Know what’s on your site before a plaintiff’s firm does
A free privacy audit shows which cookies, pixels and trackers are running — and which ones commonly appear in privacy claims.
Our first annual Data Privacy and AI Governance Trends Report covers what changed in 2026, the twelve numbers that defined the year, and the ten trends we expect to drive compliance work in 2027, with a month-by-month 2027 calendar and a 24-point readiness scorecard. Read all 20 pages below.
Annual Report · Edition 01The State of
Privacy & AI
Governance
What changed in 2026, what the numbers say, and the ten trends that will decide your compliance workload in 2027.
Inside: 10 trends for 2027 · Compliance calendar · Readiness scorecard
What’s inside
2026 was the year the deadlines got real.
For most of the last five years, privacy work was about preparing for laws that hadn’t kicked in yet. That stopped in 2026. California’s risk assessment rules took effect on January 1. The Attorney General kept settling opt-out cases. Plaintiffs’ firms filed CIPA suits at a record pace. And companies that bought AI tools in a hurry found out their vendors were sending customer data to subprocessors nobody had listed.
2027 brings more of the same, with less room for error. Automated decision-making rules go live in California and Colorado on January 1. Browsers will start sending opt-out signals by default. The EU has pushed back its high-risk AI deadline, but only to December 2027.
We wrote this report for the people who have to turn all of that into a plan: privacy leads, general counsel, marketing operations, and the founders who wear all three hats. Every figure is sourced. Every prediction carries a confidence rating, so you can see how sure we are.
How to read the predictions
Each 2027 trend carries a five-bar confidence rating.
The year in one page
If you read nothing else, read this. Five things defined privacy and AI governance in 2026, and five things will define 2027.
The opt-out became the enforcement target.
California’s Lyft, Disney and GM settlements all turned on the same question: was opting out as easy as being tracked? Regulators now test the flow, not the policy.
CIPA suits hit a record, then lost a weapon.
California filings climbed past 1,400 by late September. SB 690 then ended private pen-register claims against websites from January 1, 2027.
AI governance spread faster than it matured.
75% of organizations have an AI governance body. Only 12% call it mature. Most AI vendors still don’t name their subprocessors.
Washington and the states went to war over AI.
An executive order, a DOJ task force and a national framework all pushed preemption. Colorado rewrote its AI Act instead of dropping it.
The EU blinked, a little.
The AI Act Omnibus pushed high-risk duties to December 2027. GDPR reform is still in negotiation, with no change in force yet.
The chat window becomes the new pixel.
With pen-register claims gone, plaintiffs move to wiretap claims over chatbots, AI agents and voice bots, where the evidence is the conversation itself.
“AI notices” become as normal as cookie banners.
California ADMT rules and Colorado’s SB 26-189 both start January 1, 2027, with pre-use notices, appeal rights and record-keeping.
Opt-out signals go mainstream.
California requires browsers to offer an opt-out preference signal. Sites that ignore GPC today will be ignoring far more users tomorrow.
Data brokers face their first real deletion audit.
DROP deletions run every 45 days, with $200 per request per day penalties for brokers who fall behind.
Privacy and AI governance merge into one job.
Budgets are rising and the same team now owns consent, vendor review, risk assessments and AI inventories.
The single busiest date on the calendar. California ADMT rules, Colorado SB 26-189, CIPA’s SB 690, California’s browser opt-out mandate, and new comprehensive laws in Louisiana, Oklahoma and Vermont are all scheduled to apply on the same day. Plan your Q4 around it.
Turn on GPC, open your app logged in, and time how long opting out takes.
Include chat widgets, note-takers and anything marketing bought on a credit card.
Find every automated tool touching hiring, lending, housing, insurance or health.
Twelve figures worth remembering
The takeaway
Executives agree privacy matters. The gap is execution: most sites still miss GPC, most AI vendors still hide subprocessors, and most AI governance programs exist on paper. That gap is where 2027’s lawsuits and settlements will come from.
