Three comprehensive state privacy laws took effect on January 1, 2026: Indiana, Kentucky, and Rhode Island. For a firm that prepares tax returns, they generally do not govern the client file. Each one exempts financial institutions and data subject to the Gramm-Leach-Bliley Act, and the Federal Trade Commission treats tax preparers as financial institutions under the Safeguards Rule. The duties on that file are still the Safeguards Rule, a Written Information Security Plan, and Internal Revenue Code §7216. State law still matters for data that is not GLBA data, and for a firm large enough to be a California "business."
Last verified: September 29, 2026. This is a reading of the statutes for planning. It is not legal advice. Have counsel confirm how the exemption applies to your entity before you rely on it.
The three laws, and who they leave out
| State | Law | In force | Who it reaches | GLBA treatment |
|---|---|---|---|---|
| Indiana | IC 24-15 | January 1, 2026 | 100,000 Indiana residents, or 25,000 if more than 50% of revenue is from selling personal data | Does not apply to financial institutions and affiliates, or to data subject to GLBA Title V |
| Kentucky | KRS 367.3613 | January 1, 2026 | Same 100,000 / 25,000-and-50% thresholds | Does not apply to financial institutions, their affiliates, or data subject to GLBA Title V |
| Rhode Island | R.I. Gen. Laws § 6-48.1 | January 1, 2026 | 35,000 customers, or 10,000 if more than 20% of revenue is from selling personal data | Does not apply to a financial institution or to data subject to GLBA Title V |
A tax firm clears out of these statutes twice. The FTC's Safeguards Rule covers businesses significantly engaged in financial products or services, and the FTC's own list includes tax preparers. Indiana, Kentucky, and Rhode Island then exempt that financial institution, not only the GLBA file. A firm that does not sell personal data also misses the lower threshold, which is written for companies whose business is selling data. A 400-client practice is not at 35,000 customers.
The exemption is for the institution the statute describes. Counsel should look hard at a firm that also runs a line that is not a financial activity, or that is not itself a GLBA financial institution. The statutes put the burden of showing the exemption on the firm that claims it.
What still governs the client file
The 2026 statutes did not replace the federal duties on taxpayer data a firm collects to prepare a return.
- The FTC Safeguards Rule requires a written information security program. IRS Publication 5708 is the template preparers are pointed to. The working version is in WISP requirements for tax firms.
- IRS Publication 4557 is the safeguarding baseline.
- Section 7216 restricts use and disclosure of tax return information. A state privacy notice does not authorize a disclosure §7216 forbids.
If the firm can show the GLBA exemption, the 2026 project on the client file is to keep that program current: where the files sit, who can open them, how long they are kept, and what happens when someone leaves. That is the Safeguards Rule. It is not a new Indiana notice.
Where a 2026 law can still reach the firm
The exemption follows GLBA data and, in Indiana, Kentucky, Rhode Island, and Connecticut, the financial institution. It does not automatically cover every byte the firm touches.
A marketing site is not a tax return. Page analytics, ad pixels, and a newsletter list can be personal data that was never nonpublic personal information under GLBA. If that processing meets a state's threshold, the privacy statute can apply to the site even while the organizer stays outside it. Connecticut has required covered controllers to honor a universal opt-out signal, such as Global Privacy Control, since January 1, 2025. Connecticut General Statutes §42-517 exempts a financial institution or data subject to GLBA, so a tax preparer firm should confirm that exemption before it builds a signal process for the whole domain. Oregon is different: its entity exemption in ORS 646A.572 is for financial institutions as Oregon banking law defines them, which is a bank or credit union, not every GLBA tax preparer. GLBA information itself is excluded. Other Oregon personal data is not. Oregon has required covered controllers that sell personal data or use it for targeted advertising to honor a universal opt-out signal, such as Global Privacy Control, since January 1, 2026 (ORS 646A.578).
California regulates the information, and it added audit rules. The CCPA's GLBA provision exempts personal information collected under the Gramm-Leach-Bliley Act. It does not exempt the firm. Non-GLBA personal information of California residents can still be in scope when the firm meets the CCPA "business" test. On January 1, 2026, California Privacy Protection Agency regulations on cybersecurity audits and privacy risk assessments took effect. Under section 7120(b) of the CPPA regulations, a cybersecurity audit is required when processing presents a significant risk to consumers' security, which is met if the business got 50% or more of annual revenue from selling or sharing personal information, or if it meets the CCPA revenue threshold (about $26.6 million after the 2025 inflation adjustment) and processed personal information of 250,000 or more consumers or households, or sensitive personal information of 50,000 or more. The first certification for the largest tier is due April 1, 2028, covering an audit period that begins January 1, 2027. A firm under those lines does not pick up that audit because the rule exists.
