US State Privacy Laws in 2026: What Your Business Software Must Do

There is still no comprehensive federal consumer privacy law that covers most businesses. States have filled the gap one at a time, and each statute has its own thresholds, definitions and enforcement approach. We are deliberately not quoting a headline count of states here, because trackers disagree on the number and the count changes with every legislative session. The more useful question for you is narrower: which states do your customers live in, and do you cross the applicability threshold in each?

Thresholds vary a lot. Rhode Island's law, for example, applies to businesses that handle the personal data of at least 35,000 customers, or at least 10,000 customers when more than 20% of gross revenue comes from selling personal data, according to the Rhode Island General Laws, Chapter 6-48.1. Other states use different numbers, and some laws have revenue tests or exemptions for specific sectors. Read the statute or the attorney general's guidance for each state where you have a meaningful customer base.

Three comprehensive laws took effect on 1 January 2026: Indiana, Kentucky and Rhode Island. Kentucky's attorney general describes the Kentucky Consumer Data Protection Act and the state's Office of Data Privacy on its privacy rights page. The enacted text gives a business 30 days to cure a violation after written notice, which matters because a cure period rewards companies that can act fast and prove it. Rhode Island's act has its own timing for consumer requests: a response within 45 days, extendable once by another 45 days when reasonably necessary.

California moved the same day. The California Privacy Protection Agency announced that its regulations on risk assessments, cybersecurity audits and automated decisionmaking technology took effect on 1 January 2026, with staggered deadlines. According to the agency's announcement:

• Risk assessments must be done from 1 January 2026, with an attestation and summary due to the agency by 1 April 2028.
• Cybersecurity audit certifications are due on 1 April 2028 for businesses over $100 million in revenue, 1 April 2029 for $50–100 million, and 1 April 2030 for those under $50 million.
• Businesses that use automated decisionmaking technology for significant decisions must comply from 1 January 2027.

As of October 2026, those are the dates on the agency's own page. Check it again before you plan a release, because regulators amend rules.

Laws differ, but the shared consumer rights are close enough to design one set of features. These are the ones we would put in a requirements document.

A data inventory that matches reality

You cannot delete or export what you cannot find. List every table, file store, analytics tool, email platform and backup that holds personal data, and tie each record to a person identifier you can search. In older systems this is the hardest step, because customer data sits in spreadsheets, shared drives and forgotten staging databases. For many teams the inventory takes longer than the code.

A request portal with a deadline clock

Customers need a way to ask for access, correction, deletion and portability, and your staff need a queue that shows what is due. Build it as a workflow, not an inbox: verify identity, log the request type, start a countdown from the statute's response period, track extensions, and store the response. Appeals matter too. Several state laws let a consumer appeal a denial and then complain to the attorney general, so the appeal path should be a status in the same queue.

Opt-out signals and consent records

Connecticut's attorney general reports that since 1 January 2025, controllers must honor opt-out preference signals (see the state's Connecticut Data Privacy Act page). In practice that means your site or app has to read a browser signal such as Global Privacy Control and suppress selling, sharing and targeted advertising for that visitor, then store that decision against the person. Keep a consent ledger with the version of the notice shown, the timestamp and the choice. If an investigator asks what you did for a visitor in March, a ledger answers it in seconds.

Deletion that reaches vendors and backups

Deleting a row in your main database is the easy part. The request also has to reach processors that hold the data on your behalf: your email platform, payment tools, analytics and support desk. Keep a list of those vendors with their deletion method, and have the system send or track each deletion. For backups, document a retention window and make sure restored data is re-scrubbed against a deletion log. Regulators generally accept a documented, consistent approach better than a promise that nothing exists anywhere.

Sensitive data flags and an audit trail

Many state laws treat categories such as health, precise location, biometric and children's data as sensitive and tie them to consent or extra assessment duties. Flag those fields in the schema so that reports, exports and integrations treat them differently. Then log who viewed, changed or exported them. An audit trail also supports the risk assessments and cybersecurity audit work California now expects from larger businesses.

Several laws require a documented assessment before high-risk processing, such as targeted advertising, selling data, or handling sensitive data. Rhode Island's statute applies its assessment duty to processing activities created or generated after 1 January 2026, and does not apply it retroactively. Your software team can help by keeping a living record of each processing activity: purpose, data fields, recipients, retention period and safeguards. That register is also what you hand to a lawyer when a new state's law lands.

Do not custom-build everything. A consent banner and preference center from a specialist vendor is usually cheaper than writing your own, as long as it writes decisions back to your database. Custom work earns its place in the parts only you can build: finding a customer across your own ERP, CRM and billing tables, running the request workflow with your staff roles, and deleting or exporting data from your own stores. If you are planning a new system anyway, adding these features at design time costs far less than retrofitting them. Our custom software development for US businesses page shows how we scope that kind of work, and the USA hub lists the other services we offer US teams.

If you outsource development, apply the same rules to the contractor. Ask for a written data processing agreement, limit developer access to production data, use masked test data, and keep source code and cloud accounts in your company's name. We work that way by default: source code and accounts are in the client's name, and an NDA is available on request.

Does a small business have to follow these laws?

It depends on the state and your volume of data. Many laws set a minimum number of consumers or a share of revenue from selling data, and some exempt certain entities. Read the statute or the attorney general's guidance for each state, and ask a privacy lawyer to confirm.

Is there a federal privacy law I can follow instead?

Not for most commercial businesses. Sector rules such as HIPAA or GLBA apply to specific industries, while general consumer privacy is handled state by state.

Do we need to honor Global Privacy Control?

Some states require it, including California and Connecticut according to their regulators. Even where it is optional, honoring the signal is simple to build once your consent ledger exists.

How fast do we need to answer a consumer request?

Rhode Island's statute sets 45 days, extendable once by 45 more days with notice. Other states use similar windows but check each statute. Build the countdown into your request queue so nobody tracks it by hand.

Can an offshore team build privacy features?

Yes, if the contract, access controls and test data are set up properly. Insist on a processing agreement, role-based access and no real customer data in development.

If you want a plain list of what your current systems would need to answer a deletion or access request, book a short discovery call through our contact page. After the call we send a written scope and a fixed quote, and working software reaches a staging server every two weeks.