The patchwork got bigger
Congress still hasn’t passed a federal privacy law, so the states kept going. Four new comprehensive laws passed in 2026, several existing laws were amended, and California turned years of rulemaking into dates you can put on a calendar.
| State / rule | What changed | Effective |
|---|---|---|
| Indiana, Kentucky, Rhode Island | Comprehensive laws went live | Jan 1, 2026 |
| California CCPA regs | Risk assessments, cybersecurity audits, ADMT rules | Jan 1, 2026 (phased) |
| Virginia, Maryland | Amendments and new obligations | Jul 1, 2026 |
| Connecticut | Amendment expanding scope and sensitive data | Oct 1, 2026 |
| Louisiana, Oklahoma, Vermont | New comprehensive laws | Jan 1, 2027 |
| New Hampshire | Amendments | Jan 1, 2027 |
| Colorado SB 26-189 | Replaces the 2024 AI Act with an ADMT law | Jan 1, 2027 |
| Alabama | New comprehensive law | May 1, 2027 |
The 2026 CCPA regulations come in waves. Missing the first wave usually means missing the rest.
What’s actually different now
Thresholds keep dropping. Several newer laws and amendments reach smaller companies, and almost all treat sensitive data and minors’ data as opt-in.
A majority of state laws now require businesses to honor universal opt-out signals such as GPC. That turns your cookie tool into a legal control.
Risk assessments are no longer paperwork. California settlements with GM, PlayOn and Lyft wrote them into the terms.
Washington vs. the states: the AI preemption fight
The biggest open question in US AI policy isn’t what the rules say. It’s who gets to write them. In 2026 the White House pushed hard to set one national standard, and the states kept legislating anyway.
The federal push
Executive Order 14365 directed agencies to work toward a single national approach to AI and to challenge state laws seen as burdensome. In January, the Justice Department stood up an AI Litigation Task Force to do that. In March, the White House released a National Policy Framework that favors preemption but carves out child safety, and a Senate draft bill followed.
None of this has preempted anything yet. An executive order can’t override a state statute on its own, and Congress already rejected a blanket moratorium on state AI laws once, by 99 to 1.
The states keep building
Colorado didn’t repeal its AI Act. It replaced it. SB 26-189 drops the broad “high-risk AI” duty-of-care model in favor of notice, a 30-day explanation for adverse decisions, human review, and three-year record keeping. The Attorney General enforces it, with a 60-day cure period through 2030 and no private right of action.
Texas TRAIGA and California SB 53 (frontier model transparency) both took effect January 1, 2026. Hundreds more AI bills moved through statehouses on deepfakes, chatbots, health care and employment.
What it means for you
Plan for the state laws, not for preemption. Even if Congress passes something in 2027, it will take time to apply, it will likely carve out child safety, and it won’t touch existing privacy statutes like the CCPA. Companies that wait for a federal fix will be out of compliance with laws that are already on the books.
CIPA hit a record, then lost a weapon
The California Invasion of Privacy Act turned a 1967 wiretap law into the most common privacy claim in the country. Most suits target ordinary websites: pixels, session replay, chat widgets and analytics tags.
Signed September 30, 2026
From January 1, 2027, only the Attorney General can bring pen-register and trap-and-trace claims (Penal Code 638.51) over websites and apps. It also applies to some pending claims.
What it doesn’t do: sections 631 (wiretapping) and 632 (recording) still carry a private right of action at $5,000 per violation. So does the federal Wiretap Act.
Where the claims are going
| Theory | What plaintiffs allege | 2027 outlook |
|---|---|---|
| Pen register (638.51) | Tracking pixels act like a phone trap-and-trace device by capturing IP and device data. | Shrinks sharply after Jan 1 |
| Wiretap (631) | A third-party vendor “listened in” on chats, forms or session data in real time. | Grows, especially for chat and AI |
| Recording (632) | Confidential conversations, including calls and voice AI, recorded without consent. | Grows with voice agents |
| VPPA | Video viewing history shared with ad platforms through a pixel. | Depends on the Supreme Court |
The chat window is the new pixel
A pixel captures metadata. A chatbot captures what people actually say: questions about medication, missed payments, or a failing marriage. That’s why chat and voice AI are where plaintiffs went next.
Cases to know from 2026
Alleges Meta and Google tags on ChatGPT.com sent conversation context and hashed emails to ad networks.
Alleges contractors read and graded user chats despite “private conversation” marketing.
