2025 Year-in-Review: Privacy Law

Although another year has passed without the implementation of a comprehensive overarching federal privacy law in the United States, more states continued to enact their own privacy legislation or amend existing state statutes. We expect this trend to continue into 2026. Additionally, this area of the law, while already evolving rapidly, has taken on a new dimension recently as artificial intelligence enters the picture, with continued significant developments in AI regulation.

State Privacy Laws

New privacy laws in Delaware, Iowa, Maryland, Minnesota, Nebraska, New Hampshire, and New Jersey took effect in January 2025, followed by Tennessee in July 2025. As of January 2026, privacy laws also became effective in Indiana, Kentucky, and Rhode Island. The thresholds for businesses to be subject to these laws are similar to previously-enacted laws, e.g., Virginia, by tying coverage to the number of consumers whose personal information is processed. Nebraska, however,