Law updates
New US privacy laws in 2027: what changes and when
New privacy laws start in Oklahoma and Louisiana on January 1, 2027, and Delaware’s thresholds drop. Dates, who’s covered and what to do, with sources.
On this page
- The 2027 changes at a glance
- Delaware: the size limits drop on January 1, 2027
- Oklahoma: a new law from January 1, 2027
- Louisiana: a new law, with a short grace period
- New Hampshire: no selling children’s data
- Later in 2027: Alabama and Kentucky
- What to do before January 1, 2027
- Frequently asked questions
- Sources
Key points
- On January 1, 2027, new privacy laws start in Oklahoma and Louisiana, and Delaware’s law reaches far smaller businesses.
- New Hampshire bans selling a child’s personal data from the same day.
- Alabama’s law follows on May 1, 2027, Kentucky’s amendments on July 1, 2027, and Vermont’s law on January 1, 2028.
- Most of these laws apply by size, measured in residents’ data, not your location. Check each threshold against your traffic and customer lists.
2027 is a busy year for US privacy law. Two new state laws take effect, one state lowers its size limits sharply, and several add new rules for children’s and sensitive data. If your website has visitors or customers in these states, here is what changes, when, and what to do before each date.
- Jan 1, 2027 Delaware lowers its thresholds. Oklahoma and Louisiana laws start. New Hampshire bans selling a child’s personal data.
- May 1, 2027 Alabama’s law starts.
- Jul 1, 2027 Kentucky: no new account needed to use privacy rights; consent before collecting smart TV viewing data.
- Jul 31, 2027 Louisiana’s 30-day cure period ends.
- Jan 1, 2028 Vermont’s law starts, including opt-out preference signals such as Global Privacy Control.
The 2027 changes at a glance
| State | Date | What changes | Who it covers |
|---|---|---|---|
| Delaware | Jan 1, 2027 | Lower thresholds; list of specific third parties on request | 10,000+ consumers, or 5,000+ with over 20% of revenue from selling data |
| Oklahoma | Jan 1, 2027 | New privacy law starts | 100,000+ consumers, or 25,000+ with over 50% of revenue from selling data |
| Louisiana | Jan 1, 2027 | New privacy law starts | Revenue over $25 million, or 75,000+ consumers, households or devices, or 50%+ of revenue from selling data |
| New Hampshire | Jan 1, 2027 | No selling a child’s personal data | Details on the law page |
| Alabama | May 1, 2027 | New privacy law starts | More than 25,000 consumers, or more than 25% of revenue from selling data |
| Kentucky | Jul 1, 2027 | No new account needed to use rights; consent for smart TV viewing data | Businesses already covered by the state’s law |
| Vermont | Jan 1, 2028 | New privacy law starts, with opt-out signals | 35,000+ consumers, or sensitive data of 3,000+, or offering for sale data of 3,000+ |
Delaware: the size limits drop on January 1, 2027
Delaware’s privacy law has applied since January 1, 2025 to businesses that handle the personal data of 35,000 or more Delaware consumers, or 10,000 or more while getting over 20% of revenue from selling personal data. Amendments signed on September 2, 2026 (HB 380) lower those numbers to 10,000 consumers, or 5,000 with over 20% of revenue from sales. The governor’s office called it the lowest threshold in the nation.
From the same date, people can ask for a list of the specific third parties you disclosed their data to, not just the categories, with some exceptions. The definition of sensitive data also grows, to cover health treatment as well as status, plus categories such as neural data and government ID numbers. Delaware’s Department of Justice says the law covers nonprofits too.
Smaller sites, take note: 10,000 Delaware consumers a year is a level many online stores and service businesses reach. Delaware also already requires honoring Global Privacy Control, the browser opt-out signal.
Oklahoma: a new law from January 1, 2027
Oklahoma’s privacy law (SB 546) applies to businesses that operate in Oklahoma or target its residents and handle the personal data of 100,000 or more Oklahoma consumers, or 25,000 or more while getting over 50% of gross revenue from selling personal data. Nonprofits are exempt.
Residents get the usual rights: access, correction, deletion, a portable copy, and opting out of targeted advertising, sale and profiling. You have 45 days to respond, extendable once by 45 more, and appeals must be answered within 60 days. The law doesn’t require honoring universal opt-out signals such as Global Privacy Control. The Attorney General must give 30 days’ written notice to cure before suing, and penalties reach $7,500 per violation.
