Delaware Significantly Amends Consumer Data Privacy Law

by David Stauss - Stauss

Key point: Less than two years after Delaware’s consumer data privacy law went into effect, Delaware lawmakers have significantly revised the law to update it for changes made by other states while creating new obligations for controllers and third parties.

On September 2, 2026, Delaware Governor Matt Meyer signed HB 380 into law. Effective January 1, 2027, HB 380 significantly revises Delaware’s consumer data privacy law, which went into effect January 1, 2025.

Read more: https://staussfirm.com/2026/09/02/delaware-significantly-amends-consumer-data-privacy-law/

Privacy in the bayou: Louisiana to debut new data privacy law

by Phoebe Hebson, David Saunders, McDermott Will & Schulte - JD Supra

On May 21, 2026, the Louisiana State Senate passed Senate Bill 386, which if signed by Louisiana’s governor, will become the Louisiana Data Privacy Act (the LDPA) and come into effect January 1, 2027. The LDPA, although the latest entrant in the ongoing waltz of state privacy laws, thankfully does not introduce any novel privacy compliance obligations. The LDPA is, however, an interesting mix of California- and Connecticut-style laws. Companies doing business in Louisiana should assess the applicability of the LDPA and, if necessary, prepare for LDPA compliance before the end of this year.

Read more: https://www.jdsupra.com/legalnews/privacy-in-the-bayou-louisiana-to-debut-4973644/

Alabama Enacts Comprehensive Consumer Data Privacy Law

by Arsen Kourinian, Lei Shen, Amber C. Thomson, Megan P. Von Klein, Joshua M. Cohen - Mayer Brown

On April 17, 2026, Governor Kay Ivey signed House Bill 351 into law, enacting the Alabama Personal Data Protection Act (the "APDPA" or the "Act") and making Alabama the 22nd state to adopt a comprehensive consumer privacy law. The APDPA, which takes effect on May 1, 2027, largely follows the dominant model for state privacy legislation observed in states outside of California; however, it departs from that model in several notable respects, including generally lower applicability thresholds, a novel definition of "sale," and the absence of a data protection assessment requirement. For more information about how the APDPA compares to other privacy laws, please see our state privacy law tracker.

Read more: https://www.mayerbrown.com/en/insights/publications/2026/04/alabama-enacts-comprehensive-consumer-data-privacy-law

Indiana Releases Consumer Data Privacy Bill of Rights

by Nick Palmiere, Baker Botts L.L.P. - JD Supra

Ahead of implementation of Indiana's comprehensive data privacy law, Indiana’s Attorney General has released a Consumer Data Privacy Bill of Rights describing how the Indiana Consumer Data Protection Act ("ICDPA"), enacted in 2023, will operate when it takes effect on January 1, 2026. Although styled for consumers, the Bill of Rights functions as a practical compliance roadmap for businesses subject to the law. It reiterates the ICDPA’s scope and thresholds, articulates the core consumer rights, and underscores concrete controller obligations around transparency, data minimization, purpose limitation, sensitive data handling, and response timelines.

Read more: https://www.jdsupra.com/legalnews/indiana-releases-consumer-data-privacy-4907688/

Montana Amends Consumer Data Privacy Act to Broaden Applicability and Enhance Protections for Minors

by Lucas Schaetzel, Benesch - JD Supra

Montana’s amendments also remove the cure period for alleged violations beginning in October, provide prescriptive methods through which businesses have to provide consumers with targeted advertising opt out rights, and increase the disclosures necessary in privacy notices.

On May 8th, Montana’s Governor signed new amendments to Montana’s Consumer Data Privacy Act that expand its applicability by decreasing the threshold triggers and narrowing existing exemptions and removing the existing 60-day cure period that businesses were previously granted for alleged violations. The cure period sunsets on October 1, 2025.

