Cybersecurity and Privacy Regulations: Key Developments from October 26 to November 2, 2025

The final week of October 2025 marked a pivotal period for cybersecurity and privacy regulation in the United States. As National Cybersecurity Awareness Month concluded, the regulatory landscape was shaped by a confluence of state-level legislative activity, federal government paralysis, and ongoing debates about the future of data protection. California, long a bellwether for privacy innovation, enacted a suite of new laws targeting both artificial intelligence and consumer privacy, while the expiration of a major federal cybersecurity statute and the continued rollout of state privacy laws underscored the fragmented nature of US data governance[1][2][3].

This week’s developments unfolded against the backdrop of a federal government shutdown, which sidelined key agencies such as the Federal Trade Commission (FTC) and the Cybersecurity and Infrastructure Security Agency (CISA), raising concerns about the nation’s cyber resilience[3]. Meanwhile, state legislatures continued to fill the regulatory vacuum, with Maryland’s comprehensive privacy law taking effect and California mandating new consumer rights and transparency obligations for data brokers and technology platforms[1][2]. The expiration of the Cybersecurity Information Sharing Act (CISA) on October 1, 2025, further complicated the landscape, as private sector information sharing with the government faced new legal uncertainties[3].

This article examines the week’s most significant privacy and cybersecurity regulatory events, analyzes their implications for businesses and consumers, and offers expert perspectives on the evolving patchwork of US data protection law.

What Happened: A Surge in State Privacy Laws and Federal Paralysis

The week saw a surge in state-level privacy legislation, with Maryland’s Online Data Privacy Act (MODPA) coming into force on October 1, 2025, bringing the total number of comprehensive US state privacy laws to 17[1][2]. California Governor Gavin Newsom signed three major privacy bills: AB566, which will require web browsers to implement a universal opt-out mechanism by 2027; AB656, simplifying the deletion of social media accounts and personal data; and SB361, mandating that data brokers disclose when they sell sensitive personal information[2]. These laws are designed to give consumers greater control over their data and increase transparency in the digital economy.

At the federal level, the ongoing government shutdown paralyzed key regulatory agencies. The FTC and FCC furloughed most of their staff, halting enforcement and oversight activities. The Cybersecurity and Infrastructure Security Agency (CISA) also faced sweeping staff cuts, sparking bipartisan concern over weakened cyber defenses[3]. Compounding these challenges, the Cybersecurity Information Sharing Act (CISA)—a cornerstone of public-private cyber threat intelligence sharing—expired on October 1, 2025, leaving private companies without legal protections for sharing threat data with the government[3]. This lapse is expected to reduce information sharing by as much as 80%, according to legal experts[3].

Despite federal inaction, enforcement of existing privacy and data security requirements continued at the state level. Companies were reminded to review privacy policies, data minimization practices, and compliance with new consumer rights, particularly as more states adopt requirements for access, correction, and deletion of personal data[1][6].

Why It Matters: Fragmentation, Consumer Rights, and Legal Uncertainty

The week’s developments highlight the growing fragmentation of US privacy regulation. With the federal government largely inactive, states are driving the evolution of privacy law, resulting in a complex patchwork of obligations for businesses operating across jurisdictions[1][2]. Maryland’s MODPA, for example, imposes specific content requirements for privacy policies, data minimization mandates, and new rights for consumers, such as access and correction[1][2]. California’s new laws further expand consumer rights and transparency, setting de facto standards that may influence other states and even federal policy in the future[2].

The expiration of the federal CISA statute introduces significant legal uncertainty for companies that rely on information sharing to defend against cyber threats[3]. Without liability protections, many private entities may be reluctant to share threat intelligence, potentially weakening the nation’s collective cyber defenses. This gap is particularly concerning given the increasing sophistication of cyberattacks and the critical role of public-private collaboration in responding to threats[3].

For consumers, the new state laws promise enhanced privacy protections and greater control over personal data. Universal opt-out mechanisms, simplified account deletion, and mandatory disclosures by data brokers are designed to address longstanding concerns about data misuse and lack of transparency in the digital ecosystem[2]. However, the lack of federal harmonization means that consumer rights and business obligations will continue to vary widely depending on location.

Expert Take: Navigating the Patchwork and Preparing for What’s Next

Legal and policy experts emphasize the need for organizations to adopt a proactive, adaptive approach to privacy compliance. The proliferation of state laws—each with unique requirements for privacy notices, consumer rights, and data security practices—demands regular review and updating of privacy policies, data collection, and storage practices[1]. Companies must also prepare for new obligations related to data minimization, sensitive information handling, and digital targeting, as well as the complex matrix of rules governing children’s data[1][6].