Louisiana: a new law, with a short grace period
Louisiana’s law (Act 502 of 2026) applies to businesses operating in Louisiana that meet any one test: annual revenue over $25 million; personal information of 75,000 or more consumers, households or devices; or 50% or more of revenue from selling personal information. Note the revenue test: a large business can be covered even with few Louisiana visitors.
Sensitive data needs consent, and consent can’t come from accepting general terms, hovering over or closing content, or a dark pattern. The law allows a browser setting to act as a consumer’s authorized agent for opt-outs, but it doesn’t require honoring Global Privacy Control. From January 1 to July 31, 2027, the Attorney General must give written notice and 30 days to fix a problem. After July 31, 2027, there is no right to cure.
New Hampshire: no selling children’s data
New Hampshire’s privacy law has applied since January 1, 2025. A 2026 law (HB 1460, signed June 19, 2026) bans selling a child’s personal data from January 1, 2027. The state already requires consent before targeted advertising to, or selling the data of, consumers you know are 13 to 15, and it already requires honoring Global Privacy Control.
Later in 2027: Alabama and Kentucky
Alabama (HB 351) takes effect on May 1, 2027 for businesses that handle the data of more than 25,000 Alabama consumers, or get more than 25% of revenue from selling personal data. Businesses with fewer than 500 employees are exempt unless they sell personal data. Opt-outs go through a clear and conspicuous link, or up-to-date contact details. The Attorney General must give 45 days to fix a violation, and penalties reach $15,000 per violation, among the highest of any state privacy law.
Kentucky’s law has applied since January 1, 2026. Amendments (HB 692) take effect on July 1, 2027: you can’t make people create a new account to use their privacy rights, and you need consent before collecting automatic content recognition data, such as what someone watches on a smart TV.
Looking ahead to 2028: Vermont’s law starts on January 1, 2028, with some of the lowest thresholds in the country and a duty to honor opt-out preference signals such as Global Privacy Control. See the Vermont law page.
What to do before January 1, 2027
- Count your residents by state. Use your analytics, store orders and email lists to estimate how many people from each state you handle data for in a year.
- Check your revenue tests. Louisiana counts total revenue over $25 million; other states count the share of revenue from selling personal data.
- Update your privacy policy. Name the rights each state gives, how to use them, and how to appeal a refusal.
- Offer a clear opt-out. A “Your Privacy Choices” link and honoring Global Privacy Control cover the states that require it and are simple to add for the rest.
- Get ready for requests. Have a way to receive privacy requests and answer them within 45 days.
GoConsent’s Laws tab works out which of these laws likely apply to your site from your business settings, and lists laws that are about to start. Its consent banner honors Global Privacy Control by default, and GoConsent Pro prepares updated policy wording when a law starts to apply, which goes live once you approve it. You can also run a free audit of any site’s banner, trackers and opt-out links.
Frequently asked questions
Which new state privacy laws start in 2027?
Oklahoma and Louisiana on January 1, 2027, and Alabama on May 1, 2027. Delaware, New Hampshire and Kentucky also change their existing laws during 2027.
Does Delaware’s privacy law apply to small businesses?
From January 1, 2027, it applies to businesses that handle the personal data of 10,000 or more Delaware consumers a year, or 5,000 or more with over 20% of revenue from selling personal data. There is no revenue floor, and Delaware’s Department of Justice says nonprofits are covered too.
Do Oklahoma and Louisiana require honoring Global Privacy Control?
No. Neither law requires honoring universal opt-out signals. Louisiana lets a browser setting act as a consumer’s authorized agent but allows a business to decline in some cases. Honoring Global Privacy Control is still the simple, safe choice, and it is required in other states such as California, Colorado and Delaware.
What is a cure period, and when does Louisiana’s end?
A cure period is time the regulator must give you to fix a problem before taking action. In Louisiana, the Attorney General must give written notice and 30 days to cure from January 1 to July 31, 2027. After that, there is no right to cure.
How big are the penalties?
Up to $7,500 per violation in Oklahoma, $7,500 per continued violation in Kentucky, $10,000 per willful violation in Delaware, and $15,000 per violation in Alabama. Each state’s Attorney General or Department of Justice enforces its law; none of these laws gives consumers a private right to sue.
How do I know which laws apply to my website?
Compare each state’s thresholds with the number of its residents whose data you handle each year, and check the revenue tests. GoConsent’s Laws tab does this from your business settings and shows which laws likely apply. It is a starting point, not legal advice.
Sources
This post is general information, not legal advice. Laws change; check the official text and talk to a lawyer about your situation.
