Q2 2026 State Privacy Update: New Laws, Record CCPA Settlement, Data Broker Rules
Organizations that collect, process, or monetize consumer personal data must update compliance programs immediately, as Q2 2026 brought two new comprehensive state privacy laws, amended existing frameworks, and a record $12.75 million CCPA settlement signaling heightened regulatory scrutiny of sensitive data use and secondary data sharing.
Q2 2026 brought significant shifts to U.S. state privacy regulation: Louisiana and Vermont became the 22nd and 23rd states to enact comprehensive consumer privacy laws, with unique provisions including Louisiana’s $25 million revenue applicability threshold and Vermont’s ban on broad nonprofit exemptions, with effective dates of January 1, 2027 and January 1, 2028 respectively. Existing state privacy laws were amended across Maryland, Tennessee, Virginia, and Connecticut to tighten sensitive data definitions, ban precise geolocation data sales, lower applicability thresholds, and add minor data protections. California regulators also secured a record $12.75 million CCPA settlement against an automaker for undisclosed sale of precise geolocation data to data brokers, reinforcing enforcement focus on purpose limitation and data minimization. New Jersey and Connecticut enacted new data broker rules, including New Jersey’s tiered registration fees tied to volume of brokered consumer data. Organizations should review data collection, sharing, and retention practices to align with new and amended state requirements, particularly for sensitive data and secondary use cases.