Your privacy program now needs to cover 24 state laws, up from 20 at the start of 2026. Alabama, Louisiana, Oklahoma, and Vermont joined the roster this year. If you're still treating each state law as a separate project, you're doing it wrong.
The good news: most of these laws follow a nearly identical structure. The challenge: you still need to build a program that scales across jurisdictions without tripling your workload. Here's how to implement a unified compliance approach that covers the common framework while flagging the exceptions that matter.
The Problem: Why This Matters Now
Your organization probably operates in multiple states. Unless you're exclusively B2B or fall under one of Florida's narrow thresholds (more than $1 billion in global revenue plus specific tech criteria), you're in scope for most of these laws. Treating each state as a standalone compliance project creates redundant work, conflicting policies, and audit gaps.
The convergence around a common framework means you can build one baseline program and layer in state-specific requirements only where they diverge. But you need to know which variations actually require different controls and which are just semantic differences.
What You Need Before Starting
Before you implement anything, confirm:
- Jurisdictional scope: Which states' laws apply to your operations? Don't assume all 24 apply. Review revenue thresholds, data volume triggers, and exemptions.
- Data inventory: You can't comply with access, deletion, or correction rights if you don't know where consumer data lives. Map data flows across systems, vendors, and cloud environments.
- Current state assessment: Document what you already have. Most organizations already handle some privacy rights through support tickets or manual processes. Identify what's working and what breaks at scale.
- Vendor contracts: Your service providers need to support your compliance obligations. Review data processing agreements for language covering processor obligations, data subject rights, and security requirements.
Step-by-Step Implementation
1. Build Your Baseline Consumer Rights Framework
Start with the rights that appear in every state law:
- Access: Consumers can request a copy of their personal information.
- Deletion: Consumers can request deletion of their personal information.
- Correction: Consumers can request correction of inaccurate personal information.
- Opt-out of targeted advertising: Consumers can opt out of processing for behavioral advertising.
- Opt-out of sale: Consumers can opt out of selling or sharing their personal information.
Implement a centralized intake mechanism. This can be a web form, email address, or toll-free number. The intake point should:
- Verify the requestor's identity (balance security with accessibility; don't require notarized affidavits for low-risk requests).
- Categorize the request type.
- Route to the appropriate team for fulfillment.
- Track response deadlines (typically 45 days, with one 45-day extension if needed).
For technical implementation, you need:
- Request management system: This can be a ticketing system (Jira, ServiceNow) with custom workflows, a dedicated privacy management platform (OneTrust, TrustArc, Securiti), or a purpose-built solution. The system must track deadlines, log communications, and generate audit trails.
- Data retrieval automation: Script queries against your databases to pull consumer data. For example, if you're running PostgreSQL:
SELECT * FROM users WHERE email = '[consumer_email]'
UNION ALL
SELECT * FROM orders WHERE user_email = '[consumer_email]'
UNION ALL
SELECT * FROM analytics_events WHERE user_id = '[user_id]';
You'll need similar queries for every system that stores consumer data. Document these queries and test them quarterly.
- Deletion workflows: Implement soft deletes with retention policies. Hard deletes can break foreign key constraints and audit logs. Mark records as deleted and purge them after your legal hold periods expire.
2. Implement Universal Opt-Out Mechanism Recognition
Most state laws require you to honor browser-based opt-out signals like Global Privacy Control (GPC). Here's how:
- Detect the signal: Check for the
Sec-GPCHTTP header in incoming requests:
if (request.headers['sec-gpc'] === '1') {
// User has sent opt-out signal
setOptOutPreference(userId, true);
}
- Apply the preference: When you detect GPC, treat it as an opt-out of sale and targeted advertising. Update your consent management platform or preference database.
- Respect it globally: Don't try to parse which state the user is in. If you detect GPC, apply the opt-out universally. It's simpler and safer.
3. Layer in State-Specific Requirements
Now address the variations:
California (no B2B or employee exemption): If you process California resident data, your program must cover business contacts and employee data. Extend your intake process to accept requests from these populations. Update your privacy notice to describe B2B and employee data processing.
Florida's high thresholds: If you don't meet Florida's $1 billion revenue threshold and tech-specific criteria, you're likely out of scope for the Florida Digital Bill of Rights. Document your analysis. You may still be in scope for the Florida Information Protection Act (data security and breach notification).
Sensitive personal information handling: Review how each state defines sensitive personal information. Common categories include precise geolocation, health data, biometric data, and data about children. If you process any of these, implement opt-in consent flows before collection. Use a Consent Management Platform to capture and store consent records.
Data protection assessments: Some states require assessments for high-risk processing (profiling, sensitive data, targeted advertising to children). Document your assessment process. Use a standard template that covers:
- Purpose and legal basis
- Data categories and sources
- Retention periods
- Security controls
- Third-party disclosures
- Risk mitigation measures
4. Update Privacy Notices
Your privacy notice must describe:
- Categories of personal information collected
- Purposes for processing
- Categories of third parties you share data with
- Consumer rights and how to exercise them
- Opt-out mechanisms (including UOOM recognition)
Write one baseline notice covering the common framework. Add state-specific sections only where required (like California's B2B and employee data disclosures). Use clear headers so consumers can jump to their state's requirements.
5. Train Your Team
Your support team, legal team, and engineering team all need to understand:
- How to recognize a consumer rights request (even if it doesn't use the exact legal terminology)
- Deadlines for response
- Verification procedures
- Escalation paths for complex requests
Run tabletop exercises quarterly. Give your team sample requests and walk through fulfillment steps.
Validation: How to Verify It Works
Test your implementation:
- Submit test requests: Use test accounts to submit access, deletion, and correction requests. Verify you receive the data, the deletion completes, and corrections apply.
- Check UOOM recognition: Send requests with the
Sec-GPC: 1header. Verify your systems apply the opt-out preference. - Review response times: Track how long it takes to fulfill requests. If you're consistently hitting the 45-day limit, you need more automation or staffing.
- Audit vendor compliance: Send data subject requests that require vendor cooperation (like requests for data stored in your CRM or analytics platform). Verify vendors respond within your timelines.
Maintenance and Ongoing Tasks
Privacy compliance isn't a one-time project:
- Monitor new legislation: Subscribe to updates from the International Association of Privacy Professionals (IAPP) or similar sources. When new states pass laws, assess applicability and update your program.
- Review data flows quarterly: As you add new systems, vendors, or data sources, update your data inventory and request fulfillment processes.
- Update assessments annually: Review your data protection assessments. If your processing activities change (new data categories, new purposes, new vendors), document the changes and reassess risk.
- Track enforcement trends: State attorneys general are ramping up enforcement. Monitor settlements and enforcement actions to understand regulatory priorities. Adjust your program to address common violations.
- Test your deletion processes: Verify that deleted data actually gets purged from backups and disaster recovery systems. Retention policies mean nothing if you're restoring deleted records from last year's backup.
The expansion to 24 states doesn't mean you need 24 different compliance programs. Build one strong baseline, flag the exceptions, and automate the repetitive work. Your team will thank you, and you'll be ready when the next four states pass their laws.
