Three US states entered 2026 with new consumer data rights

Consumer privacy measures took effect in Kentucky, Indiana and Rhode Island on 1 January 2026. Each gives covered residents ways to exercise control over personal information held by covered businesses. A shared starting date does not make their thresholds, exemptions or request procedures identical. For a service operating across states, the relevant question is which law applies to its particular processing activities.

Kentucky’s attorney general lists rights to access, correct, delete and obtain a portable copy of personal data, plus opt-outs for targeted advertising, sale and certain significant profiling. Processing sensitive data requires consent. The state’s guidance describes a 100,000-consumer coverage threshold, or 25,000 consumers combined with its revenue-from-data-sales test. Exemptions apply to some entities and data. Covered controllers generally have 45 days to respond, with a possible additional 45 days when justified and notified. Enforcement belongs to the attorney general; the act creates no private right of action.

Indiana’s official consumer guide sets out a 100,000-resident threshold or at least 25,000 residents plus more than half of gross revenue from personal-data sales. It also identifies exemptions, including certain financial institutions, health entities and nonprofits. Its guide makes a practical point about deletion: there is no single request that clears information from every company. A person submits a request to each relevant holder. Controllers may need to authenticate the request, and legally permitted exceptions can affect what is deleted.

Rhode Island’s customer-rights provision covers qualifying for-profit entities processing at least 35,000 customers’ data, excluding payment-only processing. Its alternative threshold is at least 10,000 customers and more than 20% of gross revenue from data sales. The provision includes access, correction, deletion, portability and specified opt-outs. It directs customers to secure request methods described in the controller’s privacy notice. These differences make the notice and the applicable state framework useful starting points when checking what a particular service must offer.