After a year in which no US state passed a comprehensive privacy law, 2026 has produced four. Louisiana’s and Oklahoma’s laws take effect on January 1, 2027. Alabama’s follows on May 1, 2027, and Vermont’s on January 1, 2028.
That brings the count of states with comprehensive privacy laws to 23 (see where each one stands on our US state privacy law tracker). Each new law brings new obligations to give consumers more control over how their data is used.
For a consent and preference management program, the question is what has to change in the systems that capture and act on consumer choices.
What the Four Laws Have In Common
All four laws follow the model most states have adopted since the Virginia Consumer Data Protection Act (VCDPA) passed in 2021.
Consumers get the right to access, correct, and delete their data, and to opt out of the sale of personal data, targeted advertising, and profiling that produces legal or similarly significant effects.
Controllers must obtain consent before processing sensitive data, such as health, biometric, and precise location information. They must also limit the collection of personal data to what is reasonably necessary for the disclosed purpose.
Each law sets its own applicability thresholds. Louisiana is the only one of the four with a general revenue test: any business with more than $25 million in annual gross revenue is covered. That pulls in companies that would fall below the consumer-count thresholds elsewhere.
Louisiana and Oklahoma: January 1, 2027
Louisiana’s and Oklahoma’s laws arrive together in January 2027, and they require similar preparation. That includes documented data protection assessments for higher-risk processing. In both states, this covers targeted advertising, the sale of personal data, the processing of sensitive data, and profiling that presents a risk of harm to consumers.
Both give businesses a 30-day cure period, which gives controllers a chance to fix violations after receiving notice. Oklahoma’s has no end date. Louisiana’s expires on July 31, 2027, after which the state attorney general can proceed straight to enforcement.
Louisiana also lets consumers opt out through a technology-based signal such as Global Privacy Control (GPC), a browser setting that tells every site a person visits that they opt out of sale and targeted advertising.
Alabama: May 1, 2027
Alabama’s law, the Alabama Personal Data Protection Act (HB 351), is lighter than the others in one respect: it does not require controllers to conduct or document data protection assessments.
However, Alabama keeps the core consumer rights and the consent requirement for sensitive data. It also gives a 45-day cure period that does not expire.
The lighter paperwork should not be read as lighter obligations on consent. Opt-out rights still have to work properly, and consent for sensitive data must still be recorded and honored.
Vermont: January 1, 2028
Vermont’s Data Privacy and Online Surveillance Act, signed on June 16, 2026, is the most demanding of the four laws and the one that most affects consent tooling.
The law applies to any business that processes the sensitive data of 3,000 or more Vermont consumers. That is a much lower bar than its 35,000-consumer threshold for personal data generally.
Selling consumer health data requires opt-in consent. The law also bans the use of a geofence within 1,850 feet of a health care facility to identify or message people based on their health data.
Businesses must honor opt-out preference signals such as GPC.
Privacy notices must also say whether personal data is used to train large language models. When a notice changes materially, consumers must be told and given a reasonable opportunity to withdraw consent for the new processing.
The Stakes Of the Next 14 Months
Don’t treat each new law as a separate project. The obligations overlap heavily, and most of the differences come down to a handful of settings.
Three things change between now and January 2028:
- Louisiana’s and Oklahoma’s laws take effect on the same day, January 1, 2027, both with assessment requirements.
- Alabama follows four months later with the same core consumer rights and a shorter list of documentation duties.
- Vermont arrives in January 2028 with a lower threshold for sensitive data, mandatory GPC recognition, and new disclosure duties around AI training and health data.
Each adds consumers whose choices must be captured and acted on under slightly different rules.
A state law tells you which choices you must offer and how quickly you must act on them. Consent and preference management is how you deliver on that at scale.
If you manage consent as one record, with rules configured per jurisdiction, each new law becomes a configuration change. Consumers in that state then get the treatment they are entitled to on the day the law takes effect.
To see effective dates and status for every state in one place, use the Syrenis US state privacy law tracker.