Tools
Last Updated on December 22, 2025
Regulatory action is rising fast, and 2026 brings key dates that shape planning. Sixteen U.S. state laws are expected by year-end, and AI rules in the EU phase in across 20256
Enforcers are active. The California agency has pursued penalties, and GDPR fines topped €5.3 billion by late 2024. Global rules, plus the DOJ rule effective April 8, 2025, mean you must align operations, vendor checks, and subject rights handling.
You’ll learn which issues draw scrutiny—AI governance, consent, and tracking—and how to set priorities without slowing your business. Concrete timelines and counts, like ~3,000 subject requests per organization and state law rollouts, help you pace work and budget time.
This introduction sets the stage so your team can act, not react, as enforcement and expectations shift.
Key Takeaways
- Expect 16 state laws by the end of 2025; plan resources now.
- AI regulation phases in during 2025—map impacts to your systems.
- Enforcement is active: fines and investigations are real risks.
- Prioritize subject rights, vendor checks, and AI impact reviews.
- Use timelines and numbers to budget effort and reduce surprises.
Why your privacy strategy needs a present-day reset
When multiple states tighten rules at once, one-off fixes won’t protect your business for long. New laws in Delaware, Iowa, Nebraska, New Hampshire, and New Jersey — with more coming in Minnesota, Tennessee, and Maryland — create a complex compliance map you must navigate.
Start by treating compliance as ongoing operations, not a project. Recalibrate governance so it reflects how your organization actually collects and uses information today. That reduces rework and speeds approvals when stricter state provisions, like Maryland’s, apply.
Realign roles and practices to cover modern responsibilities: AI oversight, vendor risk, and security. Modern notices, consent, and use disclosures help consumers understand your practices and keep regulators satisfied.
- Build a scalable playbook for rights handling, incidents, and investigations.
- Use enforcement signals from the FTC and state enforcers to tune controls.
- Set a regular cadence to review policies and training as laws and your business change.
For a practical framework that ties legal requirements to daily operations, see this guide on building digital trust for business: digital trust and operating models.
data privacy trends shaping your next moves
You need a clear plan that links legal deadlines to product and security work. The EU AI Act milestones in 2025 and the expectation of 16 state laws by year-end force you to map out when to test, document, and deploy controls.
Regulatory momentum in the United States and abroad
U.S. states and EU rulemaking are compressing timelines. Use schedules from rulemaking calendars to sync legal, engineering, and compliance sprints.
AI’s ripple effects on consent, rights, and governance
AI rules like Colorado’s upcoming act and California’s ADMT rulemaking raise new obligations for explainability and oversight.
Document decision logic, update vendor contracts, and revise notices so your teams can answer rights requests and audits quickly.
Enforcement heat, private litigation, and operational risk
Enforcers and private litigants are active: CPPA investigations, FTC settlements, and lawsuits over tracking and chat tools show where risk concentrates.
“Act now to reduce inspection risk and costly remediation later.”
Create cross-functional rituals—legal, product, security, and data science—to review high-risk use cases before launch.
- Align processing records and impact assessments with real systems.
- Prioritize explainability and consumer rights in your rollout checklists.
- Monitor rulemaking calendars and enforcement signals to adjust timelines.
The growing state patchwork and how you stay compliant
State-level rules are multiplying fast, and that changes how you manage controls today. Five new comprehensive privacy laws took effect in January 2025. Minnesota and Tennessee follow in July, and Maryland’s Online Data Protection Act begins October 1. By year-end, 16 laws will be active.
More comprehensive laws coming online this year
These new statutes vary in scope, exceptions, and sensitive category rules. That makes a single template risky for companies that operate across state lines.
State enforcers stepping up actions
Enforcement is real: the CPPA and multiple state attorneys general are opening probes tied to unique provisions. Texas’ law adds a 30‑day cure window that favors quick remediation.
Adopt a nationwide baseline, then layer outliers
Start with a common baseline for notices, rights, consent, and security. Then add state-specific controls—like Maryland’s minimization rules—where required.
- Map flows and information sharing so you can answer inquiries fast.
- Align vendor contracts for deletion, access, and opt-outs.
- Build intake to classify requests by law and automate standard responses.
- Run cross-functional drills to meet cure periods and investigatory deadlines.
“Act quickly to show control and reduce enforcement risk.”
Your federal landscape: FTC focus areas and children’s privacy
You should prepare for focused scrutiny from federal authorities that tests everyday operations. Under incoming leadership, the agency looks set to favor case-by-case work over sweeping rulemaking.
