From Patchwork to Partnerships: How U.S. Privacy Enforcement Is Converging

U.S. data privacy has long been defined by its complexity. With no comprehensive federal law, businesses navigate a growing state-by-state patchwork, each with its own scope, thresholds, and enforcement mechanisms. Extraterritorial reach means it doesn’t matter where a business is headquartered, but rather where website visitors, e-commerce customers, app users, and others reside.

That is changing. State regulators are moving from isolated enforcement to active coordination, sharing resources and aligning priorities across jurisdictions. Understanding this shift is essential for any business that collects personal data from U.S. consumers.

The Patchwork Problem: A Brief Recap

California set the benchmark in 2018 with the California Consumer Privacy Act (CCPA), the first comprehensive state privacy law in the U.S. Other states followed slowly at first, then accelerated sharply from 2023 onward.

By 2025, laws had become enforceable in Delaware, Iowa, Minnesota, Nebraska, New Hampshire, New Jersey, Tennessee, and Maryland. That’s eight in a single year, more than any previous year. Three more followed on January 1, 2026, in Indiana, Kentucky, and Rhode Island. 

As of August 2026, 20 states have laws in effect and four more (Oklahoma, Alabama, Louisiana, and Vermont) have enacted laws not yet in force, bringing the total enacted to 24.

For businesses, this means a compliance burden that scales with every new law. There are divergent thresholds, differing sensitive-data definitions, emerging tech like AI that requires regulatory updates, inconsistent rights frameworks, and the need to track legislative activity continuously.

A Turning Point: The Consortium of Privacy Regulators

The most significant development in U.S. privacy enforcement came on April 16, 2025, when the California Privacy Protection Agency (CPPA), now known publicly as CalPrivacy, announced the Consortium of Privacy Regulators, a bipartisan coalition committed to coordinating enforcement across jurisdictions.

Founding members were the CPPA and the Attorneys General of California, Colorado, Connecticut, Delaware, Indiana, New Jersey, and Oregon, formalized through a memorandum of understanding to hold regular meetings, share priorities, pool expertise, and coordinate investigations.

By October 2025, Minnesota and New Hampshire had joined, bringing the total to ten. Maryland joined subsequently, and Vermont became the newest member in August 2026, notably before its own state privacy law, the Vermont Data Privacy and Online Surveillance Act (VDPOSA), even takes effect in 2028. The Consortium now comprises eleven state AGs and the CPPA.

The Consortium marks the first formal structure for multistate privacy enforcement collaboration, giving regulators a clear mechanism to compare notes, escalate issues across state lines, and pursue joint action. 

There are straightforward implications for businesses. A compliance failure identified in one Consortium state is now more likely to attract scrutiny from others.

Coordination in Action: The GPC Sweep and the Illuminate Settlement

Two actions show what this coordination looks like in practice. On September 9, 2025, California (via the CPPA and Attorney General), Colorado, and Connecticut jointly announced an investigative sweep targeting businesses not honoring GPC opt-out signals, sending coordinated compliance letters and building explicitly on California’s earlier USD 1.2 million Sephora settlement. It was the Consortium’s first joint enforcement action.

Separately, in November 2025, California, Connecticut, and New York secured a combined USD 5.1 million from ed-tech company Illuminate Education over a 2021 student-data breach. Since New York isn’t a Consortium member, this wasn’t explicitly a Consortium action, though it still reflects the same trend toward multistate coordination.

What Regulators Are Prioritizing

Patterns were emerging even before the Consortium formed, and have sharpened through 2025 and into 2026. Opt-out consent compliance and dark patterns remain a consistent focus, most visibly through the September 2025 GPC sweep. 

Twelve states, California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, and Texas, now require businesses to recognize Global Privacy Control (GPC) or a comparable universal opt-out mechanism (UOOM).

