State Privacy Laws 2027: What US Websites Must Change by January 1

By Eoin Villarin, 2026-10-29

Louisiana, Oklahoma, Delaware and California privacy changes start January 1, 2027. Here is what US websites must fix, from GPC signals to opt-out links.

The state privacy laws 2027 brings start on January 1, and several of them hit websites directly. Louisiana and Oklahoma's new consumer privacy laws take effect that day, Delaware's amended law starts covering much smaller businesses, California's Opt Me Out Act requires web browsers to ship a built-in privacy switch, and California's rules on automated decision-making technology become enforceable. For US businesses that run ad pixels, analytics or AI tools on their sites, the practical result is more opt-out signals to honor and less room for sloppy consent flows.

This guide is for US small and mid-sized businesses, online stores and agencies that collect customer data through a website. You get a state-by-state summary, what regulators have already fined companies for, and a website checklist you can hand to your developer.

Every date, threshold and fine below links to the official law text, legislature page or regulator announcement, with law firm analysis noted where I used it. This post is general information, not legal advice, so confirm how each law applies to your business with a privacy lawyer.

State Privacy Laws Taking Effect in 2027 at a Glance

More states follow. Alabama's law takes effect on May 1, 2027 and Vermont's on January 1, 2028, according to Morgan Lewis.

What Changes on January 1, 2027?

Louisiana: a revenue test with no data minimum

Louisiana's governor signed SB 386 on May 29, 2026, as Act 502, creating the Louisiana Data Privacy Act. It applies to businesses in Louisiana that meet any one of three tests: more than $25 million in annual gross revenue, buying, receiving, selling or sharing data on 75,000 or more consumers, households or devices, or earning half or more of revenue from selling personal information. The revenue test is the one to notice, because it can catch a mid-sized online store with few Louisiana customers.

According to Davis Wright Tremaine's analysis, the law requires opt-in consent for sensitive data, requires a posted notice if you sell sensitive or biometric data, and gives the attorney general exclusive enforcement. A 30-day cure period runs only from January 1 to July 31, 2027, so the grace window is short.

Oklahoma: $7,500 per violation after a cure period

Oklahoma's governor approved SB 546 on March 20, 2026. It covers businesses that control or process data on at least 100,000 Oklahoma consumers, or at least 25,000 if more than half their gross revenue comes from selling personal data. The enrolled text sets civil penalties of up to $7,500 per violation for businesses that do not fix a problem within 30 days of the attorney general's notice, and that cure right does not expire. It also requires data protection assessments for targeted advertising, data sales and sensitive data.

Delaware: the threshold drops to 10,000 consumers

Delaware's governor signed HB 380 on September 2, 2026, according to the state's announcement. From January 1, 2027, the Delaware Personal Data Privacy Act applies to businesses that processed data on 10,000 consumers in the prior year, down from 35,000, or 5,000 consumers if more than 20% of gross revenue comes from data sales. The amendments add new sensitive data categories such as neural data and government ID numbers, and add contract and due diligence duties when you share data with third parties.

Why California's Opt Me Out Act Matters for Every Website

California already requires businesses covered by the CCPA to treat opt-out preference signals, such as Global Privacy Control (GPC), as a valid request to stop selling or sharing personal information. The problem has been that few people knew how to turn the signal on. The California Opt Me Out Act (AB 566), signed on October 8, 2025, fixes that. When it takes effect in January 2027, browsers operating in California must offer a built-in, easy-to-use setting that sends the signal.

For a website, that means the share of visitors arriving with a GPC signal is likely to rise sharply in 2027. If your Meta Pixel, TikTok Pixel or Google Ads remarketing tags still fire for those visitors, every page view is a potential violation. California's regulator says about a dozen states require businesses to honor these signals, so this is not only a California issue.

What California has already fined companies for

California's privacy regulator, now branded CalPrivacy, has been fining businesses for exactly the website problems that GPC exposes:

• PlayOn Sports, $1.10 million (March 3, 2026). The agency alleged users had to accept tracking before using tickets or viewing the sites, that opt-outs were redirected to industry tools instead of the company's own method, and that opt-out preference signals were ignored.
• Ford, $375,703 (March 5, 2026). Ford required consumers to verify an email address before opting out. The board said "unnecessary friction in the opt-out process violates" the CCPA, and ordered Ford to audit the tracking technologies on its website and honor GPC.

The per-violation numbers add up fast. CCPA fines are currently up to $2,663 per violation and $7,988 per intentional violation or violation involving consumers under 16 the business knows about, and a business is covered if it has more than $26,625,000 in annual gross revenue or meets the law's other tests.