Read more: https://www.jdsupra.com/legalnews/montana-amends-consumer-data-privacy-7595829/

New Jersey Joins Data Privacy Party - New Jersey Data Protection Act Becomes Effective in January 2025

by Mercedes de la Rosa, Harris Freier, Benjamin Perry; Ogletree, Deakins, Nash, Smoak & Stewart, P.C. - JD Supra

Signed into law at the beginning of 2024, colloquially known as the New Jersey Data Protection Act (NJDPA), N.J. Stat. § 56:8-166.4 et seq. will go into effect on January 15, 2025, as New Jersey joins eighteen other states with comprehensive data privacy laws. Businesses affected typically include large retailers with significant online presences, online advertising platforms, social media companies, insurers, and data brokers, and these businesses may want to focus on identifying their New Jersey consumers to ensure compliance, as the forgiveness period for this law expires on July 15, 2025.

Read more: https://www.jdsupra.com/legalnews/new-jersey-joins-data-privacy-party-new-3052672/

'The big one': Online data privacy bill gives Montanans opt-out option

by Seaborn Larson Lee Newspapers - Bozeman Daily Chronicle

Montana's new consumer data protections law takes effect Tuesday, joining a handful of states that have advanced legislation on the matter before action by the federal government.

Senate Bill 384, also known as the Consumer Data Privacy Act, gives Montanans the rights to access or obtain copies of their data collected by online companies. The law will also give people the right to request a business delete personal data held by a company and opt out of the data collection process for purposes of targeted advertising or sale of their data to other companies.

Sen. Daniel Zolnikov, R-Billings, said the universal opt out is "the big one" in the bill's provisions.

Read more: https://www.bozemandailychronicle.com/news/montana-data-privacy-bill-takes-effect/article_6e639b3b-12cb-53da-81fa-6f4dc97cf9c8.html?mkt_tok=MTM4LUVaTS0wNDIAAAGV7Scnpfm4snGNoLeMRHpIeAMdoeBmOsFu1SbCzHTjM21FQSQ1xFiUupWUG5ltY0r9x0kT7rTzLB3TK3rZJqQnFSR3wKxEn4w2pePfikxdHy2w

Rhode Island Legislature Passes Consumer Data Privacy Act

by David Stauss, Husch Blackwell LLP - JD Supra

Keypoint: While the act does not include many provisions found in the more recent consumer data privacy laws, it would expand privacy notice obligations in one significant way although the applicability and scope of that requirement is unclear due to the lack of an important definition.

On June 13, 2024, the Rhode Island legislature passed the Rhode Island Data Transparency and Privacy Protection Act (SB 2500 / HB 7787). The act will now move to Governor Daniel McKee for consideration. Assuming the act becomes laws, it will go into effect on January 1, 2026.

Read more: https://www.jdsupra.com/legalnews/rhode-island-legislature-passes-2761107/

Province looking to clamp down on data privacy

by Anna Ferensowicz - Discover Airdrie

The province has announced that over the next 18 months, it will be strengthening privacy protections for Albertans, including a proposal to amend Alberta’s privacy legislation that will ensure that the penalties for misusing the data of Albertans or violating their privacy are the strongest in Canada.

The Ministry of Technology and Innovation will also create a portal to ensure Albertans can see how their data is being used and provide an avenue for people to file a complaint if they feel their data has been misused.

Read more: https://discoverairdrie.com/articles/province-looking-to-clamp-down-on-data-privacy

Employee Data Increasingly in the Crosshairs of Data Privacy Enforcement

by Robert Blamires, Michael H. Rubin, Joseph C. Hansen, Kathryn Parsons-Repone - Latham & Watkins

On July 14, 2023, the California Attorney General announced an investigative sweep targeting large California employers, focusing on employers’ compliance with the California Consumer Privacy Act’s (CCPA’s) recently expanded coverage of employees and job candidates. The announcement follows the expiration of a prior exemption for personnel and business to business (B2B) data under the CCPA (for more information, see this Latham blog post).

Read more: https://www.globalprivacyblog.com/privacy/employee-data-increasingly-in-the-crosshairs-of-data-privacy-enforcement/#page=1