Which state privacy laws affect advertising, and what do they actually say?
Part of US and Canada targeting
The short answer
As of October 2026, 19 US states have comprehensive consumer privacy laws in force, from California and Virginia in 2023 to Indiana, Kentucky and Rhode Island in January 2026. Virginia's definition of targeted advertising, whose context exclusion also appears in 12 other state statutes, excludes ads based on a consumer's current search, website visit or app.
Key takeaways
- Nineteen state comprehensive privacy laws were in force on October 21, 2026; Oklahoma's takes effect January 1, 2027 and Alabama's May 1, 2027.
- Virginia's definition of targeted advertising, whose exclusions also appear in the statutes of 12 other states, excludes ads based on the context of a consumer's current search query, website visit or online application.
- California regulates sale and sharing for cross-context behavioral advertising instead, and its regulator says businesses must honor opt-out preference signals such as the Global Privacy Control.
- Several states now require controllers to honor universal opt-out signals, with start dates from January 2025 to January 2026.
- Connecticut, Delaware and Maryland restrict targeted advertising to consumers under 18, and Oregon, Minnesota and New Hampshire set rules for younger teens.
Which state comprehensive privacy laws are in force as of October 2026?
The table lists each state law with the in-force date as the attorney general, the enforcing agency or the statute states it, checked October 21, 2026. Each link goes to that official page. Several of these laws were amended after they took effect; the dates here are the original in-force dates.
| State | Law | In force, per the official source |
|---|---|---|
| California | CCPA, as amended by the CPRA | CPRA amendments in effect January 1, 2023 (California AG (opens in a new tab)) |
| Virginia | Consumer Data Protection Act | January 1, 2023 (Virginia AG summary (opens in a new tab)) |
| Colorado | Colorado Privacy Act | July 1, 2023 (Colorado AG (opens in a new tab)) |
| Connecticut | Connecticut Data Privacy Act | July 1, 2023 (Connecticut AG (opens in a new tab)) |
| Utah | Utah Consumer Privacy Act | December 31, 2023 (Utah Division of Consumer Protection (opens in a new tab)) |
| Texas | Texas Data Privacy and Security Act | July 1, 2024 (Texas AG (opens in a new tab)) |
| Oregon | Oregon Consumer Privacy Act | July 1, 2024 (Oregon DOJ (opens in a new tab)) |
| Montana | Consumer Data Privacy Act | October 1, 2024 (Montana Legislature memo (opens in a new tab)) |
| Iowa | Consumer data protections, chapter 715D | January 1, 2025 (SF 262 as enrolled (opens in a new tab)) |
| Delaware | Delaware Personal Data Privacy Act | January 1, 2025 (Delaware AG (opens in a new tab)) |
| Nebraska | Data Privacy Act | January 1, 2025 (Nebraska AG (opens in a new tab)) |
| New Hampshire | RSA chapter 507-H | January 1, 2025 (RSA 507-H (opens in a new tab)) |
| New Jersey | New Jersey Data Privacy Act, P.L. 2023, c.266 | January 15, 2025, the date the Division of Consumer Affairs FAQ (opens in a new tab) gives for controllers and processors to comply |
| Tennessee | Tennessee Information Protection Act | July 1, 2025 (Tennessee AG (opens in a new tab)) |
| Minnesota | Consumer Data Privacy Act, chapter 325M | July 31, 2025 (Minnesota Statutes 325M (opens in a new tab)) |
| Maryland | Maryland Online Data Privacy Act | October 1, 2025 (Maryland AG (opens in a new tab)) |
| Indiana | Consumer Data Protection Act | January 1, 2026 (Indiana AG (opens in a new tab)) |
| Kentucky | Kentucky Consumer Data Protection Act | January 1, 2026 (Kentucky AG (opens in a new tab)) |
| Rhode Island | Data Transparency and Privacy Protection Act | January 1, 2026 (Rhode Island chapter 6-48.1 (opens in a new tab)) |
Two more laws are enacted but not yet in force. Oklahoma's Senate Bill 546, approved by the governor on March 20, 2026 according to the legislature's bill page (opens in a new tab), states that it becomes effective January 1, 2027. Alabama's HB 351 as enrolled (opens in a new tab) states that it becomes effective on May 1, 2027.
What counts as targeted advertising under these laws?
The definition of targeted advertising is where advertising practice meets the statute. The Code of Virginia, section 59.1-575 (opens in a new tab), defines it and lists what it does not include. The first party and current context exclusions also appear in the statutes of Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, Nebraska, New Hampshire, Minnesota and Rhode Island.
