{
  "dataset": {
    "slug": "privacy-laws-2026",
    "name": "2026 U.S. State Privacy Rights & Deletion Tracker",
    "description": "A staged PrivScrub dataset of U.S. state privacy-rights and data-broker deletion changes with official-source URLs and source-check dates.",
    "asOf": "2026-06-29",
    "canonicalUrl": "https://privscrub.com/privacy-laws",
    "jsonUrl": "https://privscrub.com/data/privacy-laws.json",
    "csvUrl": "https://privscrub.com/data/privacy-laws.csv",
    "embedUrl": "https://privscrub.com/embed/privacy-laws",
    "license": "https://creativecommons.org/licenses/by/4.0/",
    "disclaimer": "Informational research only. This dataset is not legal advice and should be checked against the official source before acting."
  },
  "items": [
    {
      "slug": "california",
      "changeSlug": "california-drop",
      "state": "California",
      "stateCode": "CA",
      "lawName": "CCPA/CPRA plus the Delete Request and Opt-Out Platform (DROP)",
      "status": "in-effect",
      "effectiveDate": "2026-01-01",
      "effectiveLabel": "DROP consumer request intake begins",
      "changeMonth": "2026-01",
      "changeType": "Data broker deletion platform",
      "summary": "California privacy rights were already in force; the 2026 dated change is DROP, the official platform for sending deletion requests to registered data brokers.",
      "coveredEntities": "California-covered businesses and registered data brokers. Scope depends on the California privacy law or data-broker rule being used.",
      "rights": [
        {
          "key": "delete",
          "label": "Delete",
          "available": true,
          "summary": "Consumers can use California privacy rights and DROP to request deletion of personal information held by registered data brokers.",
          "sourceUrl": "https://privacy.ca.gov/drop/"
        },
        {
          "key": "access",
          "label": "Access / know",
          "available": true,
          "summary": "California's official consumer-rights guidance describes rights to know/access personal information.",
          "sourceUrl": "https://privacy.ca.gov/california-privacy-rights/rights-under-the-california-consumer-privacy-act/"
        },
        {
          "key": "optOutSale",
          "label": "Opt out of sale or sharing",
          "available": true,
          "summary": "California's official consumer-rights guidance describes opt-out rights for sale or sharing of personal information.",
          "sourceUrl": "https://privacy.ca.gov/california-privacy-rights/rights-under-the-california-consumer-privacy-act/"
        },
        {
          "key": "correct",
          "label": "Correct",
          "available": true,
          "summary": "California's official consumer-rights guidance describes a correction right.",
          "sourceUrl": "https://privacy.ca.gov/california-privacy-rights/rights-under-the-california-consumer-privacy-act/"
        }
      ],
      "enforcementAuthority": "California Privacy Protection Agency and California Attorney General, depending on the rule context.",
      "penaltySummary": "No dollar penalty is summarized in this staged row; check CPPA or California enforcement materials before quoting a fine.",
      "howToExercise": "Start with the CPPA consumer-rights page; for data brokers, use the official DROP site.",
      "howToExerciseUrl": "https://privacy.ca.gov/drop/",
      "officialSourceLabel": "California Privacy Protection Agency DROP",
      "officialSourceUrl": "https://privacy.ca.gov/drop/",
      "secondarySources": [
        {
          "label": "California Consumer Privacy Rights",
          "url": "https://privacy.ca.gov/california-privacy-rights/rights-under-the-california-consumer-privacy-act/"
        }
      ],
      "sourceCheckedAt": "2026-06-29",
      "verified": true,
      "noindex": true,
      "tools": ["pii-scanner", "remove-image-metadata", "redact-pdf"],
      "notes": [
        "The official DROP page says consumers can start submitting deletion requests on January 1, 2026.",
        "The official DROP page says registered data brokers begin processing DROP requests on August 1, 2026 and at least every 45 days after that."
