US State Consumer Privacy Law Update: Notable Changes Across Existing Frameworks

As the number of states with comprehensive consumer privacy laws continues to grow, legislatures in states with existing laws are increasingly refining their privacy frameworks. In 2026, Connecticut, Maryland, New Hampshire, New Jersey, and Virginia, saw significant privacy-law updates—through a mix of recently enacted amendments and previously enacted provisions that became effective this year. Although many of these changes clarify existing obligations, others impose new requirements, expand consumer rights, or address emerging technologies, such as artificial intelligence. Organizations that currently maintain privacy compliance programs should evaluate whether these amendments require updates to their programs.

Four states also recently adopted comprehensive consumer privacy laws. Read more in our July 28, 2026 LawFlash.

CONNECTICUT

Last year, Connecticut significantly expanded the Connecticut Data Privacy Act (CTDPA), and most of these amendments took effect on July 1, 2026.

Expanded Applicability Thresholds

Among the most significant changes, the amendments significantly expand the CTDPA’s scope by lowering the applicability thresholds. The law now applies to persons that (1) conduct business in Connecticut or produce products or services targeted to Connecticut residents, and (2) during the prior calendar year, (i) controlled or processed the personal data of at least 35,000 Connecticut consumers (reduced from 100,000 Connecticut consumers), (ii) processed the sensitive data of any number of Connecticut consumers, or (iii) offered Connecticut consumers’ personal data for sale in trade or commerce. Notably, the sensitive data and sale triggers no longer include a minimum processing threshold.

Expanded Consumer Rights

Consumers may request a list of third parties to whom their personal data has been sold. In addition, as part of an access request, Connecticut residents may receive access to inferences derived from their data.

Enhanced Data Minimization Requirements

Controllers in Connecticut must ensure that collection is “reasonably necessary” and “proportionate” to the disclosed purpose for which such data is processed. Additionally, controllers processing sensitive data must now obtain consent and ensure the processing is “reasonably necessary in relation to the purposes for which such sensitive data [is] processed[.]”

Expanded Definition and Restrictions of Sensitive Data

The amendment expands the definition of “sensitive data” to encompass additional types of data, including, but not limited to, government-issued identification numbers (i.e., Social Security numbers, passport numbers, driver’s license information). The sale of sensitive data is prohibited without first obtaining the consumer’s consent.

Additional Privacy Notice Requirements

Privacy notices must disclose whether the entity collects, uses, or sells personal data to train large language models.

Additional Data Impact Assessment Requirements

Controllers are now required to conduct a data impact assessment if they engage in profiling for the purposes of “making a decision that produces any legal or similarly significant effect concerning a consumer[.]”

DATA SALE PROHIBITIONS

Connecticut, Maryland, New Hampshire, New Jersey, and Virginia recently amended their privacy laws to prohibit or further restrict the sale of certain categories of personal data, reflecting a broader trend toward heightened protections for sensitive information.

Connecticut and Virginia

Both states now prohibit the sale of precise geolocation data, joining Maryland and Oregon. Virginia’s amendment took effect on July 1, 2026, and Connecticut’s prohibition will take effect on October 1, 2026.

Maryland

Effective July 1, 2026, Maryland amended the Maryland Online Data Privacy Act to prohibit controllers from knowingly selling personal data of a consumer to a governmental entity that, within the preceding six months, engaged in or supported civil immigration enforcement through the provision of personnel or material resources.

While this amendment may be limited in practice, it is likely to be a focus of state enforcement, so organizations that disclose information to government agencies should closely review their practices. Note that Maryland also continues to prohibit the sale of sensitive data and the sale of personal data of consumers whom the controller knew or should have known to be under the age of 18.

New Jersey

New Jersey amended its privacy law to prohibit the sale of sensitive data. The prohibition took effect immediately upon enactment on June 30, 2026.

New Hampshire

New Hampshire amended its law to prohibit the sale of children’s personal data. The amendment will take effect on January 1, 2027.

HOW WE CAN HELP

Morgan Lewis is prepared to guide companies and institutions of all sizes through the challenges they face in this new regulatory environment. We closely follow developments in all 50 states as data privacy legislation is proposed, enacted, and amended. Our lawyers assist clients in virtually all the major industries around the globe in understanding how these critical changes affect their businesses and how to navigate the changing data privacy landscape.