Dismissed for account holders because Home Depot’s privacy statement disclosed “service providers.” Leave to amend granted.
ECPA claim survives: training on meeting recordings could be a “tortious purpose.”
Summary judgment for the retailer: chat was encrypted in transit and no evidence the vendor read it.
The pattern in the rulings
Cases are won and lost on two facts: what the vendor does with the conversation for its own purposes (training is the danger zone), and what notice the person saw before they typed. A footer privacy link is weaker than a notice above the chat box.
The question is who counts as a “consumer” under the Video Privacy Protection Act. If the Court reads it broadly, anyone who subscribes to anything from a company that also offers video could bring a pixel claim, at $2,500 per violation. Observers read oral argument as leaning toward letting the suit proceed. A decision is expected by June 2027. If you embed video and run a Meta pixel on the same page, audit that now.
Regulators started testing the flow
California’s Attorney General and CalPrivacy brought the most important privacy cases of the year. Almost none were about data breaches. They were about whether opting out actually worked.
No in-app opt-out, a browser detour, then a re-login. The AG’s line: if service takes one tap, opting out can’t take five.
If you link data across services and devices for ads, the opt-out has to reach just as far.
Driving data sold to brokers. The largest California privacy penalty to date.
Asymmetric cookie banners, over-verification, and broken GPC handling. Small fines, big signals.
Also in 2026: the FTC’s amended COPPA Rule became enforceable on April 22, and in February the FTC said it won’t bring COPPA cases over data collected only for age verification and then deleted.
Everyone has a committee. Few have control.
2026 was the year AI governance went from a slide in a board deck to a line in the budget. But the numbers show a wide gap between having a governance body and actually knowing where AI touches personal data.
Three shifts we saw inside companies
Most AI risk arrives through tools someone in marketing or support already bought. Vendor questionnaires now ask whether the vendor trains on your data and who its model providers are.
A chatbot answers questions. An AI agent takes actions with your systems and your customers’ data. Logging, permissions and kill switches moved from IT into governance.
96% of Cisco respondents say privacy laws help AI agility. In practice, the privacy team usually ends up owning the AI inventory, because it already owns data maps and assessments.
The EU AI Act got a new clock
In May 2026, EU institutions reached a deal on the AI Act Omnibus, which delays the high-risk obligations, adds new bans and shifts some enforcement to the AI Office. Transparency duties still arrive on time.
What else the Omnibus changed
- A new ban on AI tools that generate non-consensual intimate images and CSAM.
- Providers may process special-category data to detect and correct bias, with safeguards.
- The AI literacy duty was softened, shifting more of the burden to member states and the Commission.
- The AI Office gets direct supervision powers over AI systems built on general-purpose models.
Don’t read “delay” as “pause”
If you sell into the EU, Article 50 already applies. Chatbots must tell people they’re talking to AI, and synthetic content must be labeled. Use the extra year on high-risk systems to build the inventory and documentation, because December 2027 is only thirteen months away.
GDPR reform, and the deletion surge
EU: the Digital Omnibus, data track
The Commission proposed GDPR and cookie-rule changes in November 2025. On October 21, 2026, the Council agreed its negotiating mandate. Reported highlights:
- Breach notification window extended from 72 to 96 hours.
- Consent exemptions for strictly necessary and some low-risk analytics cookies. Ads and profiling still need consent.
- Clarifications on pseudonymised data and AI training with safeguards.
- Simpler handling of manifestly unfounded or excessive access requests.
Nothing has changed yet. Parliament’s committees face more than 1,750 amendments, with a vote expected in Q1 2027. Trilogues follow.
Elsewhere
UK: the Data (Use and Access) Act 2025 came into force in stages, relaxing some cookie and automated decision rules. India: the DPDP Rules phase in, with core obligations due in 2027. Data localization: 81% of Cisco respondents face pressure to keep data local, and 85% say it adds cost.
Why deletions matter in 2027
DROP sends brokers deletion lists on a fixed cycle, and every state law adds more requesters. A request you can’t fulfill on time is now a penalty, not a backlog.
