Cathy Mulrow-Peattie Discusses Best Practices for Expected Privacy Law Enforcement in 2026

Hinshaw partner Cathy Mulrow-Peattie provided analysis in a new Privacy Daily article discussing how companies should prepare to comply with state privacy laws, as experts anticipate increased enforcement activity in 2026.

Cathy noted that while California is known for its strict privacy regulations, companies will also need to address new, unique requirements in states such as Minnesota, Colorado, and New Jersey.

“Regulators are not going to be lenient in any of these states,” she stated, noting that while many had doubted Florida would enforce its Florida Digital Bill of Rights, the state Attorney General took action in October, approximately 15 months after the law took effect. “Privacy is top of mind for many of our regulators, so I think all of them have the capacity to enforce the laws that they have.”

Cathy also observed that regulators will have “little patience” for companies that do not understand their data flows. “[Regulators hold the belief that] If you’re using the data, you should know where it is and how it’s being used and shared,” she said. “Company privacy policies can’t be five years old if your practices have changed, and data protection assessments [and agreements] are part and parcel of almost every state privacy law.”

• • Privacy Daily: “Attorneys Outline Best Practices for Expected Enforcement Uptick in 2026” (January 6, 2026)