The 2026 state privacy laws split institutional exemptions from data exemptions

The week

Comprehensive consumer privacy laws took effect in Indiana, Kentucky and Rhode Island on New Year’s Day 2026, while most people were recovering from the night before. Three more states had changed the rules on how organizations handle personal information.

“Comprehensive” here means the laws cover personal data broadly, across industries, rather than one sector such as health care or one type of data such as children’s information. All three follow the broad template set earlier by Virginia and Colorado. In practice, that template gives consumers a familiar set of rights:

• to access the personal data an organization holds about them, and to correct it, delete it or port it, meaning receive a copy in a form they can take elsewhere;
• to opt out of targeted advertising, of the sale of their data, and of certain profiling, the automated analysis of personal data to make predictions or decisions about someone.

The laws also require data protection assessments for higher-risk processing. A data protection assessment is a documented, written review, done before the activity, of what data is used, why, what could go wrong for the people involved, and what safeguards are in place: a risk memo that a regulator can ask to see.

Enforcement sits with each state’s attorney general. There is no private right of action, which means individuals cannot sue under these laws themselves; only the state can bring a case.

For banks and health systems, the interesting part was the fine print on exemptions. Each law carves out organizations or data already governed by two federal laws: the Gramm-Leach-Bliley Act (GLBA), which governs how financial institutions handle customers’ personal financial information, and HIPAA, which governs health information held by health care providers, health plans and their contractors. But the three laws do it in different ways.

Kentucky and Indiana broadly follow Virginia in exempting GLBA financial institutions and HIPAA covered entities as organizations. Kentucky’s text also reaches financial institutions’ affiliates and HIPAA business associates, the outside firms that handle health information on a provider’s behalf. Rhode Island exempts GLBA financial institutions and data, and HIPAA covered entities and business associates, in one subsection, and lists exempt data, including protected health information, in another.

Meanwhile, Congress had still not passed a comprehensive federal privacy law, so the state-by-state patchwork kept growing.

Most banks and health systems carry a short answer to state privacy laws: GLBA or HIPAA exempts us. It is a comforting answer, and often a partly true one. The January 1 laws show why that answer needs a citation.

A privacy statute can exempt an organization because of what it is, or exempt certain data because of the federal law that governs it. The two choices produce very different obligations for the same institution. Rhode Island shows both drafting choices in one statute, with entity-level carve-outs in one subsection and data-level carve-outs in another, so an institution has to know which one it is relying on.

Every data set an organization holds falls, state by state, into exactly one of three positions: covered by an entity-level exemption, covered only by a data-level exemption, or reached by no exemption at all.

Hospitals versus ambulance sirens

Take a city noise ordinance. One version says: “This ordinance does not apply to hospitals.” Another version says: “This ordinance does not apply to ambulance sirens.” Under the first, a hospital can run a loud generator at 3 a.m. and the ordinance has nothing to say. Under the second, the hospital’s ambulances are fine, but its generator, its rooftop air conditioning and its construction crews are all subject to the rules.

Privacy exemptions split the same way. An entity-level exemption is like the first version: the organization itself is outside the law because of what it is. A data-level exemption is like the second: only certain information is outside the law, because another statute already governs it, and everything else the organization holds is in scope.

The distinction matters because banks and health systems hold far more than the data GLBA and HIPAA govern. GLBA covers nonpublic personal information about customers of financial products. HIPAA covers protected health information, the health records and related data that providers, health plans and their business associates hold. But a modern bank or hospital also runs public websites with tracking tools, marketing campaigns, event sign-ups, fundraising databases, job applicant systems and mobile apps. Whether that data is covered by a state privacy law depends entirely on which kind of exemption a state wrote, and on whether the specific legal entity holding it qualifies.

Some practical vocabulary will recur below. A data inventory is an organization’s catalog of what personal data it holds, where, and why. A consumer request is a request from an individual to exercise one of the rights above. A processor is an outside firm that handles data on the organization’s behalf, such as a marketing platform or analytics provider. And a universal opt-out signal is a setting in a person’s browser or device that automatically tells every website they visit that they do not want their data sold or used for targeted advertising, so they do not have to opt out site by site.

Entity-level exemptions

An entity-level exemption takes the whole organization outside the law’s main duties. A bank that qualifies as a GLBA financial institution under Kentucky’s law is not required to honor Kentucky deletion requests for its website analytics, its event sign-ups or its prospect lists. The exemption follows the institution, not the record.

That sounds like the best possible position, and in some ways it is. Three things make it less secure than it looks.

First, the exemption depends on corporate form. A bank holding company’s non-bank subsidiaries, an insurance agency, a wealth platform run through a separate legal entity, or a health system’s foundation may not qualify. The org chart decides, and few privacy teams keep a current one. Large organizations are rarely one legal entity; they are families of companies, and the law looks at each family member separately.