Case-by-case enforcement under new leadership
What to expect: The FTC, likely chaired by Andrew Ferguson, has signaled skepticism about broad rules and preference for targeted actions. The 2022 ANPR on commercial surveillance did not move to a proposed rule, so the agency will use existing authority to bring cases that show harmful practices.
Children’s protections and COPPA updates
Children’s privacy remains a top priority. The FTC is reviewing December 2023 COPPA rule updates. You must align collection, parental consent, retention, and deletion practices with potential changes.
“Monitor enforcement signals closely and document design choices for high-risk features.”
- Stress-test consent flows, notices, and age-gating for mixed audiences.
- Document decisions and maintain quick responses for investigative demands.
- Validate vendors to avoid derivative exposure when federal actors act.
- Elevate federal signals to your risk register and remediation playbook.
AI regulation gains speed across jurisdictions
Regulators worldwide are converting AI guidance into enforceable milestones that affect your rollout plans.
EU AI Act timelines you need to plan for this year
The EU applies prohibitions for unacceptable‑risk systems from Feb 2, 2025, and adds rules for general‑purpose models on Aug 2, 2025.
Action: sequence risk assessments, documentation, and disclosures so your companies meet phased deadlines.
Colorado’s broad AI law and upcoming rulemaking preparing the ground
Colorado’s anti‑discrimination legislation takes effect in Feb 2026, but rulemaking is expected in 2025.
Prepare now by identifying high‑risk systems and building governance, testing, and monitoring before deployment.
California ADMT rules and new state proposals you should watch
California’s CPPA proposed ADMT rules focus on automated decision transparency, opt‑outs, and notices. Other states like Texas and Oregon are active too.
- Align one set of model cards, impact assessments, and testing results to meet multiple regimes.
- Update training data and documentation to show provenance, bias mitigation, and explainability.
- Map rights impacts and build escalation paths to handle enforcement inquiries quickly.
“Embed privacy by design with checkpoints for minimization and purpose limits.”
Subject rights requests surge while consent remains essential
Subject rights requests are surging, and many teams must scale fast to keep up. IAPP found the average organization handled about 3,000 SRRs in 2023, with North American teams nearer 3,500. With more laws effective in 2025, that number will rise.
Your cookie banners may be ready, but back-end SRR operations often are not. That gap creates a real pressure point this year.
SRRs becoming a front-line obligation for more organizations
Prepare for higher volumes: expanding coverage means more consumers will ask to access, delete, or opt out. Build intake that authenticates people securely while keeping friction low and accessible.
Building scalable intake, verification, and response processes
- Automate verification, search, and fulfillment across systems and vendors to avoid errors.
- Standardize response templates that explain what information you provide and how you honor rights.
- Connect consent records to SRR workflows so opt-outs and deletion propagate end to end.
- Inventory personal data locations, including unstructured repositories, so you can act fast.
- Measure cycle times, backlog, and quality so your organizations can prove reasonable, timely responses.
- Train teams on fraud patterns and identity proofing to prevent abuse while honoring legitimate requests.
“Turn SRR insight into product changes that reduce future operational load.”
Action: treat SRR handling as an operational function. Track metrics, refine practices, and loop findings into development so you lower volume and risk over time.
Biometrics and health data move to the front burner
Your handling of fingerprints, face scans, and health inferences will face closer legal and courtroom scrutiny.
States are broadening what counts as protected information. Illinois’ BIPA set the tone, but Texas and Washington now extend consent and retention duties to many biometric uses.
BIPA and expanding biometric requirements
Review where you capture or derive biometrics—authentication, safety, or analytics—and document lawful bases and limits.
Washington, Nevada, and Connecticut reshape consumer health rules
Washington’s My Health My Data Act is notable: it defines consumer health information broadly, includes inferred conditions, and creates a private right of action. Nevada and Connecticut take narrower approaches that hinge on using information to identify a condition or diagnosis.
- Audit collection, notice, consent, and deletion to align with new laws.
- Apply minimization, retention schedules, and access controls for sensitive data.
- Strengthen vendor diligence—confirm contracts cover purpose, retention, and deletion.
- Test flows so health inferences aren’t used for advertising or profiling.
- Build incident plans that reflect heightened risk and possible private suits.
“Tighten controls now to reduce litigation exposure and keep consumer trust.”
Action: map your services against Washington’s broad definition, tune disclosures for Nevada and Connecticut, and monitor state law shifts—Vermont may revisit similar proposals. Treat these protections as operational priorities, not legal checkboxes.
