Three states, three different fixes on the same problem
Three state privacy laws took effect on July 1, 2026, and none of them are cosmetic. Connecticut nearly tripled the number of businesses covered by its privacy statute, Arkansas banned targeted advertising to anyone under 17, and Utah gave consumers a new right to correct the data companies hold on them. For marketing teams running a CDP, a DSP seat or a consent management tool across state lines, all three change what "compliant targeting" means starting now.
Connecticut: the threshold that used to protect you just dropped
The Connecticut Data Privacy Act (CTDPA) amendments lower the applicability threshold from 100,000 residents to 35,000, or as few as one resident if a business sells personal data (Wiley, 2026). A single-resident threshold also now applies to sensitive data: process one Connecticut resident's sensitive data and the law applies, full stop (Foley & Lardner, 2026). The definition of "sensitive data" expanded too, adding neural data, transgender and nonbinary status, and government ID numbers (Benesch Law, 2026). Selling sensitive data without consent is now expressly prohibited.
What changes for marketing teams: any CDP segment or lookalike audience built on financial account data, biometric signals or government ID numbers touching Connecticut residents now needs a documented, reasonably-necessary basis plus opt-in consent, not just a privacy policy disclosure. Mid-market companies that assumed a 100,000-resident floor kept them out of scope should re-run that math against 35,000. A second deadline follows close behind: Connecticut requires impact assessments for any profiling used to make decisions with legal or similarly significant effects, starting with data processing created on or after August 1, 2026 (Foley & Lardner, 2026).
Arkansas: no consent path around advertising to minors
Arkansas's Children and Teens' Online Privacy Protection Act bars operators of services directed at children, or with actual knowledge they are collecting data from anyone under 17, from collecting personal information for targeted advertising (WilmerHale, 2025; Digital Policy Alert, 2026). There is no opt-in exception. Consent does not create a workaround the way it does under most state privacy laws. Data collected and retained strictly under the law's data minimization requirements for operational purposes is the only carve-out.
For marketing teams, this means any age-gating or audience-suppression logic built on "consent obtained" as the trigger will not satisfy Arkansas. If a product or campaign has any plausible under-17 audience and Arkansas residents in it, the targeted-advertising data pipeline needs to exclude that segment entirely, not just flag it for consent capture. CDPs that route age or birthdate fields into ad platform audiences are the most exposed integration point.
Utah: consumers can now force a correction to your record of them
Utah's HB 418 adds a right for consumers to correct inaccurate personal data, with a 45-day response window, extendable once with notice (TrueVault, 2026; JCIT, 2026). The same bill adds social media data portability and interoperability requirements under Utah's Digital Choice Act.
This one hits attribution infrastructure directly. A correction request against a CDP profile does not just fix a name field. If the corrected data feeds an audience, a lookalike model or an attribution match key, the correction has to propagate through those downstream systems inside the 45-day window or the fix is cosmetic. Teams that treat their CDP as the system of record but let ad platforms cache stale profile data for matching will need a way to prove the correction actually reached the platform.
What to watch next
Connecticut's ban on selling precise geolocation data without consent takes effect October 1, 2026, and its profiling impact-assessment requirement applies to Connecticut processing activities created from August 1, 2026 onward (Foley & Lardner, 2026). Both dates are worth a calendar entry now: geolocation-based retargeting and any automated decisioning built on profiling are the next two places this patchwork will bite marketing operations in Connecticut specifically, ahead of whatever the next state does at the start of 2027.
Sources
- Wiley Law. "Major Changes to Connecticut Consumer Privacy Law Will Take Effect July 1, 2026." 2026.
- Foley & Lardner. "Connecticut Dramatically Expands Its Data Privacy Act: What Businesses Need to Know Now." 2026.
- Benesch Law. "Connecticut Broadens Data Privacy Act Requirements Effective July 1, 2026." 2026.
- WilmerHale. "Arkansas Online Privacy Act Expands Privacy Protections for Children and Teens." 2025.
- Digital Policy Alert. "Restrictions on targeted advertising in Children and Teens' Online Privacy Protection Act (HB 1717)." 2026.
- TrueVault. "Utah Adds to Its Privacy Law." 2026.
- JCIT. "Utah's New 'Right to Correct' Privacy Rule." 2026.