From the Ashurst Perkins Coie law firm:
Overview
In 2026, while states continued tightening breach notification deadlines and expanding the personal information covered by notification laws, the data security landscape was defined by the growing use of AI by companies, threat actors, plaintiffs, and consumers.
Three major themes define this year’s update:
- State legislative activity continues around general-purpose breach notification deadlines, with California and Oklahoma finalizing breach notification updates that are now in effect, Delaware modifying its AG notification timeline, and Vermont adding a data-broker-specific security breach notification regime.
- AI-driven cyberattacks are making headlines alongside federal and state efforts to increase governance, transparency, and incident reporting.
- Federal policy continues to evolve, with critical infrastructure notification requirements coming one step closer, aggressive regulations aimed at critical infrastructure supply chains, and issuance of an executive order that may provide a new framework for private-sector involvement in foreign-facing cyber operations.
Read more about specific state updates at JDSupra.
