Careers

Diversity

With 18 offices, from New York to Los Angeles and Seattle to Orlando, we live and work in communities all over the U.S., collaborating across locations, disciplines and even borders. Our experienced, highly ranked lawyers serve businesses wherever they are and wherever they want to go.

Offices

About Us

Pages

Professionals

Thought leadership: blogs, podcasts, videos, publications, events and news

Insights

Practices & Industries

Pro Bono

Am Law 100 firm with practices in Business, Digital Assets and Data Management, Intellectual Property, Labor & Employment, Litigation and Tax.

Home | BakerHostetler

HIPAA at 21 Years of Compliance: Why the Security Rule May Be Entering a More Prescriptive Era

Insurance Class Action Report, 2026 Q1

Data Counsel

State Privacy in Brief, Q1 2026

DOL Proposes New Joint Employment Test for FLSA and FMLA

The first quarter of 2026 continued a familiar trajectory for U.S. state privacy law – new state consumer privacy laws; more amendments layered onto existing statutes; and a growing convergence among privacy, artificial intelligence and youth consumer protection. Privacy compliance now extends well beyond tracking state laws to understanding how overlapping statutes, enforcement priorities, judicial developments and consumer expectations interact to create real operational challenges and risk. In this environment, privacy compliance increasingly demands functioning operational controls, documented assessments, sound data governance and readiness for multistate scrutiny.

core/paragraph

core/heading

January 2026 marked another expansion of the U.S. state privacy law map, with the compliance bar continuing to rise. Three new comprehensive privacy laws became effective on January 1, 2026 – the <a href="https://iga.in.gov/ic/2024/Title_24/Article_15.pdf" target="_blank" rel="noreferrer noopener">Indiana Consumer Data Protection Act</a>, the <a href="https://www.ag.ky.gov/about/Office-Divisions/ODP/KCDPA/Pages/default.aspx" target="_blank" rel="noreferrer noopener">Kentucky Consumer Data Protection Act</a> and the <a href="https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm" target="_blank" rel="noreferrer noopener">Rhode Island Data Transparency and Privacy Protection Act</a>. Each closely follows the established state privacy law model and grants consumers core rights, including access, deletion, correction and opt-out rights. For companies already complying with other state consumer privacy laws, these new laws generally fit within existing compliance architectures, with some unique nuances (such as Rhode Island’s proactive requirement that companies disclose third parties they sell personal data to).

California remains a demanding jurisdiction. Amended <a href="https://cppa.ca.gov/regulations/ccpa_updates.html" target="_blank" rel="noreferrer noopener">California Consumer Privacy Act (CCPA) regulations</a> took effect on January 1, 2026, refining <a href="https://www.bakerlaw.com/insights/california-privacy-in-2026-regulations-enforcement-ai-and-more/" target="_blank" rel="noreferrer noopener">compliance expectations</a> and, in some cases, increasing operational complexity around privacy risk assessments, cybersecurity audits and automated decision-making. These changes coincide with <a href="https://privacy.ca.gov/2026/04/calprivacy-launches-statewide-roadshow-to-bring-privacy-tool-directly-to-residents/" target="_blank" rel="noreferrer noopener">the approaching launch</a> of California’s <a href="https://privacy.ca.gov/drop/" target="_blank" rel="noreferrer noopener">centralized deletion mechanism</a> for data brokers, reinforcing California’s role as both a substantive and enforcement bellwether.

The Maryland <a href="https://mgaleg.maryland.gov/mgawebsite/Legislation/Details/sb0541?ys=2024RS" target="_blank" rel="noreferrer noopener">Online Data Privacy Act</a> (MODPA) fully entered its enforcement phase as of April 1, 2026, following the expiration of a six‑month grace period. MODPA is among the nation’s strictest state privacy regimes, with substantive limits on personal data processing and reduced reliance on consent as a fallback, making Maryland a jurisdiction compliance teams should watch.

Several other states have refined their laws in ways that signal regulatory priorities. For example, effective January 1, 2026, Oregon amended its <a href="https://olis.oregonlegislature.gov/liz/2025R1/Downloads/MeasureDocument/HB2008/Enrolled" target="_blank" rel="noreferrer noopener">Consumer Privacy Act</a> to prohibit the sale of precise geolocation data and the personal data of consumers under 16 in certain circumstances. Also in January, New Jersey enacted immediately effective <a href="https://www.njleg.state.nj.us/bill-search/2024/A5017/bill-text?f=A5500&amp;n=5017_R3" target="_blank" rel="noreferrer noopener">amendments</a>, expanding HIPAA‑related exemptions and the definition of de‑identified data.

