New Year, New Rules: State Privacy Changes Taking Effect in 2027

California’s Opt Me Out Act will dramatically increase the number of automated opt-outs for the sale and sharing of personal information for targeted advertising purposes, while separate Delete Act amendments will accelerate data broker deletion workflows. Delaware has significantly expanded its existing privacy regime, while Oklahoma, Louisiana, and Alabama added a few novel state-specific variations. 

For additional background, see our previous alert, New State Privacy Laws Signal a Growing Partisan Divide.

California Makes Opt Out Ubiquitous

Beginning January 1, 2027, California’s AB 566 will require all major web browsers to feature a built-in, user-configurable one-click privacy switch (e.g., the Global Privacy Control (GPC)) that automatically communicates a visitor’s choice not to sell or share personal data. 

The update will prohibit businesses regulated by the California Consumer Privacy Act (CCPA) from developing or maintaining a browser without consumer-configurable functionality that sends an opt-out preference signal to businesses the consumer interacts with through that browser. California regulators now expect businesses to honor opt-out signals across identities. For example, if a consumer opts out using one email address, customer ID, or cookie ID, and the business can tie that identifier to another email address, IP address, cookie ID, or other identifier used by the same person, the opt out must apply across those linked identifiers.

The browser functionality must be easy for a reasonable person to locate and configure, and browser developers must publicly explain how the signal works and its intended effect. The requirement extends to desktop and mobile browsers operating in California, bringing the functionality to mainstream browsers such as Chrome, Safari, and Edge rather than the small set of browsers that has included DuckDuckGo and Brave, to date.

Delaware: Broader Scope, Lower Thresholds, and New Obligations

Delaware’s HB 380 brings significant changes to its current privacy regime and the overall privacy landscape. 

Applicability Drops to 10,000 Consumers

Beginning January 1, 2027, the Delaware Personal Data Privacy Act applies to persons doing business in Delaware or targeting Delaware residents that controlled or processed personal data of at least 10,000 consumers in the preceding calendar year, down from 35,000. HB 380 also revises the revenue-and-sales test, reaches certain third-party data buyers outside the ordinary numerical thresholds, and replaces the broad Gramm-Leach-Bliley Act (GLBA) entity exemption with narrower exemptions for specified regulated financial institutions and affiliates. The data-level GLBA exemption remains.

Sensitive Data Now Includes More Categories and Inferences

HB 380 adds national origin, neural data, financial-account credentials, government-issued identifiers, and specified health and status information (mental or physical health treatment or status, in addition to diagnosis, and treatment as transgender or nonbinary, in addition to status) to the definition of sensitive data. This means that controllers still must obtain the consumer’s opt-in consent before processing sensitive data, and may now process it only where reasonably necessary and proportionate to the purposes disclosed to the consumer, a stricter standard than the general data minimization rule limiting personal data collection to what is adequate, relevant, and reasonably necessary for the disclosed purposes. Delaware does not go as far as Maryland, which permits collecting or processing sensitive data only when strictly necessary to provide or maintain a product or service the consumer requested, regardless of consent. But Delaware does cover inferences used to identify sensitive characteristics. Companies should review both data collected directly and attributes created through analytics, segmentation, or profiling.

Sensitive-Data Sales Require Necessity, Notice, and Consent

Controllers may sell sensitive data only when the sale is strictly necessary to provide or maintain a product or service affirmatively requested by the consumer. Before the sale, the controller must provide clear and conspicuous notice of the data, purpose, and recipients and obtain consent. Consent records must be retained for five years and linked to applicable data protection assessments.

New Duties for Controllers and Data Recipients

• Third-party diligence and contracts. Controllers must evaluate data recipients and use contracts addressing permitted uses, safeguards, and assistance with consumer rights. This development is significant as “first of its kind” due diligence obligations imposed on controllers and processors. In the event of a violation, compliant controllers will not be deemed in violation due to an independent violation by a recipient (such as a vendor to whom it has disclosed personal data), provided the controller has undertaken reasonable diligence, oversight, and proper contracting. 
  • Under Delaware law, reasonable due diligence now involves, at a minimum, assessing the third party through the use of questionnaires and review of relevant documents of the third party. Additional reasonable measures must be undertaken in a manner that is commensurate with the sensitivity of the data disclosed by the controller to the processor or third party. 
• Profiling. The amendments add access, opt-out, assessment, and anti-discrimination requirements for profiling that produces legal or similarly significant effects.
• Minors’ data. Heightened restrictions apply when a controller knows or reasonably should know that a resident is a minor.
• Recipient transparency. Consumers may obtain specified information about third parties that received their data during the preceding 24 months. The Delaware law now also adds notice duties for certain adverse actions following third-party disclosures.

Oklahoma, Louisiana, and Alabama Add to the State Privacy Landscape

Oklahoma: Effective January 1, 2027

Oklahoma’s SB 546 takes a comparatively business-friendly approach, like Virginia. SB 546’s primary coverage threshold applies to businesses in Oklahoma that control or process the personal data of 100,000 Oklahoma consumers; while its secondary coverage threshold applies to businesses that process data of at least 25,000 consumers to derive more than 50% of gross revenue from personal-data sales — higher than the 25% revenue threshold used in many states. The law also limits a “sale” to an exchange for monetary consideration only, does not require recognition of universal opt-out preference signals, and provides a permanent 30-day opportunity to cure. In addition, SB 546 uses a relatively narrow sensitive-data definition, including a largely typical 1,750-foot standard for precise geolocation and a biometric data standard that excludes physical or digital photographs and audio or video recordings, unless processed to identify a specific individual. 

Louisiana: Effective January 1, 2027

Louisiana’s SB 386 is now one of two states that can trigger on revenue alone; a business may be covered solely by exceeding $25 million in annual gross revenue, without processing or selling any minimum volume of personal data. Notably, its alternative threshold counts households and devices as well as consumers. The law also requires companies to honor opt-out requests transmitted through browser or device settings and requires specific notices before sales of sensitive personal information or biometric data.

Alabama: Effective May 1, 2027

Alabama’s HB 351 exempts certain businesses with fewer than 500 employees and nonprofits with fewer than 100 employees, uses a distinctive “material benefit” test for some exchanges involving valuable consideration, requires recognition of opt-out preference signals, and — unlike many comprehensive state privacy laws — does not require data protection assessments.

Key Takeaways

• Prepare for mainstream browser opt-outs. Before AB 566 becomes operative on January 1, 2027, have your website scanned to ensure that your cookie management tools are configured properly and that GPC opt-out requests are honored. Regulators are already scanning websites and looking for targets. Identify disclosures that constitute a sale or sharing and assess the potential effect of greater opt-out adoption on targeting and measurement.
• Reassess state law applicability. Account for Delaware’s lower applicability thresholds and Louisiana’s revenue-only and household/device tests, and Alabama’s employee-count exemptions.
• Separate “sale” rules by state. Oklahoma uses a monetary-consideration standard, Louisiana reaches “other valuable consideration, and Alabama adds a material-benefit and downstream-use formulation.” Delaware places new conditions on sensitive-data sales.
• Map state-specific operational duties. Focus on Delaware’s new and unique vendor diligence and profiling rules, and the different cure structures in Alabama, Louisiana, and Oklahoma.

If you have any questions, please reach out to your ArentFox Schiff contact or a member of the Privacy & Data Security team.