Though much in the privacy space has yet to be “resolved,” some aspects have become more mainstream, especially concerning consumer online privacy, said Laura Riposo VanDruff, a privacy and data security lawyer at Kelley Drye, in an interview with Privacy Daily.
Data Minimization
Data minimization is a core privacy principle requiring organizations to limit the personal data they collect, process and retain to only what is necessary for a specific purpose. Maryland’s data privacy law sets one of the nation’s strictest standards mandating that companies collect only the minimum data needed and prohibiting use beyond that stated purpose. The approach has drawn attention from other states with several exploring similar provisions to curb overcollection and reduce the risks of misuse, breaches and noncompliance.
Privacy Daily is providing readers with our top 20 most read stories published in 2025. All articles can be found by searching the titles or clicking on the hyperlinked reference numbers.
Many states that have had leading roles in the privacy space will continue to do so in 2026, but several newcomers will be noteworthy owing to laws coming online, potential enforcement and litigation, privacy lawyers said.
All 20 U.S. comprehensive privacy laws will be in effect Jan. 1 when Kentucky, Indiana and Rhode Island join 17 other states with broad privacy statutes. However, those three new state laws coming online are unlikely to significantly reshape the U.S. consumer privacy landscape, privacy experts said in interviews with Privacy Daily.
A slew of comprehensive privacy law bills from 2025 are expected to return in the new year. While no new states joined about 20 others with broad consumer privacy laws this year, 16 additional states had bills that either will carry over to 2026 or could be reintroduced.
Litigation under the California Invasion of Privacy Act (CIPA) will likely continue, if not increase, in 2026, so companies operating there should be proactive and extensive in risk mitigation strategies, said Shumaker Loop lawyer Brian Focht in a blog post Friday.
Businesses are working toward compliance with Maryland’s comprehensive privacy law, despite its differences with 19 other states' comprehensive privacy laws, two McNees privacy attorneys said in an interview with Privacy Daily on Monday. Devin Chwastyk, who co-chairs the firm’s privacy and data security group, predicted “the phone will start ringing with more vigor” as the Maryland Online Data Privacy Act’s April 1 “enforcement deadline approaches.” In addition, he said MODPA may signal the end of “cookie-cutter” state privacy bills.
Florida is signaling it will pursue AI regulation despite federal efforts to combat state legislation to rein in the nascent technology, the Shumaker law firm blogged Friday.
The state privacy patchwork continues to change as lawmakers tinker with comprehensive laws passed in previous years, the Future of Privacy Forum said Friday as it released an update to last year’s “Anatomy of a State Comprehensive Privacy Law” report.
India's detailed Digital Personal Data Protection Act (DPDPA) will potentially be a substantial compliance burden for companies, Kochlar & Company technology attorney Stephen Mathias said in a Hogan Lovells podcast Thursday.