The third quarter of 2026 brought revisions to existing privacy laws, the passage of new rules in several emerging areas and ongoing enforcement activity. California, Delaware and New Hampshire passed amendments to their comprehensive privacy laws, and a growing number of states passed new laws governing artificial intelligence (AI), data brokers and children’s privacy. Meanwhile, regulators continued to announce enforcement actions related to data broker registration and the protection of sensitive data, including children’s data.
This quarterly update provides a deep dive into recently enacted privacy legislation and key enforcement activity and looks ahead to what businesses should expect next.
State Privacy Law Amendments
Privacy law never seems to hold still. Several states enacted meaningful amendments to existing privacy laws this quarter, while previously enacted amendments took effect.
California lawmakers were active this quarter in passing a variety of amendments to the California Consumer Privacy Act (CCPA) and other state privacy laws; however, Gov. Gavin Newsom did not sign all the privacy bills presented to him.
First, and perhaps most crucially, California SB 690 will take effect Jan. 1, 2027, and will eliminate private claims brought pursuant to California Invasion of Privacy Act (CIPA) Section 638.51 (the law’s “pen register” and “trap and trace” provisions). The law has a two-year retroactive effect, meaning that any private claims brought pursuant to Section 638.51 alleging improper use of a pen register or trap and trace technology are invalid. While Newsom signed SB 690, he also issued a signing statement calling on the California Legislature to do more to fix the other provisions of CIPA next session, citing the need to clarify that the other sections of CIPA are not intended to apply to online tracking technologies such as cookies and pixels. In the meantime, businesses should remain vigilant with respect to controls and risk mitigation for tracking technologies and reevaluate litigation strategy for pending CIPA claims.
Second, California SB 923 was enacted this quarter and also will take effect Jan. 1, 2027. SB 923 expands the CCPA deletion right to cover personal information collected from sources other than the consumer themself. Previously, unlike most other state privacy laws, the CCPA’s deletion right applied only to personal information collected directly from the consumer. Thus, the change here mostly brings the CCPA in line with other states. SB 923 also requires online-only businesses to provide consumers with the option to submit deletion requests via both an email address and a web form.
Third, California AB 2561, also taking effect Jan. 1, 2027, prohibits operating systems and mobile applications from restoring privacy settings to their default settings without consent. This applies to location settings, opt-out configurations and any other privacy settings and will prohibit businesses from resetting settings to default even in the event of a software update.
One notable piece of legislation that did not become law this quarter is California AB 1542, which was vetoed by Newsom. AB 1542 would have imposed a categorical ban on the sale of sensitive personal information. In vetoing the bill, Newsom said it went “a step too far” and noted that California residents already have the right to limit the use and disclosure of their sensitive personal information. It will be worth watching whether this bill, or a version of it, is reintroduced in future sessions, particularly as sales of sensitive personal information are banned by privacy laws in some other states.
Although enacted in June, just before Q3, Delaware’s HB 380 is worth mentioning. The law will amend Delaware’s comprehensive privacy law, effective Jan. 1, 2027. Among the key updates, HB 380 lowers the law’s applicability thresholds, including covered businesses that process the personal data of more than 10,000 Delaware consumers. Additionally, HB 380 explicitly requires controllers to conduct due diligence on third parties to which personal data is disclosed and imposes new contractual obligations related to the disclosure of personal data to third parties. Further, HB 380 expands the existing Delaware right to access a list of categories of third parties to which personal data is disclosed – now granting consumers the right to access a list of specific third parties. HB 380 adds new risk assessment requirements and privacy rights related to profiling and automated decision-making. Finally, the amended law expands the definition of sensitive data to include national origin, physical health treatment or status and neural data generated by measuring an individual’s central nervous system, while also prohibiting the sale of sensitive data except under certain circumstances.
Also, in New Hampshire, HB 1460, effective Jan. 1, 2027, was enacted this quarter. This amendment to the New Hampshire Data Privacy Act will prohibit the sale of personal data of children under 13.
Finally, don’t forget that key amendments to Connecticut’s privacy law took effect July 1. Now in effect are Connecticut’s reduced applicability threshold (35,000 Connecticut consumers), consent requirements for processing sensitive data and engaging in targeted advertising directed at teens, additional privacy notice obligations related to AI, updated risk assessment requirements, new consumer rights and more.
