Revised Privacy Laws Cast Wider Net for Corporate Compliance

A handful of states are updating their data protection laws rather than passing new ones to get more companies to comply with stricter requirements.

In 2026, amendments to existing privacy laws in states such as Oregon, Utah, and Connecticut will take effect, creating new obligations for precise location and children’s data, and expanding definitions and applicability thresholds. The updates come on the heels of amendments to laws in Montana and Colorado that broadened the net of companies in scope in 2025.

With these updates, states are gaining ground by narrowing exemptions, banning new practices, and forcing companies with fewer consumers ...