On January 1, 2026, Indiana, Kentucky, and Rhode Island switched on comprehensive consumer privacy laws — pushing the U.S. total to about 20 states with those statutes in effect. Meanwhile tax preparers still live under GLBA / the FTC Safeguards Rule, IRS Publications 4557 and 5708, and a PTIN renewal question that asks whether you know you must keep a Written Information Security Plan. That is the minefield: overlapping regimes, different thresholds, and a lot of marketing that oversells what any one checkbox proves.
Last verified: September 16, 2026. Primary sources: Indiana Consumer Data Protection Act (effective Jan. 1, 2026); Kentucky Consumer Data Protection Act; Rhode Island Data Transparency and Privacy Protection Act; IAPP / MultiState state privacy trackers (20 laws in effect as of early 2026); 16 C.F.R. Part 314 (FTC Safeguards Rule); 16 C.F.R. §1.98 (FTC civil penalty maxima); IRS Form W-12 (Rev. 10-2025) Line 11; IRS Publications 4557 and 5708; Gramm-Leach-Bliley Act.
A simple map of the 2026 landscape
Think in layers, not one giant “privacy law.” Your firm may sit under several at once — or under federal financial-privacy rules while sitting outside a particular state’s consumer privacy act.
| Layer | What it mainly covers | Who enforces / cares | What a tax firm usually does about it |
|---|---|---|---|
| GLBA + FTC Safeguards Rule (16 C.F.R. Part 314) | Customer information held by financial institutions (tax prep is in scope) | FTC | Maintain a living WISP, risk assessment, access controls, vendor oversight, incident response |
| IRS Pubs 4557 / 5708 (+ related Security Summit guidance) | Safeguarding taxpayer data; practical WISP template for tax & accounting practices | IRS expectations; EFIN / e-file integrity | Inventory systems that hold return information; MFA; encryption; training; breach playbook |
| IRC §7216 / §6713 | Unauthorized use or disclosure of tax return information | Criminal / civil exposure | Limit who sees returns; control outbound uses (marketing, AI tools, sharing) |
| State comprehensive privacy laws (~20 in effect in early 2026) | Consumer personal data rights (access, delete, opt-out, etc.) when thresholds are met | State attorneys general | Check applicability; note GLBA-style exemptions often carve out regulated financial data — but do not assume you are “done” |
| PTIN Form W-12 Line 11 | Awareness that paid preparers must create and maintain a WISP | IRS PTIN program | Answer honestly; actually keep the plan (the form does not certify your WISP) |
What changed on January 1, 2026
Three more comprehensive state privacy laws took effect the same day:
- Indiana Consumer Data Protection Act (ICDPA) — generally aimed at larger controllers (for example, 100,000 Indiana consumers, or 25,000 plus more than half of revenue from selling personal data).
- Kentucky Consumer Data Protection Act (KCDPA) — similar coverage pattern to Indiana / Virginia-style statutes.
- Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA) — lower thresholds (for example, 35,000 Rhode Island residents, or 10,000 plus more than 20% of revenue from selling personal data), so smaller businesses can fall in scope more easily.
Industry trackers (including summaries keyed to the IAPP U.S. State Privacy Legislation Tracker) put the number of states with a comprehensive consumer privacy law in effect at about 20 as of early 2026, with Indiana, Kentucky, and Rhode Island among the newest. More states have enacted laws that are not yet effective. There is still no single federal consumer privacy statute replacing this patchwork.
For Denver and Front Range firms: Colorado already had the Colorado Privacy Act. The January wave matters less as “Colorado suddenly invented privacy” and more as proof the map keeps expanding — clients, vendors, and multi-state practices drag you into more than one rulebook.
Where the confusion starts
Most CPA shops hear three scary sentences and mash them together:
- “We need CCPA / state privacy compliance.”
- “We need FTC Safeguards / a WISP.”
- “PTIN renewal certifies our security plan.”
Those are not the same job.
State privacy laws are often Virginia-style consumer rights regimes with revenue or volume thresholds, sensitive-data rules, and attorney-general enforcement. Many of them also include exemptions or carve-outs for data already regulated under GLBA. That can mean a pile of taxpayer return information is primarily a federal financial-privacy / tax problem, not a “respond to every delete request like a retailer” problem — while marketing lists, website analytics, or non-tax consumer data might still sit under a state act. Get counsel for your facts. Do not skip the WISP because someone said “GLBA exempt.”