"Targeted advertising" means displaying advertisements to a consumer where the advertisement is selected based on personal data obtained from that consumer's activities over time and across nonaffiliated websites or online applications to predict such consumer's preferences or interests.
| Excluded from the definition | Statutory wording | Planning practice it describes |
|---|---|---|
| First party activity | Advertisements based on activities within a controller's own websites or online applications | Ads chosen from what a person does on the advertiser's own site or app |
| Context of the current visit | Advertisements based on the context of a consumer's current search query, visit to a website, or online application | Contextual placement chosen from the page, search or app being used at that moment |
| Requested ads | Advertisements directed to a consumer in response to the consumer's request for information or feedback | Ads a person asked to receive |
| Measurement | Processing personal data processed solely for measuring or reporting advertising performance, reach, or frequency | Frequency, performance and reach reporting |
California uses a different term. The California Privacy Protection Agency's FAQ (opens in a new tab) describes the right to request that businesses stop selling or sharing personal information, with sharing defined around cross-context behavioral advertising. Iowa is the outlier among the Virginia style laws: chapter 715D (opens in a new tab) lists a right to opt out of the sale of personal data, and separately requires a controller that engages in targeted advertising to disclose it clearly and conspicuously, along with the manner in which a consumer may opt out of that activity.
Which states require honoring a universal opt-out signal?
A universal opt-out signal, such as the Global Privacy Control browser setting explained on the Global Privacy Control page, lets a person opt out of targeted advertising and sale across many sites at once. Visitors sending a valid signal are opted out of the uses the statute names. Colorado's requirement is covered on the hub page; the table lists other states whose official sources give the rule.
| State | What the official source says | From |
|---|---|---|
| California | Businesses must honor opt-out preference signals that meet certain requirements, such as the Global Privacy Control, as a valid request to opt out of sale or sharing (CPPA FAQ) | In force |
| Connecticut | Consumers can send an opt-out preference signal to tell all controllers they intend to opt out of targeted advertising and the sale of their data (Connecticut AG) | January 1, 2025 |
| Montana | Controllers must allow opt-out of targeted advertising or sale through an opt-out preference signal sent with the consumer's consent (MCA 30-14-2809) | No later than January 1, 2025 |
| New Hampshire | Controllers must allow opt-out of targeted advertising or sale through an opt-out preference signal (RSA 507-H) | Not later than January 1, 2025 |
| Texas | A consumer may designate an authorized agent using a technology to opt out; the technology may not use a default setting (Business and Commerce Code 541.055(e) and (f)) | January 1, 2025 |
| Oregon | Businesses have to honor opt-out signals that meet certain technical requirements, such as the Global Privacy Control (Oregon DOJ) | January 1, 2026 |
| Delaware | Universal opt-out mechanisms must be recognized by controllers as valid consumer requests (Delaware AG) | January 1, 2026 |
| Minnesota | A controller must allow opt-out of targeted advertising or sale through an opt-out preference signal (Minnesota Statutes 325M) | July 31, 2025 |
What do the laws say about targeted ads to teens and minors?
Several states add rules for young people, setting a higher bar, or a ban, for targeted advertising and sale when the controller knows, or in some laws should know, that the consumer is a minor. The wording differs, so the table quotes each official source.
| State | Age covered | Rule |
|---|---|---|
| Maryland | Under 18 | A controller may not process personal data for targeted advertising, or sell it, if the controller knew or should have known the consumer is under 18; separately, a controller may not sell sensitive data (Commercial Law 14-4707) |
| Connecticut | Under 18 | A controller shall not process a minor's data for purposes of targeted advertising or any sale, when it offers an online service, product or feature to minors (Connecticut AG) |
| Delaware | Under 18 | Opt-in consent before selling personal data or processing it for targeted advertising when the consumer is under 18 (Delaware AG) |
| Oregon | Under 16 | Businesses cannot use the data of consumers under 16 for targeted ads without permission, and teens 13 to 15 can deny permission themselves (Oregon DOJ) |
| Minnesota | 13 to 16 | No targeted advertising or sale without consent where the controller knows the consumer is between the ages of 13 and 16 (Minnesota Statutes 325M) |
| New Hampshire | 13 to 15 | No targeted advertising or sale without consent where the controller has actual knowledge, or wilfully disregards, that the consumer is at least 13 and younger than 16 (RSA 507-H) |
For children under 13, these laws generally point to the federal Children's Online Privacy Protection Act. Delaware's attorney general, for example, says controllers must follow COPPA's parental consent requirements when processing a child's data. The federal rule is covered on the COPPA programmatic advertising page.
What changed in California's rules for 2026 and after?