      ]
    },
    {
      "slug": "indiana",
      "changeSlug": "indiana-icdpa-effective",
      "state": "Indiana",
      "stateCode": "IN",
      "lawName": "Indiana Consumer Data Protection Act (ICDPA)",
      "status": "in-effect",
      "effectiveDate": "2026-01-01",
      "effectiveLabel": "ICDPA takes effect",
      "changeMonth": "2026-01",
      "changeType": "State comprehensive privacy law effective date",
      "summary": "Indiana's official consumer bill-of-rights material lists January 1, 2026 as the effective date and describes consumer access, deletion, correction, portability, opt-out, and appeal rights.",
      "coveredEntities": "Businesses that meet the Indiana law's applicability thresholds; verify coverage in the official law before applying it to a specific business.",
      "rights": [
        {
          "key": "delete",
          "label": "Delete",
          "available": true,
          "summary": "The official Indiana consumer bill of rights describes a right to delete personal data provided by or obtained about the consumer.",
          "sourceUrl": "https://www.in.gov/attorneygeneral/files/Indiana-Consumer-Data-Protection-Consumer-Bill-of-Rights_Web.pdf"
        },
        {
          "key": "access",
          "label": "Access",
          "available": true,
          "summary": "The official Indiana consumer bill of rights describes a right to confirm processing and access personal data.",
          "sourceUrl": "https://www.in.gov/attorneygeneral/files/Indiana-Consumer-Data-Protection-Consumer-Bill-of-Rights_Web.pdf"
        },
        {
          "key": "optOutSale",
          "label": "Opt out",
          "available": true,
          "summary": "The official Indiana consumer bill of rights describes opt-out rights for targeted advertising, sale of personal data, and certain profiling.",
          "sourceUrl": "https://www.in.gov/attorneygeneral/files/Indiana-Consumer-Data-Protection-Consumer-Bill-of-Rights_Web.pdf"
        },
        {
          "key": "correct",
          "label": "Correct",
          "available": true,
          "summary": "The official Indiana consumer bill of rights describes a right to correct inaccuracies.",
          "sourceUrl": "https://www.in.gov/attorneygeneral/files/Indiana-Consumer-Data-Protection-Consumer-Bill-of-Rights_Web.pdf"
        }
      ],
      "enforcementAuthority": "Indiana Attorney General.",
      "penaltySummary": "No dollar penalty is summarized in this staged row; check the official Indiana Code before quoting a fine.",
      "howToExercise": "Use the business's privacy request channel first; the official Indiana material points consumers to the Attorney General complaint path if a request is denied or ignored.",
      "howToExerciseUrl": "https://www.in.gov/attorneygeneral/files/Indiana-Consumer-Data-Protection-Consumer-Bill-of-Rights_Web.pdf",
      "officialSourceLabel": "Indiana Attorney General consumer bill of rights",
      "officialSourceUrl": "https://www.in.gov/attorneygeneral/files/Indiana-Consumer-Data-Protection-Consumer-Bill-of-Rights_Web.pdf",
      "secondarySources": [],
      "sourceCheckedAt": "2026-06-29",
      "verified": true,
      "noindex": true,
      "tools": ["pii-scanner", "redact-pdf", "clean-pdf-metadata"],
      "notes": [
        "Keep business coverage, cure period, and penalty details source-checked before expanding the page."
      ]
    },
    {
      "slug": "kentucky",
      "changeSlug": "kentucky-kcdpa-effective",
      "state": "Kentucky",
      "stateCode": "KY",
      "lawName": "Kentucky Consumer Data Protection Act (KCDPA)",
      "status": "in-effect",
      "effectiveDate": "2026-01-01",
      "effectiveLabel": "KCDPA takes effect",
      "changeMonth": "2026-01",
      "changeType": "State comprehensive privacy law effective date",
      "summary": "Kentucky's Attorney General privacy page lists January 1, 2026 as the effective date and describes consumer rights to confirm, access, delete, correct, obtain, and opt out.",
      "coveredEntities": "Businesses meeting KCDPA applicability thresholds; verify the official page before applying to a specific business.",
      "rights": [
        {
          "key": "delete",
          "label": "Delete",
          "available": true,
          "summary": "The Kentucky Attorney General page describes a consumer right to delete personal data provided by or obtained about the consumer.",
          "sourceUrl": "https://www.ag.ky.gov/about/Office-Divisions/ODP/KCDPA/Pages/default.aspx"
        },
        {
          "key": "access",
          "label": "Access",
          "available": true,
          "summary": "The Kentucky Attorney General page describes rights to confirm processing and access personal data.",
          "sourceUrl": "https://www.ag.ky.gov/about/Office-Divisions/ODP/KCDPA/Pages/default.aspx"
