July 1: It just became illegal to build ad profiles on kids in three states — the other 47 are still fair game

New privacy laws took effect July 1, 2026 in Connecticut, Arkansas, and Utah. Arkansas now has a flat prohibition on collecting personal data for targeted advertising from children under 13 and teens aged 13 through 16 — no consent checkbox can override it — with penalties of $10,000 per violation. Connecticut dropped its compliance threshold to businesses handling data on at least 35,000 Connecticut residents, pulling thousands of smaller companies under the law for the first time. If your family lives anywhere else, companies are still playing by the old rules.