Privacy In Bloom: Four States Reshape The Data Protection Landscape This Spring

Spring 2026 has been a busy season for state privacy legislation. Oklahoma and Alabama each enacted comprehensive privacy laws — bringing the national total to twenty-one — while Virginia moved to prohibit the sale of precise geolocation data, Kentucky expanded its definition of sensitive data to cover automated content recognition technology, and California’s privacy enforcement agency signaled support for a bill that would ban the sale or sharing of sensitive personal information under the California Consumer Privacy Act (“CCPA”). From new consumer rights taking root in the South to geolocation restrictions blooming on the East Coast and a potentially sweeping amendment budding out West, businesses that process personal data have no shortage of new developments to track. Below, we summarize each of these developments and highlight key compliance considerations.