Privacy Lawyer Predicts 2026 Will Be 'Year of Enforcement'
If the last three years in state privacy "was really the bill-passing phase,” then 2026 “might be the year of enforcement,” said DBR Tech Law’s Nicole Sakin McNeill on a Wednesday webinar by Privado, a privacy compliance vendor.
Sign up for a free preview to unlock the rest of this article
Export Compliance Daily combines U.S. export control news, foreign border import regulation and policy developments into a single daily information service that reliably informs its trade professional readers about important current issues affecting their operations.
One reason to think enforcement will go up is that state regulators have been hiring more staff, said the privacy lawyer. Another is that rights to cure from comprehensive privacy laws will end soon in a few states that are already members of the Consortium of Privacy Regulators, she said. Two members of that state enforcement group, Delaware and New Hampshire, have privacy laws with cure rights expiring Dec. 31. Another member, Minnesota, has a right to cure that sunsets Jan. 31.
In 2025, state enforcers largely focused on “low-hanging fruit,” such as broken opt-outs, contracting issues and technology that doesn't support disclosures, Sakin McNeill said. Another key regulatory focus was data broker accountability, and that's likely to continue in 2026, predicted the lawyer, citing California’s new Data Broker Enforcement Strike Force and the upcoming Jan. 1 launch of California’s Deletion Request and Opt-Out Platform (see 2511190041).
Rather than pass fresh comprehensive privacy laws, states in 2025 tinkered with existing statutes, said Miles Light, another DBR Tech lawyer. For example, Connecticut legislators lowered their privacy law’s applicability thresholds this year, among other significant changes, he said (see 2506260005). Moving forward, "We’re likely to see a lot of that tinkering continue.” New state comprehensive privacy laws remain possible, considering there were several states that introduced but didn’t pass such bills this year, he added.
Sakin McNeill’s crystal ball for 2026 envisions an expansion of consumer opt-out rights to include automated decision-making technology. Another big subject will likely be requiring businesses to provide consumers with a clear way to verify their opt-out status, including through universal opt-out preference signals, she said.
Light predicted more age-verification laws and expanded restrictions on targeting advertising to children so that they cover teenagers. In addition, he believes that heightened risk-of-harm protections for minors will become more common, and that some states will require consent for processing data about consumers under 15.