Virginia’s governor has signed <a href="https://lis.virginia.gov/bill-details/20261/SB338/text/SB338" target="_blank" rel="noreferrer noopener">amendments</a> to its <a href="https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/" target="_blank" rel="noreferrer noopener">Consumer Data Protection Act</a> banning the sale (defined in that law as only for monetary consideration) of precise geolocation data, effective July 1, 2026. Kentucky also passed <a href="https://apps.legislature.ky.gov/recorddocuments/bill/26RS/hb692/bill.pdf" target="_blank" rel="noreferrer noopener">amendments</a> that classify automatic content recognition data from smart TVs as sensitive data, with enforcement starting July 1, 2027, signaling heightened scrutiny of IoT and smart‑device analytics. Utah enacted <a href="https://le.utah.gov/interim/2026/pdf/00001601.pdf" target="_blank" rel="noreferrer noopener">targeted refinements</a>, taking effect January 1, 2027, to the Utah Consumer Privacy Act to motor vehicle manufacturers and telematics providers regardless of traditional applicability thresholds.

March 2026 added <a href="https://www.okhouse.gov/posts/news-20260323_2" target="_blank" rel="noreferrer noopener">Oklahoma</a> to the comprehensive consumer privacy law map, although Oklahoma’s law does not take effect until January 1, 2027. Alabama soon followed. Signed on April 16, 2026, the Alabama <a href="https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-eng.pdf" target="_blank" rel="noreferrer noopener">Personal Data Protection Act</a> takes effect May 1, 2027. Both laws closely align with existing state consumer privacy laws, granting residents the rights to access, correct and delete personal data, as well as to opt out of data sales and targeted advertising. For companies already complying with other state privacy laws, these additions do not introduce fundamentally new obligations, but they continue the steady expansion of multistate compliance expectations and reinforce the need for scalable, repeatable privacy programs.

Enforcement Shaping the State Privacy Landscape

Legislative activity was only part of the story in Q1. Enforcement actions during the quarter underscored that regulators are actively coordinating, increasingly assertive and focused on whether privacy rights function in practice rather than merely existing on paper. Across jurisdictions, regulators are converging on several enforcement priorities, including the protection of health data, location data and children’s and teens’ data, effective opt-out mechanisms, transparency around automated decision-making, and the monetization of sensitive data.

One of the clearest enforcement signals remains the expectation that opt-out rights be meaningful, low-friction and operative across devices and platforms. State regulators began <a href="https://oag.ca.gov/news/press-releases/attorney-general-bonta-announces-joint-investigative-privacy-sweep%C2%A0co-ct-and-ca" target="_blank" rel="noreferrer noopener">coordinated investigations</a> in late 2025 targeting companies that allegedly failed to honor universal opt-out preference signals, such as <a href="https://globalprivacycontrol.org/" target="_blank" rel="noreferrer noopener">Global Privacy Control (GPC)</a>. By early 2026, at least a dozen state statutes required recognition of such signals. <a href="https://oag.ca.gov/privacy/ccpa/gpc" target="_blank" rel="noreferrer noopener">California</a>, <a href="https://coag.gov/opt-out/" target="_blank" rel="noreferrer noopener">Colorado</a> and <a href="https://portal.ct.gov/ag/press-releases/2024-press-releases/tong-advises-connecticut-consumers-and-businesses-of-opt-out-rights-and-requirements" target="_blank" rel="noreferrer noopener">Connecticut</a> have each publicly emphasized that these signals must be honored consistently and without unnecessary friction. For companies, this means ensuring that websites, mobile apps and consent management platforms are properly configured to detect and process opt-out signals and that those mechanisms are tested end-to-end on a regular basis.

High‑profile enforcement actions continue to underscore this point. In parallel actions, California and federal regulators pursued a family entertainment and media conglomerate for alleged privacy and children’s data violations, resulting in a $2.75 million CCPA settlement related to honoring consumer rights requests (including GPC) across services and devices, and a separate $10 million civil penalty resolving Children’s Online Privacy Protection Act (COPPA) claims related to child‑directed content and data practices. Together, these actions reflect regulators’ willingness to tie technical opt‑out failures directly to monetary penalties, particularly where sensitive data is implicated.

Enforcement during Q1 also highlighted heightened scrutiny of how companies handle minors’ and student data. In March, the California Privacy Protection Agency announced a $1.1 million settlement with a <a href="https://privacy.ca.gov/2026/03/youth-sports-media-company-to-pay-1-1-million-fine-change-practices-over-privacy-violations/" target="_blank" rel="noreferrer noopener">youth sports media and ticketing platform</a> for allegedly conditioning access to services on acceptance of tracking technologies, failing to provide compliant opt‑outs and failing to honor opt‑out preference signals. The agency emphasized that businesses cannot rely on industry opt‑out tools alone and must provide their own effective opt‑out mechanisms, particularly where student and youth data is involved.

