4 New State Privacy Laws of 2026: Oklahoma, Alabama, Louisiana and Vermont

The first question is not what these laws say. It is whether they apply to you at all. Every one of them has a threshold, and a typical blog or small online store sits below it. The table below gives you the answer in thirty seconds. We read each enacted bill to build it.

The four laws at a glance

All four are enforced by the state Attorney General. None gives consumers a private right to sue under the privacy law itself.

Oklahoma: the high threshold law

Oklahoma's Consumer Data Privacy Act follows the Virginia model closely. With a 100,000 consumer threshold, it mostly reaches larger companies. If you do cross it, you need the usual privacy notice (categories of data, purposes, third parties, how to exercise rights), a way to opt out of targeted advertising and sale, consent before processing sensitive data, and data protection assessments for high risk processing. The Attorney General must give you 30 days written notice to fix a problem before suing, and penalties reach $7,500 for each violation.

Louisiana: two sentences you may have to copy word for word

Louisiana is the only one of the four with a revenue test. Any business with more than $25 million in annual revenue that does business in the state is covered, however few Louisiana residents it serves.

Louisiana also has the most concrete notice rule. If you sell sensitive personal data, your privacy notice must carry this exact line:

And if you sell biometric data, this one:

Texas uses almost the same wording, so one line can serve both states. Violations count as unfair and deceptive trade practices. Between 1 January and 31 July 2027 the Attorney General has to give 30 days written notice first, and a business that fixes the problem and says so in writing avoids an investigation. After July 2027 that grace period ends.

Alabama: low threshold, big penalty

Alabama is the one small and mid sized sellers should watch. The law covers anyone processing the data of more than 25,000 Alabama consumers, and data used only to complete a payment does not count toward that number. It also covers any business earning more than 25% of its gross revenue from selling personal data, whatever its size.

The penalty is up to $15,000 per violation, about double the common figure in other states. There is a permanent 45 day cure period, so a business that fixes an issue after notice and confirms it in writing cannot be sued for it.

Vermont: the strictest of the four

Vermont's Data Privacy and Online Surveillance Act takes effect last, on 1 January 2028, and asks the most. Its thresholds are low (35,000 consumers, or sensitive data of just 3,000). It limits collection to what is reasonably necessary and proportionate, requires consent before processing or selling sensitive data, and requires data protection and profiling assessments. Your privacy notice will need to say whether personal data is collected, used or sold to train large language models. Consumer health data rules apply more broadly than the main thresholds.

What to change in your privacy policy

1. Check the thresholds first. Count consumers per state from your analytics or customer list. If you are below every threshold, you have nothing new to do for these four laws.
2. Add the four states to your rights section if you are covered: access, correction, deletion, portability and opt out of targeted advertising and sale.
3. Copy Louisiana's notice lines exactly if you sell sensitive or biometric data.
4. Say whether data trains AI models. Vermont will require it from 2028, and it is already good practice.
5. Offer an appeal process for refused requests, and answer requests within 45 days.

If you need a fresh policy, the free privacy policy generator writes one around your answers, and the CCPA privacy policy generator covers California. For the laws that took effect earlier, see new privacy laws 2026.

This article explains the rules in plain language. It is not legal advice. Last reviewed 27 September 2026.