Digital Chicks People Focused Tech Powered Logo

New Privacy Laws in 2026:
What Small Businesses Actually Need to Know

Look, I get it. When you hear “privacy laws,” your eyes probably glaze over faster than they do at a timeshare presentation. You’re running a business, not a multinational tech conglomerate, and Privacy policies feel like something for the big players, right?

Wrong. (Sorry to be the bearer of inconvenient news.)

Here’s the thing: 2026 is bringing five significant privacy law changes that could affect your website, whether you’re selling handmade candles from your home office or running a multi-state consultancy. And no, being small doesn’t make you invisible to regulators. In fact, one of these new laws applies to businesses processing data from just one resident of a particular state.

So let’s break down what’s coming, who needs to care (spoiler: probably you), and how to get your ducks in a row without losing your mind in the process.

The Lineup: Three New Laws, Two Updates

In 2026, we’re seeing 3 brand-new state privacy laws:

  • Kentucky Consumer Data Protection Act (January 1, 2026)
  • Rhode Island Data Transparency and Privacy Protection Act (January 1, 2026)
  • Indiana SB 5 (July 1, 2026)


Two existing laws are getting makeovers:

  • Australia Privacy Act 1988 (changes in December 2026)
  • Connecticut Data Privacy Act (changes July 1, 2026)


Now, before you think, “I don’t do business in Rhode Island, so I’m fine”… pump the brakes.

These laws don’t care where your business is registered; they care where your customers are.

Sell to someone in Kentucky? Kentucky law might apply to you.

Have Australian clients? You guessed it.

Who Actually Needs to Comply? (The "Am I Off the Hook?" Section)

Here’s where it gets interesting. Kentucky and Indiana are playing the “big business” game. Their laws mostly target companies processing data from 100,000+ residents or making serious money from selling data (25,000 residents + 50% of revenue from data sales).

But Rhode Island? Rhode Island decided to go rogue. Their law has two parts:

  • Privacy rights requirements apply to businesses processing data from 35,000+ residents (or 10,000+ if you’re making 20% of revenue from data sales).
  • Privacy Policy requirements apply to ANY commercial website doing business with even ONE Rhode Island resident.


Read that again. One. Single. Resident.

So if you have an online shop, a consulting practice, or literally any website that collects customer information and has sold something to someone in Rhode Island… congratulations, you need a compliant Privacy Policy.

Nonprofits get a pass on Kentucky, Indiana, and the privacy rights portion of Rhode Island’s law, but not on Rhode Island’s Privacy Policy requirement.

What Even Counts as "Personal Data"?

All three new laws define personal data in a similar manner.  It’s basically any information that can be linked to a real person:
  • Names and email addresses (the obvious ones)
  • Phone numbers and physical addresses
  • IP addresses and cookie identifiers (yes, those invisible trackers on your site count)
  • Location data, device IDs, and browsing behaviour
  • etc.

If you’re using Google Analytics, a heat map, a contact form, an email service, or an e-commerce platform, you’re collecting personal data. Full stop.

Consumer Rights: What People Can Demand from You

These laws give residents the right to:
  • Access their data (“Show me what you have on me”)
  • Delete their data (“Forget I ever existed”)
  • Correct inaccurate data (“Actually, that’s not my middle name”)
  • Port their data to another service (take their ball and go home)
  • Opt out of data sales and targeted advertising

Some laws also give people the right to restrict processing or object to automated decision-making and profiling (think: algorithms deciding who gets a loan or personalized ads). The kicker? You can’t discriminate against people for exercising these rights. Do not penalize customers for requesting that you delete their data.

Privacy Policy Requirements: The Checklist You Need

Each law requires a clear, accessible Privacy Policy that discloses: ✅ What categories of data you collect ✅ Why you’re collecting it ✅ Whether you sell data or use it for targeted ads ✅ Who you share data with (hello, third-party plugins) ✅ How people can submit privacy rights requests ✅ How to opt out of data sales Indiana also requires your Privacy Policy link to be “clear and conspicuous” – so no burying it in 6-point font at the bottom of your footer.

Enforcement: AKA "What Happens If I Ignore This?"

Here’s where the “it won’t happen to me” mentality gets expensive:
  • Kentucky: Up to $7,500 per violation
  • Rhode Island: Up to $10,000 per violation
  • Indiana: Up to $7,500 per violation plus investigation costs

These aren’t parking tickets. If your website violates multiple provisions across multiple users, those fines stack up fast. And each state’s Attorney General can enforce these laws, meaning you’re not just dealing with an annoyed customer; you’re dealing with someone with subpoena power.

Looking for peace of mind and less tech stress?​

Security, performance, backups, privacy, and much more – the list of tasks needed to keep your website performing at its peak can seem overwhelming and time-consuming.

Signup for website management and get a tech-savvy team who are committed to your business.

Never worry about your website again.

Let Us Help You

The Two Laws Getting Upgraded

Australia Privacy Act 1988

If you use automated decision-making (think: algorithms approving loans, filtering job applications, or serving personalized content), Australia now requires you to disclose:

  • What personal info your algorithms use
  • What kinds of decisions they make
  • Whether humans review those decisions


Connecticut Data Privacy Act

Connecticut is tightening the legislation by:

  • Lowering thresholds (now applies to businesses with 35,000+ Connecticut residents, down from 100,000)
  • Expanding “sensitive data” to include neural data, biometric data, financial info, and government IDs
  • Removing the nonprofit exemption
  • Requiring opt-in consent for selling personal data (not just opt-out)

 

How to Prepare (Without Spiraling)

Take a breath. This is manageable. Here’s your action plan:

  1. Audit your data collection. What are you actually collecting? Contact forms? Newsletter signups? Google Analytics? List it all.
  2. Check the thresholds. Do you hit the resident or revenue numbers for Kentucky, Rhode Island, or Indiana? Even if you don’t, Rhode Island’s Privacy Policy requirement probably applies to you.
  3. Update (or create) your Privacy Policy. Include all required disclosures and make it easy to find on your site.
  4. Set up a process for handling rights requests. Create a form or email system for people to request access, deletion, or opt-outs. Document everything.
  5. Review your vendor contracts. Make sure third-party tools (like your email provider or analytics platform) are contractually obligated to follow privacy rules.
  6. Train your team. If you have employees or contractors, make sure they know how to handle privacy requests properly.
  7. Stay on top of changes. Privacy laws evolve constantly. Subscribe to updates (or use a tool that monitors changes for you).

The Reality Check

I know this feels like a lot. And yes, it’s seems like privacy laws are popping up faster than mushrooms after rain. But here’s the truth: ignoring them won’t make them go away. And the “I’m too small to get caught” mentality is exactly what lands small businesses in hot water.

The good news? You don’t have to become a privacy law expert. Tools like Privacy Policy generators (ahem, like Termageddon) can handle the heavy lifting, creating policies, monitoring law changes, and updating your policies automatically when new laws apply to you.

Several of our WordPress Care & Maintenance Plans include Termageddon (and we set it up for you)!

So instead of hoping you fly under the radar, get compliant now. Your future self (and your bank account) will thank you., 

Tagged