New state privacy laws 2027: Oklahoma, Louisiana, Alabama, and Vermont in 2028

Summary. Four US states enacted comprehensive privacy laws in the first half of 2026, taking the count to 24 if Florida is included, but only three take effect in 2027. Oklahoma's SB 546 (signed 20 March 2026) and the Louisiana Data Privacy Act (SB 386, Act 502, signed 29 May 2026) apply from 1 January 2027; the Alabama Personal Data Protection Act (HB 351, signed 16 April 2026) applies from 1 May 2027. Vermont's Act 145 (S.71, signed 16 June 2026) takes effect on 1 January 2028 under its enacted text, not 1 January 2027 as one widely read roundup lists. Oklahoma needs 100,000 consumers in a calendar year; Louisiana covers any business there with more than $25 million in revenue, or 75,000 consumers, households or devices; Alabama starts above 25,000 consumers but exempts businesses under 500 employees that do not sell data; Vermont starts at 35,000 consumers, or 3,000 where sensitive data or sales are involved. Penalties reach $7,500 per violation in Oklahoma and $15,000 in Alabama, cure periods run 30 to 60 days, and none of the four creates a private lawsuit. Delaware's amended law also changes on 1 January 2027.

About this article. For US privacy, product and data teams, and offshore vendors who process data for them. We read the enrolled Oklahoma and Alabama bills on the legislature sites, and Louisiana's Act 502 and Vermont's Act 145 as archived copies of the official PDFs, because both legislature sites were unreachable from our network on the check date of 1 November 2026. Amendments to other states' laws come from law firm summaries and are marked as reported. This is general information, not legal advice, so confirm applicability with counsel. No vendor paid for inclusion. Researched with AI assistance and reviewed by our editorial team.

What takes effect, and when

The headline for 2027 is three new laws, not four. Privacy World's August 2026 roundup lists Vermont as effective 1 January 2027, but Section 4 of Act 145 sets 1 January 2028, and the Vermont legislature marks every new section that way. CalPrivacy's August 2026 briefing and Hunton's summary agree on 2028. The table draws on the enacted texts, with Privacy World and Hunton for amendments.

Comparison table: the four new state privacy laws

Every row was read against the enacted texts.

Oklahoma SB 546: in force 1 January 2027

The Oklahoma Legislature records the Governor's approval on 20 March 2026, and Privacy World calls it the first comprehensive state privacy law of the year.

Scope. It applies to a controller or processor that does business in Oklahoma, or targets its residents, and that in a calendar year processes personal data of at least 100,000 consumers, or of at least 25,000 consumers while earning more than 50% of gross revenue from selling personal data. Employment data is excluded.

Sale. A sale is an exchange for monetary consideration only, a minority approach by Privacy World's count.

Duties. Consumers can confirm, access, correct and delete data, and opt out of targeted advertising, sale and solely automated profiling with legal or similarly significant effects. Controllers answer within 45 days (extendable by 45), must answer appeals within 60 days, and need consent for sensitive data, including precise geolocation within 1,750 feet. The act has no duty to recognise universal opt-out signals and no authorised agent route.

Assessments. Required for targeted advertising, sales, risky profiling, sensitive data and other heightened-risk processing, but only for activities that commence on or after 1 January 2027.

Enforcement. The Attorney General enforces exclusively, after a 30-day cure period, with civil penalties up to $7,500 per violation. Section 14 rules out a private right of action.

Louisiana Data Privacy Act: in force 1 January 2027

The act creates R.S. 51:1780.1 to 1780.5, and Section 2 of the enrolled bill sets 1 January 2027. Covington reports the Governor signed it on 29 May 2026.

Scope is the surprise. It applies to a person or entity doing business in Louisiana that meets any one test: annual gross revenue above $25 million; annually buying, receiving, selling or sharing the personal information of 75,000 or more consumers, households or devices; or deriving 50% or more of revenue from selling personal information. The revenue test ignores how many Louisiana residents you serve, so a large national brand with a small Louisiana base can be in scope.

Sensitive data. Processing needs consent. A business earning 50% or more of revenue from selling personal information also needs prior consent to sell sensitive data. Any controller selling sensitive data must post NOTICE: We may sell your sensitive personal data. and a parallel notice applies to biometric data.

Rights and requests. The usual rights apply, with 45 days to respond plus a 45-day extension. Controllers need two or more secure request methods, though an online-only business with a direct relationship may offer just an email address. Appeals must be answered within 60 days.

Opt-out signals. A consumer may appoint an authorised agent through a website link, a browser setting or extension, or a global device setting, to opt out of targeted advertising or sale. The technology may not rely on a default setting. The controller must comply if it can verify the consumer and the agent's authority with commercially reasonable effort. It need not comply if the request is unclear, it cannot verify Louisiana residency with that effort, it cannot process the request, or it does not process similar requests under other states' laws. CalPrivacy reads Louisiana as requiring businesses to honour signals from January 2027, so treat those exits cautiously until the Attorney General gives guidance.