DROP is a data-broker system. California's Delete Request and Opt-out Platform lets a resident ask data brokers to delete personal information in one place. CalPrivacy's November 13, 2025 announcement says consumers could begin submitting requests in January 2026, and that starting August 1, 2026, data brokers must access DROP at least every 45 days, delete matching information unless an exemption applies, and report status within 45 days. A CPA firm that does not sell personal data is not a data broker and does not register for DROP because the platform launched.
A checklist that matches the statutes
- Write down why the firm is a financial institution under the Safeguards Rule, and which of Indiana, Kentucky, Rhode Island, and Connecticut that puts outside the statute. Keep the note with the WISP.
- List processing that is not GLBA data: the public website, advertising pixels, event lists, and any product that is not tax preparation or another financial activity. That list is what counsel uses to test thresholds.
- If the firm has California clients and non-GLBA personal information, test the CCPA business threshold and the section 7120(b) audit trigger before assuming either applies.
- Leave DROP alone unless the firm sells personal data and meets California's data-broker definition.
- Keep the client file on the Safeguards Rule track: inventory, access by person, encryption, retention, and a leaver process. Publication 5708 is the template. Section 7216 still limits where the file can be sent.
What a portal changes, and what it does not
XyloDocs is an AI client communication platform for tax firms. Client documents and messages move through a portal with AES-256 encryption, individual logins, one-time passcodes, and an audit trail, built to align with IRS Publication 4557. Those records are evidence for the Safeguards Rule program: who could open a file, and what they did. They do not create the GLBA exemption, they do not decide whether a marketing pixel is a "sale," and they do not complete a California cybersecurity audit. Retention and deletion of a client file still follow the firm's policy and §7216, not a toggle in the product.
The platform is available now, on its own, without tax software. Client accounts are included. The control list is on how XyloDocs handles tax-document security.
Frequently asked questions
Do the 2026 Indiana, Kentucky, and Rhode Island privacy laws apply to a CPA firm?
For a firm that prepares tax returns, usually no. Each statute exempts financial institutions and data subject to GLBA Title V, and the FTC treats tax preparers as financial institutions under the Safeguards Rule. The firm also has to miss the customer-count thresholds, which are 100,000 in Indiana and Kentucky and 35,000 in Rhode Island, unless selling personal data is a large share of revenue. Confirm the exemption with counsel if the firm has a line of work that is not a financial activity.
Does GLBA replace state privacy law for every record a firm holds?
No. The exemption tracks the financial institution and the data subject to GLBA. A marketing site, an ad pixel, or a list that was never client tax information can sit outside that exemption. Thresholds still have to be met before a state law applies to that other data.
Does a small CPA firm need a CCPA cybersecurity audit in 2026?
The audit rule took effect January 1, 2026, and it applies to businesses whose processing presents a significant risk to consumers' security. The published summaries tie that test to selling or sharing personal information as half or more of revenue, or to a CCPA-level revenue threshold plus hundreds of thousands of consumers. A firm under those lines does not take on the audit because California adopted the rule. The first certification for the largest tier is due April 1, 2028.
What is the California DROP platform, and do accountants have to use it?
DROP is the state's deletion system for data brokers. Consumers could submit requests starting in January 2026. From August 1, 2026, data brokers must check the platform at least every 45 days. A firm that does not sell personal data is not in that program.
What should a tax firm actually do with client data in 2026?
Keep the Written Information Security Plan current, limit who can open a client file, and treat §7216 as the rule on disclosure. Use the state statutes to test the marketing site and any non-tax line, not to rebuild the process for the organizer.
Sources and related reading
- Indiana Code 24-15, including IC 24-15-1-1
- Kentucky KRS 367.3613, effective January 1, 2026
- Rhode Island Gen. Laws § 6-48.1-3 and § 6-48.1-10
- Connecticut Gen. Stat. § 42-517 and the Attorney General's CTDPA page
- Oregon ORS 646A.572
- FTC, Gramm-Leach-Bliley Act (tax preparers listed among financial institutions)
- CalPrivacy, Delete Act regulations and DROP (November 13, 2025)
- IRS Publication 4557 and IRS Publication 5708
- WISP requirements for tax firms
Leave a Comment
Your comment is private and will only be visible to the author. We'll send you an email confirmation.