In recent weeks, several state legislatures have amended their state comprehensive privacy laws. Some of these amendments have already been enacted into law, while others have passed their state legislature and await the governor’s signature.
Delaware HB 380
As detailed in our prior blog post, on June 16, 2026, the Delaware General Assembly passed HB 380, which would amend the Delaware Personal Data Privacy Act (DPDPA). The amendments would update the applicability threshold of the DPDPA, narrow the Act’s GLBA entity-level exemption, require binding contracts with specific provisions for selling or sharing personal data, and heighten protections against profiling, among other changes. The bill is currently awaiting the Delaware governor’s signature, and if signed, the amendments would take effect on January 1, 2027.
Connecticut SB 4
As detailed in our prior blog post, on May 27, 2026, the Connecticut governor signed SB 4 into law, amending the Connecticut Data Privacy Act (CTDPA) by requiring data brokers to register annually with the state and instructing the Commissioner of Consumer Protection to establish an accessible deletion mechanism, similar to that under the California Delete Act, by July 1, 2028. Additionally, the bill amends provisions of the CTDPA relevant to controllers more broadly, including changes to the scope of publicly available information, the purpose limitation requirement, and new requirements on use of facial recognition technology, among other changes. These changes will take effect on October 1, 2026.
Maryland HB 711
On May 31, 2026, HB 711 was enacted into law after the Maryland governor failed to sign or veto the bill. The law amends the Maryland Online Data Privacy Act by expanding the definition of sensitive data to include data inferred by a controller to indicate sensitive characteristics. The law also restricts the sale of personal data to governmental entities that, within the preceding six months, engaged in or supported civil immigration enforcement through the provision of personnel or material resources, unless an exception applies. The law took effect on July 1, 2026.
New Hampshire HB 1460
On June 19, 2026, the New Hampshire governor signed HB 1460, which amends the New Hampshire Data Privacy Act by prohibiting a controller from selling the personal data of a child, defined as an individual under the age of 13. The amendment is effective January 1, 2027.
New Jersey A5328
On June 30, 2026, the New Jersey governor signed A5328, which amends the New Jersey Data Privacy Act by prohibiting the sale of sensitive personal data, requiring data brokers (i.e., persons or legal entities that knowingly collect or purchase personal data about a consumer with whom the person or legal entity does not have a direct relationship and that sell or license that data to a third party) to register with a new public database, and setting annual data broker registration fees, which are the highest in the nation. Portions of the amendment went into effect immediately, although the data broker and data collector requirements will remain inoperative for 270 days following the date of enactment.