Assessments and enforcement. Assessments apply as of 1 January 2027, on the same model as Oklahoma. Violations are unfair trade practices enforced by the Attorney General, with private actions under that law excluded. Until 31 July 2027 the Attorney General must give 30 days' written notice and cannot investigate if the business cures and documents the fix.

Alabama Personal Data Protection Act: in force 1 May 2027

Governor Kay Ivey signed the act on 16 April 2026, and Privacy World reports unanimous votes in both chambers. Section 12 of the enrolled act sets 1 May 2027.

Scope. It applies to persons doing business in Alabama, or targeting its residents, that process personal data of more than 25,000 consumers (excluding payment-only data), or derive more than 25% of gross revenue from selling personal data. Neither test names a period.

The small-business carve-out. A business with fewer than 500 employees is exempt if it does not sell personal data, as is a nonprofit with fewer than 100 employees that does not sell. A sale means an exchange for money, or for other valuable consideration where the controller gets a material benefit and the third party is not restricted in later use. It excludes disclosures for analytics services, and for marketing services provided solely to the controller.

Opt-out route. Section 6(b) of the enrolled act requires a clear and conspicuous website link to a page where the consumer can opt out of targeted advertising or sale, or to current contact details for doing so. The engrossed House bill also offered an alternative of honouring opt-out preference signals by 1 January 2028, but that option was removed before final passage. A leftover clause in Section 6(c) still covers signals that conflict with existing settings. Privacy World's April analysis says the act does not require honouring GPC, which matches our reading, though its August roundup groups Alabama with signal states.

Other duties. Sensitive data needs consent, and targeted advertising or sale needs consent where the controller actually knows the consumer is 13 to 15. There is no appeal right and no assessment requirement.

Enforcement. The Attorney General must send a notice and allow 45 days to correct, with no sunset date. After that, courts may impose civil penalties of up to $15,000 per violation. The act names only the Attorney General, though it does not expressly bar private suits as Oklahoma and Vermont do.

Vermont Data Privacy and Online Surveillance Act: in force 1 January 2028

Vermont enacted S.71 as Act 145, signed on 16 June 2026. It carries the most demanding duties of the four and starts a year after Louisiana and Oklahoma.

Scope. It applies to a person doing business in Vermont, or targeting its residents, that in the preceding calendar year controlled or processed personal data of 35,000 or more consumers, sensitive data of 3,000 or more consumers, or offered for sale the personal data of 3,000 or more consumers. The consumer health data rules apply whatever the size. The enacted exemptions list banks, HIPAA entities and GLBA data, but no general nonprofit or university exemption.

Distinctive duties.

• Personal data includes derived data, such as inferences drawn from information about a consumer's device.

• No targeted advertising to, and no sale of data about, consumers aged 13 to 17 where the controller has actual knowledge and wilfully disregards their age.

• Consent is needed to sell sensitive data and consumer health data, and geofences within 1,850 feet of health care facilities are banned for health tracking.

• The privacy notice must say whether the controller collects, uses or sells personal data to train large language models.

• Consumers can opt out of profiling, question the result and, for housing decisions, have it re-evaluated on corrected data.

Opt-out signals. Controllers must honour opt-out preference signals, but the mechanism must not use a default setting and must require an affirmative choice. A browser that sends GPC by default may not qualify.

Enforcement. The Attorney General enforces under the Vermont Consumer Protection Act. Private lawsuits are barred, but Section 2 says the legislature may consider adding them if the Attorney General's office lacks resources. Until 30 June 2029 the Attorney General must give notice and 60 days to cure where a cure is possible.

Other 2027 changes in existing state laws

• Delaware: Hunton reports HB 380, signed on 2 September 2026, takes effect on 1 January 2027. It cuts the main threshold from 35,000 to 10,000 consumers, and from 10,000 to 5,000 for businesses earning more than 20% of gross revenue from sales, and adds third-party contract and due diligence duties.

• New Hampshire and Utah: Privacy World reports New Hampshire's ban on selling data of children under 13, and Utah's extension to motor vehicle manufacturers, both from 1 January 2027.

• California: browsers must offer opt-out preference signals from 1 January 2027, and the ADMT rules apply from the same date. Our guide to California's browser opt-out signal law covers the tag changes. On 6 November 2026 CalPrivacy's Board considers opening formal rulemaking on signals, which would name GPC as an example.

• Already in force: Connecticut and Virginia ban sales of precise geolocation data, and Maryland and New Jersey ban sales of sensitive data, according to Privacy World.

• Watch: MultiState reports a Massachusetts conference committee is working on privacy bills passed by both chambers.

