State privacy laws and what they mean for business insurance

There is still no single U.S. privacy statute for businesses. Instead, about 20 states had comprehensive consumer privacy laws in force as of October 2026, and four more are enacted but not yet effective. If you collect personal data from residents of those states and cross a statute's thresholds, you owe them access, deletion and opt-out rights, and you answer to the state attorney general (or, in California, the privacy agency) when something goes wrong.

For insurance, this matters in three places: whether your cyber policy responds to regulatory proceedings, whether the policy excludes the "wrongful collection" claims these laws invite, and what an underwriter asks about your data practices. This guide is general information, not legal advice; the statutes differ in detail, so your counsel and your state attorney general's site are the places for specifics.

Comprehensive state laws in force (October 2026)

Counts vary by tracker because sources differ on whether Florida's narrow law and the older California statute count as "comprehensive." The IAPP's US State Privacy Legislation Tracker is the standard reference, but its detail sits behind a membership; the list below follows the statutes and law-firm summaries and should be checked against your state attorney general's page.

The three January 2026 laws are confirmed by TrustArc and Koley Jessen's 2026 summaries. Earlier effective dates come from the statutes themselves as widely reported.

Enacted but not yet effective

According to law-firm summaries (Troutman, Hunton, Baker Donelson), with signing dates checked against the legislatures' bill records for Oklahoma, Louisiana and Vermont:

• Oklahoma (SB 546, approved by the Governor March 20, 2026 (bill history)): effective January 1, 2027.
• Louisiana (Data Privacy Act, SB 386, signed May 29, 2026 as Act 502 (bill history)): effective January 1, 2027, with a 30-day cure period through July 31, 2027.
• Alabama (Personal Data Protection Act, HB 351, signed in April 2026): effective May 1, 2027, with a 45-day cure right.
• Vermont (Data Privacy and Online Surveillance Act, S.71, signed June 16, 2026 as Act 145 (bill status)): effective January 1, 2028.

Alabama's signing date and the Oklahoma and Vermont effective dates are still secondary-source reporting; confirm them against the enacted text.

Who is covered

Most laws apply to a business that does business in the state or targets its residents and meets a volume trigger, typically processing personal data of a set number of consumers (many use 100,000) or deriving a share of revenue from selling personal data. Lower thresholds exist: Connecticut's July 1, 2026 amendments cut its main trigger from 100,000 to 35,000 consumers and added triggers with no minimum for businesses that process sensitive data or sell personal data (per law-firm summaries of SB 1295). Texas applies to many businesses that are not small businesses as defined by the SBA, which matters for the smallest firms.

Common exemptions, which differ by state:

• Gramm-Leach-Bliley data and entities. Many laws exempt financial institutions or information subject to GLBA. Insurers and producers often find some or all of their consumer data carved out, but a few states exempt only the data, not the company.
• Employee and business-contact data. Most laws exclude employee and B2B data. California is the notable exception; it extends rights to employees and business contacts.
• Nonprofits and government. Treatment varies widely.
• HIPAA-covered data. Usually exempt, with entity-level exemptions in some states.

Whether you are in scope is a legal question. A business with customers in many states often applies the strictest standard everywhere rather than tracking each exemption.

What the laws require

The common core, with state variations:

1. Consumer rights: access, correction, deletion, portability and opting out of sale, targeted advertising and certain profiling.
2. Privacy notices describing what you collect, why and with whom you share it.
3. Data protection assessments for high-risk processing such as sensitive data.
4. Processor contracts that bind vendors to your instructions.
5. Opt-in consent for sensitive data in most states.

Enforcement is by the attorney general in nearly every state, usually with a cure period that some states have phased out. One summary puts penalties at up to $7,500 per violation in Indiana and Kentucky, and $10,000 in Rhode Island with no cure period. California's agency has its own enforcement process. Because these are per-violation penalties, a data practice affecting thousands of consumers can multiply quickly.

How this connects to your insurance

Regulatory coverage in cyber policies

Most standalone cyber policies have a regulatory defense and penalties insuring agreement. It generally pays defense costs for an attorney general inquiry and may pay fines and penalties only where insurable by law and where the policy grants it; see are fines, penalties and punitive damages insurable? and payment card fines and assessments: does cyber insurance pay?. Check three things in your policy: whether privacy-law violations are within the definition of a regulatory proceeding, whether fines and penalties are covered or sublimited, and whether the insurer must have consented to the investigation response.

Exclusions to look for

Privacy-law claims often arrive as class actions, not just regulatory actions. Many cyber and E&O forms exclude wrongful collection, unlawful use of tracking technologies, or violations of specific statutes. The wrongful-collection and biometric exclusions are the ones that surprise policyholders; read common cyber insurance exclusions and Biometric privacy (BIPA) lawsuits and insurance. A commercial general liability policy's personal and advertising injury coverage usually does not respond to data privacy claims, because standard ISO forms typically carry electronic-data and access-or-disclosure exclusions (the endorsement names vary by edition).

The underwriting conversation

Expect application questions on what personal data you hold, how many records, whether you sell or share it, whether you use pixels and trackers on your website, and whether you have a documented incident response plan. Our the cyber insurance application: what underwriters ask and how to answer guide walks through the questions, and the cyber insurance readiness checklist helps you prepare. Breach notification is a separate regime; see data breach notification laws and what they cost.

A practical checklist

Hypothetical example: a 40-person online retailer in Ohio sells to customers in Texas, California and Virginia.

1. List which states' residents you have data on and compare counts to each law's threshold.
2. Map the personal data you collect, including website trackers and vendor sharing.
3. Post a notice that matches your practices, and set up a way to receive requests.
4. Review vendor contracts for processor terms.
5. Ask your broker whether the cyber policy covers regulatory proceedings, privacy-law fines where insurable, and wrongful collection, and what the sublimits are.
6. Re-check each January and July, when many laws take effect; use workers' comp and benefits requirements by state to find your state's department of insurance and attorney general.

Key takeaways

• About 20 states have comprehensive privacy laws in force as of October 2026, and Oklahoma, Louisiana, Alabama and Vermont have enacted laws effective from 2027 to 2028.
• Thresholds, exemptions (especially for GLBA-covered entities) and cure periods differ by state; do not assume one state's rule is national.
• Cyber policies may cover defense of regulatory proceedings, but fines and wrongful-collection claims depend on wording and law.
• Underwriters increasingly ask about data inventories, trackers and sale of data.
• Verify current status on your state attorney general's site and with counsel.

Sources: IAPP US State Privacy Legislation Tracker; TrustArc, new 2026 state privacy laws; Koley Jessen; Wiley on Connecticut amendments; Troutman on Louisiana.