        },
        {
          "key": "optOutSale",
          "label": "Opt out",
          "available": true,
          "summary": "The Kentucky Attorney General page describes opt-out rights for targeted advertising, sale of personal data, and certain profiling.",
          "sourceUrl": "https://www.ag.ky.gov/about/Office-Divisions/ODP/KCDPA/Pages/default.aspx"
        },
        {
          "key": "correct",
          "label": "Correct",
          "available": true,
          "summary": "The Kentucky Attorney General page describes a right to correct inaccuracies.",
          "sourceUrl": "https://www.ag.ky.gov/about/Office-Divisions/ODP/KCDPA/Pages/default.aspx"
        }
      ],
      "enforcementAuthority": "Kentucky Attorney General.",
      "penaltySummary": "The Kentucky Attorney General page says violations can carry civil penalties of up to $7,500 per violation.",
      "howToExercise": "Use the business's consumer request process first; the Kentucky Attorney General page provides the state consumer privacy reference.",
      "howToExerciseUrl": "https://www.ag.ky.gov/about/Office-Divisions/ODP/KCDPA/Pages/default.aspx",
      "officialSourceLabel": "Kentucky Attorney General KCDPA page",
      "officialSourceUrl": "https://www.ag.ky.gov/about/Office-Divisions/ODP/KCDPA/Pages/default.aspx",
      "secondarySources": [],
      "sourceCheckedAt": "2026-06-29",
      "verified": true,
      "noindex": true,
      "tools": ["pii-scanner", "redact-pdf", "inspect-pdf"],
      "notes": [
        "The row keeps the official AG source as the source of record for date, rights, enforcement, and penalty summary."
      ]
    },
    {
      "slug": "rhode-island",
      "changeSlug": "rhode-island-dtppa-effective",
      "state": "Rhode Island",
      "stateCode": "RI",
      "lawName": "Rhode Island Data Transparency and Privacy Protection Act (DTPPA)",
      "status": "in-effect",
      "effectiveDate": "2026-01-01",
      "effectiveLabel": "DTPPA takes effect",
      "changeMonth": "2026-01",
      "changeType": "State privacy law effective date",
      "summary": "Rhode Island's official bill text lists January 1, 2026 as the effective date and includes consumer access, delete, correct, portability, and opt-out rights.",
      "coveredEntities": "Entities covered by the Rhode Island Act; verify applicability and exemptions in the official bill text before relying on it.",
      "rights": [
        {
          "key": "delete",
          "label": "Delete",
          "available": true,
          "summary": "The official Rhode Island bill text includes a right to delete personal data provided by or obtained about the customer.",
          "sourceUrl": "https://webserver.rilegislature.gov/BillText/BillText24/HouseText24/H7787A.pdf"
        },
        {
          "key": "access",
          "label": "Access",
          "available": true,
          "summary": "The official Rhode Island bill text includes a right to confirm processing and access personal data.",
          "sourceUrl": "https://webserver.rilegislature.gov/BillText/BillText24/HouseText24/H7787A.pdf"
        },
        {
          "key": "optOutSale",
          "label": "Opt out",
          "available": true,
          "summary": "The official Rhode Island bill text includes opt-out rights for targeted advertising, sale of personal data, and certain profiling.",
          "sourceUrl": "https://webserver.rilegislature.gov/BillText/BillText24/HouseText24/H7787A.pdf"
        },
        {
          "key": "correct",
          "label": "Correct",
          "available": true,
          "summary": "The official Rhode Island bill text includes a right to correct inaccuracies.",
          "sourceUrl": "https://webserver.rilegislature.gov/BillText/BillText24/HouseText24/H7787A.pdf"
        }
      ],
      "enforcementAuthority": "Rhode Island Attorney General.",
      "penaltySummary": "The official bill text describes civil penalties from $100 to $500 for each intentional disclosure of personal data to a shell entity.",
      "howToExercise": "Use a covered business's privacy request channel first; source-check the official bill text for deadlines and exemptions.",
      "howToExerciseUrl": "https://webserver.rilegislature.gov/BillText/BillText24/HouseText24/H7787A.pdf",
      "officialSourceLabel": "Rhode Island General Assembly bill text H7787A",
      "officialSourceUrl": "https://webserver.rilegislature.gov/BillText/BillText24/HouseText24/H7787A.pdf",
      "secondarySources": [],
      "sourceCheckedAt": "2026-06-29",
      "verified": true,
      "noindex": true,
      "tools": ["pii-scanner", "redact-pdf", "remove-image-metadata"],
      "notes": [
        "Use official Rhode Island updates before adding implementation guidance beyond the bill text."
      ]
    }
  ]
}