New state privacy laws and fines put ad tracking under scrutiny

Comprehensive privacy laws took effect in Indiana, Kentucky and Rhode Island on January 1, 2026, and Connecticut widened its law on July 1. California fined Disney, PlayOn Sports and Ford in the first quarter over opt-out processes that regulators said fell short. Tracking code sits at the center of these cases: the pixels and tags that send visitor data to ad platforms.

Which state privacy laws took effect in 2026

Law firm Hunton Andrews Kurth confirms the January 1 start for the Indiana, Kentucky and Rhode Island laws, and it notes that amendments to Oregon’s law took effect the same day Hunton Andrews Kurth . All three new laws let consumers opt out of targeted advertising, the sale of personal data and certain profiling, according to a summary by law firm Koley Jessen Koley Jessen . The thresholds and penalties differ.

State	Who it covers	Maximum penalty	Cure period
Indiana	100,000 state consumers, or 25,000 if 50% of revenue comes from selling personal data	$7,500 per violation	30 days
Kentucky	100,000 state consumers, or 25,000 if over 50% of gross revenue comes from selling personal data	$7,500 per violation	30 days
Rhode Island	35,000 customers, or 10,000 if over 20% of gross revenue comes from selling personal data	$10,000 per violation	None

Rhode Island’s statute sets the 35,000 threshold and leaves out data used only to complete a payment R.I. General Assembly . It gives customers the right to opt out of processing for targeted advertising, the sale of personal data and some automated profiling R.I. General Assembly . Koley Jessen notes that the state attorney general has sole enforcement authority and that the law provides no cure period.

Connecticut’s amendments, passed as SB 1295, took effect July 1, 2026, according to the Future of Privacy Forum (FPF) Future of Privacy Forum . The law now reaches a business that controls or processes the personal data of at least 35,000 consumers, controls or processes sensitive data, or offers personal data for sale. The last two triggers carry no customer minimum. The law bars processing minors’ personal data for targeted advertising or sale. It requires businesses to disclose whether they collect, use or sell personal data to train large language models.

What California’s 2026 cases show

On February 11, 2026, California Attorney General Rob Bonta announced a $2.75 million settlement with Disney, which his office called the largest under the California Consumer Privacy Act (CCPA) California AG . The state alleged that Disney’s opt-out toggles applied only to the streaming service or device in use. Disney’s webform stopped sharing through its own ad platform, but data kept flowing to third-party ad tech companies whose code Disney embedded in its websites and apps. Global Privacy Control requests applied only to the device that sent them, even for logged-in users.

The attorney general’s office describes Global Privacy Control as an easy-to-use “stop selling or sharing my data switch” that some browsers offer or that users add as an extension. Bonta said businesses “can’t force people to go device-by-device or service-by-service.” The settlement resolves allegations, and the release does not say Disney admitted wrongdoing.

On March 3, 2026, the California Privacy Protection Agency, known as CalPrivacy, announced a $1.10 million fine against youth sports media company PlayOn Sports CalPrivacy . The agency said PlayOn required users to click “agree” to tracking technologies before they could use their tickets. It said the company sent users to opt-out programs run by the Network Advertising Initiative and the Digital Advertising Alliance in place of its own method. It said PlayOn failed to recognize opt-out preference signals. CalPrivacy said the decision is its board’s first on privacy violations involving students and California schools.

Two days later, CalPrivacy fined Ford $375,703 CalPrivacy . Ford required consumers to complete an email verification step before they could opt out of the sale and sharing of their data. The order requires opt-out methods with minimal steps, an audit of the tracking technologies on Ford’s website, and compliance with opt-out preference signals, including Global Privacy Control. “Opting out is supposed to be easy,” said Michael Macko, CalPrivacy’s head of enforcement.

Law firm Koley Jessen drew a plain lesson from the first quarter’s cases: “Outsourcing technical functions does not transfer legal accountability.” It noted that Disney cited vendor and technological challenges for its missteps Koley Jessen .

What it means if an agency runs your tracking

If an agency installed your ad pixels, tag manager or cookie banner, it built the kind of system these cases examined. The fines landed on the businesses that ran the sites and apps. Disney’s case turned on third-party code embedded in its own properties, and Ford’s turned on one extra step in its opt-out process.

Size matters under the new laws, with one exception. A business that holds data on a few thousand residents of a state sits below the 35,000 and 100,000 consumer thresholds. Connecticut works differently. According to FPF’s summary, processing sensitive data or offering personal data for sale brings a business under its law at any size. Check your customer counts against each state’s thresholds every year.

Our guide to marketing agency red flags covers other warning signs, and the agency index scores agencies on one public rubric. Accessibility is the other site-level risk an agency controls. See our report on ADA website lawsuits in 2026.

This article summarizes statutes, regulator releases and law firm analyses. It is not legal advice. Ask your own lawyer which state laws apply to your business and whether your ad tracking counts as a sale or sharing of data.

Questions to ask your agency

1. Can you list every pixel, tag and script on our site, and what each one sends? You need that list before you can check anything else.
2. What happens when a visitor opts out or sends a Global Privacy Control signal? Ask the agency to show, in a live test, which tags stop firing.
3. Does our opt-out take extra steps, such as email verification or a login? Ford’s fine came from an email verification step.
4. Do opt-outs carry across our site, apps and devices? Disney’s settlement turned on opt-outs that stayed on one device or service.
5. Do any forms, audiences or ad settings use sensitive data, such as health details? Connecticut’s law covers any business that processes sensitive data.
6. Who owns the tag manager and consent tool accounts? Your business should hold the admin login, not the agency alone.