Keeping Up with California: What Evolving Privacy Laws Mean for OOH
As states continue to strengthen consumer privacy protections, California remains at the forefront of legislation shaping how businesses collect, use and manage personal data.
For the out of home (OOH) advertising industry, these developments are important to watch. While OOH operates differently from many digital advertising channels, evolving privacy laws could have implications for how companies use data, measure campaign performance and connect OOH with broader marketing strategies.
As The Human Medium, OOH has a unique relationship with consumers, reaching people in the physical world through shared experiences and real-world connections. As our industry continues to embrace new technologies and more sophisticated measurement capabilities, understanding the evolving privacy landscape is increasingly important.
California Sets the Standard
In 2018, California became the first state to enact a comprehensive consumer privacy law with the California Consumer Privacy Act (CCPA). The state subsequently established an independent regulatory agency to oversee enforcement and expanded its privacy framework through additional legislation.
These measures have strengthened consumer rights, established a public data broker registry and created new mechanisms for individuals to control how their personal information is collected, shared and deleted.
California’s approach has helped shape privacy legislation nationwide. Today, 23 states have enacted comprehensive consumer privacy laws, reflecting a broader movement toward greater transparency, consumer control and accountability in the use of personal data.
State Privacy Legislation Continues to Expand
In 2026, Alabama, Louisiana, Oklahoma and Vermont joined the growing number of states advancing comprehensive consumer privacy legislation. Other states introduced updates and amendments to existing laws, further expanding the regulatory landscape.
California continued to lead the conversation during its most recent legislative session, with Governor Gavin Newsom signing or vetoing more than 300 bills, including several measures addressing consumer privacy and artificial intelligence (AI).
Among the new laws are additional protections for social media users under the age of 16, including restrictions on how platforms collect and use consumer profile data for targeted advertising.
California and Pennsylvania also enacted new AI-related legislation, including requirements addressing the use of digitally generated performers in advertising. Similar to legislation recently adopted in New York, these measures introduce new disclosure considerations for advertisers using AI-generated voices, actors and other synthetic representations.
Other proposals did not advance. Governor Newsom vetoed legislation that would have prohibited companies subject to the CCPA from selling or sharing sensitive personal information, citing existing consumer opt-out protections and concerns about the proposal’s broad application.
Meanwhile, other states are taking different approaches. Several have restricted the sale of certain categories of sensitive personal information, including precise geolocation data. Maryland and New Jersey have gone further, prohibiting the sale of sensitive personal information even with consumer consent.
Together, these developments underscore the increasingly complex privacy environment facing advertisers and media companies operating across multiple states.
What This Means for OOH
While many of these laws are primarily focused on digital platforms and data-driven advertising, their implications extend to the broader media ecosystem, including OOH.
OOH’s ability to reach consumers in the physical world is one of the qualities that makes it The Human Medium. At the same time, as the industry advances its capabilities in audience measurement, attribution, programmatic advertising and omnichannel integration, data privacy remains an important consideration.
OOH companies should pay particular attention to how evolving state requirements may affect:
- Location and audience data: Restrictions on the collection, sale and use of precise geolocation and other sensitive personal information.
- Third-party data partnerships: New requirements governing data brokers and access to consumer information.
- Integrated campaigns and measurement: Privacy considerations for campaigns connecting OOH exposure with digital engagement, attribution and other performance metrics.
- Digital operations: Compliance obligations related to company websites, consumer data practices and other digital platforms.
- AI-generated advertising: Emerging disclosure requirements for synthetic performers and AI-generated creative content.
Although not every new law will directly affect OOH, understanding where legislation intersects with industry practices is essential as the medium continues to evolve.
OAAA’s Commitment to Keeping Members Informed
As privacy legislation continues to evolve, OAAA remains focused on helping members understand the changing regulatory environment and its potential implications for the industry.
Our role is to monitor legislative and regulatory developments, identify emerging issues and provide members with the information they need to navigate new requirements.
Looking ahead to 2027, we expect continued attention to consumer privacy, data usage and AI-generated advertising as state legislatures reconvene and regulators implement existing laws.
Our medium is rooted in its ability to connect brands and consumers in the real world. As technology expands what our industry can deliver, protecting consumer trust and staying informed about evolving regulations will remain important priorities.
OAAA will continue to monitor these developments, advocate for the industry’s interests and keep members informed as the regulatory landscape evolves.
