Table of Contents
September 2026: If you run a small business website, the past six months delivered more new site laws than any comparable stretch in recent memory. Laws that are taking effect through 2027. State legislatures passed new privacy statutes, tightened subscription cancellation rules, extended all-in pricing requirements to more states, and moved quickly on rules for AI chatbots. Some of those site laws already apply to you. Others take effect over the next eighteen months, which gives you time to adjust if you know what is coming.
This bulletin gathers the site laws passed or activated from roughly March through September 2026 that matter to a business your size. You will not find every bill that moved in every statehouse. You will find the changes most likely to touch your privacy policy, your checkout flow, your pricing pages, and any chatbot you run, along with a plain-language note on what each one asks of you.
One caveat before you dive in. Several of these laws are not yet in effect, and a few face active court challenges that could shift effective dates or narrow their scope. Treat this as a briefing to guide your own review, not a substitute for advice from an attorney who knows your state and your business.
Why These Site Laws Matter to Your Small Business
You may assume that most of these laws target large platforms. Some do, but a surprising number reach down to businesses with a handful of employees. Auto-renewal rules apply to anyone selling a subscription, whether that means a monthly coffee box or a maintenance plan. All-in pricing rules apply the moment you advertise a price online. Chatbot site laws apply to a customer-service bot on a plumbing company site just as they apply to a consumer app.
Privacy laws remain the exception, since most include revenue or data-volume thresholds that exempt very small businesses. Even there, the thresholds vary by state, and your privacy policy still has to describe your real practices under Federal Trade Commission rules regardless of size. The practical way to use these site laws is to match each one against what your site actually does, then flag the ones that apply.
New Comprehensive State Privacy Laws
Four states passed new omnibus privacy laws in the first half of 2026, the largest single group of new site laws this year. According to Venable’s 2026 mid-year state privacy update, Louisiana and Oklahoma take effect January 1, 2027, Alabama takes effect May 1, 2027, and Vermont takes effect January 1, 2028. All four largely follow the framework already familiar from Virginia, Connecticut, and other states, which means consumer rights to access, correct, delete, and opt out of the sale of personal data.
A few differences stand out. Louisiana requires specific notice when a business sells sensitive personal information or biometric data. Vermont places added emphasis on automated decision making and, in a first for state privacy law, requires privacy notices to state whether personal information is collected, used, or sold to train large language models. Alabama’s law, signed in April, made the state the twenty-first with a broad consumer privacy statute.
What this means for you depends on where your customers live. If you have meaningful sales in any of these four states and process data on tens of thousands of residents, plan a privacy policy update before the relevant effective date. If you fall below the thresholds, no new obligation attaches, but a policy that already covers these rights positions you well for the next state that passes a similar law.
Amendments to Existing Privacy Laws
Several states that already had privacy laws tightened them during this window, producing site laws that arrive sooner than the new statutes. Connecticut’s SB 4, signed May 27, 2026, requires data brokers to register annually, adds rules on facial recognition technology, and changes how the law treats publicly available information and purpose limitation. Those changes take effect October 1, 2026. Maryland’s HB 711 became law on May 31 and expands the definition of sensitive data to include characteristics a business infers about a consumer, effective July 1, 2026.
Children’s data drew particular attention. New Hampshire’s HB 1460, signed June 19, prohibits selling the personal data of a child under 13, effective January 1, 2027. New Jersey’s A5328, signed June 30, prohibits selling sensitive personal data outright. Nebraska amended the state’s Age-Appropriate Design Code Act to broaden which businesses fall under the law, and California advanced a bill adding design-code provisions to the state business code.
A quieter change deserves mention. Cure periods, which gave businesses a window to fix a violation before penalties applied, are expiring across several states. Montana’s ended April 1, 2026, and New Jersey’s ends in mid-2026. If you relied on those grace windows as a buffer, that safety net is disappearing, and regulators can now move directly to enforcement.
