Data Privacy Laws in 2026: What They Mean for Selling Your Data

Direct answer: As of 2026, roughly 20 U.S. states have comprehensive consumer privacy laws in effect (including new laws in Indiana, Kentucky, and Rhode Island this year), alongside expanded data broker registration rules in California and a sweeping new New Jersey law covering both brokers and the companies that sell to them — giving consumers stronger opt-out, deletion, and disclosure rights than at any point before.

The 2026 state privacy landscape

Twenty states now have comprehensive privacy laws on the books, with Indiana, Kentucky, and Rhode Island joining in January 2026 and Connecticut, Arkansas, and Utah amendments taking effect mid-year. Most of these laws follow a similar template: rights to access, correct, delete, and opt out of the sale of your personal data.

California's expanded data broker rules

California's Delete Act created a centralized deletion platform (DROP) that lets consumers submit a single request honored across all registered brokers, with an expanded August 2026 registration requirement forcing brokers to disclose more about who buys their data — including whether it's sold to foreign actors, governments, or AI developers.

New Jersey's sweeping new law

A New Jersey law enacted June 30, 2026 goes further than most states by also regulating "data collectors" — companies with a direct consumer relationship that sell data onward to brokers — and by banning the sale of sensitive data (health, financial, biometric) outright, regardless of company size.

What this means if you want to sell or protect your data

These laws primarily strengthen your ability to opt out and delete — they don't create a right to be paid for your data. If you want to monetize your information, that still requires opting into a specific legitimate program separately from exercising your privacy-law rights.

Frequently Asked Questions

Do these new laws mean companies have to pay me for my data?

No — most state privacy laws create rights to access, correct, delete, and opt out of sale, not a right to be paid. Monetization requires separately opting into a specific paid program.

Which states have the strongest data broker rules in 2026?

California (with its centralized DROP deletion platform and expanded registration disclosures) and New Jersey (with its broad data collector rules and sensitive-data sale ban) are widely considered to have the most far-reaching data broker regulations in 2026.

Does my state need a comprehensive privacy law for me to opt out of data brokers?

You can submit opt-out requests to brokers regardless of your state's law, though centralized deletion platforms and mandatory response timelines are currently only available in states that have enacted them.