United States Enacts New Privacy Laws in Rhode Island, Kentucky and Indiana

United States has added three state privacy statutes covering Rhode Island, Kentucky and Indiana, each requiring companies to obtain clear consent before collecting personal data and to provide a simple opt‑out mechanism for consumers.

Businesses must revise website privacy notices, implement data‑mapping tools and train staff to meet the new consent and breach‑notification rules, while facing potential penalties that can reach up to a percentage of annual revenue under the state enforcement schemes.

Privacy advocates say the trio of laws aligns the United States with a global surge of regulations highlighted in recent privacy roundups, noting that tighter rules may improve consumer trust but also increase compliance costs for firms operating across multiple jurisdictions.

Regulators in the three states have set up dedicated privacy offices, modeled after the European GDPR framework, and plan to issue guidance within months, according to a compliance guide that lists five key checkpoints for companies to start addressing in 2026.