Since October 1, 2026, Maryland HB 895 (Chapter 154 of 2026) bars food retailers of 15,000+ square feet and third-party delivery service providers from using a consumer's personal data to set a higher price for tax-exempt food. The Consumer Protection Division enforces it after a 45-day cure.
Since October 1, 2026, Connecticut SB 4 (Public Act 26-64) provides: "No controller shall sell any consumer's precise geolocation data" and "No third party shall sell any consumer's precise geolocation data." The ban has no consent clause. The Attorney General enforces it under CUTPA.
California SB 690, Chapter 976, makes § 638.51 pen register claims over websites, online applications and mobile applications an Attorney General action from 2027-01-01, and applies to pending claims filed in the prior two years. Sections 631 and 632 keep their private right of action.
In Frasco v. Flo Health, No. 3:21-cv-00757-JD, plaintiffs moved on 2026-09-14 for a $1,110,575,000 judgment against Meta for 222,115 California Flo users they say they have identified, $5,000 each under CIPA. Meta opposed on 2026-09-28. Hearing 2026-10-29.
California AB 2561, Chapter 478 of 2026, bars an operating system or app from undoing a user's affirmative configuration of a privacy setting without the user's consent, from January 1, 2027. The text names no penalty or enforcer; the rule requiring the most protective default was cut in April.
On September 10, 2026, California enacted SB 1119 (Chapter 190). From July 1, 2027, a companion chatbot open to users under 18 must ship with parent-only default settings, may not show children cross-context behavioral ads or sell a child's chatbot data. Penalties reach $15,000 per affected child.
On September 10, 2026, California signed AB 1856, AB 1709 and AB 2246. From January 1, 2027, a developer that requests and receives the age bracket signal is deemed to know the user's age range. A state table, the Apple and Google APIs, and what a binary and a traffic capture can show.
On September 8, 2026, Connecticut Attorney General William Tong announced an investigation into MediaLab.AI Inc., owner of Kik, under the CTDPA and CUTPA. It follows a July 2025 notice of violation that, per the AG, cited sensitive data, including precise geolocation, processed without consent.
On September 2, 2026, Delaware Governor Matt Meyer signed HB 380, amending the Delaware Personal Data Privacy Act from January 1, 2027. The law will apply at 10,000 consumers, and a sale of sensitive data must be "strictly necessary" to a product or service the consumer requested.
Governor Mikie Sherrill signed the New Jersey Kids Code Act (A4015/S3413) on August 11, 2026, as P.L.2026, c.73. It takes effect September 1, 2027. A covered child or minor, a parent or the Attorney General can sue, and a court may award $5,000 per violation or treble damages, whichever is greater.
Since August 1, 2026, California Civil Code § 1798.99.86(c) requires every data broker to access the Delete Request and Opt-out Platform (DROP) at least once every 45 days and process deletion requests within 45 days. The fine is $200 per deletion request per day.
On July 24, 2026, the Fifth Circuit (No. 24-50721) affirmed the injunction against the Texas SCOPE Act's monitoring and filtering duty on Section 230 grounds and vacated the injunction on the targeted ads, unlawful ads and age-verification duties for lack of standing or as foreclosed.