As states continue to strengthen consumer privacy protections, California remains at the forefront of legislation shaping how businesses collect, use and manage personal data.
For the out of home (OOH) advertising industry, these developments are important to watch. While OOH operates differently from many digital advertising channels, evolving privacy laws could have implications for how companies use data, measure campaign performance and connect OOH with broader marketing strategies.
As The Human Medium, OOH has a unique relationship with consumers, reaching people in the physical world through shared experiences and real-world connections. As our industry continues to embrace new technologies and more sophisticated measurement capabilities, understanding the evolving privacy landscape is increasingly important.
California Sets the Standard
In 2018, California became the first state to enact a comprehensive consumer privacy law with the California Consumer Privacy Act (CCPA). The state subsequently established an independent regulatory agency to oversee enforcement and expanded its privacy framework through additional legislation.
These measures have strengthened consumer rights, established a public data broker registry and created new mechanisms for individuals to control how their personal information is collected, shared and deleted.
California’s approach has helped shape privacy legislation nationwide. Today, 23 states have enacted comprehensive consumer privacy laws, reflecting a broader movement toward greater transparency, consumer control and accountability in the use of personal data.
State Privacy Legislation Continues to Expand
In 2026, Alabama, Louisiana, Oklahoma and Vermont joined the growing number of states advancing comprehensive consumer privacy legislation. Other states introduced updates and amendments to existing laws, further expanding the regulatory landscape.
California continued to lead the conversation during its most recent legislative session, with Governor Gavin Newsom signing or vetoing more than 300 bills, including several measures addressing consumer privacy and artificial intelligence (AI).
Among the new laws are additional protections for social media users under the age of 16, including restrictions on how platforms collect and use consumer profile data for targeted advertising.
California and Pennsylvania also enacted new AI-related legislation, including requirements addressing the use of digitally generated performers in advertising. Similar to legislation recently adopted in New York, these measures introduce new disclosure considerations for advertisers using AI-generated voices, actors and other synthetic representations.
Other proposals did not advance. Governor Newsom vetoed legislation that would have prohibited companies subject to the CCPA from selling or sharing sensitive personal information, citing existing consumer opt-out protections and concerns about the proposal’s broad application.
Meanwhile, other states are taking different approaches. Several have restricted the sale of certain categories of sensitive personal information, including precise geolocation data. Maryland and New Jersey have gone further, prohibiting the sale of sensitive personal information even with consumer consent.
Together, these developments underscore the increasingly complex privacy environment facing advertisers and media companies operating across multiple states.
What This Means for OOH
While many of these laws are primarily focused on digital platforms and data-driven advertising, their implications extend to the broader media ecosystem, including OOH.
OOH’s ability to reach consumers in the physical world is one of the qualities that makes it The Human Medium. At the same time, as the industry advances its capabilities in audience measurement, attribution, programmatic advertising and omnichannel integration, data privacy remains an important consideration.
OOH companies should pay particular attention to how evolving state requirements may affect:
- Location and audience data: Restrictions on the collection, sale and use of precise geolocation and other sensitive personal information.
- Third-party data partnerships: New requirements governing data brokers and access to consumer information.
- Integrated campaigns and measurement: Privacy considerations for campaigns connecting OOH exposure with digital engagement, attribution and other performance metrics.
- Digital operations: Compliance obligations related to company websites, consumer data practices and other digital platforms.
- AI-generated advertising: Emerging disclosure requirements for synthetic performers and AI-generated creative content.
Although not every new law will directly affect OOH, understanding where legislation intersects with industry practices is essential as the medium continues to evolve.
OAAA’s Commitment to Keeping Members Informed
As privacy legislation continues to evolve, OAAA remains focused on helping members understand the changing regulatory environment and its potential implications for the industry.
Our role is to monitor legislative and regulatory developments, identify emerging issues and provide members with the information they need to navigate new requirements.
Looking ahead to 2027, we expect continued attention to consumer privacy, data usage and AI-generated advertising as state legislatures reconvene and regulators implement existing laws.
Our medium is rooted in its ability to connect brands and consumers in the real world. As technology expands what our industry can deliver, protecting consumer trust and staying informed about evolving regulations will remain important priorities.
OAAA will continue to monitor these developments, advocate for the industry’s interests and keep members informed as the regulatory landscape evolves.
Keeping up with California
In what might sound like the title to a new country song, the headline, at least in this article, refers to California’s place as a pioneer in one of the fastest growing areas of public policy – protecting consumer data and personal information.
This article provides a history of state privacy laws and explores the potential impact on out of home (OOH) advertising. While our medium may not be directly affected, at least for now, state statutes and regulatory implementation are creeping closer to intersecting with OOH platforms.
First in the Nation
In 2018, California was the first state to enact a comprehensive consumer privacy law – the California Consumer Privacy Act (CCPA), and shortly thereafter the first to stand up an independent regulatory body to enforce it. They enhanced their privacy laws in subsequent years with additional statutes to require a public data broker registry, to establish individual rights for state residents in how their personal information is used, and to create a central system for exercising opt-out and deletion rights.
Their foundational CCPA statute, and continued enhancements, soon became a model for others. Now eight years later, there are 23 states that have enacted their own comprehensive consumer privacy laws, all in the race to secure personal data, put guardrails around how it might be used, and provide assurances to state consumers in an increasingly fast-paced online world.
State Actions in 2026
This year, four states followed suit – Alabama, Louisiana, Oklahoma, and Vermont. Various other states passed updates, adaptations, and adjustments to their existing laws. Which brings us full circle back to the first – California.
The recent end of the California legislative session saw a flurry of activity, with Gov. Gavin Newsom signing or vetoing over 300 bills. Among them were several more consumer privacy-related proposals.
Enacted were greater protections for social media users under the age of 16, through a new law that restricts the collection and use of consumer profile data. Among the provisions are limitations on social media platforms and their use of data profiles for targeted advertising.
Also enacted were several Artificial Intelligence related bills, one which is similar to a recent New York law requiring disclosure of “synthetic performers” in advertisements. Advertisers and ad platforms will need to scrutinize ad content to ensure that A.I. digitally generated representations (i.e.: voices, actors) are properly identified and disclosed.
Vetoed was a proposed ban on the selling or sharing of a consumer’s sensitive personal information. The ban would have applied to any company subject to the state’s consumer privacy act. Newsom vetoed the bill indicating that state law already allows for a consumer to opt-out and that its application was too broad. A number of other states have passed laws prohibiting the sale of certain sensitive personal information, such as precise geolocation, and two states (Maryland and New Jersey) now prohibit the sale of any sensitive personal information at all, even with consumer consent.
OOH & OAAA
Every out-of-home company that touches personal data in any way needs to be mindful of the respective state laws where they operate. While there may not be an apparent direct impact of new state laws on OOH, OOH companies may be impacted by the restrictions on selling precise geolocation, the ability to obtain data from third party data brokers, the impact on integrated online and offline campaigns, and even a company’s own website.
At the same time, A.I. related state legislation is starting to intersect with OOH. The New York and California examples are sure to be noticed by other states when many state legislatures meet again in 2027.
Our watchwords are vigilance and awareness, and our responsibility at OAAA is the continued education of our member companies. Rest assured we continue to monitor state legislative sessions, and future regulatory implementation of existing state laws, which will more clearly define platform responsibilities and statutory application.
Published: October 26, 2026