Last updated: November 13, 2026. What changed: Added the first CalPrivacy fines against data brokers under both the CCPA and the Delete Act, the 45-day DROP deletion clock that started July 31, 2026, and the stalled SECURE Data Act preemption fight.
TL;DR: Starting today, January 1, 2026, residents of Indiana, Kentucky, and Rhode Island can demand companies delete their data, correct inaccuracies, and opt out of tracking. California launched a centralized platform to delete your info from all data brokers at once. Your rights just expanded.
What changed (July 13, 2026): California's DROP platform has crossed 300,000 sign-ups as registered data broker counts hit a record high. CalPrivacy also announced a twelve point seven five million dollar GM settlement in May 2026, the largest CCPA penalty to date.
What changed (November 13, 2026): Data brokers are now on a 45-day deletion clock under DROP, and CalPrivacy has fined two of them for failing to register. Meanwhile the SECURE Data Act looks unlikely to pass this year, so the state patchwork gets messier.
Indiana, Kentucky, Rhode Island Join the Privacy Club
Three states flipped the switch on comprehensive privacy laws today. If you live in Indiana, Kentucky, or Rhode Island, you just gained rights similar to what California and Virginia residents already have. Companies operating in these states now face legal requirements to respect your data choices.[1][2][3]
The laws target larger businesses. Indiana's Consumer Data Protection Act applies to companies processing data from 100,000 or more Indiana residents annually, or 25,000 residents if the company makes over half its revenue from selling personal data. Kentucky uses the same thresholds. Rhode Island set a lower bar: 35,000 consumers, or 10,000 if data sales bring in 20% or more of revenue.[1][2][3]
That means local businesses with small customer lists don't have compliance headaches. But every major tech platform, retailer, and data broker operating in these states? They're covered.
What You Can Actually Do
All three state laws grant you five core rights:
Access Your Data
Request a copy of what they've collected about you. Companies have 45 days to respond in most cases. They have to tell you what categories of data they hold, how they use it, and who they share it with.
Fix Inaccuracies
Wrong address in their system? Outdated employment info floating around data broker networks? You can demand corrections. Companies must either fix it or explain why they won't.
Delete Your Data
Tell them to wipe your records. Exceptions exist for legal obligations, fraud prevention, and completing transactions. But your random browsing history from three years ago? Fair game for deletion.
Opt Out of Sales
Companies can't sell your personal data if you tell them not to. "Sale" includes trading data for "other valuable consideration" in Rhode Island's law, potentially catching analytics partnerships other states miss.
Opt Out of Targeting
Block targeted advertising based on your behavior across different websites and apps. Companies must provide clear opt-out methods, not buried three menus deep.
Opt Out of Profiling
Refuse automated decision-making that affects your access to housing, credit, employment, education, or healthcare. If an algorithm makes significant decisions about your life, you can say no.
The Devil in the Details
Kentucky gave companies a permanent cure period. If you file a complaint and the Kentucky Attorney General investigates, companies get 30 days to fix violations before facing penalties. Indiana also provides a 30-day cure period. Rhode Island went the opposite direction: no cure period at all.[3]
None of the three states require companies to honor universal opt-out signals like Global Privacy Control. That means if you set GPC in your browser, companies in these states do not have to respect it automatically under state law, though some may choose to for cross-state compliance simplicity.[1][3]
Indiana and Rhode Island require data protection assessments for high-risk processing activities starting today. Kentucky delays its assessment requirement until June 1, 2026.[3]
Update (July 13, 2026): DROP Is Working
Five months in, California Privacy Protection Agency (CalPrivacy) reports more than 300,000 Californians signed up for DROP as of June 2, 2026, with 581 registered data brokers (the highest since the registry was established in 2020).[7] A statewide roadshow launched April 21, 2026 to bring the deletion tool to residents in person across campuses, farmers markets, festivals, and community fairs.[8]
Enforcement is landing too. On May 8, 2026, Attorney General Bonta and CalPrivacy announced a twelve point seven five million dollar settlement with General Motors, the largest CCPA penalty on record and the first data minimization case, over illegal sale of Californians' driving and location data to Verisk Analytics and LexisNexis Risk Solutions.[9] On March 5, 2026, CalPrivacy fined Ford $375,703 for requiring email verification before consumers could opt out of sale and sharing of personal information collected through its connected vehicle services and digital properties, a violation CalPrivacy described as "unnecessary friction."[10] On March 3, 2026, CalPrivacy settled with PlayOn Sports for one point one million dollars, the first Board decision addressing privacy violations involving students and California schools.[11]
These are exactly the kind of teeth the laws that just took effect need to see elsewhere. State-level privacy rights work when attorneys general pursue cases and agencies name violators.
Update (November 13, 2026): The First Fines Arrive
What changed: Data brokers started deleting on a 45-day clock, and California's privacy regulator wrote its first check to a broker that had never registered.