Second, the exemption is drafted state by state. One law may cover “financial institutions and their affiliates”; another may name only the institution. Kentucky’s reach to affiliates and business associates is a good example: an affiliate that is exempt in Kentucky may not be exempt in a state whose text names only the institution itself.

Third, an exemption from the privacy statute leaves other laws untouched. Breach notification laws, consumer health data laws and the attorney general’s unfair practices authority all still apply. Being outside one statute does not put an institution outside the attorney general’s interest.

The practical control is a legal-entity register mapped to each statute’s exemption language. It should list which entities rely on which exemption, under which section, as of which version of the law. Counsel should review it whenever the corporate structure or a statute changes.

Where the reading is uncertain, for example whether a particular affiliate counts as a covered entity or business associate, the register should say so. A health system can record the narrower reading as its working assumption, scope that affiliate’s data on that basis, and note what would change if the broader reading prevailed. That costs a few days of data mapping. Guessing wrong in the other direction costs a remediation project under an attorney general’s deadline, with consumer requests already unanswered.

Data-level exemptions

A data-level exemption covers only the information that GLBA or HIPAA governs. Everything else the organization holds is in scope. For a hospital in a state that exempts protected health information but not covered entities, the clinical record is outside the law. The fundraising database, the marketing pixel data from the public website, the wellness event registrations and the call recordings from a scheduling line may not be. A marketing pixel is a tiny piece of code on a web page that reports visitors’ activity back to an advertising or analytics company.

This position creates the most operational work, because it requires the organization to sort its own data by legal status. That sort rarely matches how systems are built. A customer relationship management platform, the software sales and service teams use to track every interaction with a customer, may hold account data that GLBA covers alongside marketing preferences that it does not. A patient engagement platform may mix protected health information with general consumer data collected before anyone became a patient.

Three capabilities matter here:

1. The data inventory needs a field for legal basis as well as sensitivity. Most inventories record whether data is “confidential” or “restricted.” Few record whether it is GLBA data, HIPAA data, or neither. Without that field, nobody can tell which records a state law reaches.
2. The consumer request process needs logic that can split a request. It must be able to honor a deletion for marketing data while retaining records the institution must keep.
3. The response letter has to explain the split clearly. A customer who asks a bank to delete their data will not accept “some of it is exempt” without an explanation of which part and why.

The patient who asked to be deleted

Suppose a health system operates in a state with a data-level exemption for protected health information, and a former patient asks it to delete all of her data. Her medical record is protected health information, governed by HIPAA, and outside the state law, so it stays. But she also attended a free community cooking class two years ago, signed up for the health system’s newsletter, and browsed the website where a marketing pixel recorded her visits. Those records are likely in scope. A good response deletes what the state law reaches, explains in a short paragraph that her medical record is governed by federal health privacy law and must be retained, and tells her how to exercise her HIPAA rights. A poor response either deletes nothing, citing HIPAA, or tries to delete everything and collides with medical record retention duties.

Data no exemption reaches

The third position covers data outside both kinds of carve-out. Typical examples include advertising technology data, data shared with analytics partners, information about people who are neither customers nor patients, and data held by affiliates that are not themselves banks or covered entities. Fintech subsidiaries and direct-to-consumer digital health ventures often land here.

In this position the state laws apply in full:

• Targeted advertising opt-outs must work.
• Universal opt-out signals must be recognized where a state requires it.
• Profiling that produces significant effects needs a documented data protection assessment.
• Processors must be bound by contract terms on confidentiality, deletion and help with consumer requests.

The contract point is often missed. Many marketing and analytics agreements were signed on the assumption that GLBA or HIPAA took the institution out of scope. Those agreements may lack the processor terms the state laws expect. Fixing them one renewal at a time can take years, so a targeted amendment campaign for the highest-volume vendors is usually faster.

This position also tends to grow unnoticed, because each new digital product, tracking tool or data partnership adds to it without a formal privacy review. A marketing team that adds a new analytics tag to the website on a Tuesday afternoon may have just created a new state-law obligation, without anyone in legal knowing.

How a privacy request actually travels through an organization

The three positions stop being abstract once you follow a single request from start to finish.

A request usually arrives through a web form, an email address or a call center. The first step is verifying that the person is who they say they are, so that a stranger cannot obtain or delete someone else’s data. The second step is working out which state’s law applies, which usually depends on where the person lives.

The third step is the one most organizations find hardest: finding the person’s data. In a bank or health system, one individual may appear in a dozen systems, often under slightly different names, email addresses or account numbers. The core banking system or electronic health record, the CRM, the marketing email platform, the website analytics tool, the event registration system and the call recording archive may each hold a piece. A good data inventory tells the team where to look; a poor one leaves them guessing.