Click-to-Cancel and Auto-Renewal Rules
Subscription rules produced some of the most direct site laws for online sellers this year. Louisiana signed a Click-to-Cancel Act on June 9, 2026, imposing new disclosure, consent, and cancellation requirements with compliance required by January 1, 2027. Businesses with fewer than 50 employees or under $5 million in annual revenue are exempt, along with banks, insurers, and certain regulated services, so many small sellers fall outside this one.
New York City added a local layer. Kelley Drye’s summer 2026 auto-renewal roundup explains that the city’s rule, effective October 1, 2026, requires businesses to present all material terms clearly and in visual proximity to the consent request, and to send reminders for longer subscriptions, material changes, and free trials longer than one month. The provisions mirror New York state law but add a separate enforcement channel.
Three more states activated changes during the window. Maryland’s law took effect June 1, 2026, requiring notices before free trials or discount periods longer than 14 days end, plus an alternative cancellation option for customers who cannot cancel through an online account. Connecticut’s annual renewal reminder requirement took effect in July 2026. Virginia, as of July 1, 2026, requires a conspicuous online cancel option and a rule that cancelling be as easy as signing up.
If you sell anything on a recurring basis, review three things now: whether your checkout shows renewal terms before the customer consents, whether you send reminder emails on the timelines your customers’ states require, and whether a customer who signed up online can cancel online in one step. A cancellation flow that satisfies one state can still violate another, so build to the strictest standard your customer base touches.
All-In Pricing and Junk Fee Laws
Price transparency rules produced another cluster of site laws. Connecticut’s all-in pricing requirement took effect July 1, 2026, joining California, Colorado, Massachusetts, Minnesota, Oregon, and Virginia in requiring the first advertised price to include all mandatory fees. Oregon’s version, effective January 1, 2026, specifically targets online sellers. The common thread is simple: the number a shopper sees on your product page must be the number they pay, minus taxes and shipping that depend on the buyer.
Federal activity reinforced the trend. The FTC announced on April 14, 2026 an advance notice of proposed rulemaking on fee practices in online food and grocery delivery, with drip pricing as the central concern. State attorneys general are enforcing aggressively under existing consumer fraud laws as well. New Jersey’s office has called out dark patterns such as hiding fee information in dense fine print, manipulating font sizes, and using complex clickthroughs as violations even without a dedicated junk fee statute.
For a small store, compliance usually means auditing your product pages and checkout for any mandatory charge that appears late. Handling fees, service fees, and small-order fees all belong in the headline price. Credit card surcharges remain a gray area in several states, so if you surcharge, display the card price and cash price side by side rather than posting a notice that a fee applies.
Chatbot Disclosure and AI Laws
No area of site laws moved faster during this window than chatbot regulation. Bloomberg Law’s tracker counts fifteen states with enacted chatbot laws, ten of them signed in 2026 alone. Orrick’s review of 2026 state chatbot laws highlights several: Oregon’s SB 1546, signed in March, requires disclosure of AI involvement and creates a private right of action with $1,000 in statutory damages per violation, effective January 1, 2027. Washington’s Chatbot Disclosure Act, also from March, takes effect the same day. Tennessee’s SB 1580 prohibits AI systems from presenting themselves as licensed mental health professionals, effective July 1, 2026.
Most of these laws target “companion” chatbots that simulate emotional relationships, and several expressly exclude customer service bots. Utah and Maine take a broader approach, applying disclosure requirements to all AI interactions. Idaho enacted a conversational AI law in April with an effective date of July 1, 2027, following Nebraska’s model on disclosure and safety.
The practical takeaway for a small business is inexpensive. If you run any chatbot on your site, add a clear statement that the visitor is talking to an AI, avoid giving the bot a human name and photo without that disclosure, and make sure the bot never implies medical, legal, or financial licensure. Those three steps put you ahead of nearly every state standard now on the books, including the broad ones.
