Introduction
If you thought keeping up with data privacy rules in the US was already a full-time job, here’s some more work for your calendar: Louisiana and Vermont have both added new privacy protections to the growing patchwork of state-level data laws that marketing and martech teams are expected to follow.
There’s no single federal privacy law covering the whole country, which means every state gets to write its own rules, and every state that does adds one more thing your marketing tools and processes need to account for.
This guide breaks down what’s changed, why it matters even if you don’t have customers in either state, and what to actually do about it.
What you’ll learn:
- Why individual states keep passing their own privacy laws
- What’s changed in Louisiana and Vermont
- How this affects your martech stack and marketing practices
- A practical checklist to stay compliant going forward
Key Takeaways
- The US still has no single federal privacy law, so states continue passing their own individual rules, and that patchwork keeps growing.
- Louisiana and Vermont have joined the group of states with active data privacy protections in 2026.
- Most state privacy laws share common themes: consumer rights over their data, restrictions on selling data, and requirements around consent for certain data uses.
- If your marketing collects data from consumers anywhere in the US, you may need to comply with several state laws simultaneously, not just the state where your company is based.
- Building your compliance approach around the strictest applicable state law is usually easier than managing separate rules for each one.
Why This Keeps Happening: The US Privacy Patchwork
Unlike the European Union, which has one overarching privacy law covering every member country, the United States has left privacy regulation mostly up to individual states. Since the first wave of state privacy laws passed several years ago, more states have steadily joined in, each adding their own version of consumer data protections.
For marketing and martech teams, this means compliance isn’t a “check the box once” exercise. It’s an ongoing process, because a state you don’t currently do business in today might pass a new law next year that suddenly applies to you.
Louisiana and Vermont are simply the latest additions to that growing list.
What Changed in Louisiana and Vermont
Both states have moved to strengthen data privacy protections for their residents, joining the broader trend of state-level privacy legislation that’s been building steadily. While the specific legal language differs by state, these laws generally follow patterns already established elsewhere: giving consumers more visibility into and control over their personal data, and placing new obligations on companies that collect it.
For marketing teams specifically, this typically touches areas like:
- How consumer data can be collected and for what purposes
- Whether and how that data can be sold or shared with third parties
- What rights consumers have to access, correct, or request deletion of their data
- What disclosures companies must provide about their data practices
The exact thresholds and requirements vary by state, which is exactly why a state-by-state compliance approach quickly becomes unmanageable for most marketing teams.
Why This Matters Even If You’re Not Based in Either State
Here’s the detail that trips up a lot of marketing teams: these laws generally apply based on where your customers or website visitors live, not where your company is headquartered.
If your marketing reaches consumers nationally, through paid ads, email campaigns, or a public website, you may need to comply with Louisiana’s and Vermont’s rules even if your business has no physical presence in either state. The same logic applies to every other state with an active privacy law.
This is why many companies stop trying to track each state law individually and instead build their marketing data practices around the strictest standard among all the states they reach. It’s simpler, and it naturally covers you as more states add new laws over time.
Step-by-Step: Building a Compliance-Ready Marketing Process
Step 1: Map where your data actually comes from. List every source: website forms, ad platforms, email signups, purchased lists, app data. You can’t comply with a law about data you can’t account for.
Step 2: Identify where your audience lives. Even a rough breakdown by state helps you understand which specific state privacy laws are relevant to your marketing right now.
Step 3: Review your current consent and disclosure practices. Check whether your privacy policy, cookie banners, and opt-in language clearly explain what data you collect and why.
Step 4: Build a request-handling process. Most state privacy laws give consumers rights to access, correct, or delete their data. Make sure there’s a clear internal process, not just a policy page promise, for handling these requests.
Step 5: Set a recurring review cadence. Because new states keep passing new laws, schedule a compliance review at least twice a year rather than treating this as a one-time project.
Best practices: Keep documentation of your data practices even where not strictly required, since it makes future compliance reviews far faster.
Common troubleshooting tip: If your martech stack can’t currently produce a report showing exactly what data you hold on a specific individual, that’s usually the first gap to fix before worrying about anything else.