The fourth step is deciding, system by system, which records the law reaches. This is where the legal-basis field earns its keep. If each data set is already tagged as GLBA data, HIPAA data or neither, the decision is quick and consistent. If not, a privacy analyst has to work it out case by case, which is slow and invites inconsistent answers to similar requests.

The fifth step is carrying out the request, including telling processors to do the same. If a marketing vendor holds the person’s data, the vendor must delete it too, which only works smoothly if the contract obliges the vendor to help.

The final step is the response letter, which must explain what was done and what was not, in language a customer can follow, within the deadline the law sets.

Each of these steps maps back to one of the controls described above. The entity register answers which law applies to which part of the organization. The inventory and its legal-basis field answer where the data is and whether it is in scope. The processor contracts make deletion possible outside the institution’s own walls. When those controls are missing, every request becomes a small investigation.

The exposure in each position

Each of the three positions carries concrete business exposure.

Regulatory risk. Attorneys general enforce these laws, and an investigation tends to begin with a simple question: on what basis did you decide this law did not apply? An institution that can produce a register, with statutory citations and dates, has a defensible answer. One that can only say “we assumed GLBA covered it” has a much harder conversation.

Operational cost. The work of sorting data by legal basis, building request logic and amending contracts is real, but it is far cheaper done on a planned schedule than under an enforcement deadline. Remediation projects run under pressure tend to cost more and disrupt more.

Customer trust. Customers and patients increasingly exercise these rights. A clear, respectful response to a deletion request builds confidence; a confusing or dismissive one can become a complaint, a social media post or a news story. Banks and health systems trade on trust, and privacy handling is one of the visible places where that trust is tested.

Growth plans. New digital ventures, fintech subsidiaries and consumer health apps are often where growth is expected. They are also where exemptions are least likely to reach. Building privacy compliance into those ventures from the start is much cheaper than retrofitting it.

One matrix, several owners

The output of all three positions is a matrix with data sets down one side, states across the top, and the applicable position in each cell. Ownership matters as much as content. The privacy office understands the statutes. Data teams know where the data lives. Marketing owns many of the systems in the third position. The matrix is where those groups agree on the facts, and it gives examiners and auditors a record of how the institution decided what applied.

The institutions that handle this well keep a legal-entity register with statutory citations and version dates; a data inventory with a legal-basis field; a consumer request process that can split requests and explain the split; processor contracts updated for the highest-volume vendors; and a fixed calendar for re-testing exemption claims.

The errors are predictable too: treating the parent company’s exemption as covering every subsidiary; assuming one state’s exemption language matches another’s; leaving marketing technology out of the privacy review because “we are a HIPAA entity”; and responding to consumer requests with a blanket refusal that cites a federal law the requester has never heard of.

Where an exemption claim is weakest

• For each state where we have customers or patients, which kind of exemption do we rely on, and which section of which statute says so?
• Which of our legal entities, such as foundations, subsidiaries, agencies and digital ventures, do not themselves qualify for an exemption?
• If someone asked us to delete all their data tomorrow, could we delete what the law reaches and explain clearly what we kept and why?
• Which of our marketing and analytics contracts lack the processor terms state laws expect, and which vendors handle the most data?
• When did we last re-test our exemption claims, and is there a date in the calendar for the next review?

Most of these can be answered by a small working group from privacy, data and marketing in a few weeks. The answers become the institution’s record of how it decided, which is exactly what a regulator will ask to see.

With hindsight

Connecticut’s amended privacy law took effect on July 1, 2026, and made plain what the January laws had only suggested: exemptions are a property of a statute’s current text, and that text moves. On their own, the January laws did not change much for most banks and health systems.

The Connecticut amendments, signed in June 2025, replaced the state’s entity-level GLBA exemption with a data-level one, while adding entity-level exemptions for certain banks, insurers and other regulated firms. As a result, some institutions that had been outside Connecticut’s law as organizations found that, from that date, only their GLBA data was exempt, while others gained an organization-wide exemption they had not had before. An institution that had filed Connecticut under “exempt” in 2023 had to recheck its position before that date.

Congress still had not enacted a comprehensive federal privacy law by October 2026, so the patchwork kept growing. For organizations operating across many states, that means the privacy picture is never finished; it is a map that has to be redrawn each time a legislature acts.

The organizations in the best position were those that recorded the specific statutory basis for each exemption claim and reviewed it on a fixed calendar. Those relying on a blanket assumption of GLBA or HIPAA coverage tended to find the gap through a consumer request, a vendor audit or an attorney general inquiry, which are the three least comfortable ways to find it.

How a compliance decision is recorded matters as much as what it concludes. “We are exempt” is a conclusion. “We are exempt under this section, of this version of this statute, for these entities, as of this date” is a decision that can be checked, defended and updated. The second takes slightly more effort and saves a great deal when the text changes. It also means a new general counsel, privacy officer or auditor can pick up the file and understand the reasoning without starting again.