As also reflected in various recent state-level amendments, regulators are <a href="https://www.texasattorneygeneral.gov/news/releases/attorney-general-ken-paxton-opens-investigation-car-manufacturers-collection-and-sale-drivers-data" target="_blank" rel="noreferrer noopener">treating precise geolocation and connected‑device data</a> as high‑risk categories. In January, and consistent with trends we’ve been seeing at the state level, the Federal Trade Commission finalized a broad order against an automotive manufacturer over allegations that it collected and sold precise geolocation and driving behavior data without adequate disclosure or affirmative consumer consent. The order imposes long‑term restrictions on data sharing and mandates expanded consumer access, deletion and opt‑out rights, reinforcing that location data monetization will be closely scrutinized under unfair and deceptive practices theories, even outside comprehensive state privacy statutes.

Children’s and teens’ data protection also drove one of the most consequential enforcement and litigation developments of the quarter. In March, New Mexico <a href="https://nmdoj.gov/press-release/new-mexico-department-of-justice-wins-landmark-verdict-against-meta/" target="_blank" rel="noreferrer noopener">secured a $375 million jury verdict</a> against a social media company under the state’s consumer protection law, based on findings that the company misled consumers about the safety of its platforms and engaged in practices that endangered children. The verdict, one of the largest to date obtained by a state against a technology company, reflects a growing willingness by attorneys general to use existing consumer protection frameworks to challenge platform design and algorithmic features as well as representations about youth safety. That trend was reinforced the same month by a separate California jury verdict finding two social media companies liable for harms linked to the addictive designs of social media platforms and treating those platforms as defective products based on how their features were engineered to engage minors. Both companies have signaled their intent to appeal. Taken together, these cases indicate that regulators and courts are increasingly willing to look beyond content moderation and focus on product design and algorithmic engagement alongside the real‑world impacts of digital services on children and teens, significantly expanding enforcement and litigation risk for companies that serve or attract younger users.

Finally, enforcement attention expanded further into algorithmic decision‑making and pricing. In January, the New York Attorney General demanded extensive information from an online grocer regarding alleged algorithmic pricing practices, focusing on whether the company provided adequate disclosures about the use of personal data to affect prices under New York’s <a href="https://ag.ny.gov/press-release/2025/attorney-general-james-warns-new-yorkers-about-algorithmic-pricing-new-law-takes" target="_blank" rel="noreferrer noopener">Algorithmic Pricing Disclosure Act</a>. The inquiry highlights that algorithmic systems affecting consumers’ economic outcomes are rapidly becoming an enforcement priority, even where no dedicated AI statute is invoked.

Collectively, these actions reflect a clear enforcement shift toward testing operational privacy compliance. Regulators are examining whether opt‑out mechanisms function in practice, whether sensitive data use aligns with disclosures, and whether companies can demonstrate transparent, governable algorithmic systems across products and platforms.

App store <a href="https://www.bakerdatacounsel.com/blogs/an-app-developers-guide-to-app-store-age-assurance-laws/" target="_blank" rel="noreferrer noopener">age assurance laws</a> remain one of the more operationally complex privacy developments heading into mid‑2026. While much of the litigation posture remains unsettled, companies with consumer‑facing apps should not view these laws as theoretical.

Texas’ <a href="https://capitol.texas.gov/tlodocs/89R/billtext/pdf/SB02420F.pdf" target="_blank" rel="noreferrer noopener">App Store Accountability Act</a> was <a href="https://ccianet.org/news/2025/12/judge-blocks-texass-app-store-accountability-act-as-unconstitutional-speech-restriction/" target="_blank" rel="noreferrer noopener">enjoined</a> days before its January 1, 2026, effective date on First Amendment grounds and is currently on appeal. That decision has placed similar statutes under close judicial scrutiny, but it has not slowed legislative momentum.

Utah’s <a href="https://le.utah.gov/~2026/bills/static/SB0142.html" target="_blank" rel="noreferrer noopener">App Store Accountability Act</a> is scheduled to take effect May 6, 2026, following a <a href="https://ccianet.org/news/2026/02/ccia-challenges-unconstitutional-app-store-law-in-utah/" target="_blank" rel="noreferrer noopener">legal challenge</a> and last‑minute <a href="https://le.utah.gov/~2026/bills/static/HB0498.html" target="_blank" rel="noreferrer noopener">legislative amendments</a> addressing preinstalled apps, default safety settings and age‑verification flows. Importantly, those amendments defer substantive compliance obligations for app stores and developers until May 6, 2027. The amendments also eliminate enforcement authority by the Utah Attorney General while leaving a private right of action in place. Louisiana’s <a href="https://www.legis.la.gov/legis/LawPrint.aspx?d=1429255" target="_blank" rel="noreferrer noopener">Online Protections for Minors</a> law is scheduled for July 1, 2026, and California’s <a href="https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260AB1043" target="_blank" rel="noreferrer noopener">Digital Age Assurance Act</a> is slated for January 1, 2027. In February 2026, Alabama became the latest state to <a href="https://legiscan.com/AL/bill/HB161/2026" target="_blank" rel="noreferrer noopener">adopt an app store accountability</a> statute, extending common age‑verification, account categorization and parental consent requirements and also applying them to previously installed apps and existing accounts. Like California’s law, Alabama’s law takes effect January 1, 2027.

