Navigating Privacy and Cybersecurity Laws in 2026 Will Prove Difficult

Navigating privacy and cybersecurity laws in 2026 will prove difficult for enterprises, with compliance challenges expected to persist even as new regulations emerge. According to McDermott, Will and Schulte’s David Saunders, the fast pace of change in the environment makes it hard for companies to keep up and can deter compliance.

The piece notes actions already taken in 2025, such as the US Department of Justice’s Data Security Program, updates to COPPA, and proposed HIPAA Security Rule amendments, highlighting how the regulatory landscape has evolved over the past decade. It also points to potential federal uncertainty in 2026, with state enforcement likely stepping in to fill gaps and bring more burdensome, divergent rules for organisations.

Three main legal actions are cited as top of mind for US clients: minimum age requirements for apps, expanded data privacy rules, and AI use in human resources, including debates sparked by age‑signal laws and evolving AI employment rules. The article also references recent court actions blocking Texas and Louisiana age‑verification laws, while noting that California’s forthcoming risk‑audits and stricter CCPA provisions will demand substantial preparation.