Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 26 JANUARY 2026

Market Intelligence Thought Leadership Award Winner

Countdown To Compliance: Navigating 2026 Privacy Laws And Regulations

Bass, Berry & Sims PLC
Explore more from Bass, Berry & Sims PLC

U.S. states continue to crank out consumer privacy laws and regulations. Although only three new comprehensive consumer privacy laws are currently slated to take effect in 2026...

United StatesPrivacy
Faheem S. Ali
Faheem S. Ali
Alexandria Wood Davenport
Alexandria Wood Davenport
Chase Van Patten
Chase Van Patten
Roy Wyman
Roy Wyman

U.S. states continue to crank out consumer privacy laws and regulations. Although only three new comprehensive consumer privacy laws are currently slated to take effect in 2026 (compared to the eight that took effect in 2025), the year ahead will almost certainly feature additional and consequential developments as regulators introduce new rules and enforcement priorities that will significantly impact how companies handle personal data. Below is a summary of the updates that businesses should consider to update their compliance for the new year.

New State Consumer Privacy Laws

2026 will see Indiana, Kentucky, and Rhode Island's comprehensive consumer privacy laws take effect. While each of these state's new laws in many ways track the structure of existing data privacy laws (and should be a lighter compliance lift for organizations already in compliance with the Virginia Consumer Data Protection Act if adding compliance with Kentucky or Indiana's law, and the

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

SB 54 Is In Effect: What California’s New Packaging Law Means For Your Business

Although being challenged by an injunction filed on August 20, 2026, by a coalition of 17 states, California’s SB 54 Plastic Pollution Prevention and Packaging Producer Responsibility Act is now in effect, and companies that sell, distribute, import, or ship packaged products into California should be evaluating whether they have compliance obligations.
United StatesPrivacy
Wilson Elser Moskowitz Edelman & Dicker LLP
Wilson Elser Moskowitz Edelman & Dicker LLP
Article

California’s 2026 Legislative Session Wraps: A Wave Of Privacy And AI Bills Reaches The Governor, With Key Child Safety And AI Measures Signed Into Law

California's 2026 legislative session concluded with Governor Newsom signing several landmark privacy and AI bills into law, including comprehensive child safety measures, AI auditor oversight frameworks, and expanded data protection requirements. How will these new regulations reshape digital advertising, workplace AI deployment, and online platform obligations for businesses operating in California?
United StatesPrivacy
Kelley Drye & Warren LLP
Kelley Drye & Warren LLP
Article

California's Fall 2026 Privacy Roundup: Expanded CCPA Deletion Rights And More

California Governor Gavin Newsom has signed several significant privacy bills that will reshape how businesses handle consumer data, including expanded deletion rights under the CCPA, shortened data broker response cycles, and sweeping new insurance sector privacy requirements. While one landmark bill banning the sale of sensitive personal information was vetoed, the approved legislation requires companies to update their deletion workflows...
United StatesPrivacy
McDermott Will & Schulte
McDermott Will & Schulte
Article

Eleventh Circuit Developments: Decisions On Florida And Georgia Social Media/Minor Laws And New Alabama Law

Legal risk intensifies for companies offering online interactive features to minors across Georgia, Florida, and Alabama as the Eleventh Circuit vacates preliminary injunctions against state social media laws. With Florida's HB 3 and Georgia's SB 351 now enforceable and Alabama's HB 161 set to take effect January 1, 2027, businesses face divergent compliance requirements including age verification, parental consent mechanisms, and account deletion protocols.
United StatesPrivacy
Taft, Stettinius & Hollister LLP
Taft, Stettinius & Hollister LLP
Article

The Data Breach Brief: Week Of September 30th, 2026

Multiple organizations have recently disclosed significant data breaches affecting thousands of individuals, with compromised information ranging from basic contact details to highly sensitive medical records and financial data. The incidents span various sectors including healthcare, insurance, and professional services, raising questions about the scope of exposure and potential remedies for affected individuals.
United StatesPrivacy
Morgan & Morgan
Morgan & Morgan
Article

FCC Replaces TCPA “Revoke All” Rule: New Category-Specific Opt-Out Rules For Robocalls And Robotexts