Children’s and teens’ data is a bipartisan priority. U.S. state privacy laws typically classify it as “sensitive” by default. Connecticut, Colorado, and Maryland have added protections for 13-to-17-year-olds, and the FTC and House Energy & Commerce Committee have both stepped up activity.

Sensitive categories like health, location, and biometric data continue to draw scrutiny, illustrated by the FTC’s finalized January 2026 order against General Motors and OnStar over undisclosed geolocation and driver-behavior data sales. The requirement is clear: consent before collection, not after.

Data brokers face heightened scrutiny under California’s Delete Act, with the CPPA securing multiple actions after targeted sweeps. Texas, not a Consortium member, runs its own active enforcement track. Third-party transparency is also growing, with Minnesota, Oregon, and Connecticut now requiring disclosure of which third parties receive consumer data.

What’s Next: Pressure for Even Tighter Coordination

On August 3, 2026, Senator Ron Wyden wrote to attorneys general in ten states, California, Colorado, Connecticut, Delaware, Maryland, Montana, Nebraska, New Hampshire, New Jersey, and Texas, plus the chair of the California Privacy Protection Agency Board, urging public guidance that GPC signals be honored regardless of a user’s apparent location or VPN use, and a dedicated multistate task force for joint GPC enforcement.

Nothing here has been adopted, and no state has committed to the task force; it remains a legislative request. But it signals the direction of travel, with more coordination, not less, and with geographic workarounds for opt-out compliance drawing direct scrutiny.

Enforcement Is Accelerating, Even Without New Laws

2025 was notably the first year since 2020 with no brand-new comprehensive state privacy law (though that changed in early 2026), yet enforcement activity increased as states shifted focus from passing laws to enforcing what’s already on the books.

California’s AG announced its office’s largest CCPA penalty to date in July 2025, USD 1.55 million against Healthline Media, for continuing to share sensitive health-related browsing data with advertisers after opt-outs, including via GPC. Connecticut’s AG reached its first CTDPA settlement, USD 85,000 with TicketNetwork, the same month. 

Separately, the CPPA has issued its own record settlements against Tractor Supply, and the California AG’s office set another record with a USD 2.75 million settlement with Disney in February 2026.

These cases also required corrective actions, including operational changes, added resources, and ongoing monitoring.

It’s Not Just Regulators: Private Lawsuits Are Multiplying Too

Regulators aren’t the only ones bringing cases. A decades-old California law is quietly becoming one of the biggest website-compliance risks going, and it has nothing to do with any state AG or the Consortium.

The California Invasion of Privacy Act (CIPA) was written in 1967 to stop illegal phone wiretapping. Plaintiffs’ firms have spent the past few years applying it to ordinary website technology instead, arguing that session-replay tools, tracking pixels, live chat, and AI chatbots “intercept” a visitor’s communications before they’ve consented. 

CIPA allows any individual to sue directly, with statutory damages of USD 5,000 per violation (or three times actual damages, whichever is greater), and a plaintiff doesn’t have to prove real harm to ask for it. 

That combination has made it a favorite theory for plaintiffs’ firms, and case law is still a mixed bag. A federal court approved a USD 3.85 million class settlement against the Los Angeles Times in June 2026, while a nearly identical claim was thrown out with prejudice by a state court just three weeks earlier.

There’s a legislative fix in motion, but it’s a narrow one. SB 690 would strip the private right of action for one specific CIPA theory, pen-register and trap-and-trace claims (Sections 638.50–638.51), and hand enforcement to the California Attorney General instead. 

It’s not law yet, and it still has to clear the Assembly floor and Senate concurrence before an August 31, 2026 deadline. Even if it passes, it wouldn’t touch the wiretapping and eavesdropping theories (Sections 631 and 632) that most CIPA website suits actually rely on today.

It’s spreading past California too. Plaintiffs are increasingly pairing CIPA claims with similar theories under Florida’s and Pennsylvania’s wiretap statutes and the federal Wiretap Act, as well as the VPPA and ECPA, so a website with visitors across multiple states can’t treat this as a California-only problem.

