Enforcement has focused heavily in 2025 on surface-level, obvious and quick fixes, privacy lawyers said in recent interviews. While this trend will continue in 2026, additional tools and other factors should keep enforcement an area to watch, they said.
Data Brokers and Delete Acts
Data brokers aggregate and sell personal data—often without clear user awareness. In response, many U.S. states are passing “delete acts” and other laws to increase transparency, require registration and give users control over data sales. These laws will reshape compliance and collection practices for brokers and companies relying on third-party data. This page tracks legislation, rulemaking and enforcement trends affecting the data brokerage industry.
The House Commerce Committee plans to take “action” on comprehensive privacy legislation after considering kid bills this spring, a committee staffer said in a statement Friday.
The FTC should reopen its study of surveillance pricing, a bipartisan group of senators wrote Chairman Andrew Ferguson in a letter released Thursday.
Data brokers must register quickly and comprehensively in California, the California Privacy Protection Agency said in an enforcement advisory Wednesday. CalPrivacy issued the advisory, which addresses data broker registration requirements related to trade names, websites and parent-subsidiary relationships, with about two weeks to go until the planned Jan. 1 launch of the Delete Request and Opt-Out Platform (DROP).
Privacy Daily is providing readers with the top stories from last week, in case you missed them. All articles can be found by searching the title or clicking on the hyperlinked reference number.
The House Commerce Subcommittee passed several kids-related bills Thursday, setting up votes from the full House Commerce Committee, as expected (see 2512090058).
If the last three years in state privacy "was really the bill-passing phase,” then 2026 “might be the year of enforcement,” said DBR Tech Law’s Nicole Sakin McNeill on a Wednesday webinar by Privado, a privacy compliance vendor.
California Privacy Protection Agency (CalPrivacy) fines for Delete Act violations next fall could rise from tens of thousands of dollars to tens of millions of dollars -- at least -- with no room for negotiation on total penalties, panelists said on a webinar by consumer privacy vendor Reklaim on Wednesday. In addition, many more companies may be considered data brokers covered by the law than realize it now, they said.
Privacy Daily is providing readers with the top stories from last week, in case you missed them. All articles can be found by searching the title or clicking on the hyperlinked reference number.
Vermont could next year join California in requiring browsers to include an option for activating global opt-out preference signals (OOPS). Rep. Monique Priestley (D), who also will be pursuing a comprehensive privacy bill and at least one data broker measure (see 2512040015), has a draft bill pending on “Browser Opt-Out,” among many other bills about data and AI, according to Priestley’s webpage as updated Friday.