US State Privacy Laws 2026–2028: Effective Dates, Opt-Out Signals, and Customer Profiles

As of 17 October 2026, 23 states have enacted comprehensive consumer privacy laws, with the newest effective dates running from Louisiana and Oklahoma (1 January 2027) and Alabama (1 May 2027) to Vermont (1 January 2028) 14. The practical differences are which laws require businesses to honor universal opt-out signals such as Global Privacy Control (GPC), which require opt-in consent for sensitive data, and which give a profiling opt-out. The master table below covers each state.

Who this is for: privacy counsel and marketing-data teams that keep customer profiles in a customer data platform (CDP) or similar system. Part of the regulation hub; dates also feed the regulatory deadline tracker.

State privacy laws 2026: master table

| Texas (TDPSA) | 1 Jul 2024 | Any non-small business (SBA test) that conducts business in Texas and processes or sells personal data. HIPAA covered entities and business associates exempt | Authorized-agent opt-out by browser or device setting, with conditions | Opt-in | Opt out | 30 days, no sunset | S, I | | Oregon (OCPA) | 1 Jul 2024 | 100,000+ consumers; or 25,000+ and 25%+ revenue from sales. PHI exempt | Required from 1 Jan 2026 | Opt-in | Opt out | 30 days; sunset reportedly 1 Jan 2026 † | S, T | | Delaware (DPDPA) | 1 Jan 2025 | 35,000+ consumers; or 10,000+ and over 20% revenue from sales. From 1 Jan 2027: 10,000+; or 5,000+ and over 20%; plus third parties receiving controller data | Required from 1 Jan 2026 | Opt-in | Opt out of "solely automated" profiling; "automated" from 1 Jan 2027 | 60 days mandatory to 31 Dec 2025; discretionary since | S | | New Hampshire (NHPA) | 1 Jan 2025 | 35,000+ consumers; or 10,000+ and 25%+ revenue from sales † | Required † | Opt-in | Opt out | 60 days; sunset Jan 2026 † | I, T | | New Jersey (NJDPA) | 15 Jan 2025 | 100,000+ consumers; or 25,000+ with sales revenue or discount. PHI exempt | Required from about 15 Jul 2025 (six months after effective date) | Opt-in | Opt out | 30 days until about 15 Jul 2026 | S | | Nebraska (NDPA) | 1 Jan 2025 | Any non-small business (SBA test) that processes or sells personal data. HIPAA covered entities and business associates exempt | Authorized-agent opt-out by browser or device setting | Opt-in | Opt out | 30 days | S | | Kentucky (KCDPA) | 1 Jan 2026 | 100,000+ consumers; or 25,000+ and over 50% revenue from sales. HIPAA covered entities and business associates exempt | None found | Opt-in | Opt out | 30 days | S | | Minnesota (MCDPA) | 31 Jul 2025 | 100,000+ consumers; or 25,000+ and over 25% revenue from sales. PHI exempt | Authorized-agent opt-out by browser or device setting | Opt-in | Opt out; right to question result | Expired 31 Jan 2026 | S | | Maryland (MODPA) | 1 Oct 2025 | 35,000+ consumers; or 10,000+ and over 20% revenue from sales | Required on or before 1 Oct 2025 | Only if strictly necessary; sale banned | Opt out of solely automated decisions | Discretionary, 60 days minimum, for violations to 1 Apr 2027 | S | | Rhode Island (RIDTPPA) | 1 Jan 2026 | 35,000+ consumers; or 10,000+ with 20%+ revenue from sales †. HIPAA covered entities and business associates exempt | Not required † | Opt-in | Opt out | None † | S, I, T | | Louisiana (LDPA) | 1 Jan 2027 | Over $25M revenue; or 75,000+ consumers, households or devices; or 50%+ revenue from sales | Not clearly mandated † | Opt-in | Opt out | 30 days; sunsets 31 Jul 2027 | T | | Oklahoma (OCDPA) | 1 Jan 2027 | 100,000+ residents; or 25,000+ and over 50% revenue from sales | Not required † | Opt-in | Opt out | 30 days | T | | Alabama (APDPA) | 1 May 2027 | Over 25,000 consumers; or over 25% revenue from sales | Not required † | Opt-in; consent for ages 13 to 15 | Opt out | 45 days | T | | Vermont (VTDPOSA) | 1 Jan 2028 | 35,000+ consumers; or 3,000+ sensitive-data consumers; or 3,000+ with data for sale | Required † (date not stated) | Opt-in; consent to sell consumer health data | Opt out | 60 days; sunsets 30 Jun 2029 | T |

Sources for rows: 1–22. Notes: Florida's Digital Bill of Rights is narrower and is usually counted separately; it covers a "controller" with over $1 billion in global gross annual revenue that also meets an advertising, smart-speaker or app-store test 21. Maryland's law applies to processing activities from 1 April 2026 3. Vermont also requires disclosure of large-language-model training use and restricts geofencing near healthcare facilities 4.