California's Automated Decision-Making Rules Start January 1, 2027

California's Office of Administrative Law approved new CCPA regulations on September 23, 2025, and they took effect on January 1, 2026 with phased deadlines. According to the agency's announcement:

• Automated decisionmaking technology (ADMT): businesses that use ADMT to make significant decisions must comply from January 1, 2027. Significant decisions cover areas such as lending, housing, education, employment and healthcare.
• Risk assessments: compliance began January 1, 2026, with an attestation and summary due to the agency by April 1, 2028.
• Cybersecurity audits: certifications are due April 1, 2028 for businesses with over $100 million in revenue, April 1, 2029 for $50 million to $100 million, and April 1, 2030 for less than $50 million.

If your careers page uses an AI screening tool, or your site uses an automated tool to approve financing or rental applications, this rule is likely aimed at you.

What These State Privacy Laws Mean for Your Website

Most of the compliance work for the 2027 state laws lands on the website: the tags that load, the banner that asks, the links in the footer and the forms that collect requests. Here is the checklist I use with US clients.

1. Work out which laws apply. Count consumers by state, not just orders, and check your revenue against Louisiana's $25 million test and California's $26,625,000 threshold.
2. Honor GPC in code, not just in policy. Detect the Sec-GPC request header and the navigator.globalPrivacyControl property, then block sale and sharing tags such as ad pixels and remarketing scripts before they load. If the visitor is logged in, apply the opt-out to their account too.
3. Test your consent tool with GPC switched on. Many cookie banners claim GPC support but still fire tags. Use your browser's developer tools to confirm nothing loads that should not.
4. Remove friction from opt-outs. No email verification, no forced accept screens, no redirect to third-party opt-out sites in place of your own, and a "Do Not Sell or Share" link that works in one or two clicks.
5. Get opt-in consent for sensitive data. Oklahoma, Louisiana and Delaware require consent for categories such as health details and precise geolocation. Review quiz funnels, booking forms and store locators that collect them.
6. Update your privacy policy. Add the new states, list request methods, explain how you handle opt-out signals, and add Louisiana's required notice if you sell sensitive or biometric data.
7. Fix how requests come in. Louisiana generally expects two or more ways to submit requests, and Oklahoma gives you 45 days to respond. A simple request form connected to a tracked inbox beats an email address nobody checks.
8. Audit your tags and vendors. List every pixel, chat widget and analytics script, what data each receives and whether your contracts cover Delaware's new diligence duties. Shopify stores should combine this with the script tag to pixels migration before March 2027.
9. Document assessments and AI decisions. Record risk or data protection assessments for targeted advertising and data sales, and list any AI tools that help make significant decisions about people.

While you are in the code, check the server too. The PHP2Shell vulnerability affects most WordPress and WooCommerce sites, and a breach would turn a privacy project into an incident response.

Frequently asked questions

Which state privacy laws take effect on January 1, 2027?

Louisiana's Data Privacy Act and Oklahoma's SB 546 take effect on January 1, 2027, along with Delaware's HB 380 amendments that lower its threshold to 10,000 consumers. California's Opt Me Out Act and its automated decision-making rules also start in January 2027. Alabama follows on May 1, 2027 and Vermont on January 1, 2028.

Do I have to honor Global Privacy Control on my website?

If the CCPA or another state law that recognizes opt-out preference signals applies to you, yes. California treats a GPC signal as a valid request to opt out of selling or sharing personal information, and California regulators fined Ford and PlayOn Sports in March 2026 partly over opt-out failures. From January 2027, browsers must offer the setting to Californians.

Does a small business need to comply with state privacy laws?

It depends on the thresholds, not on how small you feel. Delaware now covers businesses handling data on 10,000 consumers, and Louisiana covers any business with more than $25 million in revenue regardless of data volume. Count consumers per state, including newsletter subscribers and site visitors you track, then check each law's tests.

What are the fines for violating state privacy laws?

California fines are up to $2,663 per violation and $7,988 per intentional violation or violation involving known minors under 16. Oklahoma allows civil penalties of up to $7,500 per violation if a business does not cure within 30 days of notice. Other states enforce through their attorneys general under consumer protection law.

Is a cookie banner enough to comply with US privacy laws?

No. Most US state laws are opt-out laws, so the banner matters less than whether ad and tracking tags actually stop for people who opt out or send GPC. You also need a working Do Not Sell or Share link, consent for sensitive data, an updated privacy policy and a reliable way to handle requests.

Get Ready Before Browsers Flip the Switch

January 2027 changes US privacy compliance from a policy page into a technical job. New states join, Delaware reaches much smaller businesses, and California is about to put an opt-out switch in front of millions of browser users. The businesses that get fined are usually the ones whose tags ignore the signal.

If you want your site's pixels, consent banner, GPC handling and request forms checked and fixed before January 1, send me a message and I will audit your tracking setup on WordPress, Shopify or a custom stack and give you a clear fix list. You can see similar projects in my case studies. I will reply within 24 hours.