AI Chatbot Laws
Two states passed AI chatbot laws in Q3 2026, with California and Hawaii enacting new laws governing these technologies. These measures include new disclosure, consumer protection and child safety requirements. California’s laws focus on both consumer-facing customer service chatbots and safeguards for children using AI companion chatbots, while Hawaii adopted a broader framework addressing AI companion chatbot disclosures and crisis response.
On Sept. 10, Newsom signed SB 1119, which requires operators of companion chatbots to perform and document a comprehensive risk assessment before making a new or substantially modified companion chatbot available to California residents. The risk assessment would evaluate the companion chatbot’s “covered harm,” which includes (1) the reasonably foreseeable physical or financial harm to a child, (2) the severe and reasonably foreseeable psychological or emotional harm to a reasonable child, (3) a highly offensive privacy intrusion, and (4) adverse discrimination. The law does not apply to chatbots that provide customer service or internal research; are integrated into video games and cannot discuss mental health, self-harm and sexually explicit conduct or maintain a dialogue unrelated to the game; or are smart speakers. The law provides a private right of action and allows a prosecutor to bring a civil action up to $5,000 per affected child for each negligent violation and up to $15,000 per affected child for each intentional violation. Most of the law’s substantive requirements take effect Jan. 1, 2027.
Newsom then signed AB 1609 on Sept. 28. AB 1609 applies to businesses generating more than $500 million in gross annual revenue and prohibits these businesses from representing that their customer service chatbot is a human. The law also requires a clear and conspicuous disclosure when a reasonable person interacting with a customer service chatbot is likely to believe it is a human. Covered businesses must also provide a method to connect a customer with a live customer service agent through commonly understood commands, prompts, menu selections or verbal requests. For online chatbot customer services and telephonic customer service platforms, covered businesses must make a good faith effort to not place the customer on hold for more than 15 minutes before connecting to a customer service agent and to ensure that cumulative hold/wait times do not exceed more than one hour total. AB 1609 goes into effect Jan. 1, 2027.
Lastly, Hawaii’s SB 3001, signed and effective July 14, establishes requirements for AI companion chatbots. When a reasonable person interacting with an AI companion chatbot could be led to believe they are interacting with a human, the operator must provide a clear and conspicuous notice indicating that the AI companion chatbot is AI and not human. Further, if the operator actually knows or is reasonably certain that a user is under 18, it must clearly and conspicuously provide this same disclosure either through a persistent visible disclaimer or at the beginning of each session, along with an hourly reminder. AI companion chatbot operators must also implement a protocol for the AI companion chatbot to respond to prompts regarding suicidal ideation or self-harm, including reasonable efforts to refer the user to crisis hotlines and services. Additionally, the operator must not provide users under 18 with rewards or points at unpredictable intervals with the intent of increasing engagement or include AI outputs that discourage the user from disengaging with the AI companion chatbot. Beginning Jan. 1, 2028, operators must submit annual reports to the Behavioral Health Administration of Hawaii’s Department of Health with (1) the number of times an operator issued its crisis intervention services provider referral, (2) the operator’s protocols to detect, remove and respond to user prompts regarding suicidal ideation or self-harm, and (3) the operator’s protocols to prohibit an AI companion’s response promoting suicidal ideation or actions or self-harm.
Children’s Protection Laws
New Jersey and California enacted new legislation to protect children’s personal data. In New Jersey, A4015 is set to become the New Jersey Kids Code Act, an age-appropriate design code that requires online businesses to design digital products and services with the safety, privacy and well-being of children in mind. The law will apply to online services operated by businesses that meet certain thresholds and that are reasonably likely to be accessed by a child (under 13) or a minor (aged 13-17). Similar to other age-appropriate design code laws, the New Jersey law requires covered businesses to configure settings to the highest level of privacy, avoid dark patterns and aggressive push notifications, minimize the collection and use of minors’ personal data, limit algorithmic recommendation engines, prevent compulsive use and provide controls to block, report and delete accounts, among other requirements.
Also in New Jersey, A5362 was introduced and would prohibit the sale of minors’ personal data, regardless of the provisions in the existing New Jersey Data Privacy Act. The bill would further require businesses, including both controllers and processors, to provide minors and their parents with the ability to request the deletion of personal data.