For private companies, these laws raise recurring issues, including determining whether particular apps or features are in scope, especially where minors may reasonably access them. Age‑verification and age‑estimation mechanisms themselves create sensitive data and data minimization concerns. Parental controls and teen‑specific defaults must be synchronized with state privacy rights and disclosures. Enforcement risk is unlikely to stay confined to app stores alone, particularly where developers, advertising practices or downstream data flows involving minors are implicated.

Q1 confirmed that AI governance is no longer separable from privacy compliance. In <em>United States v. Heppner</em>, for example, a federal court held that communications between a nonattorney employee and a public consumer AI tool were not privileged, focusing on how the tool was used and what the tool’s privacy notice explained to users about data uses and disclosures. Other courts have reached different conclusions on different facts, reinforcing that regulators and judges are scrutinizing transparency, notices, usage context and user expectations.

Although AI-specific legislation has encountered political headwinds, state regulators have made clear they will regulate AI through existing privacy, consumer protection, civil rights and antitrust laws. The Connecticut Attorney General’s February 2026 <a href="https://portal.ct.gov/-/media/ag/press_releases/2026/office-of-the-attorney-general---ai-advisory.pdf?rev=1b393e0f5a2e4eccb19642e4520773bd&amp;hash=0EB1AB8FF586C129315C292974C9A27A" target="_blank" rel="noreferrer noopener">guidance</a> explicitly emphasized this approach, warning that discrimination, deceptive practices and unlawful data use remain fully enforceable regardless of whether AI-specific statutes exist, particularly where consumers, children or essential services are affected.

AI compliance in 2026 resembles early-stage privacy compliance, with regulators moving from broad principles toward named risks, prohibited conduct and required governance documentation. Several state consumer privacy laws now include express rights related to profiling and automated decision-making. For companies, the takeaway is straightforward – if personal data is used to train models, power biometric systems or drive consequential decisions, regulators may ask not only whether models work but also whether consumer rights were honored, disclosures were accurate, opt-outs functioned, discriminatory effects were assessed and governance records exist.

Several significant requirements will take effect this summer, continuing the shift toward stricter oversight of minors’ data, automated processing, opt-out rights and compliance readiness. <a href="https://fpf.org/blog/the-connecticut-data-privacy-act-gets-an-overhaul-again/" target="_blank" rel="noreferrer noopener">Amendments</a> to the <a href="https://www.cga.ct.gov/2025/ACT/PA/PDF/2025PA-00113-R00SB-01295-PA.PDF" target="_blank" rel="noreferrer noopener">Connecticut Data Privacy Act</a> will expand applicability thresholds, add to sensitive data definitions, enhance consumer automated decision-making rights and require new disclosures related to the use of personal data for training large language models. Utah’s Consumer Privacy Act will <a href="https://le.utah.gov/~2025/bills/static/HB0418.html" target="_blank" rel="noreferrer noopener">add a right to correct</a> personal data and <a href="https://arkleg.state.ar.us/Bills/Detail?id=hb1717&amp;ddBienniumSession=2025%2F2025R" target="_blank" rel="noreferrer noopener">Arkansas’ Children and Teens’ Online Privacy Protection Act</a> will impose COPPA-style obligations on companies collecting data from children and teens, including limits on targeted advertising and heightened consent requirements. Louisiana’s App Store Accountability Act is scheduled to take effect. Colorado’s delayed <a href="https://leg.colorado.gov/bills/SB25B-004" target="_blank" rel="noreferrer noopener">AI law</a> may finally (<a href="https://www.justice.gov/opa/pr/justice-department-intervenes-xai-lawsuit-challenging-colorados-algorithmic-discrimination" target="_blank" rel="noreferrer noopener">or may</a> <a href="https://governorsoffice.colorado.gov/governor/news/colorado-artificial-intelligence-policy-workgroup-delivers-unanimous-support-revised-policy" target="_blank" rel="noreferrer noopener">not</a>) come online with requirements tied to bias assessments, transparency and monitoring for discriminatory outcomes, although the Colorado Attorney General has in response to pending litigation signaled no intent to enforce the law until rulemaking is complete.

Related Services

Featured Insights