9 Privacy Law Changes Hit Websites on January 1, 2027: Your Checklist

Nine changes start on January 1, 2027, and three more follow by May 1. Use the last column as your to-do list. Key terms: CCPA is the California Consumer Privacy Act, ADMT is automated decisionmaking technology, and GPC is Global Privacy Control, a browser setting that tells sites a visitor opts out of the sale or sharing of their data.

Two later dates matter too: Louisiana's cure period ends July 31, 2027, and California risk assessments for existing processing are due December 31, 2027. For a running calendar, see the ScanComply deadline tracker.

Oklahoma's SB 546, signed March 20, 2026, applies to businesses that control or process the data of at least 100,000 Oklahoma consumers, or at least 25,000 if more than half of gross revenue comes from selling personal data (WilmerHale). Consumers get the familiar rights: access, correction, deletion, portability, and opt-outs from targeted advertising, sale and certain profiling.

• Enforcement: Attorney General only, with a 30-day cure period and penalties of up to $7,500 per violation.
• Sensitive data, including precise geolocation and data from a known child, needs consent.
• A narrower "sale": only exchanges for money count.
• No opt-out signal mandate.

Louisiana's Data Privacy Act (SB 386), signed May 29, 2026, has an unusual trigger: a business operating in Louisiana with more than $25 million in annual revenue is covered on revenue alone. The other tests are 75,000 consumers, households or devices, or at least 50% of revenue from selling personal data (WilmerHale). Only the Attorney General enforces it, and the 30-day cure period runs only from January 1 through July 31, 2027.

Louisiana never uses the phrase "universal opt-out mechanism," but it lets consumers designate an authorized agent "using a technology," including a global setting on a device, to opt out of sales and targeted advertising (Future of Privacy Forum). California's privacy agency counts Louisiana among the states that will require honoring opt-out signals from January 2027, so treat GPC as in scope there. State summaries: Oklahoma • Louisiana.

Delaware's HB 380, signed September 2, 2026, is the broadest of the three amendments (Troutman):

• Coverage: 10,000 consumers (from 35,000), or 5,000 (from 10,000) when over 20% of revenue comes from selling data.
• Third parties: any third party that acquires personal data from a controller is covered, with no minimum volume.
• Sensitive data: now includes inferences, neural data, financial account credentials and certain government ID numbers.
• Profiling: the opt-out widens, and data protection assessments are triggered at 50,000 consumers (from 100,000).

New Hampshire's HB 1460, signed June 19, 2026, bars controllers from selling a child's personal data "with or without consent" (Hunton). "Child" means under 13, as in the federal Children's Online Privacy Protection Act. If your site is aimed at children, or you know some users are under 13, make sure none of their data is sold; parental consent no longer makes it lawful.

Connecticut's SB 4, signed May 27, 2026, creates a data broker registry. From January 1, 2027, a business may not sell or license "brokered personal data" unless it is registered with the Department of Consumer Protection, at $2,500 a year (FPF). Most small sites are not data brokers, but list-rental and lead-resale businesses should check. State summaries: Connecticut • New Hampshire.

California's changes apply to businesses covered by the CCPA. The revenue test has been $26,625,000 since January 2025, and the California Privacy Protection Agency (CPPA) adjusts it every odd-numbered year (CPPA).

• Automated decisionmaking technology (ADMT). If software that replaces human judgment makes a "significant decision" about financial or lending services, housing, education, employment or contracting, compensation, or healthcare services, you need a pre-use notice, an opt-out or a qualifying human appeal, and a way for consumers to access information about its use (Bass, Berry & Sims). Marketing sites rarely make such decisions; automated loan pre-qualification, tenant screening and hiring tools do.
• Browser opt-out signals (AB 566). The Opt Me Out Act, signed October 8, 2025, requires browsers to give Californians a built-in way to send an opt-out preference signal from January 1, 2027 (CPPA; Hunton). The duty falls on browser makers, but more of your visitors will arrive with the signal, and you must honor it.
• Request methods and deletion (SB 923). Online-only businesses with a direct consumer relationship must offer both an email address and an online method, such as a web form or portal, for access, correction and deletion requests. The law also extends deletion rights to personal information obtained from third parties (Nixon Peabody).
• Pixel lawsuits (SB 690). Signed September 30, 2026, it makes the Attorney General the only party who can sue under the California Invasion of Privacy Act's pen-register provision (§638.51) for conduct on websites and apps (Crowell). Private wiretap claims under §631 and §632 remain. Read our SB 690 explainer.

The sleeper deadline is the risk assessment. The same regulations require a written risk assessment before high-risk processing, including selling or sharing personal information, which typically covers ad pixels used for cross-context behavioral advertising. Processing that began before 2026 must be assessed by December 31, 2027, with the first submission to the CPPA due April 1, 2028 (ZwillGen).

Put these dates on the calendar now:

• January 31: California data broker registration. Businesses that meet the Delete Act's data broker definition must register with the CPPA every year between January 1 and 31 (CPPA) and process deletion requests from the state's Delete Request and Opt-out Platform (DROP). See our DROP guide.
• April 1: Maryland's cure period ends. Its cure period of at least 60 days is discretionary, not a right, and covers only alleged violations on or before April 1, 2027 (Troutman). After that, do not count on a chance to fix problems first. Maryland summary.
• May 1: Alabama's law takes effect. Businesses with fewer than 500 employees are exempt unless they sell personal data (Hunton). It has a 45-day cure period with no sunset, penalties of up to $15,000 per violation and no opt-out signal requirement, plus opt-in consent before selling the data of users known to be 13 to 16 or targeting ads to them. Alabama summary.
• July 31: Louisiana's cure window closes.
• December 31: California risk assessments are due for processing that began before 2026.

Vermont, the 23rd state to enact a comprehensive privacy law, follows on January 1, 2028. Vermont summary.

Most of these fixes cover several states at once. Work through them in order:

1. Count your audience by state. Compare your 2026 numbers for Delaware, Oklahoma, Louisiana and Alabama with the thresholds above.
2. Inventory every tag: each pixel, analytics script, chat widget and session-replay tool, and what it sends where.
3. Stop pre-consent firing. Non-essential trackers should wait for your consent or opt-out logic.
4. Honor Global Privacy Control everywhere, including for logged-in accounts, and show California visitors it was processed. How to test GPC.
5. Update your privacy policy for Oklahoma and Louisiana now and Alabama by May.
6. Fix request intake. Offer an email address and a web form (SB 923), and never demand extra verification just to opt out.
7. Check children's and teens' data. End any sale of under-13 data (New Hampshire) and plan opt-in consent for ages 13 to 16 (Alabama).
8. Scope ADMT and risk assessments if you automate significant decisions or your pixels share data.
9. Confirm your data broker status before the California and Connecticut registration dates.
10. Keep dated evidence of scans, policy versions and consent settings, especially while Maryland's and Louisiana's cure periods run.