Beyond SOC 2
Why is everyone updating their privacy policy in 2026?
Why is everyone updating their privacy policy in 2026?
Because the law under those policies changed in batches. A wave of new US state consumer privacy laws took effect through 2025 and into January 2026: Tennessee and Minnesota in mid-2025, Maryland in October 2025, and Indiana, Kentucky, and Rhode Island on January 1, 2026. Each new law adds required disclosures and consumer rights, so companies serving US consumers have been revising policies on the same schedule the laws arrive. By early 2026, roughly 20 states have such laws in force.
The drivers, in one place
| Driver | What changed | What it forces into the policy |
|---|---|---|
| New state privacy laws | Tennessee, Minnesota (mid-2025), Maryland (Oct 2025), Indiana, Kentucky, Rhode Island (Jan 2026) | State-specific rights sections, opt-out links for targeted ads and data sales, contact and appeal mechanisms |
| Stricter existing states | Maryland's law imposes unusually tight data minimization and largely bans selling sensitive data | Narrower stated purposes for collection; some practices must stop, not just be disclosed |
| EU AI Act phase-in | Transparency obligations for AI systems phasing in through 2025 and 2026 | Disclosure when users interact with AI, and how personal data feeds AI features |
| Enforcement pressure | FTC and state AG actions on dark patterns and vague "sale" disclosures | Plain-language opt-outs, honest descriptions of data sharing with ad tech |
| Universal opt-out signals | Several states now require honoring browser signals such as Global Privacy Control | A statement of whether and how opt-out preference signals are honored |
Why the updates cluster in January
Most state privacy laws take effect on January 1. Legal teams typically batch the changes: audit data practices in the fall, publish one revised policy before the effective dates, and notify users once. That is why inboxes fill with "we've updated our privacy policy" emails each December and January, and why 2026 looks like "everyone at once" when it is really three new states plus amendments landing on the same date.
What "update" actually means
A meaningful update is rarely just new text. The state laws grant rights (access, deletion, correction, portability, opt-out of targeted advertising and data sales) that the company must be able to honor operationally. The policy update is the visible end of a chain: data inventory, vendor review, opt-out plumbing, then the rewritten disclosure. A policy that promises rights the company cannot fulfill is worse than an old one, because misdescribing your practices is the core of most FTC and state enforcement.
Two clarifications, since the question hides an ambiguity. First, "privacy policy" here means the public-facing notice to consumers, which is different from internal privacy and security policies that frameworks like SOC 2 or ISO 27001 examine; the 2026 wave is about the public notice. Second, most of these state laws have applicability thresholds, commonly around 100,000 state residents' data processed per year, or 25,000 if you sell data. Small B2B companies that process little consumer data are often below every threshold, and many of them update anyway because enterprise customers and privacy-conscious users expect current state coverage.
Do you need to act?
If you serve US consumers in any volume, yes: check whether Indiana, Kentucky, Rhode Island, or Maryland cover you, and whether your policy discloses opt-out rights and honors universal opt-out signals where required. If you are a B2B vendor below the thresholds, the direct legal risk is low, but expect the question to arrive through customer security and privacy reviews instead. Either way, the underlying rule is stable even as statutes multiply: describe what you actually do with data, accurately, and revisit the description every time the practices or the laws change.