Key players include state legislatures passing the laws, attorneys general for enforcement (e.g., fines of $7,500–$20,000 per violation, escalating for minors or per consumer), and agencies like California's CPPA (first enforcement actions in 2025 against Tractor Supply, Honda).[1][4][5][6] Businesses face compliance burdens for data inventories, consent mechanisms, processor agreements, and Global Privacy Control (GPC) recognition, amid multi-state AG sweeps on opt-outs.[2][5][6] No federal law exists, forcing a patchwork approach modeled partly on Virginia's framework.[2][3]
This stems from California's 2018 CCPA pioneering state-level protections, with steady growth (no new laws in 2025, first pause since 2018) amid rising public demand for data control post-high-profile breaches and AI concerns.[3][6] Timeline: Laws signed pre-2026; Indiana/Kentucky/Rhode Island effective Jan 1; Oregon cure period ends; California assessments due 2028.[1][4]
Newsworthy as these activations demand immediate multi-state compliance amid intensifying enforcement (e.g., 2025 GPC sweeps by CA/CO/CT AGs/CPPA, looming audits on minors' data/AI), amplifying the "compliance tightrope" without federal uniformity—especially timely days after Jan 1 amid 16 states eyeing bills.[3][5][6][7]