Age Verification Expansion
Age verification laws for adult content continued to spread, and a new category of site laws emerged. As of mid-August 2026, twenty-seven states require commercial adult-content sites to verify visitor age, with Iowa effective July 1, 2026 and Missouri effective August 28, 2026. The Supreme Court’s 2025 decision upholding Texas’s law settled the core constitutional question, so these statutes now stand on firm ground.
The newer development is app-store age verification. Utah, Texas, Louisiana, and Alabama have enacted laws that place age verification duties on Apple’s and Google’s app stores rather than on individual websites. California and Colorado are advancing operating-system-level age signals with implementation targeting 2027. For a typical business site, none of this applies unless you sell age-restricted products or host explicit content. If you do sell alcohol, tobacco, or similar products online, a self-declared birthdate is no longer enough in a growing number of states.
What These Site Laws Mean for Your Site
Taken together, these site laws point in one direction. States are moving from broad privacy frameworks toward specific rules about how your site behaves at the moment of sale: what price you show, how you get consent, how easily a customer can leave, and whether the customer knows when a machine is talking. Those are checkout and design questions as much as legal ones, which means your developer needs to hear about them alongside your attorney.
A practical review for the next quarter looks like this. Confirm whether you have customers in Louisiana, Oklahoma, Alabama, or Vermont and whether you approach those states’ thresholds. Audit any subscription checkout against the click-to-cancel rules in New York, Maryland, Connecticut, Virginia, and Louisiana. Check every advertised price for late-appearing mandatory fees, especially if you sell into Connecticut or the other all-in pricing states. Add an AI disclosure to any chatbot. None of those tasks requires a large budget, and together they cover most of the risk these site laws created.
Key Takeaways
Among this year’s site laws, four new state privacy statutes take effect between January 2027 and January 2028, and several existing laws lost their cure periods this year. Subscription sellers face new cancellation and reminder rules in Louisiana, New York City, Maryland, Connecticut, and Virginia. All-in pricing now applies in at least seven states, with Connecticut the latest. Ten new state chatbot laws passed in 2026, and a simple AI disclosure satisfies most of them. Age verification remains limited to adult content and age-restricted products for now, but the compliance bar in those categories keeps rising.
Frequently Asked Questions
Do any of these site laws apply to a business with no subscriptions and no chatbot?
Possibly the privacy and pricing changes. If you advertise prices online, all-in pricing rules apply regardless of what you sell. If you process data on residents of the four new privacy states above their thresholds, those laws apply. Otherwise, your exposure from this window is limited.
My business is well under $5 million in revenue. Am I exempt from the click-to-cancel rules?
Louisiana’s new law exempts businesses under 50 employees or $5 million in revenue, but the Maryland, Connecticut, Virginia, and New York City rules do not carry the same exemption. Check each state where you have subscribers.
Does a customer service chatbot need an AI disclosure?
Under Utah and Maine law, yes, and under FTC deception principles a bot that pretends to be human creates risk anywhere. Most other 2026 chatbot laws target companion apps, but a disclosure costs nothing and removes the question.
When should I update my privacy policy for the new state laws?
Plan the update before January 1, 2027, the first effective date among the four new laws. A single revision that addresses all four states, plus the Vermont language about AI training, covers you through 2028.
Are these laws final?
Most of these site laws are enacted, but several age verification and chatbot statutes face court challenges, and effective dates occasionally shift. Recheck the status of any law you are relying on before you finalize changes.
Conclusion
The site laws from the past six months share a theme: states are regulating the specific moments when your site collects consent, shows a price, or holds a customer. For a small business, that means the checkout page and the chat window now carry as much legal weight as the privacy policy. Most of the fixes are modest, and the effective dates give you room to work through them one at a time.
Keep this bulletin as a checklist for the next quarter, and expect another round of site laws as legislatures return in early 2027. The businesses that fare best in this environment are the ones that review their sites on a schedule rather than reacting to a demand letter.