By Legal Radar 
A $25 billion penalty against Meta in New Mexico just landed, one of the largest privacy-related judgments in U.S. history. Across the country and in Europe, regulators are no longer content with paper policies. Privacy law news today shows a clear pivot: from checking compliance boxes to building durable privacy infrastructure that can survive multi-state rules, AI scrutiny, and aggressive enforcement.
This article synthesizes the developments that matter most for in-house counsel, CISOs, CPOs, compliance executives, and tech leaders. It covers the mega-verdicts, the expanding state patchwork, the California Privacy Protection Agency’s growing reach, EU AI Act enforcement, biometric and DSAR pressures, and practical steps to reduce enterprise risk. The goal is straightforward: turn regulatory noise into operational clarity so your organization treats privacy as infrastructure rather than an annual audit exercise.
The Meta Verdict and the Rise of State Consumer Protection Power
In late October 2026, a New Mexico judge ordered Meta to pay $25 billion after a jury found the company misled consumers about its data practices in connection with the Cambridge Analytica scandal. Jurors identified more than 43 million violations of the state’s Unfair Practices Act. The judge reduced a potential $219 billion figure but still delivered one of the largest single-state penalties ever imposed on a technology company.
This outcome is more than a headline. It confirms that state attorneys general and consumer protection statutes have become powerful tools against Big Tech. Similar theories have produced substantial settlements and ongoing investigations in other jurisdictions. For corporate legal teams, the lesson is clear: privacy representations in privacy policies, product marketing, and public statements now carry multi-state litigation risk measured in the billions.
Regulatory enforcement actions are no longer limited to the FTC or European data protection authorities. State AG offices are treating data practices as consumer deception claims, and juries are responding. Enterprises that once viewed privacy primarily through a federal or GDPR lens must now map every public statement and product feature against the consumer protection laws of the states where they operate or sell.
California’s 2026 Legislative Wave and CPPA Momentum
California closed its 2026 legislative session with a package of privacy and AI bills that reshape obligations for businesses of almost every size. Governor Newsom signed the majority of the major measures sent to him. Several stand out for enterprise risk.
SB 923, the Expanding Privacy Rights Act, takes effect January 1, 2027. It expands the CCPA right to delete so that a business must delete personal information it holds “from or about” a consumer, not only data collected directly from that individual. Third-party enrichment data, broker records, and inferred information now fall within the deletion obligation. Online-only businesses must also provide a web form or portal in addition to an email address for requests.
AB 883 shortens certain data broker response timelines from 45 days to 30 days and tightens notice requirements around California’s Delete Request and Opt-Out Platform (DROP). Data brokers face accelerated compliance clocks and higher operational pressure.
SB 690 narrows private rights of action under the California Invasion of Privacy Act for certain online pen-register and trap-and-trace claims involving websites and apps. Enforcement of those specific theories shifts primarily to the Attorney General, offering limited relief from the flood of CIPA website-tracking suits. Other CIPA theories remain available to private plaintiffs.
The California Privacy Protection Agency (often branded CalPrivacy) continues to drive both rulemaking and enforcement. Risk assessments for high-risk processing and phased independent cybersecurity audits are now part of the regulatory landscape, with attestation and certification deadlines stretching into 2028–2030 depending on revenue thresholds. The agency has signaled continued focus on Global Privacy Control signals, cross-device opt-outs, and foundational compliance.
These changes move California further toward treating privacy as an ongoing operational system rather than a static notice-and-choice framework. Companies that still rely on annual policy updates and reactive DSAR handling will find the new deletion and audit requirements difficult to meet without infrastructure investment.
The Expanding State Privacy Patchwork
Twenty states now have comprehensive privacy laws in effect. Connecticut’s expanded Data Privacy Act provisions took effect October 1, 2026, adding rules on facial recognition, precise geolocation data sales, automated employment decision tools, and related disclosures. Other states continue to refine thresholds, sensitive data definitions, and opt-out mechanics.
Global Privacy Control (GPC) has become a practical flashpoint. At least a dozen states require businesses to honor universal opt-out preference signals. Enforcement actions and settlements have already targeted companies that ignored GPC signals, applied them only to a single device, or failed to propagate the preference across linked accounts and services. Treating GPC as a browser-level toggle rather than a durable, person-level preference is now a documented compliance failure.
Multi-state compliance no longer means maintaining a lowest-common-denominator CCPA program. It requires mapping applicability thresholds, sensitive data categories, appeal processes for denied requests, data protection assessments, and universal opt-out handling across jurisdictions. The operational cost of fragmentation is rising, which is precisely why leading organizations are consolidating privacy technology, data inventories, and rights-request workflows into shared infrastructure.
EU AI Act Enforcement and the Convergence of AI Governance
On the European side, the EU AI Act’s general application and transparency rules became enforceable on August 2, 2026. Providers of certain AI systems must disclose when users are interacting with AI rather than a human and must mark synthetic or AI-generated content. Prohibited practices and general-purpose AI model obligations are also live. Enforcement powers for the AI Office and national authorities are active, with information requests already issued to major model providers.
High-risk system obligations for stand-alone Annex III systems have been deferred to December 2027, and those embedded in regulated products to August 2028, following the Digital Omnibus regulation. New prohibitions on systems designed to generate non-consensual intimate imagery or child sexual abuse material apply from December 2026. The first harmonized standard under the Act (addressing quality management systems) has been cited, giving providers a presumption of conformity path once the relevant obligations apply.
