Four More States Are About to Get Privacy Laws — Here's Your Advance Notice
Four states have already signed comprehensive consumer privacy laws that simply haven't taken effect yet. None of these are enforceable today, but each has a real, fixed effective date, and getting ahead of them costs nothing right now.
Oklahoma — Effective January 1, 2027
The Oklahoma Consumer Data Protection Act follows the now-familiar structure: applies at 100,000 or more consumers, or 25,000 or more consumers combined with deriving 50% or more revenue from data sales. It grants the standard rights set, plus a right to appeal a denied request, something not every comparable state includes. Notably, Oklahoma defines "sale" narrowly, limited to transactions involving monetary consideration only, a real distinction from broader definitions elsewhere.
Louisiana — Effective January 1, 2027
Louisiana's law stands out for having a genuine revenue-only trigger, uncommon among its peers: it applies at $25 million or more in revenue, or 75,000 or more consumers, or 50% or more revenue from selling personal data. That's a three-part OR structure, meaning any one path alone is enough.
Alabama — Effective May 1, 2027
Alabama's law is modeled on Connecticut's framework rather than Virginia's, and notably skips the Data Protection Impact Assessment requirement that most comprehensive laws include. It also does not include a right to appeal a denied request, unlike Oklahoma and Louisiana. Its threshold is 25,000 or more consumers, or 25% or more revenue from data sales, a lower revenue-share bar than the 50% used in most comparable states.
Vermont — Effective January 1, 2028
Vermont's law has the lowest thresholds of any state on this list by a wide margin: 35,000 consumers, or just 3,000 consumers if sensitive data is involved, or 3,000 consumers whose data is sold. Independent legal analysts have described it as one of the more progressive state privacy laws in the country. It also includes several rights not found in the other three: the right to obtain a list of specific third parties your data was sold to, and rights related to understanding and contesting decisions made through automated profiling.
Why This Is Worth Reading Now, Not Later
None of these laws can be enforced against your business today. But effective dates arrive faster than compliance programs get built, and Vermont's unusually low thresholds in particular mean a broader range of sellers will need to pay attention once 2028 arrives than under most other states' laws. Reading the requirements now, while there's no pressure, is a genuinely better position than discovering them the week before they take effect.
Check Your Future Exposure
All information in this article is sourced from the Oklahoma Consumer Data Protection Act (SB 546), the Louisiana Data Privacy Act (Act 502), the Alabama Data Privacy Act (HB 351), and the Vermont Data Privacy and Online Surveillance Act (Act 145), along with independent legal analysis from IAPP and multiple law firm publications. Regulens is informational only and this article is not legal advice. Speak to a licensed privacy attorney about your specific compliance situation.
Regulens tracks all four of these states as part of its ongoing state-by-state privacy coverage, ready to activate the moment each law takes effect.
Free to check, takes three minutes, no credit card needed. Not legal advice. Informational only.
Further Reading
Four States Now Ban Selling Your Customers' Exact Location — Is Yours Next
Virginia, Connecticut, Maryland, and Oregon have each independently banned the sale of precise geolocation data within the same general stretch of time. A pattern like this rarely stays confined to four states for long.
Utah's New Tax Has Nothing to Do With Nexus Thresholds — And That's the Point
As of this month, Utah taxes a specific category of digital content at 2%, tied to age-verification requirements. It's a genuinely different kind of obligation than the nexus thresholds most sellers are used to tracking.