A compliant privacy policy, state law checklist, and opt-out mechanism don’t cover this. Litigation risk here comes from a completely different legal theory, and it’s not waiting on any regulator to act.

What Convergence Means for Your Business

A violation in one state can now trigger action in others. With Consortium states sharing information under their MOU, and non-Consortium states like New York and Texas increasingly coordinating independently, state-by-state risk management is no longer sufficient.

Having a privacy policy isn’t enough. Regulators check whether obligations are met in practice, and non-functional consent banners, hard-to-use opt-outs, and policies that don’t reflect real data practices have all drawn enforcement.

Universal opt-out mechanisms are now required in twelve states, with more likely to adopt the requirement. As sweeps increase and Washington pushes for a dedicated task force, non-compliant implementations face growing exposure.

Third-party and vendor relationships also carry risk: data sharing with ad tech, analytics, and brokers is an active focus, so contracts should reflect current obligations, and businesses need visibility into how third parties use consumer data.

The Federal Picture: Still No Comprehensive Law

Federal privacy legislation is still stuck, though there’s more visible motion than in past years. The House Energy & Commerce Committee’s Privacy Working Group spent over a year gathering input, and in April 2026 that effort produced the SECURE Data Act (H.R. 8413), the most serious attempt at a comprehensive federal privacy law in years. 

The bill would set a single national standard and broadly preempt state privacy laws. It cleared a subcommittee hearing in June 2026, but split sharply along party lines there and hasn’t advanced to a markup vote since. If it moves at all, it’s still a long way from becoming law.

The federal government is still active in narrower areas: the DOJ’s Bulk Data Rule, restricting sensitive data transfers to countries of concern, took effect April 8, 2025 (full enforcement from July 8, 2025); the FTC continues enforcing COPPA and has signaled it intends to pursue the Protecting Americans’ Data from Foreign Adversaries Act; and sector rules like HIPAA and the GLBA remain in force regardless.

Without a federal law in place, expect the Consortium model to keep growing in influence, building something close to a national enforcement standard from the state level up, at least for as long as the SECURE Data Act remains stalled.

How to Build a Privacy Compliance Strategy for This Environment

Privacy compliance is no longer a one-time project. For businesses operating across multiple states, these steps are a practical starting point.

Review your consent mechanisms

Does your site honor GPC signals? Are opt-outs genuinely easy to use, regardless of a visitor’s apparent location?

Map your third-party data flows

Do vendor contracts reflect current requirements, and do you know how third parties use consumer data?

Assess your sensitive-data handling

Health, location, biometric, and children’s data draw disproportionate attention. Document your practices clearly.

Implement scalable consent management

Manually tracking 20-plus state laws isn’t practical. A comprehensive management platform helps automate consent collection, honor opt-in and opt-out signals, and keep auditable records, without manually tracking every state’s requirements.

Track enforcement, not just legislation

Settlements often reveal more about regulator expectations than statutory text alone.

Where This Leaves Your Privacy Compliance Strategy

The U.S. privacy environment is becoming more coordinated and more active, not less. More states are likely to join the Consortium of Privacy Regulators, pass privacy laws, and require honoring opt-out signals, alongside more joint enforcement actions across jurisdictions, supported by Washington.

And regulatory coordination is only half the picture. Private litigation, particularly under statutes like California’s CIPA, is running on an entirely separate track, with its own damages framework and its own timeline, and it doesn’t require any AG to act first. Treating enforcement risk and litigation risk as the same problem, or addressing only one, leaves a real gap.

A privacy compliance program built around a single state’s requirements, or around regulatory enforcement alone, is unlikely to be sufficient. Consistent, transparent, and scalable privacy practices, supported by the right tools, like Usercentrics Web CMP, are the most reliable path to managing risk on both fronts, and getting this right is as much an opportunity to demonstrate responsibility to customers as it is a way to avoid both penalties and litigation exposure.