CalPrivacy counts at least a dozen states that already require businesses to honour opt-out signals. Senator Ron Wyden wrote on 3 August 2026 to attorneys general in 10 of those states and to the CalPrivacy Board chair, urging guidance against using IP geolocation to ignore signals. Honouring GPC nationally is becoming the practical default.

Do these laws apply to you? A decision table

Worked example: one company, four thresholds

A hypothetical US subscription retailer has $40 million in annual revenue and 300 employees, and shares website data with advertising platforms. In 2026 it served 60,000 Oklahoma consumers, 20,000 in Louisiana, 30,000 in Alabama and 12,000 in Vermont, of whom 4,000 gave health-related information.

• Oklahoma: 60,000 is below 100,000, and it does not earn over 50% of revenue from sales. Out of scope.

• Louisiana: $40 million is above the $25 million test. In scope from 1 January 2027, even though 20,000 consumers is below 75,000.

• Alabama: 30,000 is above 25,000, but 300 employees is below 500, so it is exempt unless it sells personal data. If its ad platform terms restrict how partners use the data, it may not sell. Ask counsel: the answer decides scope.

• Vermont (2028): the test looks at the preceding year, so 2027 counts. If 2027 looks like 2026, 12,000 is below 35,000, but 4,000 consumers' sensitive data is above 3,000. In scope from 1 January 2028.

Four laws, three different answers. Count consumers by state from your CRM and analytics now.

A note for Indian and offshore teams

Many Indian IT and SaaS firms act as processors for US clients. All four laws require a controller-processor contract covering instructions, confidentiality, deletion or return of data and information that shows compliance; only Vermont adds a chance for the controller to object to subcontractors. India's DPDP Act is a separate question, which our DPDP engineering playbook covers.

Compliance checklist for 1 January 2027

1. Count consumers by state for 2026 and record the method; repeat each year.

1. Test Louisiana's revenue threshold separately, and recheck Delaware at 10,000 consumers.

1. Map sale and targeted advertising flows per vendor, using each state's definition.

1. Run data protection assessments for targeted advertising, sales, profiling and sensitive data (Oklahoma and Louisiana).

1. Update privacy notices: Louisiana's sale notices; Oklahoma's and Alabama's categories of data shared and recipients.

1. Provide two or more request methods and appeals answered within 60 days.

1. Honour opt-out signals nationally, and add Alabama's website opt-out link by May 2027.

1. Add teen controls for Alabama by May 2027 and Vermont by January 2028.

1. Review processor contracts and Vermont's subcontractor objection right.

1. Plan Vermont work for 2027: the LLM training disclosure, health data rules and assessments.

How eCorpIT can help

eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. Our data and analytics services team builds the data maps, per-state consumer counts and opt-out pipelines these laws assume, alongside your counsel. Talk to us at /contact-us/.

Last updated: 1 November 2026.

References

1. Twenty-Four States Now Have Comprehensive Consumer Privacy Laws, 28 October 2026 — MultiState

1. Bill information for SB 546, 2026 session — Oklahoma Legislature

1. Louisiana Enacts Comprehensive Privacy Law, 5 June 2026 — Covington, Inside Privacy

1. The Heart of Dixie Embraces Consumer Privacy, 20 April 2026 — Privacy World, Squire Patton Boggs

1. Act 145 (S.71) as enacted: Vermont Data Privacy and Online Surveillance Act — Vermont General Assembly

1. Adding to the Count: The latest in state consumer privacy laws, 17 August 2026 — Privacy World, Squire Patton Boggs

1. Delaware Expands State Privacy Law, 10 September 2026 — Hunton Andrews Kurth

1. Bill status, S.71 (Act 145), statutes affected and effective dates — Vermont General Assembly

1. Board informational session on opt-out preference signals, 6 August 2026 — California Privacy Protection Agency

1. Vermont Becomes 23rd State with Comprehensive Consumer Privacy Law, 17 June 2026 — Hunton Andrews Kurth

1. Enrolled Senate Bill 546 — Oklahoma Legislature

1. SB 386 enrolled, Act 502: Louisiana Data Privacy Act — Louisiana Legislature

1. HB 351 enrolled: Alabama Personal Data Protection Act — Alabama Legislature

1. California Consumer Privacy Act, effective 1 January 2026 — California Privacy Protection Agency

1. Oklahoma's New Privacy Law Sweeps In, 26 March 2026 — Privacy World, Squire Patton Boggs

1. HB 351 engrossed — Alabama Legislature

1. California Finalizes Regulations to Strengthen Consumers' Privacy, 23 September 2025 — California Privacy Protection Agency

1. Agenda Item 9 cover memo, proposed amendments on opt-out preference signals, 6 November 2026 — California Privacy Protection Agency

1. Letter to attorneys general on Global Privacy Control, 3 August 2026 — Senator Ron Wyden, hosted by Privacy World