New rules for your website, before they start
Rules for websites change every year, and most businesses hear about them late. Here is what is coming, from each legislature’s or regulator’s own text. Rule Watch emails you when something new is signed, for the states you choose.
Coming into force:
SB 923: An online way to make privacy requests
What changes
- An email address on its own will no longer be enough for requests to see, delete or correct personal information.
- An online method, such as a web form or an online portal, must be offered as well as the email address.
- Requests to delete will also reach information collected about a person from other sources, not only what the person gave.
In practice: A privacy policy whose only route for requests is “email privacy@…” will need a form or portal beside it.
- Written for
- Businesses covered by California’s consumer data law that operate only online.
- Enforced by
- The California Privacy Protection Agency and the California Attorney General.
- Signed
- Source
- California Legislature
SB 690: Who can bring pen register cases about websites
What changes
- Only the Attorney General will be able to bring cases under the pen register and trap and trace section of the California Invasion of Privacy Act about websites and apps.
- Law firms report that it also reaches cases filed in the two years before it starts.
- The Act’s wiretapping section, which many tracking pixel and session recording cases rely on, is unchanged.
In practice: Tags and pixels that send visitor data to other companies stay within the wiretapping section; only one route for private cases closes.
- Written for
- Businesses with websites or apps that people in California use.
- Enforced by
- The California Attorney General, for the pen register section.
- Signed
- Source
- California Legislature
AB 566: An opt-out setting in every browser
What changes
- Browsers must include a setting that sends an opt-out preference signal, such as Global Privacy Control, to every site a person visits.
- Businesses covered by California’s consumer data law already have to treat that signal as a request to opt out of the sale and sharing of personal information.
In practice: Far more visitors will arrive with the signal switched on, so how a site responds to it will matter on many more visits.
- Written for
- Companies that make web browsers. Every website will see the signal more often.
- Enforced by
- The California Privacy Protection Agency and the California Attorney General.
- Signed
- Source
- California Legislature
CPPA rules: Automated decision-making
What changes
- A notice before the technology is used.
- Rights to opt out of it and to see information about how it is used.
- Risk assessments have been required since 1 January 2026; cybersecurity audits follow from 2028, by size of business.
In practice: Tools that decide on jobs, lending, housing, insurance, education or health care without a person will need a notice and an opt-out.
- Written for
- Businesses covered by California’s consumer data law that use automated decision-making for significant decisions about people.
- Enforced by
- The California Privacy Protection Agency.
- Signed
- Source
- California Privacy Protection Agency
AB 2246: A new design code for young users
What changes
- It replaces the Age-Appropriate Design Code Act.
- Services must estimate users’ ages, or give everyone the protections for young users.
- Privacy settings start high; no profiling and no sale of precise location by default; no design that pushes young users to give up protections.
In practice: Default settings and sign-up flows on services young people use will need to start at the most protective choice.
- Written for
- Online services likely to be used by people under 18.
- Enforced by
- The California Attorney General.
- Signed
- Source
- California Legislature
SB 26-189: Automated decisions, in place of the 2024 AI Act
What changes
- A notice when the technology is used.
- A plain-language explanation after an adverse outcome.
- Rights to see and correct the data used, and human review on request.
In practice: A person turned down by an automated tool can ask why, and ask for a person to look again.
- Written for
- Businesses that build or use automated decision-making for decisions about jobs, housing, lending, insurance, health care, education or public benefits.
- Enforced by
- The Colorado Attorney General.
- Signed
- Source
- Colorado General Assembly
SB 546: A new consumer data law
What changes
- Residents get rights to see, delete and correct their data.
- Rights to opt out of its sale, of targeted advertising and of profiling.
- 30 days to put things right after a notice, before any action.
In practice: Privacy notices and request routes will need to cover Oklahoma residents alongside the other states with such laws.
- Written for
- Businesses above the law’s size thresholds that handle data about Oklahoma residents.
- Enforced by
- The Oklahoma Attorney General.
- Signed
- Source
- Oklahoma Legislature
SB 386: The Louisiana Data Privacy Act
What changes
- Rights to see, delete and correct personal data.
- Rights to opt out of its sale and of targeted advertising.
- Modelled on the Texas law, with a period to put things right that law firms report ends 31 July 2027.
In practice: Privacy notices and request routes will need to cover Louisiana residents alongside the other states with such laws.
- Written for
- Businesses with revenue over 25 million US dollars, data on at least 75,000 consumers, or half their revenue from selling data.
- Enforced by
- The Louisiana Attorney General.
- Signed
- Source
- Louisiana State Legislature
Rule Watch reports what lawmakers and regulators announced. It is not legal advice, and Tolbrook is not a law firm.
Get Rule Watch by email
Once a week at most, only when something is new. We email a link to confirm your address first.