GLBA + Safeguards is the floor for tax preparers: a written information security program that matches how you actually collect, store, and transmit customer information. IRS Pub 5708 exists because that program is expected in practice, not as optional branding.
PTIN Line 11 is an awareness attestation. Form W-12 (Rev. October 2025) asks you to confirm you are aware that paid preparers must create and maintain a written information security plan protecting taxpayer information, and it points to Pubs 5708 and 4557. Checking “Yes” is not IRS approval of your PDF. Checking “No” is a red flag about awareness. Either way, the legal duty to have a real plan sits outside the checkbox.
About those FTC penalty headlines
You will see “$50,120 per violation” repeated in vendor blogs. That figure matches an older inflation-adjusted maximum (around the 2023 adjustment cycle). Under the FTC’s current civil-penalty schedule in 16 C.F.R. §1.98 (amounts applicable after January 17, 2025), several FTC Act penalty maxima sit at $53,088 per violation.
Two caveats matter more than the sticker number:
- These are maximum civil penalty amounts under statutes the FTC enforces. They are not an automatic meter that prints $53,088 the moment your WISP is messy.
- Enforcement often arrives through investigations, orders, and knowing violations after notice — not a drive-through fine for every missing bullet in Pub 5708.
Still: the cost of getting data wrong is not the penalty line alone. Breach notification, downtime, cyber insurance, client loss, and §7216 exposure dwarf a blog’s round number.
A practical “minefield” checklist for firm owners
- Name your systems. Email, portal, SMS/WhatsApp, tax engine, scanners, home laptops. If it is not in the WISP inventory, it is a blind spot.
- Separate tax-return data from marketing data. Different rules can apply. Mixing them in one shared inbox is how confusion becomes an incident.
- Read your state thresholds before panicking. A 20-state map does not mean every solo shop is a “controller” under every statute.
- Treat Line 11 as a reminder, not a certificate. Renew the PTIN and update the WISP the same week.
- Kill insecure email intake. Unencrypted W-2 attachments are still the most common self-inflicted exposure.
- Vendor diligence. Safeguards expects oversight of service providers that handle customer information. Ask where files live and who can access them.
How XyloDocs helps with the documentation problem (without magic compliance)
No SaaS product “makes you FTC certified.” What you can buy is a cleaner control story for the client-communication and document-intake layer — the part of the WISP that usually fails because files live in email.
XyloDocs is an AI client communication platform for tax firms: bilingual calling, SMS, WhatsApp, proactive status updates, and secure document intake with access controls and audit trails built to align with IRS Publication 1075 safeguards. For a Denver bilingual practice, that means fewer shadow channels and a clearer answer to “where did this W-2 come from, and who saw it?”
That does not replace counsel, your WISP owner, or MFA on email. It does give you something concrete to put in the information-systems section of Pub 5708: a named intake path, logging, and less reliance on Gmail as the vault. For the plan itself, start with WISP requirements for tax firms and the IRS templates in Pub 5708.
Frequently asked questions
Do the new Indiana, Kentucky, and Rhode Island laws automatically apply to every CPA firm?
No. Each law has applicability thresholds (and often exemptions). Many firms will still be driven first by GLBA / Safeguards and IRS guidance. Have counsel map your client geography and data types.
If GLBA data is exempt from a state privacy law, can we ignore state privacy altogether?
Not safely. Exemptions are statute-specific and usually limited to regulated data categories. Websites, advertising tools, and non-tax personal data can still create state-law obligations.
Does PTIN renewal prove we have a compliant WISP?
No. Form W-12 Line 11 asks whether you are aware of the legal duty to create and maintain a WISP. It is not IRS certification of your plan.
What penalty number should we put in staff training?
Use the current FTC civil-penalty maxima (about $53,088 for several FTC Act provisions after the January 2025 inflation adjustment) as a ceiling illustration — and emphasize that breach costs and client trust usually dominate the math.
Pick a lane and document it
The 2026 minefield is real: more state privacy laws, unchanged federal Safeguards pressure, and a PTIN form that keeps rubbing your nose in the WISP duty. You do not win by memorizing twenty statutes. You win by knowing which layer governs which data, writing that into a living plan, and closing the obvious holes — starting with how clients send documents.
If you want help locking down the communication and intake layer, review XyloDocs security or book a walkthrough.
Leave a Comment
Your comment is private and will only be visible to the author. We'll send you an email confirmation.