The expiration of the federal CISA law is seen as a wake-up call for both policymakers and industry. Attorneys warn that the absence of liability protections could chill information sharing, undermining national cyber resilience at a time when threat actors are increasingly sophisticated[3]. Some experts advocate for urgent congressional action to restore or replace the statute, while others suggest that states may step in to fill the gap with their own information-sharing frameworks.

California’s legislative activity is widely viewed as a bellwether for national trends. The state’s new privacy laws are expected to influence both corporate practices and legislative agendas in other jurisdictions, particularly as businesses seek to streamline compliance by adopting the most stringent standards across their operations[2]. Experts also note the growing importance of transparency and consumer empowerment, as reflected in requirements for universal opt-out mechanisms and data broker disclosures.

Real-World Impact: Business Compliance, Consumer Empowerment, and Cyber Risk

For businesses, the evolving regulatory landscape presents both challenges and opportunities. Companies operating in multiple states must navigate a growing array of privacy laws, each with distinct requirements for data handling, consumer rights, and breach notification[1][6]. Failure to comply can result in enforcement actions, reputational damage, and loss of consumer trust. The need for regular privacy policy reviews, robust data minimization practices, and clear procedures for responding to consumer requests is more urgent than ever[1].

Consumers stand to benefit from expanded rights and greater transparency. The ability to opt out of data sales, delete social media accounts, and receive disclosures about the sale of sensitive information empowers individuals to take greater control of their digital lives[2]. However, the uneven application of these rights across states may create confusion and limit the effectiveness of privacy protections for some users.

The expiration of the federal CISA law introduces new cyber risks, as reduced information sharing could hamper the ability of both government and private sector actors to detect and respond to emerging threats[3]. This vulnerability is particularly acute during periods of federal inaction, such as the current government shutdown, which has already disrupted key cybersecurity functions at agencies like CISA and NIST[3].

Analysis & Implications

The events of late October 2025 underscore the urgent need for a more coherent and harmonized approach to privacy and cybersecurity regulation in the United States. The continued proliferation of state privacy laws reflects both the demand for stronger consumer protections and the vacuum left by federal inaction. While state innovation—exemplified by California and Maryland—has driven important advances in privacy rights and transparency, it has also created a complex and often conflicting web of obligations for businesses[1][2].

The expiration of the federal Cybersecurity Information Sharing Act is a critical inflection point. Without the legal protections it provided, the willingness of private entities to share threat intelligence is likely to decline, potentially undermining national cyber defenses at a time of escalating risk[3]. The government shutdown has further exposed the fragility of the current system, as key agencies responsible for cybersecurity oversight and enforcement have been sidelined[3].

For organizations, the imperative is clear: adopt a dynamic, risk-based approach to privacy and cybersecurity compliance. This includes regular reviews of privacy policies, data collection and storage practices, and consumer rights management, as well as investment in robust incident response and breach notification procedures[1]. Companies should also monitor legislative developments closely, as new state laws and potential federal action could rapidly alter the compliance landscape.

Looking ahead, the pressure is mounting for Congress to enact comprehensive federal privacy and cybersecurity legislation that harmonizes standards, restores critical legal protections, and provides clear guidance for both businesses and consumers. In the absence of such action, the patchwork will continue to grow, increasing compliance costs and legal uncertainty while leaving gaps in the nation’s cyber defenses.

Conclusion

The week of October 26 to November 2, 2025, was marked by significant developments in US privacy and cybersecurity regulation. State legislatures, led by California and Maryland, continued to expand consumer rights and transparency obligations, while the expiration of a key federal cybersecurity law and the paralysis of regulatory agencies highlighted the risks of a fragmented approach. For businesses and consumers alike, the evolving landscape demands vigilance, adaptability, and a renewed commitment to privacy and security best practices. The coming months will be critical in determining whether the US can achieve the harmonization and resilience needed to meet the challenges of the digital age.

References

[1] International Association of Privacy Professionals. (2025, October 29). US State Privacy Legislation Tracker. IAPP. https://iapp.org/resources/article/us-state-privacy-legislation-tracker/

[2] Cloud Security Alliance. (2024, November 20). 5 Big Cybersecurity Laws to Know About Ahead of 2025. Cloud Security Alliance. https://cloudsecurityalliance.org/blog/2024/11/20/5-big-cybersecurity-laws-you-need-to-know-about-ahead-of-2025

[3] World Economic Forum. (2025, October 30). Key US cyber law expires, and other cybersecurity news. World Economic Forum. https://www.weforum.org/stories/2025/10/key-us-cyber-law-expire-cybersecurity-news/

[6] Foley & Lardner LLP. (2025, October 17). State Data Breach Notification Laws. Foley & Lardner LLP. https://www.foley.com/insights/publications/2025/10/state-data-breach-notification-laws/