Data brokers under the microscope
Scrutiny of broker networks has sharpened, and that affects buyers and sellers alike. Regulators have pursued settlements and registration notices that reach beyond pure brokers to any company that supplies or purchases lists.
Federal and state actions targeting registration and sensitive location data
In December 2024 the FTC settled with two brokers over sale of precise location tied to sensitive places, citing weak consent checks. Texas’ broker registration law took effect in March 2024 and the AG has sent notices to over 100 companies. The CPPA brought actions in November 2024 for failures to register.
Managing risk when you buy from or sell to brokers
Act now: confirm whether your company qualifies as a broker and complete required registrations.
- Verify how partners collect consent for sensitive data and demand proof.
- Contractually require disclosure of sources, collection methods, and deletion practices for personal information.
- Test samples for leakage and implement kill‑switches if obligations aren’t met.
- Align notices and opt-outs so consumer expectations match broker‑derived audiences.
- Document risk assessments, audits, and decision rationales for each broker relationship.
“Track enforcement patterns so your company can remediate before letters arrive.”
Cross-border and foreign adversary restrictions you can’t ignore
Transfers that once felt routine can now trigger civil and criminal exposure. You must map cross-border flows and spot transactions that touch bulk information or protected populations.
PADFA (effective June 2024) bars brokers from selling or transferring Americans’ personally identifiable sensitive data to China, Russia, Iran, North Korea, or entities 20%+ controlled by them. The FTC enforces this law, so you should confirm whether you or your partners act as brokers.
DOJ rule and covered personal data transactions
The DOJ rule (effective April 8, 2025) restricts or prohibits certain transactions involving bulk U.S. personal data and government-related records. This regulation covers brokerage, vendor, employment, and investment agreements and carries steep penalties for willful breaches.
Practical steps for your team:
- Inventory cross-border flows and flag transfers that may touch sensitive data or implicate countries of concern.
- Screen ownership and control thresholds to detect foreign-adversary ties before deals close.
- Tighten contractual limits for vendors and brokers, and add approval gates for licensing and analytics partnerships.
- Strengthen data protection controls, update incident playbooks, and record enforcement-ready evidence of controls and exceptions handling.
- Brief executives on legal and national security impacts so companies can adjust deal structures and timelines.
“Treat international transfers as legal and security decisions, not just operational tasks.”
Litigation and communications risks on your websites and devices
Litigation over web tools and messaging has become a front‑line risk for brands and product teams. Courts and regulators are scrutinizing how chat tools, session replay, and pixels collect and transmit user signals.
Wiretapping, chat tools, and pixel-based claims intensifying
Plaintiffs filed nearly 1,970 federal suits in 2024 alleging violations under statutes like the California Invasion of Privacy Act and pen register theories. Claims often target chat recordings and pixels that transmit sensitive health or location information.
What you should do: audit chat, session replay, and pixel collection so disclosures and consent match actual collection and use. Segment flows that touch health or finance to reduce exposure.
TCPA’s new one-to-one consent and opt-out rules changing your outreach
The FCC updated TCPA rules in 2025, requiring one‑to‑one prior express written consent for certain messages and faster opt‑out honoring. You must keep messages topically associated with the consented subject.
Action: update consent capture to collect one‑seller authorization, and build omnichannel opt‑out handling that respects revocation within ten business days.
Designing consent and revocation flows that withstand scrutiny
Document consent provenance and retention so you can respond fast to enforcement or litigation. Link proof to campaigns, vendors, and content for rapid evidence production.
- Train marketing, product, and engineering on current case law and company practices.
- Implement runtime checks to block flows when consent or rights change.
- Validate copy and content to preserve topical association under TCPA rules.
- Keep counsel involved to update your playbook before complaints arrive.
“Design controls that stop risky transmissions and show clear proof of consent.”
Conclusion
Make the next steps simple: pick high‑impact fixes, assign owners, and measure results.
Focus on the few moves that cut risk fastest—SRR scale, AI governance, and state patchwork alignment. Set owners for EU AI Act dates, TCPA updates, and state law rollouts so timelines don’t slip.
Double down on security and data protection basics that support compliance across regulators. Train teams, streamline playbooks, and measure progress with KPIs tied to cycle times, SRR quality, and consent integrity.
Use a short, repeatable checklist for the rest of the year so your organizations and companies can act with clarity. For practical next steps, see our guide to operationalizing data-privacy work.