The CPPA's September 23, 2025 announcement (opens in a new tab) of approved regulations sets out a staggered schedule. Dates before October 2026 are in force; the later ones are upcoming.
| Requirement | Date | Status on October 21, 2026 |
|---|---|---|
| New regulations take effect | January 1, 2026 | In effect |
| Risk assessment compliance begins | January 1, 2026 | In effect |
| Automated decisionmaking technology requirements for significant decisions | January 1, 2027 | Upcoming |
| Risk assessment materials submitted to the CPPA | By April 1, 2028 | Upcoming |
| First cybersecurity audit certification, businesses over $100 million | April 1, 2028 | Upcoming |
How can a multi-state campaign plan document its data flows?
State laws attach to personal data. The checklist records facts for review. It does not decide whether a law applies, since each statute has its own applicability thresholds and exemptions.
Facts to record for a campaign running in several states
- The states the campaign will deliver in, matched against the in-force table above.
- How placements were chosen: page and site content only, or personal data from activity across nonaffiliated sites.
- Every tag, pixel and measurement script on the advertiser's site, and who receives its data.
- Whether the advertiser's site honors opt-out preference signals such as the Global Privacy Control.
- Whether any audience segment could include people under 18, and the age rules in the delivery states.
Fictional example
A home fitness retailer plans a Maryland and Minnesota campaign
Kestrava Fitness, a fictional online seller of home gym equipment, plans display ads in Maryland and Minnesota beside articles on strength training, running and home workouts. The planner builds the site list from article content, so placements are chosen by the context of the page being read.
The client also asks for a lookalike audience built from site visitors. The planner records it as a separate data flow, notes that both states set teen rules and include opt-out preference signal provisions, and sends the data flow sheet to the client's counsel before the audience is created.
How does PlacementGraph support contextual plans across states?
PlacementGraph builds the site selection layer of a plan from page content and public data.
Frequently asked questions
Can a browser turn on an opt-out signal by default?
Texas law says the technology a consumer uses to opt out through an authorized agent may not make use of a default setting, and must require the consumer to make an affirmative, freely given and unambiguous choice. Montana, New Hampshire and Minnesota describe the signal as sent with the consumer's consent. Each statute sets its own technical conditions.
Does Iowa's law include a right to opt out of targeted advertising?
Iowa's chapter 715D lists a right to opt out of the sale of personal data rather than a separate targeted advertising right. It does require a controller that sells personal data or engages in targeted advertising to disclose that activity clearly and conspicuously, along with how a consumer may opt out of it.
When do Oklahoma's and Alabama's privacy laws take effect?
Oklahoma's Senate Bill 546, approved by the governor on March 20, 2026, states that it becomes effective January 1, 2027. Alabama's HB 351 as enrolled states that it becomes effective on May 1, 2027. Neither was in force on October 21, 2026, so neither appears in this page's in-force table.
Does Maryland's law ban selling sensitive data?
Maryland's attorney general says businesses cannot sell your sensitive data, and section 14-4707 of the Commercial Law article lists selling sensitive data among the things a controller may not do. The same section bars targeted advertising and sale where the controller knew or should have known the consumer is under 18.
Sources
- California Consumer Privacy Act (CCPA) (opens in a new tab)California Attorney General
- Frequently Asked Questions (opens in a new tab)California Privacy Protection Agency
- CPPA announcement of approved regulations, September 23, 2025 (opens in a new tab)California Privacy Protection Agency
- Code of Virginia, Title 59.1, Chapter 53, Consumer Data Protection Act (opens in a new tab)Virginia General Assembly
- The Connecticut Data Privacy Act (opens in a new tab)Connecticut Attorney General
- Consumer privacy (opens in a new tab)Oregon Department of Justice
- Personal Data Privacy Portal, frequently asked questions (opens in a new tab)Delaware Attorney General
- Data privacy (opens in a new tab)Maryland Attorney General
- Commercial Law, section 14-4707 (opens in a new tab)Maryland General Assembly
- Minnesota Statutes, chapter 325M (opens in a new tab)Minnesota Office of the Revisor of Statutes
- RSA chapter 507-H (opens in a new tab)New Hampshire General Court
- Montana Code Annotated 30-14-2809 (opens in a new tab)Montana Legislature
- HB 4 as enrolled, 88th Legislature (opens in a new tab)Texas Legislature
- Iowa Code chapter 715D (opens in a new tab)Iowa Legislature
- SB 546 bill information (opens in a new tab)Oklahoma Legislature
- HB 351 enrolled (opens in a new tab)Alabama Legislature
- NJ Data Privacy Law FAQ (opens in a new tab)New Jersey Division of Consumer Affairs
Researched and written by PlacementGraph Research. Read how we research, source and update these pages. Corrections: diana@placementgraph.com.