23 States Now Have Consumer Privacy Laws, More Coming in 2027

Twenty-three states have enacted consumer privacy laws; more take effect through 2028.

As of August 2026, 23 U.S. states have enacted comprehensive consumer data privacy laws, with 20 already in effect, reflecting a continued expansion of state-level privacy regulation. States such as Indiana, Kentucky, and Rhode Island saw their laws become effective on January 1, 2026, signaling early momentum in this trend. (Clym Privacy Law Map)

New privacy legislation continues to roll out, with Louisiana and Oklahoma enacting laws effective January 1, 2027. Notably, Oklahoma’s law, signed on March 20, 2026, marks it as the 21st state with comprehensive protections. Alabama’s privacy law goes into effect May 1, 2027, and Vermont will follow on January 1, 2028, further increasing the regulatory patchwork companies must navigate. (Venable 2026 Mid-Year Update, Mayer Brown Analysis)

The trend extends beyond general data privacy to AI-specific regulation. Illinois’ AI Safety Measures Act, effective January 1, 2027, targets AI developers with over $500 million annual revenue, requiring transparency via published safety frameworks and annual audits. Washington’s generative AI disclosure law, also effective early 2027, mandates specific disclosures related to generative AI technologies. (Venable Review)

This growing mosaic of state privacy laws, each with unique requirements including vendor contract clauses, means that companies operating nationally must maintain vigilant compliance monitoring. Michael A. Signorelli, Partner at Venable LLP, noted, "State lawmakers continued to expand and add to consumer data privacy requirements during the first half of 2026." Meanwhile, the Forbes Technology Council highlighted the complexity of navigating privacy compliance without federal guidance.

What's next: Businesses should prepare for Alabama's law effective May 1, 2027, and Vermont's on January 1, 2028, while monitoring evolving AI-specific privacy rules.