Consumer Privacy

On March 20, 2026, Oklahoma became the 20th state to pass a comprehensive consumer privacy statute. The Oklahoma Consumer Data Privacy Act (“OKCDPA”) takes effect January 1, 2027.

With a growing number of states enacting comprehensive privacy laws year after year, California’s reputation and influence as a regulatory trendsetter continues to accelerate. But the most significant recent development is not just the spread of privacy legislation—it is the spread of privacy enforcement.

700Credit has confirmed a data breach involving dealer customer data copied without authorization between May and October 2025. 700Credit has committed to providing required federal, state, and consumer notifications on behalf of dealers, as well as credit monitoring services, unless a dealer opts out by December 5, 2025, at 5:00 PM ET.

New privacy laws in Kentucky, Indiana, Rhode Island, and updated rules in Oregon and California take effect on January 1, 2026.

Regulators in CA, CO, and CT announced a coordinated sweep of businesses that appear to be ignoring opt out preference signals, including GPC signals. For dealerships, this development is a signal that regulators are looking closely at the way businesses’ websites collect and use consumer data, and whether those practices line up with state privacy laws.