The Federal Communications Commission has fundamentally altered how businesses must handle consumer opt-out requests under the Telephone Consumer Protection Act, replacing the broad "revoke all" mandate with a more nuanced, category-specific approach for informational messages. This regulatory shift allows companies to maintain separate consent tracks for different types of non-marketing communications while preserving stricter opt-out requirements for telemarketing messages. The Updated Order introduces ne
United StatesConsumer Protection
Bass, Berry & Sims PLC
Bass, Berry & Sims PLC
Article

Healthcare Trends & Transactions Q2 2026

Healthcare M&A activity maintained steady momentum through Q2 2026, driven by physician practice consolidation, AI-enabled technology acquisitions, and strategic outpatient expansion. Private equity investment persisted despite intensifying regulatory scrutiny of MSO arrangements, while digital health buyers paid significant premiums for platforms demonstrating production-grade AI capabilities and proprietary data assets.
United StatesCorporate/Commercial Law
Bass, Berry & Sims PLC
Bass, Berry & Sims PLC
Article

DOJ Continues DEI False Claims Act Enforcement With $25 Million Accenture Settlement

The Department of Justice announced a $25 million settlement with Accenture Federal Services over allegations that the company violated the False Claims Act by falsely certifying compliance with anti-discrimination requirements while allegedly using race or sex in hiring, promotion, and access to professional development programs. This marks the third major DEI-related FCA enforcement action in 2026, following similar settlements with IBM and Deloitte.
United StatesGovernment, Public Sector
Bass, Berry & Sims PLC
Bass, Berry & Sims PLC
Article

DOJ's $2 Million Honeywell Settlement Under The Civil Cyber-Fraud Initiative: What Compliance Failures Mean For Defense Contractors

The Department of Justice secured a $2 million settlement with Honeywell Aerospace for allegedly failing to comply with NIST SP 800-171 cybersecurity requirements under a Department of War contract. This case demonstrates how cybersecurity compliance failures can trigger False Claims Act liability even without an actual data breach or cyberattack, and highlights the growing role of whistleblowers in exposing contractors' gaps between contractual obligations and actual security practices.
United StatesGovernment, Public Sector
Bass, Berry & Sims PLC
Bass, Berry & Sims PLC
Article

No More SEC Responses To Rule 14a-8 No-Action Requests: What Public Companies Should Know For The Upcoming Proxy Season

The SEC's Division of Corporation Finance has announced it will no longer respond to Rule 14a-8 no-action requests, marking a significant shift in the shareholder proposal process. Companies must still comply with notification requirements under Rule 14a-8(j), but without staff guidance on exclusion decisions, they will need to rely on existing SEC guidance, precedent, and judicial decisions.
United StatesCorporate/Commercial Law
Bass, Berry & Sims PLC
Bass, Berry & Sims PLC
Article

CAS Board Raises Contract Thresholds To $35 Million And Eliminates CAS 407: What Federal Contractors Need To Know As DoW Demands Cost And Pricing Transparency

The CAS Board has raised contract thresholds to $35 million and eliminated CAS 407, fundamentally changing cost accounting requirements for federal contractors. At the same time, the Department of War is demanding unprecedented cost and pricing transparency through new memoranda requiring actual cost information for negotiations valued at $10 million or more, creating a complex landscape where contractors face fewer formal CAS requirements but heightened scrutiny of their pricing data.
United StatesAccounting and Audit
Bass, Berry & Sims PLC
Bass, Berry & Sims PLC
Article

Still Tracking, Still Suing: Website Privacy Litigation After SB 690

California's SB 690 eliminates private lawsuits under CIPA for pen register and trap-and-trace device theories, but website tracking litigation continues under federal wiretapping statutes, ECPA's crime-tort exception, and sector-specific claims. Businesses face ongoing risk from cookies, pixels, and tracking technologies that may unlawfully intercept visitor communications or collect routing data without proper consent.
United StatesPrivacy
Bass, Berry & Sims PLC
Bass, Berry & Sims PLC
Article

BIS Settlement Highlights Export Control Risks For Medical And Research Technology

The U.S. Department of Commerce's Bureau of Industry and Security reached a $1.7 million settlement with Plexon, Inc. over unlicensed exports of neural recording systems to a Chinese research institution on the Entity List. This enforcement action demonstrates that medical and research products are subject to U.S. export controls, and even EAR99 items may require licenses based on destination, end user, or end use.
United StatesInternational Law
Bass, Berry & Sims PLC
Bass, Berry & Sims PLC