enforcement has focused heavily in 2025 on surface-level, obvious and quick fixes, privacy lawyers said in recent interviews. While this trend will continue in 2026, additional tools and other factors should keep enforcement an area to watch, they said.
Kids privacy and child safety online have been hot-button issues on both sides of the aisle and will remain so in 2026, said privacy lawyers in interviews with Privacy Daily. Despite the bipartisan focus and federal bills pending on these issues, several of the lawyers were doubtful about passage of a national law next year.
A district court’s decision Tuesday to grant a preliminary injunction against Texas’ App Store Accountability Act surprised some, but not others, as privacy pros digested the Computer & Communications Industry Association's initial victory.
Instacart said Monday it will immediately end what it called price testing following a Consumer Reports (CR) study that the organization said proved it used personal data to set its online grocery prices. However, Instacart also denied its "pricing tests" included surveillance pricing or dynamic pricing, "and were never based on supply or demand, personal data, demographics, or individual shopping behavior.”
Data security is inextricably linked to vendors, third parties and others along the supply chain, necessitating that companies have a firm understanding of how their information flows internally as well as externally, panelists said during a Practising Law Institute (PLI) event Wednesday.