Comparison: Common Elements Across State Privacy Laws
| Element | Typically Included? | Why It Matters for Marketing |
|---|---|---|
| Consumer right to access their data | Usually yes | You need a process to retrieve and share this data on request |
| Consumer right to delete their data | Usually yes | Your CDP and marketing tools need to support deletion, not just storage |
| Restrictions on selling data | Usually yes, with some variation | Affects data-sharing partnerships and some ad targeting practices |
| Opt-out rights for targeted advertising | Often included | May require adjustments to how you run retargeting campaigns |
| Specific disclosure requirements | Usually yes | Privacy policy language needs regular review and updating |
Common Mistakes to Avoid
- Assuming compliance only matters if your company is based in that state. Most laws apply based on where your customers live, not your headquarters.
- Treating your privacy policy as a “set it and forget it” document. Policies need updating as laws change, not just when someone finally notices they’re outdated.
- Not knowing what data your martech stack actually holds. You can’t respond to a deletion request for data you don’t know you have.
- Handling privacy law compliance as purely a legal team problem. Marketing operations and martech admins need to be directly involved, since they control the tools where the data lives.
- Waiting for a specific state to “come after you” before acting. Enforcement can happen well after a law takes effect, and non-compliance during that gap still carries risk.
Benefits of Getting Ahead of Compliance
Main benefits: Reduced legal and financial risk, improved customer trust, and a martech stack that’s easier to manage as more states inevitably pass similar laws.
Who should prioritize this immediately: Any company running national digital marketing campaigns, email programs, or advertising, regardless of where the company itself is headquartered.
Who has a bit more breathing room: Very small, hyper-local businesses marketing only within a single state without an active privacy law, though this window is shrinking every year.
Expert Tips
- Build your compliance program around your strictest applicable state law, then treat every other state’s requirements as already covered by that baseline. This avoids constant one-off adjustments every time a new law passes.
- Ask your martech vendors directly whether their platform can produce a full data report for a single individual on request. If they can’t answer confidently, that’s a real risk in your stack.
- Loop in your martech operations team on privacy law discussions early. Legal teams understand the requirements, but marketing operations teams are the ones who actually implement changes inside the tools.
What’s Next for State Privacy Laws
Expect more states to introduce their own privacy legislation in the coming years, continuing the current pace of expansion rather than slowing down.
Expect growing pressure, from both consumers and industry groups, for a single federal privacy standard that would simplify this patchwork, though there’s no clear timeline for that happening.
Expect martech vendors to increasingly market built-in compliance features as a competitive advantage, since managing this complexity manually is becoming harder for marketing teams to justify.
Conclusion
Louisiana and Vermont are the latest reminder that data privacy compliance in the US isn’t a box you check once, it’s an ongoing responsibility that grows every time another state passes its own law. The good news is that the underlying requirements across most state laws follow similar patterns: give consumers visibility into their data, honor their requests, and be transparent about what you collect and why.
Build your marketing compliance process around the strictest standard you’re subject to, keep your martech stack able to produce and act on individual data reports, and review your practices regularly. That approach will keep you ahead of Louisiana, Vermont, and whichever state passes the next law after them.
FAQ
What privacy laws did Louisiana and Vermont pass? Both states have introduced data privacy protections for their residents as part of the broader trend of individual US states passing their own privacy legislation.
Does my company need to comply with Louisiana and Vermont’s privacy laws if we’re not based there? Likely yes, if your marketing reaches consumers who live in those states, since most state privacy laws apply based on where the consumer lives, not where your company is headquartered.
Why doesn’t the US have one federal privacy law? Federal privacy legislation hasn’t passed, so individual states have continued to write and pass their own separate privacy laws, creating a growing patchwork of state-level rules.
What rights do state privacy laws typically give consumers? Common rights include the ability to access their personal data, request corrections, request deletion, and opt out of having their data sold or used for targeted advertising.
How can marketing teams prepare for new state privacy laws? By mapping where their data comes from, understanding where their audience lives, reviewing consent practices, and building a clear process for handling consumer data requests.
What happens if my company doesn’t comply with a state privacy law? Consequences vary by state but can include financial penalties and legal risk, along with potential damage to consumer trust.
Should I build separate compliance processes for each state? Most companies find it easier to build one compliance process based on the strictest applicable state law rather than managing separate processes for each individual state.
How often do new state privacy laws get introduced? Fairly regularly. More states have been adding their own privacy legislation, and this trend is expected to continue in the coming years.
Does my martech stack need special features to comply with these laws? Ideally yes. Your tools should be able to produce a report on what data you hold for a specific individual and support deletion or correction requests.
Who should be responsible for privacy law compliance within a marketing team? It should be a shared responsibility between legal or compliance teams, who understand the requirements, and marketing operations teams, who implement changes inside the actual martech tools.
