A new wave of comprehensive state privacy laws is on the horizon for 2026 and beyond. Alabama, Louisiana, Oklahoma, and Vermont have each enacted consumer data privacy statutes that will come online over the next few years, extending the patchwork and raising the stakes for multi‑state compliance programs.

Below, we provide the general thresholds for each law and a few additional key takeaways.

Alabama

Alabama’s Personal Data Protection Act (APDPA) takes effect May 1, 2027. We previously discussed Alabama’s new privacy law in detail here, but a few key takeaways are below:

  • Applies to businesses that (1) control or process personal data of more than 25,000 consumers (excluding data processed solely to complete a payment transaction), or (2) derive more than 25% of gross revenue from the sale of personal data.
  • Provides familiar consumer rights (access, correction, deletion, portability, and opt‑outs for targeted advertising, sale, and profiling).

Louisiana

Louisiana’s Data Privacy Act takes effect January 1, 2027. A few key takeaways, including a California style revenue threshold, are below:

  • Applies to entities doing business in Louisiana that satisfy one or more of the following thresholds: (i) have annual gross revenue in excess of $25 million; OR (ii) annually buy, receive for the business’s commercial purposes, sell, or share for commercial purposes the personal information of 75,000 or more consumers, households, or devices; OR (iii) derive 50% or more of their annual revenue from selling consumers’ personal information.
  • Louisiana residents have the following rights: (a) know, (b) correct, (c) delete, (d) portability, and (e) opt out of targeted advertising, sale of personal data, and profiling.
  • Enforced by the Attorney General, with a 30‑day cure period from January 1 through July 31, 2027.

Oklahoma

The Oklahoma Data Privacy Act takes effect January 1, 2027. We previously discussed Oklahoma’s new privacy law in detail here, but a few key takeaways are below:

  • The law applies to entities that conduct business in Oklahoma or target products or services to Oklahoma residents and that, during a calendar year, either (i) process personal data of at least 100,000 consumers, OR (ii) process personal data of at least 25,000 consumers while deriving more than 50% of gross revenue from the sale of personal data.
  • Oklahoma residents have the following rights: (a) know, (b) correct, (c) delete, (d) portability, and (e) opt out of targeted advertising, sale of personal data, and profiling.
  • The Attorney General holds enforcement authority. Before filing suit, the Attorney General must provide 30 days’ written notice of the alleged violation. A business that cures the violation within that window and submits a written commitment to compliance may avoid an action.  

Vermont

The Vermont Data Privacy and Online Surveillance Act takes effect January 1, 2028. A few key takeaways, including low thresholds of applicability and the right to request a list of third parties to whom business has disclosed the consumer’s personal data, are below:

  • Applies to businesses that conduct business in Vermont or that target products or services to Vermont residents, and that meet one of the following thresholds: (i) control or process the personal data of 35,000 or more Vermont residents; (ii) control or process sensitive data of at least 3,000 Vermont residents; or (iii) offer for sale in trade or commerce the personal data of 3,000 or more Vermont residents.
  • Vermont residents have the following rights: (a) access, (b) correct, (c) delete, (d) portability, (e) opt out of targeted advertising, sale of personal data, and profiling; (f) question profiling; and (g) obtain a list of third parties.
  • Includes separate protections for consumer health data, which is “any personal data that a controller uses to identify a consumer’s physical or mental health condition, diagnosis, or status, including gender-affirming health data and reproductive or sexual health data.”
  • Enforced exclusively by the Vermont attorney general. During the period beginning January 1, 2028, and ending on June 30, 2029, the Attorney General must issue a notice of violation to the alleged violator if the Attorney General determines that a cure is possible. If the person fails to cure the violation within 60 days after receipt of the notice of violation, the Attorney General may bring an action.

To keep up with the latest for the latest in privacy, security, and artificial intelligence legal news, you can follow us here at Privacy and Data Security Insights and on LinkedIn. Should you need counsel in any of these areas, Taft’s Privacy, Security & AI attorneys are ready to assist.