Your state privacy rights in 2026, in plain English

By MercPrivacy · Published 2026-08-03 · Updated 2026-08-05

State privacy rights in 2026, mapped in plain English: who has deletion and opt-out rights, what California's new one-stop broker deletion platform changes, and what stays public.

You have more privacy rights today than you had five years ago, and there is a decent chance you have never used one of them. That is not a character flaw. The rights arrived state by state, statute by statute, each with its own acronym, thresholds, and paperwork, and nobody sent you a summary.

Here is the summary.

As of 2026, a growing list of states — California, Texas, Virginia, Colorado, and Connecticut among them — give their residents enforceable rights against many of the companies that hold their personal data. The details vary by state, and some of the variations matter. But the core rights rhyme from statute to statute, and you can understand the whole landscape in the time it takes to finish a coffee.

## The four rights that keep showing up

Most state privacy laws are assembled from the same parts. In plain English:

- **The right to know** — you can ask a covered company what personal data it holds about you and, in most states, get a copy of it. - **The right to delete** — you can tell a covered company to delete the personal data it holds about you. Exceptions exist; companies can generally keep what they need to complete a transaction, prevent fraud, or comply with other laws. - **The right to correct** — several states also let you force a fix to inaccurate data. Not every state includes this one. - **The right to opt out** — you can refuse the sale of your personal data, and in most of these states its use for targeted advertising, regardless of what the privacy policy said when you clicked accept.

The word *covered* is doing quiet work in every bullet. These laws generally apply to businesses above certain size or data-volume thresholds, and every statute carves out categories — employment records, some financial and medical data already governed by federal law, and more. The rights are real. They are not universal.

## Who has them

Residency decides, not the company's address. A Texas resident holds Texas rights against a company in Delaware; a Colorado resident holds Colorado rights against that same company. If your state has no comprehensive privacy law yet, you still benefit at the margins, because many national companies run one request process for everyone rather than maintain a different version per state. But a courtesy extended is not a right conferred. Outside a covered state, the company can decline, and your leverage is thinner.

There is also a quieter limit that applies everywhere:

> A right you have to exercise one company at a time is a right most people never use.

That sentence explains most of the gap between what these laws allow and what actually happens. The deletion right is real. So is the fact that an ordinary person's data sits with hundreds of data-broker sites, each requiring its own request, its own identity check, and its own follow-up. Which is why the newest development matters more than the rest of the list combined.

## The Delete Act: one request instead of hundreds

California looked at that math and changed it for one industry. Its Delete Act created a one-stop deletion platform, called DROP, where a California resident files a single deletion request that data brokers registered with the state are required to act on. Consumers could begin filing in January 2026. As of August 2026, registered brokers must actually process those requests.

That second deadline just arrived. This is the first month the full loop — one form, every registered broker, mandatory processing — is legally required to work end to end. The scope is real but bounded: it covers California residents and brokers on California's registry, so it is not a national fix, and it does not erase the exceptions above. It is, however, the first serious attempt to solve the one-at-a-time problem rather than declaring rights and wishing consumers luck. Whether other states copy the model is worth watching.

## What no state right does

Public records stay public. No deletion right reaches into a courthouse, a county recorder's office, or a voter file. These laws run against companies, and most of them treat publicly available information as outside their scope entirely. The same boundary explains why a court-records aggregator or a county's own portal is a different problem from a marketing broker — different sources, different rules, different levers.

The practical consequence is the one that surprises people. A data broker can honor your deletion request completely and later, lawfully, rebuild much of your profile — because the deeds, dockets, licenses, and filings it drew from never stopped publishing. Deletion is real, and it is also perishable. That is why suppressing [what a data broker knows](https://mercprivacy.com/knowledge/what-a-data-broker-knows) is a maintenance cycle rather than a one-time event; the mechanics of the rebuild are laid out in [why listings come back](https://mercprivacy.com/knowledge/why-listings-come-back).

## Using your rights without making it a career

Three habits capture most of the value:

1. **Aim at the brokers first.** Deleting your file at a store you visited once is tidy. Suppressing your file at the brokers and people-search sites that resell it is what actually reduces the calls, the mail, and the listings. 2. **Expect verification, and use the company's own channel.** A covered company must confirm you are you before it deletes or discloses anything, so a request that asks for identity confirmation is normal. Send what is asked and nothing more. Most covered companies also designate a specific form or portal for these requests; using it beats arguing with a support inbox about whether your email counts. 3. **Keep the confirmations.** A dated trail of who you asked, when, and what they said turns a vague grievance into a documented one. If a dispute ever hardens into a legal matter, the record is what carries it.

## Where we fit

MercPrivacy runs the exercise-and-maintain cycle for clients — the broker suppressions, the re-checks, the paper trail — using whichever rights your state provides; the process is laid out in [how it works](https://mercprivacy.com/how-it-works). If you want to know what applies to your situation, [Stephanie](https://mercprivacy.com/stephanie) answers instantly and free, or call (830) 587-5011. We are not a law firm; when a matter requires legal representation, a licensed attorney is engaged.