Insights / Calendar
The privacy, accessibility, advertising, and licensing rules that change what a business website must show, by the date each one applies. Every entry links to the official text. Checked October 10, 2026; not legal advice.
Next date
January
1
2027
Every date
Filter by topic. Dates that have passed stay listed, because the rules still apply.
Jan 1
2026
In effect
Covered businesses need a privacy notice that lists the data they process and how to exercise rights, a clear disclosure and opt-out if they sell data or run targeted advertising, and a way to submit requests without creating an account. The act applies to businesses that process the data of at least 100,000 Indiana consumers a year, or 25,000 when more than half their revenue comes from selling data.
The website duties match Indiana’s: a privacy notice, a clear opt-out for data sales and targeted advertising, and a request method that does not require an account. The thresholds are also the same, 100,000 consumers, or 25,000 when more than half of revenue comes from selling data.
A commercial website that collects and sells customers’ personally identifiable information must list the categories it collects and every third party it sells to, with an active email address or other contact, in a conspicuous place where similar notices usually appear. The consumer rights duties apply above 35,000 customers, or 10,000 when more than 20 percent of revenue comes from selling data.
Covered businesses must let consumers opt out of data sales and targeted advertising through a browser or device signal that the consumer turns on. A 2025 law that took effect the same day bans selling precise geolocation data and the data of consumers known to be under 16.
A business covered by the CCPA must show on its website whether it has processed a visitor’s opt-out preference signal as a valid opt-out request, for example with a message such as “Opt-Out Request Honored” (11 CCR section 7025(c)(6)).
A real estate licensee who markets property for sale with a digitally altered image must label it on or next to the image and link to the unaltered original (Business and Professions Code section 10140.8, added by AB 723).
Apr 20
2026
In effect
The Justice Department’s interim final rule gave state and local governments one more year to make their websites and mobile apps meet WCAG 2.1 Level AA. The technical standard did not change.
Jul 1
2026
In effect
Public Act 25-113 lowered the thresholds that bring a business under Connecticut’s privacy law and expanded what the privacy notice must say.
Consumers can ask a covered business to correct inaccurate personal data, so the request method in the privacy notice should handle corrections as well as access and deletion.
Oct 1
2026
In effect
Public Act 26-64, signed May 27, 2026, banned the sale of precise geolocation data and made other changes to the privacy law.
Jan 1
2027
In 83 days
AB 2025, signed September 27, 2026, removes leases longer than a year from section 10140.8 and adds Civil Code section 1940.11. Anyone who advertises real property for rent with a digitally altered or AI-generated image must label it, and include the unaltered original when the image began as a photograph.
SB 690, signed September 30, 2026, lets only the Attorney General bring a Penal Code section 638.51 claim against a private business over conduct on a website or app, and applies the change to pending claims filed in the two years before it takes effect. Private suits under section 631, often brought over chat widgets and session replay, are unchanged.
The sections that protect the title Certified Interior Designer were due to expire on January 1, 2027. AB 2772, signed September 27, 2026, extends them to January 1, 2031, so people pages should keep using the title only for certified designers.
Covered businesses need a privacy notice, a clear opt-out for data sales and targeted advertising, and a posted notice if they sell sensitive personal data. The act applies to businesses with more than $25 million in annual revenue, or that buy, receive, sell, or share the personal information of 75,000 or more consumers, households, or devices a year.
Covered businesses need a privacy notice, a clear disclosure and opt-out for data sales and targeted advertising, and at least two ways to submit requests. The act applies at 100,000 consumers, or 25,000 when more than half of revenue comes from selling data.
Apr 26
2027
In 198 days
State and local governments serving 50,000 people or more must make their websites and mobile apps meet WCAG 2.1 Level AA.
May 1
2027
In 203 days
Covered businesses need a clear website link to opt out of targeted advertising and data sales, and a privacy notice with an active email address or other contact. The act exempts businesses with fewer than 500 employees that do not sell personal data.
Apr 26
2028
In 564 days
State and local governments serving fewer than 50,000 people, and special districts, must make their websites and mobile apps meet WCAG 2.1 Level AA.
For your website
We build privacy notices, opt-out links, preference signal messages, and accessible pages into the websites we design, and we can update an existing site before a deadline. Your counsel approves the wording, and we put it in place on every page.
Start a projectLouisiana’s and Oklahoma’s laws take effect on January 1, 2027, and Alabama’s on May 1, 2027. Each applies only to businesses above its thresholds, which are listed on this page and in our state-by-state guide.
State and local governments serving 50,000 people or more have until April 26, 2027, and smaller governments and special districts have until April 26, 2028. The standard is WCAG 2.1 Level AA, and the dates were moved back a year by an interim final rule on April 20, 2026.
No. From January 1, 2027, only the Attorney General can bring a claim under Penal Code section 638.51 against a private business over conduct on a website or app. Private suits under section 631, often brought over chat widgets and session replay, are unchanged.
Usually not. Most apply only above a number of consumers whose data a business handles in a year, often 100,000, or a lower number when most revenue comes from selling data. Alabama’s exempts businesses with fewer than 500 employees that do not sell personal data. California’s Online Privacy Protection Act still requires a posted privacy policy on any commercial website that collects personal information from California residents.
Each entry links to the official text, and the page was last checked on October 10, 2026. The countdowns update in your browser every day, and the entries are reviewed when we refresh our state-by-state guide.
No. It is a summary to plan a website around. Your counsel owns the final wording of any privacy notice or disclosure.
Contact Endcap
A website, a brand, or a complete set of materials.
We reply within an hour during business hours, and we only use your details to answer you.
Start a project or call or text Noah at (425) 233-0769