As the privacy landscape continues to evolve, companies may find it difficult to manage regulator expectations of compliance and consumer demands as outlined in lawsuits, said Julie Rubash, chief privacy officer for Sourcepoint, a vendor.
Privacy professionals begin the new year considering significant changes to some state privacy requirements. Lawyers suggested resolutions to review data and get an early start on risk assessments.
Many states that have had leading roles in the privacy space will continue to do so in 2026, but several newcomers will be noteworthy owing to laws coming online, potential enforcement and litigation, privacy lawyers said.
All 20 U.S. comprehensive privacy laws will be in effect Jan. 1 when Kentucky, Indiana and Rhode Island join 17 other states with broad privacy statutes. However, those three new state laws coming online are unlikely to significantly reshape the U.S. consumer privacy landscape, privacy experts said in interviews with Privacy Daily.
A slew of comprehensive privacy law bills from 2025 are expected to return in the new year. While no new states joined about 20 others with broad consumer privacy laws this year, 16 additional states had bills that either will carry over to 2026 or could be reintroduced.
Kids privacy and child safety online have been hot-button issues on both sides of the aisle and will remain so in 2026, said privacy lawyers in interviews with Privacy Daily. Despite the bipartisan focus and federal bills pending on these issues, several of the lawyers were doubtful about passage of a national law next year.
Efforts continue to pass a New Mexico comprehensive privacy bill that includes a private right of action, but logistical issues in the legislature could prevent the measure from getting a hearing in 2026, supporters said.
State legislators across the country already have filed several kids online safety bills ahead of 2026 legislative sessions. An attorney earlier this week predicted an “avalanche of new state laws” related to child online safety over the next one to two years (see 2512170031).
A bill that would add carveouts to New Jersey’s comprehensive privacy law is nearing the finish line. The Senate voted 38-0 on Thursday to pass A-5017, which would exempt insurance-support organizations and national securities associations from certain disclosure requirements in the New Jersey Data Protection Act, which already exempted insurance institutions.
The House Commerce Committee plans to take “action” on comprehensive privacy legislation after considering kid bills this spring, a committee staffer said in a statement Friday.