The 2026 state privacy landscape is not defined by one new law. It is defined by a shift in how states are tightening, refining, and differentiating their privacy regimes. Indiana, Rhode Island, and Kentucky all brought comprehensive privacy laws into effect on January 1, 2026.
At the same time, states with existing laws are moving in different directions. Oregon’s cure period sunset on January 1, 2026, California expanded “sensitive personal information” to include neural data, and Virginia added a product-specific rule for social media platforms and minors under 16, effective January 1, 2026.
State privacy law is no longer converging neatly around one model. It is branching into sector-specific restrictions, youth protections, narrower enforcement discretion, and more expansive categories of protected data. Companies now need a more flexible operating model that can track state-specific definitions, cure-period exposure, amendments, and sensitive-data expansion without reworking the whole program every quarter.