For U.S. companies with European users or operations, the practical effect is that AI governance can no longer sit in a separate silo from data protection compliance. Training data provenance, transparency disclosures, human oversight for high-risk uses, and documentation of risk management now intersect with GDPR obligations and emerging U.S. state AI rules. Enterprises that treat AI governance as a product or research issue rather than a legal and operational control will face dual regulatory exposure.
Biometric Privacy, DSAR Volume, and Cybersecurity Risk
Biometric privacy remains a high-stakes area. State laws and private litigation continue to target collection, storage, and use of facial recognition, fingerprints, voiceprints, and similar identifiers. Several jurisdictions have tightened consent and purpose-limitation rules. Companies that deployed biometric systems under older interpretations are discovering that “notice and consent” alone is often insufficient when collection is excessive or retention is indefinite.
Data subject access requests (DSARs) and related rights requests continue to grow in volume and complexity. Expanded deletion rights under California law and parallel requirements in other states mean that incomplete data inventories quickly become liability. Organizations without automated discovery, identity resolution, and deletion workflows struggle to meet statutory timelines and face both regulatory and private claims.
Corporate cybersecurity risk is now inseparable from privacy risk. California’s cybersecurity audit requirements and similar expectations elsewhere treat security failures as privacy failures. A breach that exposes personal information triggers not only notification duties but also questions about whether the organization maintained reasonable security and conducted required risk assessments. Privacy infrastructure therefore includes technical controls, vendor management, and documented risk processes, not merely legal policies.
Building Privacy Infrastructure: Practical Steps for 2026 and Beyond
The shift from compliance to infrastructure requires concrete changes.
First, treat data inventory and mapping as a living system rather than a static spreadsheet. Include third-party and inferred data sources so that expanded deletion rights can be honored.
Second, implement person-level preference management. GPC and other opt-out signals must propagate across devices, accounts, and processing activities when the business can reasonably link them.
Third, automate rights-request workflows. Manual handling of DSARs and deletion requests does not scale under current volumes and shortened timelines.
Fourth, integrate AI governance into the privacy program. Document training data sources, transparency mechanisms, human oversight points, and risk assessments for systems that process personal data.
Fifth, prepare for audits and attestations. Cybersecurity audits and risk assessment summaries will require evidence, not just policy statements. Assign clear ownership between legal, security, and product teams.
Sixth, monitor state AG and CPPA enforcement patterns. Public statements, product features, and marketing claims are fair game under consumer protection theories.
These steps convert regulatory obligations into operational capabilities that reduce both litigation exposure and the cost of ongoing compliance.
Key Pitfalls to Avoid
Relying solely on cookie banners or one-time consent interfaces leaves organizations exposed when signals such as GPC are ignored or when deletion must reach third-party data. Treating AI systems as outside the privacy program creates gaps that regulators are already examining. Underestimating state consumer protection statutes in favor of traditional privacy frameworks has proven costly. Finally, viewing privacy as a legal-only function rather than a cross-functional infrastructure investment leaves security and product teams unprepared for audit and enforcement demands.
Conclusion
Privacy law news today makes one reality unavoidable: the era of checkbox compliance is ending. Mega-verdicts, expanded state deletion rights, mandatory universal opt-out signals, active EU AI Act enforcement, and rising DSAR and biometric pressures all point toward the same requirement. Organizations must build durable privacy infrastructure that can adapt to multi-state rules, AI transparency duties, and aggressive regulatory and private enforcement.
Legal and compliance leaders who treat these developments as operational design problems rather than pure legal risk will be better positioned to protect their companies and their customers. Review your data inventory, preference management, rights workflows, and AI governance controls now. The cost of delay is measured in both regulatory exposure and the resources required to retrofit systems under pressure.
Consult experienced privacy counsel and technical specialists to evaluate your specific risk profile and prioritize infrastructure investments that match your processing activities and geographic footprint.
FAQs
What is the most significant privacy law news today for U.S. companies?
The combination of the $25 billion Meta penalty in New Mexico, California’s expansion of CCPA deletion rights to third-party data, and the growing number of states requiring Global Privacy Control signals. These developments raise both litigation and operational compliance stakes.
How does the EU AI Act affect U.S. companies in 2026?
Transparency and certain prohibited-practice rules became enforceable in August 2026. Companies offering AI systems or general-purpose models to EU users must address disclosure, marking of synthetic content, and documentation obligations even while high-risk system rules remain deferred.
What changes does SB 923 make to California deletion rights?
Effective January 1, 2027, businesses must delete personal information held “from or about” a consumer, including data obtained from third parties and brokers, not only data collected directly from the individual.
Why is Global Privacy Control important right now?
Multiple states treat GPC as a valid universal opt-out request. Enforcement actions have already targeted failures to honor the signal across devices and linked accounts. Ignoring it creates clear regulatory risk.
How should companies prepare for cybersecurity audits under California rules?
Begin documenting security controls, risk assessments, and evidence of implementation now. Certification deadlines are phased by revenue beginning in 2028, but the underlying program work must start earlier.
Are biometric privacy claims still a major risk?
Yes. State laws and private litigation continue to focus on collection, retention, and use of biometric identifiers. Consent alone is often insufficient if the collection is broader than necessary or retention is open-ended.
What is the practical difference between compliance and infrastructure?
Compliance focuses on meeting current legal requirements through policies and reactive processes. Infrastructure builds systems (data inventories, automated rights fulfillment, preference management, integrated AI governance) that can absorb new rules and scale with enforcement intensity.
You May Also Like: 15 Weird Laws in Florida That Are Surprisingly Still on the Books