Finally, California’s SB 867 bans the manufacture and sale of toys designed for children under 16 that contain embedded AI chatbots until Jan. 1, 2031.
Enforcement Actions
Regulators continued to actively enforce privacy laws this quarter, paying special attention to data brokers, children’s data and sensitive data. In California, the California Privacy Protection Agency (CalPrivacy) announced data broker enforcement actions against two data broker companies. One was required to pay a $52,400 fine, while the other received a penalty of $36,400. Both enforcement actions alleged failure to register as a data broker pursuant to the Delete Act. Also, in its first enforcement under both the CCPA and the Delete Act, CalPrivacy issued a decision alleging both failure to timely register as a data broker under the Delete Act and requiring consumers to provide sensitive personal information, including partial Social Security numbers (SSN), before allowing them the ability to exercise their right to opt out of sales. The decision demonstrates that a partial SSN is still considered sensitive personal information under the CCPA and that requiring a partial SSN to honor an opt-out request will be considered unlawful because California law prohibits verification before honoring opt-out requests, and so requesting a partial SSN before honoring an opt-out request is neither reasonably necessary nor proportionate. Collectively, these actions demonstrate CalPrivacy’s continued focus on data broker registration and sensitive data processing practices.
Connecticut announced investigations into multiple companies relating to website tracking and alleged failures to protect children online. According to the Connecticut attorney general, one of the companies did not use technological tooling to monitor for underage users, relied on reactive reviews of reported or manually discovered content and conducted no audits or reviews of the effectiveness of its age determination processes. Further, it was alleged that the company advertises to children and provides “frictionless access to account creation and anonymity.” According to the Attorney General’s Office, the investigation was prompted by deficiencies in the company’s privacy notice and consumer rights mechanisms, including the failure to obtain consent before collecting sensitive data.
Further evidencing the regulatory focus on children’s privacy and online safety, Connecticut also issued an advisory letter to social media companies regarding youth privacy protections, warning of future enforcement. In the letter, the attorney general cited a focus on children’s data and online practices harmful to children, such as addictive feeds, push notifications and dark patterns.
Finally, the Florida attorney general filed a lawsuit against a popular streaming service alleging violations of Florida’s Digital Bill of Rights and unfair and deceptive acts and practices (UDAP) law. The suit alleges that the platform secretly records data about children’s usage despite marketing its “Kids Profiles” as secure, ad-free and surveillance-free. The complaint further alleges that children’s behavioral data was collected and shared with data brokers and ad networks without parental knowledge or consent. Under the UDAP law, Florida also alleges that the platform’s autoplay feature removes natural stopping points between episodes in an effort to manipulate children’s behavior and bypass parental screen-time controls.
These actions demonstrate regulators’ ongoing focus on children’s privacy and online safety, sensitive data and data brokers, all trends that we expect to continue in the next quarter.
Looking Ahead
Our Q1 and Q2 state privacy blog posts also provide a detailed overview of comprehensive privacy laws taking effect in 2027, including in Oklahoma, Alabama, Louisiana and Vermont. While these laws share much in common with existing U.S. comprehensive privacy frameworks, we recommend revisiting those posts to learn more about the unique provisions that may warrant extra attention.
Businesses should also closely monitor regulators’ growing focus on data brokers, third-party data sharing and privacy rights mechanisms. Throughout 2026, CalPrivacy continued its aggressive enforcement campaign against data brokers for alleged violations of the Delete Act, data broker registration obligations and privacy rights requirements. These actions signal that regulators are increasingly scrutinizing not only whether companies honor consumer rights but also how those rights are exercised in practice. As California’s Delete Request and Opt-Out Platform becomes operational and additional states continue adopting data broker laws, organizations should evaluate their data sharing ecosystems, vendor relationships, consumer request procedures and data minimization practices before enforcement expectations further mature.
Finally, the next quarter is likely to bring heightened scrutiny of children’s privacy, sensitive data, online tracking technologies and AI-driven profiling activities. Recent enforcement actions demonstrate regulators’ increasing willingness to challenge advertising practices, age-assurance measures, youth engagement and the processing of sensitive personal information. Privacy leaders should prioritize children’s privacy programs, vendor and adtech reviews, AI governance frameworks, sensitive data controls and privacy-by-design initiatives, as these areas appear most likely to attract regulatory attention and scrutiny in the coming months.
