For Those Who Have an Additional Site Other Than ESTAGE, Needing Legal Docs

US privacy in 2026 will still be driven mainly by a patchwork of state consumer privacy laws, sector‑specific federal laws (like financial, health, children), and expanding rules around kids and online safety, with no single comprehensive federal privacy statute expected in force at the start of 2026.

Overall structure in 2026
In 2026, organizations handling U.S. personal data will navigate three main layers: state “comprehensive” consumer privacy laws, federal sector‑specific rules, and emerging online‑safety/AI measures, especially for minors. Compliance programs generally need a scalable, nationwide approach because state laws continue to proliferate and diverge on details like thresholds, sensitive data, and minors’ protections.

State consumer privacy laws.
By January 1, 2026, at least 19 states will have comprehensive consumer data privacy laws in force, including long‑standing regimes (California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, etc.) plus new laws in Kentucky, Indiana, and Rhode Island. These state laws typically grant rights to access, correction, deletion, data portability, and opt‑out of targeted advertising and “sale” of personal data, while imposing duties like data protection assessments and purpose limitation on covered businesses.

Several states are tightening their frameworks for 2026, expanding applicability thresholds, broadening “sensitive data,” and enhancing minors’ protections and obligations for social media platforms. Amendments in states such as Connecticut and Kentucky add stricter conditions for processing sensitive data, bring more entities (including some nonprofits) into scope, and require more robust transparency and opt‑out mechanisms.

Key changes effective in 2026
On January 1, 2026, new comprehensive privacy laws in Kentucky (KCDPA), Indiana (ICDPA), and Rhode Island (RIDTPPA) will begin to apply, extending similar consumer rights and controller/processor duties to more businesses nationwide. Rhode Island’s law is notable for obligating companies that sell personal information to disclose the identity of all third parties receiving that information, even without a specific consumer request.​

Other states have 2026 effective dates for strengthened obligations, including expanded data protection assessments, online safety rules for minors, and stricter limits on selling precise geolocation data. For example, a 2026 measure bans sale of precise geolocation data that can identify a person or device within about a 1,750‑foot radius, with a narrow exception, reflecting growing concern over location tracking.

Minors, online safety, and children’s privacy.
Children’s and teens’ online privacy and safety are a central focus going into 2026, with both state amendments and federal proposals targeting social media and AI‑driven services. States are adding heightened protections for minors, including stricter parental‑consent requirements, limitations on targeted advertising to under‑16s, and online safety obligations such as anti‑cyberbullying policies and safer default settings.​

At the federal level, congressional proposals like “COPPA 2.0” would update the Children’s Online Privacy Protection Act to strengthen rules on collection, use, and disclosure of children’s data and to ban targeted advertising to children and teens, enforced by the FTC, though these have not yet been fully enacted for 2026. Additional bipartisan bills in 2025 aim to regulate chatbots and minors’ access to AI companionship tools, potentially adding federal online‑safety standards that could interact with state privacy regimes in 2026.

Currently, less than $30 a year! Review the site by clicking here.