ZetrixwebThe landscape in brief
Indiana, Kentucky, and Rhode Island comprehensive privacy laws took effect on 1 January 2026. Counts of how many states now have such laws differ by source, from about eighteen to twenty, depending on whether narrower laws like Florida's are included and on the date of the count. State attorneys general enforce them. Indiana and Kentucky offer a 30-day cure period; Rhode Island does not. Rhode Island, like Connecticut, applies at a 35,000-consumer threshold, among the lowest in the country, so smaller businesses are more likely to be covered than expected.
The statutes differ in thresholds, definitions, and exceptions, but they share a core: transparency, consumer rights, limits on certain processing, and obligations for service providers.
Five engineering capabilities that cover most of it
First, a data inventory that says what personal data you collect, where it lives, why, and who receives it. Second, a request pipeline that can find, export, correct, and delete an individual's data across systems and vendors within statutory timelines. Third, consent and preference management, including opt-in for sensitive data where required and respect for universal opt-out signals, which several states require businesses to honor.
Fourth, vendor management: contracts that restrict processors to your instructions, and a list of who handles what. Fifth, records: assessments for higher-risk processing, evidence of how requests were handled, and logs of consent. These five also serve customer security reviews and international laws.
| Capability | Why it matters | Common failure |
|---|---|---|
| Data inventory | Everything else depends on it | Shadow data in analytics and logs |
| Request pipeline | Statutory deadlines apply | Manual, partial deletion |
| Consent and signals | Opt-in and opt-out rules differ | Ignoring browser opt-out signals |
| Vendor controls | Processors must follow your instructions | Out-of-date contracts |
| Records | Regulators ask for evidence | No logs of decisions |
Where AI features complicate things
Prompts, outputs, embeddings, and model logs can all contain personal data, and they often sit outside the systems your request pipeline reaches. Add them to the inventory and decide retention and deletion for each.
For automated decision-making, our article on California's rules lays out the notices and assessments to expect.
Want a privacy engineering assessment across your product and vendors? Talk to us.
Key takeaways
- Indiana, Kentucky, and Rhode Island laws took effect on 1 January 2026; counts of covered states vary from about 18 to 20 by source.
- Rhode Island has no cure period and a low 35,000-consumer threshold.
- Build five reusable capabilities: data inventory, request pipeline, consent and signals, vendor controls, and records.
- Include AI artifacts such as prompts, outputs, and embeddings in your inventory and retention rules.