Two different privacy-law stories collided in the middle of 2026, and it is easy to mix them up if you only skim the headlines. Vermont and Louisiana each signed a brand-new comprehensive privacy law this year, but neither one is in effect yet. At the same time, amendments to three laws that have been on the books for years, in Connecticut, Arkansas, and Utah, actually took effect on July 1. If your business tracks state privacy compliance by watching for new state names, you can miss the part that changes what you owe consumers right now.
That distinction matters for anyone maintaining a privacy policy today. The July 1 amendments impose new, live obligations on businesses already subject to Connecticut, Arkansas, or Utah law, mostly around how minors' data gets collected, sold, and profiled. Vermont's and Louisiana's new laws do not require anything of businesses yet. Confusing the two means either scrambling to comply with something that is not due, or missing a live deadline because a headline made it sound like the news was all about brand-new states.
Source: MultiState, "All of the Comprehensive Privacy Laws That Take Effect in 2026", captured August 2026.
What actually took effect July 1
Connecticut's amendment, SB 1295, was signed in June 2025 and became effective on July 1, 2026. It expands the state's definition of a protected minor to cover everyone from 13 through 17, not just consumers under 13, and it now bans targeted advertising and the sale of a minor's personal data outright once a business has actual knowledge, or willfully disregards knowledge, that the consumer falls in that age range, regardless of whether anyone consented. The amendment also restricts profiling minors and tracking their precise geolocation, bars using design features specifically to keep a minor engaged longer, and adds a new data protection impact assessment requirement for processing activities created on or after August 1, 2026.
Arkansas's change works through a separate law, the Arkansas Children and Teens' Online Privacy Protection Act, signed in April 2025 and effective the same July 1 date. It sits alongside the state's existing Arkansas Personal Data Protection Act, which already took effect back in 2025. The new teen-specific law makes Arkansas the first state to extend COPPA-style protections to teenagers rather than stopping at children under 13. A business needs verifiable parental consent to collect personal information from a child under 13, and for teens aged 13 through 16, either the teen or a parent can consent after receiving clear notice of how the data will be used. Targeted advertising to minors is prohibited outright.
Utah's amendment, HB 418, was signed in March 2025 and took effect the same day as Connecticut's and Arkansas's changes. It adds a right to correct inaccurate personal data to the Utah Consumer Privacy Act, something the original law never granted, and businesses now have 45 days to act on a correction request. The same bill also created the Utah Digital Choice Act, which requires social media platforms to support data portability and interoperability, including a user's social graph, when a Utah consumer asks to move their data elsewhere.
Figure: Time between when each 2026 privacy law was signed and when it took or takes effect. Connecticut, Arkansas, and Utah are amendments to laws already in force; Vermont and Louisiana are brand-new laws still ahead of their effective dates.
Why Vermont and Louisiana are a different story
Louisiana signed its Louisiana Data Privacy Act into law on May 29, 2026, making it the newest state with a comprehensive privacy statute on the books. That law does not take effect until January 1, 2027, giving covered businesses roughly seven months of runway from signing to compliance.
Vermont followed less than three weeks later, when the governor signed the Vermont Data Privacy and Online Surveillance Act on June 16, 2026. Vermont gave businesses the longest runway of the five laws in this batch: the law does not take effect until January 1, 2028, over eighteen months after it was signed. Neither Vermont's nor Louisiana's law changes what a business needs to disclose in its privacy policy today. What changed today, if you are covered by Connecticut, Arkansas, or Utah law, is real and enforceable now.
What this means for your privacy policy
If your business is already subject to the Connecticut Data Privacy Act, Arkansas's privacy statutes, or the Utah Consumer Privacy Act, July 1 was not a symbolic date. A policy that still describes minors' data handling the old way, or that omits a correction-rights process for Utah consumers, is now describing obligations that no longer match the law. Businesses that are not yet covered by Vermont's or Louisiana's laws do not need to rewrite anything for those two states today, but it is worth noting both effective dates on a compliance calendar well before 2027 and 2028 arrive, since a law with an eighteen-month runway is also a law that is easy to forget about until it is suddenly due.
Our Privacy Policy Generator keeps the minors' data, correction-rights, and portability language current with amendments like these as they take effect, so a policy written before July 1 does not quietly fall out of step with what Connecticut, Arkansas, and Utah now require.
The information in this article is for informational purposes only and should not be construed as legal advice on any matter, and does not create a lawyer-client relationship.
