US State Privacy Laws: The 2027 Compliance Map — Twenty Laws in Force, Six More in January, and What Changes for Each

SAN FRANCISCO — For four years, privacy officers at national companies have hoped for one of two things: a federal law to replace the state statutes, or a court to find that a state cannot regulate a business with no presence inside it. Congress has not delivered the first. Earlier this month the Supreme Court foreclosed the second, upholding a state data broker law against a dormant Commerce Clause challenge in a decision whose reasoning applies to every comprehensive privacy statute on the books. The patchwork is the law, and for 2027 it has twenty-six pieces.

"The question is no longer which states to comply with. It is which state's rule you will apply to everyone, because you cannot run twenty-six programs," the chief privacy officer of a national retailer told The Counsel.

The laws in force

The table below sets out the twenty statutes in effect, in order of their effective dates. "Threshold" is the volume of consumers whose data a business must process in a year to be covered; most laws also cover smaller businesses that derive a share of revenue from selling data. "UOOM" indicates whether the state requires controllers to honor universal opt-out mechanisms such as Global Privacy Control. "Cure" indicates whether a right to cure violations before enforcement still exists.

The six taking effect in January 2027

Six statutes enacted in the 2026 sessions take effect on January 1. Five follow the Connecticut model closely; one, in Massachusetts, borrows Maryland's data-minimization standard and adds a private right of action for intentional violations, which would make it the second state after California to permit consumer suits.

The question is no longer which states to comply with. It is which state's rule you will apply to everyone, because you cannot run twenty-six programs.

A chief privacy officer, to The Counsel

Where the laws converge

• Consumer rights. Access, deletion, correction (except Iowa and Utah), portability, and opt-outs from sale, targeted advertising and profiling with significant effects, with responses due in 45 days.
• Sensitive data. Opt-in consent before processing racial or ethnic origin, religious belief, health, sexual orientation, citizenship or immigration status, genetic and biometric data, children's data and precise geolocation; New Jersey adds financial data, and Maryland and Massachusetts bar sale of sensitive data outright.
• Data protection assessments. Required for targeted advertising, sale, profiling and sensitive data in every state except Utah and Iowa, and producible to the attorney general on request.
• Contracts with processors. Mandatory terms on instructions, confidentiality, subcontractors, deletion and audits, in every state.
• Children. Consent for known under-13s everywhere; restrictions on targeted advertising and sale for 13-to-17-year-olds in Connecticut, Colorado, Oregon, Delaware, New Jersey, New Hampshire, Montana, Maryland and most of the 2027 states.

Where they diverge

• Universal opt-out. Twelve states in force and four of the six new ones require honoring Global Privacy Control; the practical answer has been to honor it nationally.
• Data minimization. Most states require collection to be "adequate, relevant and reasonably necessary" for disclosed purposes. Maryland, and Massachusetts from January, limit collection to what is "reasonably necessary and proportionate" to provide the product the consumer requested — a standard that forbids collection for purposes the consumer did not ask for even with consent.
• Scope. Texas and Nebraska cover any business that is not a small business under federal standards; Florida covers almost no one; the rest use consumer counts from 25,000 to 175,000.
• Employees and B2B contacts. Covered only in California.
• Private suits. California for breaches; Massachusetts from January for intentional violations; nowhere else.

Enforcement

The cure periods that softened the first years are gone in Colorado, Connecticut, Oregon, Montana, Delaware, New Hampshire, New Jersey and Minnesota, and expire in Maryland in April 2027. Enforcement has followed. California's agency and attorney general have imposed penalties on an automaker over its opt-out process, on a retailer over a broken cookie banner, and on a health publisher over data shared with advertisers — the last at $1.55 million, the largest to date. Texas has sued over the sale of driving data to insurers and over children's data practices; Connecticut has settled with ticketing and retail companies over privacy notices and opt-out links. Common threads: opt-out mechanisms that do not work, privacy notices that do not match practice, and consent flows that ask for more than the law allows.

A compliance program for 2027

1. Pick a baseline. Most national companies now build to the strictest common denominator — Maryland's minimization rule, Connecticut's minors' provisions, California's rights and automated decision-making rules — and apply it everywhere, with state-specific notices layered on.
2. Honor GPC nationally. It is required in sixteen of the twenty-six and cannot be reliably geofenced.
3. Refresh assessments. Data protection assessments should cover every targeted advertising, sale, profiling and sensitive data activity, and be dated within the year.
4. Inventory. Minnesota requires one; every attorney general investigation starts by asking for one.
5. Test the opt-out. Every enforcement action to date has involved an opt-out that did not work as described.
6. Watch Massachusetts. A private right of action changes the risk calculus for every company with Massachusetts customers.

The Counsel will update this map as attorneys general issue rules under the 2027 laws. Businesses near a state's threshold should count consumers on a rolling calendar-year basis and recheck in January.

This report is for general information only and is not legal advice. Readers should consult a licensed attorney about their own circumstances. Statutory thresholds and dates are as enacted and may be amended.