For analytics and marketing teams, the practical question isn't which law applies in which state. It's whether your tracking setup respects the choices people make, and whether you could show that if asked. Here's what changed in 2026 and a checklist to work through with your legal team.
What changed in 2026
| Change | Effective | Why it matters for analytics |
|---|---|---|
| New laws in Indiana, Kentucky and Rhode Island | January 1, 2026 | More states with opt-out rights for targeted advertising and the "sale" or "sharing" of data |
| Updated California CCPA regulations | January 1, 2026 | New rules on risk assessments, automated decision-making and privacy notices |
| Connecticut amendments | July 1, 2026 | Lower threshold (35,000 residents, down from 100,000), and opt-in consent for sensitive data |
| Arkansas children's privacy law | July 1, 2026 | Strict limits on data collection and targeted advertising involving minors |
Several other states, including Alabama, Louisiana, Oklahoma and Vermont, have reportedly enacted laws that take effect later, so the list will keep growing.
Three themes that matter most for tracking
1. Ad pixels can count as "sharing." Under many state laws, sending visitor data to ad platforms through pixels, or using it to build lookalike audiences, can count as sharing or selling personal data for targeted advertising. That triggers opt-out rights. In other words, your Meta pixel, Google Ads tags and similar tools are squarely in scope.
2. Browser privacy signals are becoming mandatory. Global Privacy Control (GPC) is a signal a visitor's browser or extension sends to say "don't sell or share my data." According to one 2026 analysis, twelve states now require businesses to honor it as an opt-out, including California, Colorado, Connecticut, Oregon and Texas. California also expects sites to visibly confirm when a GPC signal has been honored. Regulators in several states ran a joint enforcement sweep on GPC in September 2025.
3. Lawsuits are a risk alongside regulators. Class actions alleging that tracking pixels and session recording without proper consent amount to illegal "wiretapping" under California's CIPA have surged. Lawsuits under the federal Video Privacy Protection Act (VPPA), over video-viewing data shared through pixels, are also rising. Even where a regulator might not act, a poorly configured tag can invite a lawsuit.
The analytics team's checklist
You don't need to be a lawyer to do most of this. You do need to work with one on the decisions.
1. Inventory every tag. List every tag, pixel and script on your site: what it is, what data it sends, where it goes and why. Include tags added by agencies, plugins and your ecommerce platform. You can't control what you don't know is there.
2. Map each tag to a consent category. Classify each tag as strictly necessary, analytics, advertising or personalization. Advertising tags that share data for targeted ads are where opt-out rights apply most directly.
3. Honor Global Privacy Control. Test your site with GPC turned on. Several browsers and privacy extensions can send it. Confirm that advertising and "sharing" tags stop firing or switch to a restricted mode, and that your consent platform records the opt-out. If you have California visitors, check how you confirm that the signal was honored.
4. Make "reject" as easy as "accept." Where your banner offers choices, regulators expect symmetry: declining shouldn't take more clicks than accepting. A banner with only "Accept all" is increasingly risky.
5. Check that "no" actually means no. In GTM Preview mode, decline consent and confirm that advertising tags don't fire, and that nothing loads before the visitor makes a choice where consent is required. A banner that records choices but doesn't control tags offers little protection.
6. Keep sensitive data out of your tags. Health conditions, precise location, financial details and similar sensitive information increasingly require opt-in consent. Check that page URLs, page titles, search terms and event parameters don't leak it to analytics or ad platforms. Health, finance and legal websites need particular care.
7. Review session recording and chat tools. Session replay and chat tools are frequent targets in wiretapping lawsuits. Confirm they're covered by consent where required and mask form fields and sensitive text.
8. Know your audience's age. If your site or app attracts minors, review targeted advertising and data collection carefully. Arkansas's new law and the federal COPPA rule updates both raise the bar.
9. Document everything. Keep a record of your tag inventory, consent configuration, testing results and decisions. If a regulator or plaintiff asks, documentation shows you took compliance seriously.
10. Re-test regularly. Tags change constantly. Re-run your consent and GPC tests quarterly and after any major site or tag change.
Where server-side and consent tools help
Two tools covered elsewhere on this blog make compliance easier. A solid consent management platform connected to Google Consent Mode ensures your choices reach your tags reliably, which matters more since Google made Consent Mode the sole gate for advertising data to Google Ads in June 2026. Server-side tagging gives you a place to filter or redact data before it reaches third parties, which can reduce what you share in the first place.
The bottom line
The US privacy landscape is now a patchwork of 20 states and counting, with more opt-out signals, more sensitive data rules and more lawsuits. You don't have to master every statute to protect your organization. Know every tag on your site, make sure consent and GPC choices actually control them, keep sensitive data out, and document what you've done. That's good privacy practice, and increasingly, it's the law.
Steps 1, 2, 3 and 5 are tag work as much as legal work. Our Google Tag Manager consulting service can build the tag inventory, map tags to consent categories and test that consent and GPC choices actually control what fires.
This post is general information, not legal advice. Privacy laws vary by state and business, and change often. Consult your legal or privacy team about your obligations.
Sources: Foley & Lardner: 2026 privacy landscape · Secure Privacy: US state privacy laws 2026 for marketers · Beancount: Mid-2026 state privacy law wave
