State Privacy Laws Are Moving Beyond Disclosures: What Businesses Need to Know in 2026

In this insight piece, authors Dorian Simmons, Cynthia Cole, Maki DePalo & Jennifer Everett (Alston & Bird) explore how state privacy laws are evolving from disclosure-based requirements into broader operational obligations affecting product design, data governance, vendor management, and technology systems. Regulators increasingly assess whether companies’ actual data practices align with their privacy notices, with enforcement risks particularly concentrated in digital advertising, data sharing, and the handling of sensitive information.

The authors highlight the limitations of exemptions under laws such as the Gramm-Leach-Bliley Act (GLBA) and the Health Insurance Portability and Accountability Act (HIPAA), noting that marketing, analytics, and advertising data may remain subject to state privacy requirements. They also examine expanding protections for minors, which increasingly influence product design, personalization, profiling, and targeted advertising practices, particularly for services likely to be used by children and teenagers.

Health and precise geolocation data remain areas of heightened regulatory scrutiny, especially where information is used for advertising, analytics, or profiling. Companies must also ensure that universal opt-out mechanisms and consumer privacy requests are properly implemented across their systems and third-party vendors. In addition, expanding transparency requirements mean businesses need greater visibility into how personal information is shared with third parties and how consumer rights are fulfilled across different jurisdictions.

Finally, the authors examine stricter data minimization standards and consumer appeal procedures, emphasizing that privacy compliance requires more than written policies. Businesses should establish clear data inventories, limit collection and processing to justified purposes, maintain consistent procedures for consumer requests and appeals, and regularly test technical controls. Effective privacy governance increasingly depends on demonstrable alignment between legal obligations, business practices, and the systems that manage personal information.

CONTINUE READING…