3 Key Takeaways from the World of Data Privacy in 2022

As we move through 2026, the data privacy landscape has shifted from "preparing for change" to "navigating active enforcement." The trends that emerged in 2022—such as the Sephora settlement and the rise of the CPRA—have matured into a complex, high-stakes regulatory environment.

Here are the three critical takeaways for 2026, updated to reflect the current state of national and state-level privacy.

1. The US Federal Privacy Law: A "Stalled" Reality

Back in 2022, there was significant hope that the American Data Privacy and Protection Act (ADPPA) would simplify compliance by preempting the state patchwork. However, as of March 2026, a comprehensive federal law remains elusive.

• The State Patchwork is Now the Standard: In the absence of federal action, the number of states with comprehensive privacy laws has jumped from 5 in 2022 to 19 active states in 2026 (including newcomers like Indiana, Kentucky, and Rhode Island).
• A "De Facto" National Standard: While there is no federal law, a "common core" has emerged. Most states have adopted the "Virginia-style" model, which emphasizes data minimization, consumer rights (access, delete, correct), and mandatory Data Protection Impact Assessments (DPIAs).

2. Consent 2.0: The End of "Silent" Processing

The $1.2 million Sephora settlement in 2022 was a warning shot; today, the California Privacy Protection Agency (CPPA) has made "opt-out transparency" a primary enforcement pillar.

• Mandatory Confirmation: Starting January 1, 2026, California businesses must not only honor Global Privacy Control (GPC) signals but also provide a visible indicator (like a badge or "Opt-Out Honored" toggle) to show the consumer their signal was recognized. "Silent" backend processing is no longer compliant.
• The "Symmetry" Rule: Regulators are aggressively targeting "Dark Patterns." Under current rules, the path to opt-out must be just as easy as the path to opt-in. If your "Accept All" button is bright green and your "Reject All" is hidden in a sub-menu, you are an immediate target for a $7,500+ intentional violation fine.

3. HR Data: The Privacy "Blind Spot" is Gone

The expiration of the employee data exemption in 2023 was the single biggest operational shock to HR departments. In 2026, we are seeing the first major enforcement actions regarding employee Data Subject Access Requests (DSARs).

• The "Vexatious" Shield: New 2025/2026 amendments in some states (and the UK’s DUAA) allow firms to refuse requests that are "vexatious or excessive." This helps HR teams defend against former employees using DSARs to harass the company.
• AI & Employee Monitoring: With the rise of hybrid work and AI-driven productivity tracking, California now requires specific Risk Assessments and notices before using Automated Decision-Making Technology (ADMT) for "significant decisions" like hiring, firing, or performance scoring.

‍