The 2026 state privacy laws split institutional exemptions from data exemptions

The week

On January 1, 2026, comprehensive consumer privacy laws took effect in Indiana, Kentucky and Rhode Island. All three follow the broad template set by Virginia and Colorado: rights to access, correct, delete and port personal data, opt-outs from targeted advertising, sale and certain profiling, and data protection assessments for higher-risk processing. Enforcement sits with the state attorney general, with no private right of action.

Each law carves out organizations or data already governed by the Gramm-Leach-Bliley Act and HIPAA, but not in the same way. Kentucky and Indiana broadly follow Virginia in exempting GLBA financial institutions and HIPAA covered entities as organizations. Rhode Island exempts GLBA financial institutions and HIPAA covered entities and business associates in one provision, and data governed by those laws in another. Congress had still not passed a comprehensive federal privacy law.

Most banks and health systems carry a short answer to state privacy laws: GLBA or HIPAA exempts us. The January 1 laws show why that answer needs a citation. A privacy statute can exempt an organization because of what it is, or exempt certain data because of the federal law that governs it. The two drafting choices produce very different obligations for the same institution. Rhode Island shows both drafting choices in one statute, with entity-level carve-outs in one section and data-level carve-outs in another, so an institution has to know which one it is relying on.

Every data set an organization holds falls, state by state, into exactly one of three positions: covered by an entity-level exemption, covered only by a data-level exemption, or reached by no exemption at all. The sections below take them in that order.

Entity-level exemptions

An entity-level exemption takes the whole organization outside the law’s main duties. A bank that qualifies as a GLBA financial institution under Kentucky’s law is not required to honor Kentucky deletion requests for its website analytics, its event sign-ups or its prospect lists. The exemption follows the institution, not the record.

Three things make this position less secure than it looks. First, the exemption depends on corporate form. A bank holding company’s non-bank subsidiaries, an insurance agency, a wealth platform run through a separate legal entity, or a health system’s foundation may not qualify. The org chart decides, and few privacy teams keep a current one. Second, the exemption is drafted state by state. One law may cover “financial institutions and their affiliates”; another may name only the institution. Third, an exemption from the privacy statute leaves breach notification laws, consumer health data laws and the attorney general’s unfair practices authority untouched.

The practical control is a legal-entity register mapped to each statute’s exemption language. It should list which entities rely on which exemption, under which section, as of which version of the law. Counsel should review it whenever the corporate structure or a statute changes.

Where the reading is uncertain, for example whether a particular affiliate counts as a covered entity or business associate, the register should say so. A health system can record the narrower reading as its working assumption, scope that affiliate’s data on that basis, and note what would change if the broader reading prevailed. That costs a few days of data mapping. Guessing wrong in the other direction costs a remediation project under an attorney general’s deadline, with consumer requests already unanswered.

Data-level exemptions

A data-level exemption covers only the information that GLBA or HIPAA governs. Everything else the organization holds is in scope. For a hospital in a state that exempts protected health information but not covered entities, the clinical record is outside the law. The fundraising database, the marketing pixel data from the public website, the wellness event registrations and the call recordings from a scheduling line may not be.

This position creates the most operational work, because it requires the organization to sort its own data by legal status. That sort rarely matches how systems are built. A customer relationship management platform may hold account data that GLBA covers alongside marketing preferences that it does not. A patient engagement platform may mix protected health information with general consumer data collected before anyone became a patient.

Three capabilities matter here. The data inventory needs a field for legal basis, not only for sensitivity. The consumer request process needs logic that can honor a deletion for marketing data while retaining records the institution must keep. And the response letter has to explain the split in plain terms. A customer who asks a bank to delete their data will not accept “some of it is exempt” without an explanation of which part and why.

Data no exemption reaches

The third position covers data outside both kinds of carve-out. Typical examples include advertising technology data, data shared with analytics partners, information about people who are neither customers nor patients, and data held by affiliates that are not themselves banks or covered entities. Fintech subsidiaries and direct-to-consumer digital health ventures often land here.

In this position the state laws apply in full. Targeted advertising opt-outs must work. Universal opt-out signals must be recognized where a state requires it. Profiling that produces significant effects needs a documented data protection assessment. Processors must be bound by contract terms on confidentiality, deletion and help with consumer requests.

The contract point is often missed. Many marketing and analytics agreements were signed on the assumption that GLBA or HIPAA took the institution out of scope. Those agreements may lack the processor terms the state laws expect. Fixing them one renewal at a time can take years, so a targeted amendment campaign for the highest-volume vendors is usually faster. This position also tends to grow quietly, because each new digital product, tracking tool or data partnership adds to it without a formal privacy review.

The output of all three positions is a matrix with data sets down one side, states across the top, and the applicable position in each cell. Ownership matters as much as content. The privacy office understands the statutes. Data teams know where the data lives. Marketing owns many of the systems in the third position. The matrix is where those groups agree on the facts, and it gives examiners and auditors a record of how the institution decided what applied.

With hindsight

The January laws did not, on their own, change much for most banks and health systems. What they confirmed is that exemptions are a property of a statute’s current text, and that text moves. Connecticut had already shown this. Amendments signed in June 2025 replaced its entity-level GLBA exemption with a data-level one, while adding entity-level exemptions for certain banks, insurers and other regulated firms, effective July 1, 2026. An institution that had filed Connecticut under “exempt” in 2023 had to recheck its position before that date.

Congress still had not enacted a comprehensive federal privacy law by October 2026, so the patchwork kept growing. The organizations in the best position were those that recorded the specific statutory basis for each exemption claim and reviewed it on a fixed calendar. Those relying on a blanket assumption of GLBA or HIPAA coverage tended to find the gap through a consumer request, a vendor audit or an attorney general inquiry.