Universal opt-out signals and Global Privacy Control by state

Global Privacy Control (GPC) is a browser or extension setting that sends an opt-out preference signal. The states that require recognizing such signals, from the texts we read, are California (the attorney general states a user-enabled GPC "must be honored") 5, Colorado (since 1 July 2024) 9, Connecticut (since 1 January 2025) 10, Delaware (from 1 January 2026) 13, Maryland (on or before 1 October 2025) 16, New Jersey (six months after its 15 January 2025 effective date) 14 and Oregon (from 1 January 2026) 12. Osano reports that New Hampshire and, from 2028, Vermont require signals, and Montana is believed to as well, but we could not confirm those texts 3. Texas, Minnesota and Nebraska take a narrower route: a consumer may use an authorized agent, including a browser or device setting, to opt out, and the controller must comply subject to listed conditions 111519.

Sensitive data, profiling and cure periods

Sensitive data. Most states require opt-in consent before processing sensitive data 2. Exceptions: Utah and Iowa use notice and opt-out 217; California gives a right to limit use 5; Maryland allows collection only where strictly necessary to provide a requested product or service and bans selling sensitive data 16. Connecticut's 1 July 2026 amendments widened the category to include, among other things, treatment, disability, neural data and financial account numbers 10.

Profiling and automated decisions. Nearly all laws give an opt-out of profiling in furtherance of decisions with legal or similarly significant effects; Utah and Iowa do not 217. Connecticut and Minnesota add a right to question the result 1015. California's regulations, effective 1 January 2026, add an opt-out of automated decision-making technology (ADMT) for significant decisions, defined to include healthcare services, with compliance required by 1 January 2027 6. For EU-side overlap see EU AI Act for marketing and customer decisioning.

Cure periods are closing. Colorado, Connecticut, Minnesota and Montana have expired; Delaware's mandatory period ended on 31 December 2025; New Jersey's ended around mid-July 2026; Rhode Island has none 3910131415. Virginia, Texas, Kentucky and Nebraska keep a 30-day cure 8111819.

HIPAA is not exempt everywhere in the same way. Virginia, Texas, Kentucky, Nebraska and Rhode Island exempt covered entities and business associates as organizations, so a hospital's marketing data may fall outside those laws. Colorado, Oregon, New Jersey and Minnesota exempt PHI and related data rather than the organization, so a provider's non-PHI marketing profiles can still be covered 8911121415181920. See HIPAA marketing rules.

What this means for customer profiles and customer data platform (CDP) configuration

Build one policy layer rather than 23 rule sets. The checklist below assumes a customer data platform (CDP) holding resolved profiles, as described in identity resolution explained.

1. Opt-out of sale, sharing and targeted advertising. Store opt-out status per resolved profile, with timestamp, source and jurisdiction. Apply it at activation, not only at ingestion, and suppress it from every ad and data-sale destination. See consent withdrawal across channels.
2. GPC at the data layer. Capture the signal when the visitor arrives (the GPC specification defines an HTTP header and a script property), record it on the event and the anonymous profile, and attach it to the known profile when identity resolution links the visitor to an account. Define the rule when a signal conflicts with a stored consent. Many teams choose to honor the signal for all US visitors, since geolocating by state is brittle; that is a design choice, not a legal requirement.
3. Sensitive-data segmentation. Tag sensitive attributes and inferences at the schema level. Keep them out of marketing audiences unless a consent record exists, and out of audiences entirely for Maryland residents where collection is limited to what is strictly necessary. Revisit the tag list after Connecticut's July 2026 changes.
4. Profiling and ADM opt-outs. Record each model-driven decision with inputs, reason codes and the opt-out state, and route opted-out individuals to a non-automated path for significant decisions.
5. Deletion workflows. Deletion must reach the identity graph, the warehouse, caches, backups according to policy, and every processor and destination. Keep a proof record per request.
6. Thresholds and jurisdiction. Count consumers per state each year; thresholds are moving (Connecticut, Delaware, Montana) and several laws have no revenue floor.

A customer-owned deployment of PrivyCDP keeps these records inside your own infrastructure with an append-only audit ledger; the pattern applies to any platform.

Federal privacy bill 2026: the SECURE Data Act

Use the compliance guide to map these obligations to your deployment, and return to the regulation hub.