New 2026 privacy laws help you

6 min read

Asking What They Know About You

Apps, websites, store loyalty cards and connected gadgets all collect information about the people who use them. States have been passing their own consumer privacy laws to give people more say over that information, one state at a time.

On January 1, 2026, three more states put full consumer privacy laws into effect: Indiana, Kentucky and Rhode Island. Several states that already had laws tightened them during the year, including new limits on selling location data and a disclosure rule about artificial intelligence.

What Happened

Three new laws. Indiana's Consumer Data Protection Act, Kentucky's Consumer Data Protection Act and Rhode Island's Data Transparency and Privacy Protection Act all took effect on January 1. None of them covers every business. Indiana and Kentucky apply to companies that handle personal data on at least 100,000 state residents, or on at least 25,000 if half or more of their revenue comes from selling personal data, according to Koley Jessen and the Kentucky Attorney General. Rhode Island's bar is lower: 35,000 residents, or 10,000 for a company that earns more than 20% of its revenue from selling data.

Under these laws, residents can ask a covered business to:

• confirm whether it holds their personal data, and let them see it
• correct mistakes in it
• delete it
• hand over a copy in a form they can take elsewhere
• stop using it for targeted ads, stop selling it, and stop using it for certain kinds of profiling, the automated sorting of people that can feed important decisions about them

Rhode Island adds a transparency rule: businesses must name the third parties they sell personal data to, BakerHostetler reports.

Some information gets extra protection. The Indiana and Kentucky attorneys general both list categories of "sensitive" data that a company may not process without the person's consent. They include precise location, health diagnoses, genetic and biometric data, sexual orientation, religious beliefs, racial or ethnic origin, citizenship or immigration status, and data about a child under 13. Indiana's office says a parent or guardian can use these rights on a child's behalf.

The laws also set deadlines. In Indiana and Kentucky, a company must answer a request within 45 days. It can take 45 more, for 90 days in total, but has to tell the person within the first 45. If it refuses, it must explain why and how to appeal, and it must decide an appeal within 60 days. Indiana's attorney general says people can get a copy of the data they provided free of charge once a year.

Only the state attorney general can enforce each law. Kentucky's office states plainly that individuals cannot sue under its law. Koley Jessen reports that Indiana and Kentucky give a company 30 days to fix a violation before penalties apply, with fines of up to $7,500 per violation. Rhode Island offers no such grace period, according to Koley Jessen.

Other states tightened their rules.

• Oregon: since January 1, 2026, selling precise location data is banned, and selling data of people under 16 is restricted in some cases (BakerHostetler).
• New Jersey: a ban on selling sensitive data took effect June 30, 2026 (Morgan Lewis).
• Virginia: a ban on selling precise location data took effect July 1, 2026. BakerHostetler notes that Virginia counts something as a sale only when money changes hands.
• Connecticut: amendments, most of them effective July 1, 2026, lowered the coverage threshold from 100,000 residents to 35,000 and let people ask for a list of the third parties their data was sold to. Privacy notices must now say whether personal data is used to train large language models, the type of AI behind chatbots. A ban on selling precise location data followed on October 1, 2026 (Morgan Lewis).

How This Kind of Thing Happens

Most data collection happens out of sight. A weather app records your location to show the local forecast and may share it with advertising partners. A website notes which pages you read. A data broker, a company that buys and resells personal information, can combine these scraps into a detailed profile and sell it to marketers and other buyers.

Precise location is the most revealing piece. A phone's GPS can often place it within a few yards. A few weeks of those points can show where someone lives and works, which doctor they visit and where they worship. Several states, including Oregon, Virginia and Connecticut, have now gone beyond letting people opt out of location sales and banned those sales.

The new laws do put some duties on companies up front. Indiana's attorney general, for example, says collection should be limited to what is reasonably necessary for the purpose the company disclosed. Most of the rights, though, work only when a person asks. You have to find each company and send the request yourself.

Why It Matters at Home

If you live in one of these states, you now have a legal way to ask a company what it knows about your household and to have it removed. Parents have specific protections for children under 13. In Indiana, the attorney general says requests are generally free.

The limits are real, too. Each law covers only businesses above its size thresholds, and Kentucky's attorney general lists exempt groups such as nonprofits, state agencies and colleges. The rights belong to residents of that state, so a relative across a state line may not have them. And each request goes to one company at a time. None of the sources used here says a deletion request also reaches copies a company already sold to others.

That is why the first step matters most. Every request starts with knowing who has your data in the first place.

What You Can Do

• Check whether your state has a consumer privacy law. Your state attorney general's website is a good place to start.
• Look for a privacy link at the bottom of websites and in app settings. A company's privacy notice should explain what it collects and how to send a request.
• Start with the companies that likely hold the most about you: your phone carrier, apps that use your location, and store loyalty programs.
• Write down the date you send each request. In Indiana and Kentucky, a company has 45 days to respond, or 90 if it tells you it needs more time.
• If a company misses the deadline, Indiana's attorney general advises notifying it in writing first. If it refuses, use its appeal process.
• If the appeal fails or the company stays silent, complain to your attorney general. Kentucky's Office of Data Privacy takes complaints through an online form or at (502) 892-8538. Indiana's attorney general takes complaints online at in.gov/attorneygeneral.
• In your phone's settings, turn off location access for apps that don't need it.

Sources

1. Koley Jessen, Dec 31, 2025
2. BakerHostetler, Apr 28, 2026
3. Morgan Lewis, Jul 30, 2026
4. Kentucky Attorney General
5. Indiana Attorney General

This article is based on the published reports listed above, written in our own words. Details are as reported on the dates shown. Spotted an error? Email support@krudodesigns.net and we will correct it.