We read the other 2026 trend reports
Good trend reports each measure one slice of the market well. We used them as inputs, cited their numbers, and tried to fill the gaps between them.
| Report | What it measures well | What it leaves out |
|---|---|---|
| DataGrail Privacy & AI Trends 2026 | Real system telemetry: DSR volumes, GPC compliance, AI vendor disclosures across 2,400 systems. | Litigation and court rulings; no forward-looking calendar. |
| Cisco Data Privacy Benchmark 2026 | Executive attitudes and spending across 5,200 respondents in 12 markets. | Self-reported; light on US state law and enforcement detail. |
| IAPP Governance & profession reports | How privacy and AI governance teams are staffed, structured and paid. | Operational controls; what regulators and plaintiffs actually target. |
| Fisher Phillips CIPA tracking | Litigation counts and filing trends, updated through the year. | Regulatory and AI governance context. |
| This report | Regulation, litigation, enforcement and AI governance in one place, with dated predictions. | We are not a survey firm. Our predictions are judgment calls, rated for confidence. |
Predictions you can check
Every 2027 trend has a confidence rating. We’ll score ourselves in next year’s edition.
Dates, not themes
A month-by-month 2027 calendar covering US, EU, AI and global deadlines.
A scorecard, not a sales pitch
24 checks you can run this quarter with or without us.
Where the reports agree
Every major 2026 report lands in the same place: budgets and attention are up, but execution is behind. The surveys show it in maturity scores. The telemetry shows it in GPC failures and missing subprocessor lists. The court dockets show it in filing counts. 2027 is when that gap starts costing money.
10 trends for 2027
Ranked by how much compliance work each one will create for a typical US company with a website, an app and at least one AI tool.
The chat window becomes the new pixel
With pen-register claims gone from January 1, plaintiffs shift to wiretap and recording claims under CIPA 631 and 632. Chatbots, AI support agents, voice bots and meeting note-takers become the most common targets.
The signal
Chatbot wiretap matters went from 2 in 2021 to 30 in 2025. 2026 brought suits against OpenAI, Google, Otter.ai and Pegasystems.
Do this now
Inventory every conversation tool, check vendor training rights, and put an AI notice above the chat box before the first message.
“AI notices” become as normal as cookie banners
California’s ADMT rules and Colorado’s SB 26-189 both apply on January 1, 2027. Companies using automated tools for hiring, lending, housing, insurance or health decisions will need pre-use notices, explanations and a path to a human.
The signal
Both rules are final with fixed dates. Colorado requires a 30-day explanation after adverse decisions and three years of records.
Do this now
List every tool that makes or substantially shapes a significant decision. Draft notices and an appeal process this quarter.
Opt-out signals go mainstream
California’s browser mandate makes a built-in opt-out preference signal standard in major browsers. The number of visitors sending GPC jumps, and so does the cost of ignoring it.
The signal
63% of sites already fail GPC. California has penalized GPC failures in multiple actions, and CalPrivacy is updating its signal rules.
Do this now
Test your site with GPC on. Make sure the signal stops sales and sharing, and extends to logged-in profiles.
Data brokers face their first real deletion audit
DROP has hundreds of thousands of Californians on the list and deletions running every 45 days. Expect the first DROP penalties in 2027, and expect companies that buy broker data to ask hard questions about provenance.
The signal
About 550,000 sign-ups and tens of millions of profile deletions reported. Penalties are $200 per request per day.
Do this now
Check whether you meet the broker definition. If you buy lists or enrichment data, ask vendors how they process DROP.
AI vendor review becomes the new SOC 2 question
Procurement teams start rejecting AI tools that can’t name their model providers, retention periods and training rights. “Do you train on our data?” becomes a standard contract clause.
The signal
63.6% of AI vendors don’t disclose subprocessors. Courts are treating vendor training as the key liability fact.
Do this now
Add AI-specific questions to vendor reviews. Renegotiate contracts that let vendors reuse your customers’ data.
The federal-state AI fight goes to court, not Congress
The DOJ task force challenges at least one state AI law. Congress debates preemption but doesn’t pass a comprehensive bill. State laws stay in force through 2027.
The signal
A task force exists to bring these cases. Congress has rejected a moratorium once, and election-year calendars are tight.
Do this now
Comply with the strictest state law that applies to you. Don’t build a program that only works if preemption passes.
