United States: no federal GDPR, 23 state laws

On 16 June 2026, Vermont’s governor signed S.71, the state’s data privacy and online surveillance act. Vermont thus became the 23rd US state with a comprehensive personal data protection law, according to the IAPP count (international · IAPP), which leaves aside Florida’s narrower statute. As of 29 October 2026, 19 of these laws are in force. Four were passed this year, after a 2025 with no new law at all. At federal level, still nothing.

For a European company serving American customers, waiting for a “federal GDPR” is not a plan. US compliance is built state by state, with a new deadline almost every 1 January.

What is already in force

• Nineteen laws in force (international · IAPP): California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland and, since 1 January 2026, Indiana, Kentucky and Rhode Island.
• Three laws in force since 1 January 2026 (United States · legislatures of Indiana, Kentucky and Rhode Island): Indiana and Kentucky cover businesses processing the data of at least 100,000 consumers; Rhode Island, above 35,000.
• Maryland, the strictest law (United States (Maryland) · Attorney General): in force since 1 October 2025 and applicable to processing carried out since 1 April 2026, it bans the sale of sensitive data, even with consent, and limits its collection to what is “strictly necessary”.
• California, with a dedicated agency (United States (California) · CPPA): its regulations on automated decision-making, risk assessments and cybersecurity audits have been in force since 1 January 2026, with deadlines phased in until 2030. We return to them on 6 November.
• Thresholds are falling (United States (Delaware) · General Assembly): HB 380, signed on 2 September 2026, lowers the applicability threshold from 35,000 to 10,000 consumers from 1 January 2027.

What comes in 2027 and 2028

• Louisiana and Oklahoma, 1 January 2027 (United States · legislatures of both states): Louisiana covers, among others, businesses with more than USD 25 million in annual revenue; Oklahoma, those processing the data of 100,000 residents.
• Alabama, 1 May 2027 (United States (Alabama) · Legislature): a threshold of 25,000 consumers, but businesses with fewer than 500 employees that do not sell data are exempt, and no impact assessment is required.
• Vermont, 1 January 2028 (United States (Vermont) · General Assembly): a threshold of 35,000 consumers, or 3,000 for sensitive data; collection limited to what is “reasonably necessary and proportionate”; privacy notices must state whether data is used to train large language models.
• Massachusetts, under negotiation (United States (Massachusetts) · Legislature): each chamber has passed its own version and a conference committee is seeking a compromise this autumn. The House version would let individuals sue large data holders.
• A contested federal bill (United States · House of Representatives): the SECURE Data Act (H.R. 8413), introduced on 21 April 2026 by Republican congressman John Joyce, would replace most state laws. Heard on 3 June, it is opposed by the California agency and a coalition of 18 attorneys general. As of 29 October 2026, the congressional record shows no committee vote.

The real issue: a common core, but not the GDPR

The 23 laws resemble each other more than they differ. Almost all grant rights of access, correction, deletion and portability, a right to opt out of data sales, targeted advertising and profiling, and most require consent for sensitive data. The state attorney general enforces them; individuals cannot sue, except, in a limited way, in California.

But the logic remains the reverse of the GDPR. In Europe, every processing operation needs a legal basis (EU · GDPR, Article 6). In the United States, processing is allowed by default and it is up to the individual to object. GDPR compliance covers most of the rights, not the opt-out machinery: a “do not sell or share” link, refusal of targeted advertising, and honouring opt-out signals sent automatically by the browser, mandatory in Oregon since 1 January 2026.

Another gap: scope. The GDPR applies from the first data subject. US laws cover businesses that process the data of, most often, 25,000 to 100,000 state residents. They do not require a data protection officer, but several grant a 30- to 60-day period to cure a breach before any penalty.

Three points of vigilance

1. Thresholds are low, and falling. 35,000 residents in Maryland, Rhode Island or Vermont, 25,000 in Alabama, 10,000 in Delaware from 1 January 2027: a mid-sized European company selling online in the United States can cross them without knowing it.

2. Sensitive data is not treated the same way everywhere. Maryland bans its sale, even with consent. Vermont will prohibit geofencing within 1,850 feet (about 560 metres) of a healthcare facility to identify, track or target a person in relation to their health data.

3. Federal pre-emption is not a strategy. The main bill under discussion was drafted without Democratic support and stalls on pre-empting state laws. Nobody can say when, or whether, a federal law will pass. Until then, every state deadline applies.

What a European company should do

1. Count its US residents state by state, customers and prospects alike, and compare them with each law’s threshold.
2. Take the strictest law as the benchmark: Maryland for minimisation and sensitive data, California for automated decisions.
3. Build the opt-out machinery: a “do not sell or share” link, opt-outs from targeted advertising and profiling, and recognition of automatic browser signals.
4. Collect explicit consent for sensitive data, and stop selling it where sales are banned.
5. Reuse GDPR impact assessments as the basis for the assessments required by most states, including Louisiana, Oklahoma and Vermont, adding what each law demands.
6. Review processor contracts: all four 2026 laws require a contract with every provider processing the data.
7. Put the next dates in the diary: 1 January 2027, 1 May 2027, 1 January 2028.

In the United States, privacy has no federal law: it has a calendar.

The question to ask on Monday morning

To your data protection officer: “How many residents of each US state do we hold in our databases, and which thresholds will we cross on 1 January 2027?”