Skip to main content

Issue October 2026

US privacy rules for advertisers in 2026

The US still has no federal privacy law, but the state map grew again in 2026. Indiana, Kentucky and Rhode Island laws took effect on 1 January, bringing the count of states with comprehensive privacy laws to twenty. California’s updated CCPA regulations, also effective 1 January 2026, add risk assessments, cybersecurity audits and rights around automated decision-making technology. For advertisers the practical work is opt-out handling for targeted advertising in every state where you have customers, and a record of how audience data is used.

Executive findings

  1. 1

    Comprehensive privacy laws in Indiana, Kentucky and Rhode Island took effect on 1 January 2026, bringing the total to twenty states.

    Secondary source. Scope: United States; state legislative tracker, as of . [1]

  2. 2

    Rhode Island’s law covers entities processing data of at least 35,000 consumers, or 10,000 if more than 20% of revenue comes from selling personal data.

    Secondary source. Scope: Rhode Island; state legislative tracker, as of . [1]

  3. 3

    California’s updated CCPA regulations, adopted in July 2025 and approved in September 2025, took effect on 1 January 2026 and cover risk assessments, cybersecurity audits and ADMT.

    Documented: official source. Scope: California; CPPA, as of . [2]

  4. 4

    Further state amendments take effect on 1 July 2026 in Connecticut, Arkansas and Utah.

    Secondary source. Scope: United States; state legislative tracker, as of . [1]

Method and limitations
Question
What changed in US privacy law in 2026 that affects how advertisers target and measure?
Written for
Performance and CRM leads buying US media.
Decision at stake
How to set opt-out handling, data mapping and measurement for US campaigns.
Sources
A state privacy law tracker, the California Privacy Protection Agency rulemaking page and regulation text, and a law firm briefing on the three new state laws.
Period
Official and legal sources as published and opened on 18 October 2026.
Markets
United States, with California detail.
Definitions
  • Targeted advertising: ads selected using personal data obtained across unaffiliated sites or apps, as defined in most state laws.
  • ADMT: automated decision-making technology, as defined in the California regulations.
Limitations
  • State laws differ in thresholds and definitions; this summary does not list every amendment.
  • This is not legal or tax advice. Confirm obligations for your business with qualified counsel in the market.

The state map in 2026

Secondary source

Indiana, Kentucky and Rhode Island joined the list of states with comprehensive privacy laws on 1 January 2026. All three follow the Virginia template, which gives consumers a right to opt out of targeted advertising and the sale of personal data. Rhode Island’s thresholds are low enough to catch many mid-sized businesses.

Amendments in Connecticut, Arkansas and Utah follow on 1 July 2026, several of them tightening rules on minors’ data.

California: assessments, audits and ADMT

Documented: official source

The California Privacy Protection Agency board adopted updated regulations on 24 July 2025; they were approved on 22 September 2025 and took effect on 1 January 2026. They require certain businesses to conduct risk assessments and annual cybersecurity audits and give consumers rights to access and opt out of some uses of automated decision-making technology. Audit deadlines are phased, with the first reports due from April 2028 for the largest businesses.

What to change in campaigns

FOCUSADS view

  • Honour Global Privacy Control and opt-out signals on every site, not only for California visitors.
  • Map which audiences come from your own customers and which from third parties.
  • Send CRM outcomes back to platforms through approved conversion APIs so optimisation relies less on cross-site tracking.
  • Record which audience and bidding decisions are automated, in case an ADMT request arrives.

Where we see opportunity

FOCUSADS view

As cross-site signals narrow, budgets move towards channels with their own first-party audiences: retail media networks, connected TV with logged-in viewers, and search. Advertisers with clean CRM data can measure these against real outcomes rather than platform-reported conversions.

How this connects to our method: How FOCUSADS screens channels by market

References

  1. All of the comprehensive privacy laws that take effect in 2026, MultiState, accessed
  2. CCPA updates, cybersecurity audits, risk assessments, ADMT and insurance regulations, California Privacy Protection Agency, accessed
  3. California Consumer Privacy Act Regulations, effective 1 January 2026, California Privacy Protection Agency, accessed
  4. New state privacy laws effective January 1, 2026: Indiana, Kentucky and Rhode Island, Koley Jessen, accessed

Related reading

  1. Cross-industry, Canada

    Canada news, tax and ad rules in 2026

    Three facts shape Canadian digital advertising in 2026. Meta has blocked news content on Facebook and Instagram in Canada since August 2023 in response to the Online News Act. Google holds an exemption from the Act in exchange for paying C$100 million a year, distributed to news outlets by the Canadian Journalism Collective. Canada announced on 29 June 2025 that it would rescind its 3% digital services tax. For advertisers, news audiences on Meta are gone, publisher inventory reached through other routes carries more of the news context, and platform pricing is no longer exposed to the DST.

    Meta Ads, Google Ads, Programmatic display, Connected TV and OTT

  2. Cross-industry, Global

    Where a Google-and-Meta plan stops working

    A plan copied from the home market usually buys Google search and Meta social in every country. In several of our 32 markets the local platforms sell search, messaging or marketplace inventory that this plan never touches, and in two markets the global platforms are not a working route at all. This briefing documents what each local platform says it sells, from its own advertiser pages, and sets out the order of checks we run before splitting a multi-country budget.

    Google Ads, Meta Ads, Search, Marketplace advertising

  3. Cross-industry, Global

    Channel and measurement choices by market

    A multi-market plan fails in two predictable ways. It buys channels that are unavailable, ineligible or unmeasurable in some markets, and it spreads the budget so thinly that no market produces a readable result. The framework below runs five gates per market and channel, funds only the lines that pass, and assigns each line a measurement method that can answer the budget question at that spend level. Platform attribution, lift tests, geo holdouts and marketing mix models answer different questions, and each needs a different amount of data.

    Google Ads, Meta Ads, TikTok Ads, App acquisition

Turn the briefing into a plan for your account

Build Your Plan scores each channel for your market, industry, goal and budget, and shows service, setup and media costs on separate lines.

Build a US plan around first-party data Request a tailored quote
Build your planContact