--- question: "Why is everyone updating their privacy policy in 2026?" title: "Why Everyone Is Updating Their Privacy Policy in 2026" seoTitle: "2026 Privacy Policy Updates: New State Laws Explained" summary: "Companies are updating privacy policies in 2026 because a cluster of new US state privacy laws took effect through 2025 and into January 2026, including Tennessee and Minnesota in mid-2025, Maryland in October 2025, and Indiana, Kentucky, and Rhode Island in January 2026. Each law carries its own disclosure requirements, consumer rights, and opt-out language, so a policy written for California and Virginia alone is now incomplete. On top of the state wave, EU AI Act transparency obligations are phasing in for companies using AI on personal data, and regulators are actively enforcing against dark patterns and vague sale-of-data disclosures. The updates you are seeing are mostly compliance catch-up, done in batches because the effective dates arrived in batches." publishedAt: "2026-08-22" keywords: - "privacy policy update 2026" - "new state privacy laws 2026" - "US state privacy laws" - "privacy policy requirements" pillar: "Beyond SOC 2" faqs: - question: "do i need to update my privacy policy every year?" answer: "No law sets an annual schedule, but in practice yes, roughly annually. You must update it whenever your data practices change, when a new law that covers you takes effect, or when a law you already follow is amended. With new state laws arriving every year since 2023, most companies that serve US consumers have needed at least one update per year, and several state laws expect the policy to state when it was last revised." - question: "what happens if my privacy policy is outdated?" answer: "Two kinds of exposure. Regulators, including the FTC and state attorneys general, treat a policy that misdescribes your actual practices as a deceptive practice, which is the basis of most privacy enforcement. Separately, an outdated policy can miss newly required disclosures, such as opt-out rights for targeted advertising, which is a violation of the state law itself. Most state laws include a cure period for first violations, but not all, and cure periods are shrinking as laws mature." - question: "which states have new privacy laws in 2026?" answer: "Indiana, Kentucky, and Rhode Island have privacy laws taking effect on January 1, 2026. They follow Tennessee and Minnesota in mid-2025 and Maryland in October 2025, which brought notably stricter data minimization rules. By early 2026 roughly 20 states have general consumer privacy laws in force, each with its own thresholds and disclosure requirements." - question: "what should be included in a privacy statement?" answer: "At minimum: the categories of personal data you collect, the purposes you use it for, who you share or sell it to, the rights consumers have (access, deletion, correction, opt-out of targeted advertising and sales), how to exercise those rights, and a contact point for privacy questions. Individual state laws layer on specific required disclosures, such as an appeal process for denied requests or a statement on honoring browser opt-out signals. The statement must describe what you actually do, since a mismatch between the policy and your practices is the basis of most enforcement." - question: "what are some examples of privacy law violations?" answer: "Common ones include collecting or using data for purposes the policy never disclosed, ignoring deletion or opt-out requests, selling or sharing data without offering the required opt-out, and using dark patterns that make refusing consent harder than granting it. Regulators, including the FTC and state attorneys general, have brought enforcement actions on all of these. The pattern across cases is the same: the gap between what the policy says and what the company does is the violation." - question: "does gdpr apply in the united states?" answer: "Yes, to US companies in scope of it. GDPR applies extraterritorially: a US company with no EU presence is covered if it offers goods or services to people in the EU or monitors their behavior, for example through tracking and analytics on EU visitors. Merely having a website reachable from Europe does not by itself trigger it; targeting or monitoring EU individuals does." --- ## Why is everyone updating their privacy policy in 2026? Because the law under those policies changed in batches. A wave of new US state consumer privacy laws took effect through 2025 and into January 2026: Tennessee and Minnesota in mid-2025, Maryland in October 2025, and Indiana, Kentucky, and Rhode Island on January 1, 2026. Each new law adds required disclosures and consumer rights, so companies serving US consumers have been revising policies on the same schedule the laws arrive. By early 2026, roughly 20 states have such laws in force. ## The drivers, in one place | Driver | What changed | What it forces into the policy | |---|---|---| | New state privacy laws | Tennessee, Minnesota (mid-2025), Maryland (Oct 2025), Indiana, Kentucky, Rhode Island (Jan 2026) | State-specific rights sections, opt-out links for targeted ads and data sales, contact and appeal mechanisms | | Stricter existing states | Maryland's law imposes unusually tight data minimization and largely bans selling sensitive data | Narrower stated purposes for collection; some practices must stop, not just be disclosed | | EU AI Act phase-in | Transparency obligations for AI systems phasing in through 2025 and 2026 | Disclosure when users interact with AI, and how personal data feeds AI features | | Enforcement pressure | FTC and state AG actions on dark patterns and vague "sale" disclosures | Plain-language opt-outs, honest descriptions of data sharing with ad tech | | Universal opt-out signals | Several states now require honoring browser signals such as Global Privacy Control | A statement of whether and how opt-out preference signals are honored | ## Why the updates cluster in January Most state privacy laws take effect on January 1. Legal teams typically batch the changes: audit data practices in the fall, publish one revised policy before the effective dates, and notify users once. That is why inboxes fill with "we've updated our privacy policy" emails each December and January, and why 2026 looks like "everyone at once" when it is really three new states plus amendments landing on the same date. ## What "update" actually means A meaningful update is rarely just new text. The state laws grant rights (access, deletion, correction, portability, opt-out of targeted advertising and data sales) that the company must be able to honor operationally. The policy update is the visible end of a chain: data inventory, vendor review, opt-out plumbing, then the rewritten disclosure. A policy that promises rights the company cannot fulfill is worse than an old one, because misdescribing your practices is the core of most FTC and state enforcement. Two clarifications, since the question hides an ambiguity. First, "privacy policy" here means the public-facing notice to consumers, which is different from internal privacy and security policies that frameworks like SOC 2 or ISO 27001 examine; the 2026 wave is about the public notice. Second, most of these state laws have applicability thresholds, commonly around 100,000 state residents' data processed per year, or 25,000 if you sell data. Small B2B companies that process little consumer data are often below every threshold, and many of them update anyway because enterprise customers and privacy-conscious users expect current state coverage. ## Do you need to act? If you serve US consumers in any volume, yes: check whether Indiana, Kentucky, Rhode Island, or Maryland cover you, and whether your policy discloses opt-out rights and honors universal opt-out signals where required. If you are a B2B vendor below the thresholds, the direct legal risk is low, but expect the question to arrive through customer security and privacy reviews instead. Either way, the underlying rule is stable even as statutes multiply: describe what you actually do with data, accurately, and revisit the description every time the practices or the laws change.