State Privacy Law

State of play.

• Courts are now examining what embedded tracking technologies actually do operationally, not just what privacy policies say. Federal courts have allowed CIPA and wiretap claims against Shopify's checkout tools and the NBA's cookie banner to proceed, with the NBA case raising the specific question of whether consent banners stop tracking in practice (→ Courts Reopen Shopify Privacy Suit, Probe NBA’s Cookie Tracking Practices).
• A 15-state coalition has sued to block federal agencies from accessing Medicaid and TANF beneficiary data for immigration enforcement, framing state-held social services data as outside the scope of permissible federal repurposing—a structural challenge to federal data-sharing authority with no settled precedent (→ Washington se suma a demanda contra HHS por compartir datos médicos con DHS).
• Connecticut's CTDPA overhaul is now in force, with applicability thresholds collapsed to 35,000 residents or a single resident's sensitive data, new categorical bans on minors' data use, and LLM training disclosure requirements—making prior compliance assessments obsolete .
• The Seventh Circuit has ruled that marketing texts do not trigger the TCPA's federal Do-Not-Call provisions, sharpening a circuit split and redirecting enforcement exposure to state telemarketing statutes that are often stricter .
• For counsel advising multistate operators, the practical baseline is that state enforcement remains the primary risk vector—Connecticut's expanded regime is immediately operative, CIPA litigation is accelerating against high-traffic consumer sites, and the federal-state data-sharing litigation will reshape how health and welfare data flows between state programs and federal agencies.

Where things stand.

• Twenty-one-plus states have enacted comprehensive privacy statutes, covering roughly 46 percent of the U.S. population. Indiana, Kentucky, and Rhode Island activated January 1, 2026; Connecticut's expanded CTDPA took effect July 1, 2026; Alabama (APDPA) follows May 1, 2027 .
• Connecticut now ranks among the nation's strictest privacy regimes. The revised CTDPA covers any business selling data of even a single resident, expands sensitive data to include neural data, financial account information, and biometric inferences, imposes categorical bans on minors' data for targeted advertising, and requires disclosure of LLM training use; data broker registration begins January 1, 2027 and profiling impact assessments apply to processing activities created after August 1, 2026 .
• State AGs are the primary enforcement engine, and multistate coalitions are the emerging enforcement vehicle. Most state regimes vest exclusive enforcement authority in the AG; cure periods are narrowing or eliminated; California's CPPA has launched a dedicated Audits Division signaling proactive enforcement ahead of formal certification deadlines (→ Washington se suma a demanda contra HHS por compartir datos médicos con DHS).
• CIPA and state wiretap analogs are the primary private litigation vehicle for tracking technologies. CIPA's $5,000-per-violation statutory damages with no actual-harm requirement drives mass arbitration and class action filings; the NFL.com case—182 trackers loading before opt-in—represents one of the highest tracker counts documented in recent CIPA actions; courts have denied class certification in some pixel-tracking cases while upholding claim viability in others (→ Courts Reopen Shopify Privacy Suit, Probe NBA’s Cookie Tracking Practices).
• Connected TV and ACR-based data collection remain an active enforcement and litigation target. The Sony/Samba TV class action was voluntarily dismissed with undisclosed terms, but Texas AG enforcement against Sony and other TV makers over ACR practices remains active; the dismissal does not resolve underlying exposure for smart TV manufacturers .
• BIPA remains the highest-stakes biometric privacy statute, now with restructured damages. The Seventh Circuit's Clay decision caps recovery at one award per person per collection method, eliminating per-scan multipliers; Illinois state courts are not bound by this ruling and may diverge on retroactivity .
• Geolocation data has moved from consent-based to ban-based in multiple states. Virginia enacted an outright ban on the sale of precise geolocation data effective July 1, 2026, joining Maryland and Oregon; Virginia's narrow "sale" definition may leave non-monetary data-sharing arrangements unaddressed .
• Children's and minors' data is the fastest-moving substantive category. The EU Commission has issued preliminary DSA findings against TikTok's default minor account settings; Connecticut's CTDPA amendments impose categorical bans on minors' data for targeted advertising; age verification mandates are proliferating across at least half of U.S. states despite documented technical ineffectiveness .
• Federal preemption is on the table but structurally stalled. The SECURE Data Act would preempt most state privacy laws but lacks Democratic support and faces a history of failed federal privacy efforts; if enacted, it eliminates California's private right of action and CPPA enforcement infrastructure .

Latest developments.