On August 11, 2026, CalPrivacy fined LocateSmarter, an Iowa data broker, $116,490 in its first enforcement action against a broker under both the CCPA and the Delete Act.[12] The board found two problems: the company had not registered as a data broker even though it licensed personal information to customers, and it made Californians hand over the last four digits of their Social Security numbers before they could opt out of sale.[12] Enforcement chief Michael Macko said this case shows the agency evaluates conduct through the lens of multiple laws to find the best fit to protect Californians.[12]
On August 13, 2026, the agency fined a second broker, Cybba of Boston, $52,400 for failing to register with the data broker registry by the 2025 deadline.[13] Cybba must now publish its privacy rights metrics, join DROP, and route future deletion requests through the platform.[13]
The bigger change came at the end of July. Since July 31, 2026, every registered data broker has to open DROP at least once every 45 days, pull the deletion requests, and erase the personal information on those lists, including any inferences the broker drew from it.[14] Brokers have 45 days from receiving a request to finish deleting, must push their own vendors to do the same, and must keep suppression lists so they delete the data again if they re-acquire it.[14] The Delete Act fine is $200 per consumer per day for each failure to delete.[14]
Meanwhile the federal push stalled. Representative Brett Guthrie, who chairs the House Energy and Commerce Committee, has been pushing his SECURE Data Act, but a June subcommittee hearing split along party lines over preemption.[15] Cobun Zweifel-Keegan, managing director at the IAPP, said the likelihood of passing a comprehensive consumer privacy law before the end of the year is vanishingly small.[15] States kept writing: Oklahoma, Louisiana, and Alabama have laws taking effect in 2027, Vermont's starts in 2028, and Virginia, Maryland, Connecticut, New Hampshire, and Delaware all amended their statutes.[15]
California's DELETE Platform Goes Live
California launched something bigger today: the Delete Request and Opt-out Platform, or DROP. It's a centralized system where California residents submit one deletion request that reaches every registered data broker simultaneously.[4][5][6]
Before DROP, you had to contact data brokers individually. There are hundreds of them. Acxiom, Epsilon, Oracle Data Cloud, LiveRamp, TransUnion, Experian, plus dozens you've never heard of. Each had its own opt-out process. Some made it easy. Most didn't. Some ignored requests.
Now you authenticate once through DROP, submit your deletion request, and the California Privacy Protection Agency distributes it to all registered brokers. Data brokers must check DROP at least every 45 days and process verified requests.[4][5][6]
The penalties bite. Failure to delete information costs $200 per deletion request per day.[5]
California also imposed new risk assessment requirements today. Companies processing personal data in ways that present significant privacy risks must conduct and document assessments. This includes the new Automated Decision-Making Technology (ADMT) regulations. The first cybersecurity audits by independent auditors come due April 1, 2028, giving businesses time to prepare.
Who Enforces This
State attorneys general hold enforcement power in Indiana, Kentucky, and Rhode Island. No private right of action means you can't sue companies directly for violations. You file complaints with the AG, who decides whether to investigate and prosecute.
Use Your New Rights
Check company privacy policies for instructions on submitting data requests. Look for sections titled "Your Privacy Rights," "State-Specific Rights," or similar. Indiana, Kentucky, and Rhode Island residents should see updated language acknowledging new rights.
California residents: visit the CPPA website to access DROP once it's fully operational. The platform went live today, though there may be initial rollout issues as data brokers integrate their systems.
For targeted advertising opt-outs, install Privacy Badger or enable Global Privacy Control in browsers that support it. None of the three new state laws (Indiana, Kentucky, Rhode Island) require companies to honor GPC automatically, but many will to simplify compliance across states that do.
Document your requests. Save confirmation emails. Screenshot response deadlines. If companies ignore you past 45 days (or whatever deadline their policy specifies), file complaints with your state attorney general. These laws only work if people use them.
More States Are Passing Privacy Laws
A growing number of US states now have comprehensive consumer privacy laws. That's not federal protection, but it gives more residents rights to access, correct, and delete data.
The pattern is clear: once a few states pass laws, others follow. California led in 2018 with the CCPA. Virginia followed in 2021. Then Colorado, Connecticut, Utah. Then the flood: Montana, Oregon, Texas, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee. Now Indiana, Kentucky, Rhode Island.
Congress still hasn't passed federal privacy legislation. State laws fill the gap, creating a patchwork that's better than nothing but worse than a unified national standard. Until federal law happens, check whether your state gives you rights. If it does, use them.
References
- Ketch - Data privacy laws: what to expect for 2026
- ComplyAuto - State Privacy Law Deadline: January 1, 2026
- ArentFox Schiff - New Year, New Privacy Obligations
- California Privacy Protection Agency - California Approves Delete Act Regulations
- Hunton Andrews Kurth - California's New Delete Request Tool Impacts Data Brokers and Residents
- Benesch - The Era of Centralized Deletion Is Here: Understanding CalPrivacy's DROP Platform
- California Privacy Protection Agency - Privacy Momentum Builds: 300,000+ Californians Sign Up for DROP (June 2, 2026)
- California Privacy Protection Agency - CalPrivacy Launches Statewide Roadshow (April 21, 2026)
- California Privacy Protection Agency - $12.75 Million General Motors Privacy Settlement (May 8, 2026)
- California Privacy Protection Agency - Ford Decision (March 5, 2026)
- California Privacy Protection Agency - $1.1M Youth Sports Media Settlement (March 3, 2026)
- California Privacy Protection Agency - CalPrivacy Brings First Action Against a Data Broker Under Both the CCPA and Delete Act (August 11, 2026)
- California Privacy Protection Agency - CalPrivacy Announces Second Data Broker Enforcement Action in Less Than a Week (August 13, 2026)
- Privacy Rights Clearinghouse - Deletion obligations under DROP are here! Data brokers must now delete (July 31, 2026)
- StateScoop - Federal privacy law highly unlikely in 2026, leaving states to continue setting their own rules (September 25, 2026)