Rhode Island, Kentucky, and Indiana Enact New Privacy Laws Shaping Data Practices

Rhode Island – The state introduced a comprehensive privacy statute in 2026 that obligates businesses to secure explicit consumer consent before gathering personal information, and it establishes a framework for handling data requests and breach disclosures.

Kentucky – Lawmakers approved a privacy bill that grants residents the right to delete their data, requires companies to respond to access requests within a set period, and mandates prompt public notification of any data breach affecting state residents.

Indiana – The new legislation combines privacy protections with AI oversight, requiring firms using automated decision systems to disclose algorithmic logic to affected individuals and to maintain records for regulatory review, linking data security with emerging technology accountability.

United States – The trio of state privacy statutes illustrates a growing national momentum toward data protection, encouraging companies to develop unified compliance programs that address varied state requirements, and signaling potential future federal privacy legislation.