• Federal court allows CIPA and wiretap claims against Shopify's checkout tools and the NBA's cookie banner to proceed, with courts scrutinizing operational tracker behavior rather than privacy policy language (→ Courts Reopen Shopify Privacy Suit, Probe NBA’s Cookie Tracking Practices).
• Washington AG joins 15-state coalition suing HHS and DHS to block unrestricted ICE access to Medicaid beneficiary health data (→ Washington se suma a demanda contra HHS por compartir datos médicos con DHS).
• Washington AG separately joins multistate suit challenging USDA demand for TANF recipient personal data, alleging unlawful repurposing of program-restricted information .
• New Jersey AG joins 24-state coalition suing to block Trump administration TANF data-sharing rule that would expose SSNs, addresses, immigration status, and family data to DHS .
• Connecticut's CTDPA amendments took effect July 1, 2026, collapsing applicability thresholds, expanding sensitive data categories, and imposing categorical bans on minors' data use and LLM training disclosure requirements .
• Seventh Circuit holds in Steidinger v. Blackstone Medical Services that marketing texts do not qualify as "telephone calls" under the TCPA's federal DNC provisions, sharpening a circuit split and redirecting exposure to state telemarketing statutes .
• NFL.com hit with CIPA class action alleging 182 third-party trackers loaded before opt-in, invoking CIPA sections 631(a) and 638.51(a), the federal Wiretap Act, CDAFA, and California's UCL .
• Sony/Samba TV class action voluntarily dismissed with undisclosed terms; Texas AG ACR enforcement against Sony and other TV makers remains active .
• EU Commission issues preliminary DSA findings that TikTok's default minor account settings violate the Digital Services Act, with potential fines up to 6% of global revenue .

Active questions and open splits.

• Whether consent banners constitute "meaningful consent" when trackers load before or despite opt-out. The Shopify and NBA cases both turn on operational tracker behavior versus policy representations; courts have not yet defined what technical evidence proves or disproves effective consent, and the answer will set the standard for every high-traffic consumer site (→ Courts Reopen Shopify Privacy Suit, Probe NBA’s Cookie Tracking Practices).
• Whether federal agencies can compel states to disclose beneficiary data beyond program administration requirements. The Medicaid/HHS and TANF/USDA multistate suits present the same structural question from two directions; a ruling for the states would force HHS and USDA to revise data-sharing policies across all state-administered benefit programs (→ Washington se suma a demanda contra HHS por compartir datos médicos con DHS).
• Whether the Seventh Circuit's TCPA text-as-not-a-call ruling will be adopted by other circuits or the FCC will act to resolve the split. The FCC has previously stated autodialed texts are "calls" subject to the statute; the Steidinger ruling conflicts with that position and with other judicial authority, leaving national marketers in a fragmented compliance posture .
• Whether Illinois state courts will apply the BIPA damages cap retroactively. The Seventh Circuit's Clay ruling binds federal courts in Illinois, Indiana, and Wisconsin; Illinois state courts are not bound and may reach a different conclusion, preserving a two-track litigation landscape for plaintiffs' counsel .
• How states will define "sale" for geolocation ban purposes. Virginia's ban covers only monetary exchanges, potentially leaving non-monetary data-sharing arrangements—common in ad-tech—unaffected; California, Massachusetts, Vermont, and Washington have comparable legislation advancing with differing definitions .
• Whether age verification mandates will survive constitutional challenge. Security and privacy researchers have documented that age verification systems are technically ineffective and create centralized breach risks; legislatures are proceeding regardless; First Amendment challenges have succeeded in some jurisdictions while others have restructured enforcement to moot standing .
• What the CPPA Audits Division will actually examine—and when. The agency has not disclosed which companies face audits first or what specific compliance gaps trigger enforcement action; the division's stated focus on AI tool governance and surveillance pricing signals enforcement priorities beyond traditional consumer rights workflows .

What to watch.

• Injunction proceedings in the Medicaid/HHS and TANF/USDA multistate suits—whether courts block federal data transfers pending full judicial review will determine whether state-held beneficiary data remains protected during the litigation and set a structural precedent for federal data access authority (→ Washington se suma a demanda contra HHS por compartir datos médicos con DHS).
• Connecticut CTDPA data broker registration deadline of January 1, 2027—the first hard compliance trigger under the expanded regime; enforcement posture of the Department of Consumer Protection will signal how strictly the lowered thresholds are applied .
• Class certification proceedings in the NFL.com CIPA case—whether courts certify the class and how they calculate per-violation damages will signal enforcement appetite for high-tracker-count consumer sites and calibrate settlement leverage across the CIPA filing wave .
• EU Commission final compliance decision against TikTok under the DSA—a formal violation finding would establish the regulatory template for algorithmic recommendation systems and default privacy settings affecting minors across all platforms operating in Europe .
• CPPA Audits Division's first enforcement targets—which sectors and compliance gaps draw early action will set the practical standard for what "audit-ready" means under the CCPA .
• Whether any circuit court takes up the TCPA text-as-call question en banc or the FCC issues clarifying guidance resolving the Steidinger split .