While Washington spends the summer debating whether to preempt state privacy laws, the states keep writing better ones. Today — July 1, 2026 — three of them level up at once: Arkansas joins the roster of comprehensive-privacy states, Utah adds new consumer rights to its first-generation law, and Connecticut activates a set of amendments that make its Data Privacy Act one of the most forward-looking in the country, with first-of-their-kind rules on neural data and AI training disclosure. None of this will lead the evening news. All of it changes what companies can legally do with your data starting this morning.
Connecticut: the amendment worth reading twice
Connecticut’s amended CTDPA is the headline act, and two provisions in particular mark the frontier of American privacy law.
The first is the addition of neural data to the categories of sensitive personal information — alongside government-issued IDs — with a flat prohibition on selling sensitive data without consent. Neural data protections existed in only a handful of states, and their arrival in Connecticut confirms a trend we expect to accelerate: as consumer EEG headsets, focus-tracking wearables, and brain-computer interfaces move from labs to shopping carts, legislators are deciding before the scandal, for once, that the signals coming off your nervous system are not just another marketing input. Data about what your brain is doing is the last truly interior information you have. Connecticut now treats it that way.
The second is quieter and, we would argue, just as consequential: privacy notices in Connecticut must now disclose whether the controller collects, uses, or sells personal data for the purpose of training large language models. That is a disclosure obligation aimed squarely at the defining data grab of this decade. We have covered the lawsuits — therapy transcripts surfacing in AI training corpora, chatbot queries shared with ad platforms — and the common thread is that nobody was told. As of today, in one state, silence is no longer an option. Expect the plaintiff’s bar to read those notices closely, and expect “we do not train on your data” to become a competitive claim that companies must actually honor.
The amendments also lower the law’s applicability threshold to entities processing data of just 35,000 consumers — or any sensitive data — and extend earlier work on profiling rights, algorithmic pricing disclosures, and restrictions on precise geolocation. Surveillance pricing readers will recognize that algorithmic-pricing language; Connecticut saw the same reporting everyone else did.
Arkansas and Utah: the patchwork grows and matures
Arkansas’s new law makes it roughly the twentieth state with comprehensive consumer privacy coverage — the by-now-familiar bundle of access, deletion, and opt-out rights. It is not an ambitious statute, but that is almost beside the point. Every state that crosses the line makes the “patchwork” larger, and the patchwork is the single strongest argument industry has for a weak federal ceiling. More on that in a moment.
Utah, one of the earliest and mildest privacy states, is doing something more interesting: growing up in place. As of today its residents gain a right to correct inaccurate personal data — closing a gap that had made Utah’s law the outlier among its peers — and the state’s novel social media data portability and interoperability requirements come online, forcing platforms to let users take their social graph with them. Portability rules attack the lock-in that makes surveillance platforms unaccountable in the first place; you cannot leave a platform that holds your entire social life hostage. Watch whether other states copy this.
The preemption shadow
You cannot understand today’s milestones without the fight we covered in June: the SECURE Data Act, the House framework that would impose a national privacy standard by preempting state laws — including, potentially, everything described above. Its supporters call the state patchwork unworkable. Note what the patchwork actually produced this morning: neural data protections, LLM training transparency, and data portability, none of which appear in the federal draft. The states are not fragmenting a national standard. They are writing the first draft of one, and the preemption debate is at bottom about whether that draft gets erased.
The pattern has held for five years now: California invents, Connecticut and Colorado refine, and two dozen states adopt — while the federal proposal that would freeze it all perpetually circles the runway. If preemption passes, July 1, 2026 is the kind of day that stops happening.
What to do about it, practically
If you live in Connecticut, Arkansas, or Utah: your rights expanded overnight, and they are only as real as their exercise. Send access requests. Use the opt-outs. Connecticut residents in particular should start reading privacy notices for the new LLM-training disclosure — and treating its absence as the red flag it now legally is. If you live elsewhere, remember that companies rarely build state-specific plumbing; rights won in Hartford have a habit of showing up in everyone’s settings page.
And wherever you live, watch the preemption fight in Congress with today in mind. The question is not whether America gets a privacy law. Twenty states already answered that. The question is whether the ambitious ones survive.
