The U.S. state privacy landscape expanded in 2026 with new comprehensive data privacy laws in Indiana, Kentucky, and Rhode Island that grant consumers rights over personal data and require opt‑in consent for sensitive information. In California, updated CCPA regulations now mandate privacy risk assessments and establish rules for automated decision‑making technology (ADMT), with compliance steps including notices, opt‑out rights, and documented safeguards. Businesses should review applicability and update privacy programs.
