Trend of More Specific Privacy Laws Expected to Continue in 2026
Privacy professionals expected more states to enact comprehensive privacy laws this year, but none of the bills introduced this year crossed the finish line, they said Thursday on a TrustArc webinar. Instead, states passed narrowly tailored privacy legislation or amendments to existing laws. In addition, several court decisions and enforcement actions drilled deep into top privacy issues, the privacy pros said.
Sign up for a free preview to unlock the rest of this article
Timely, relevant coverage of court proceedings and agency rulings involving tariffs, classification, valuation, origin and antidumping and countervailing duties. Each day, Trade Law Daily subscribers receive a daily headline email, in-depth PDF edition and access to all relevant documents via our trade law source document library and website.
Though eight comprehensive laws came into effect in 2025, passage of such bills slowed, said Joanne Furtsch, TrustArc vice president of knowledge. Instead, nine states amended privacy laws to address emerging issues, including kids’ privacy and the public's right to access, delete and correct data.
"Quite possibly," that trend will continue into 2026, said Baker McKenzie privacy attorney Cynthia Cole.
"Rigorous" enforcement continued in 2025, with an increase in FTC action around COPPA, Furtsch said. This was true at the state level as well, where regulators “focused on transparency, vendor oversight [and] honoring consumer requests.”
Cole said it’s important to track enforcement, especially in California, as it reveals “trends that regulators are going to continue to lean on.”
Cookie enforcement is a trend the pros expect will continue in 2026, as “enforcement in this area is tending to get more coordinated,” Furtsch said. Additionally, regulators tend to start with what they can see, such as a cookie banner. “If it's not functioning in the way that's expected,” regulators will then raise other questions about “governance on the back end,” for example.
Furtsch predicted California will remain at the helm of these enforcement actions, especially with the Delete Request and Opt-Out Platform (DROP) becoming available Jan. 1 (see 2511100015).
Companies “need to expect” to “get inquiries from states … with respect to [their] privacy practices,” Cole said. Cooperation is key, “and it doesn't make it better if you don't.”
Three comprehensive privacy laws, in Indiana, Kentucky and Rhode Island, take effect Jan. 1. Also, Cole said it's worth watching active bills in states like Massachusetts (see 2511180042), Michigan, Pennsylvania (see 2510020029) and Wisconsin.
In the courts, we are “continuing to see [an] increase in aggressive" litigation under the California Invasion of Privacy Act, Furtsch said, as well as “significant judicial legislative developments” that attempt to strike a balance between “plaintiff recovery” and “curbing potentially frivolous lawsuits.” She predicted a similar amount of activity in 2026.
Also, the privacy pros predicted that kids’ privacy will continue to be a hot-button issue. “There's no consensus as to what children's privacy means,” despite it being bipartisan, noted Ami Rodrigues, deputy general counsel at Under Armour. Furtsch agreed such “fragmentation” will continue.
In light of all this, Rodrigues recommended companies get “back to basics,” and ensure they are “grounded” and have an “understanding [of] core elements" of privacy programs. Especially given the emergence of AI, there’s going to be “the same privacy risk that you had two years ago … but at a faster pace.”
Cole concurred. “The world is becoming increasingly more complex,” and “data use is even more political than it was a year ago,” so checking in on your company's data flows and understanding where everything is and how it works can help with compliance.
“Going back to core principles” and then having “continuous auditing [or] monitoring” is how “you're going to succeed in 2026,” Furtsch said.