Kids’ privacy shifts to age assurance
Amended COPPA rules, app-store age laws and California’s Digital Age Assurance Act push companies to know (or estimate) user age. Age signals from devices and app stores become a new data stream to govern.
The signal
COPPA amendments enforceable since April 22, 2026. The FTC calls children’s privacy a top priority and gave age-verification data a safe harbor.
Do this now
Map where minors could use your service. Decide how you’ll receive and honor age signals.
The Supreme Court widens VPPA exposure
In Salazar, the Court adopts a broader reading of “consumer.” A new wave of video pixel suits follows in the second half of 2027, aimed at any site that pairs video with ad tracking.
The signal
Oral argument on October 14 suggested the Justices were open to the plaintiff’s reading.
Do this now
Find every page with embedded video and an ad pixel. Remove the pixel or get VPPA-compliant consent.
The EU finishes GDPR reform late, and cookie banners shrink
Parliament adopts its position in early 2027 and trilogues start. A political deal on the data Omnibus is possible by late 2027, with application in 2028. Analytics-only sites may eventually drop banners in the EU.
The signal
Council mandate agreed October 21, 2026. Parliament faces 1,750+ amendments, so slippage is likely.
Do this now
Nothing changes yet. Keep consent in place, and categorize cookies so you’re ready when the exemptions land.
Privacy and AI governance become one function
Separate AI ethics committees fold into privacy programs that already own data maps, assessments and vendor reviews. Risk assessments become the shared evidence for both.
The signal
38% now spend $5M+ on privacy. California’s risk assessments cover AI training, and the first attestations are due April 2028.
Do this now
Use one inventory for data, vendors and AI systems. Run assessments that satisfy CCPA, Colorado and the EU AI Act together.
Wild cards we’re watching
A federal privacy bill with real preemption. Unlikely, but it would reset everything.
A major AI agent incident involving customer data that triggers emergency rules.
An EU adequacy shock if the EU-US Data Privacy Framework faces a serious court challenge.
2027 compliance calendar
Your runway to January 1, 2027
Weeks 1–2
Scan the site and app. List every tracker, pixel and AI tool.
Weeks 3–4
Fix GPC and opt-out flows. Remove pixels from chat and video pages.
Weeks 5–6
Draft ADMT notices, appeal paths and AI chat disclosures.
Weeks 7–8
Update privacy notices, vendor terms and your risk assessment list.
Are you ready for 2027?
Give yourself one point for every box you can check today with evidence, not intentions.
Consent & opt-outs
AI & automated decisions
Rights requests & data
Governance & evidence
How we built this report
This report combines three types of evidence: primary legal sources (statutes, regulations, court filings, and regulator announcements), published third-party research (cited by name next to each figure), and our own tracking of US state privacy laws and California enforcement.
Figures are reported as published by their source. We did not adjust or combine survey data from different studies. Where sources differ, we used the most recent primary source.
Predictions are the judgment of the Captain Compliance team. Confidence ratings reflect how much a prediction depends on fixed dates versus courts, legislatures and regulators.
Information is current as of November 2026. Laws, dates and pending cases change. This report is for general information and is not legal advice.
Accountability
We’ll publish a scorecard of these ten predictions in the 2027–2028 edition, including the ones we get wrong.
Captain Compliance helps businesses meet privacy laws without slowing down. Our platform covers cookie consent and GPC, website scanning, data subject requests, vendor and AI risk, and privacy program management across US state laws, GDPR and beyond.
Questions about this report or press inquiries: captaincompliance.com/contact
Find out where you stand
before January 1.
Captain Compliance scans your website for every tracker, tests your GPC and opt-out flows, and shows you exactly what a regulator or plaintiff’s firm would find.
Free cookie scan
Every tracker, pixel and tag on your site.
Consent that holds up
GPC, opt-outs and logged choices across 24 states.
Requests, automated
DSRs and deletions handled on deadline.
captaincompliance.com
By Richart Ruddie, Founder & CEO
Not legal advice. Current as of November 2026.
Put this into practice
Turn privacy guidance into working controls.
Captain Compliance helps teams discover tracking technologies, enforce consent, manage privacy requests and document the evidence behind every decision.
