Privacy and AI Trends Report 2026 | DataGrail
2026 EDITION
Privacy and AI Trends Report
Navigating data privacy in the era of AI.
PUBLISHED
May 2026
ANALYSIS WINDOW
Jan 2025 – Dec 2025
FOREWORD
If there's one word to describe data privacy in 2026, it's more.
More US privacy fines than in the last 5 years combined. 145 more AI-related laws enacted. 567% more deletion requests than in 2021. The one thing there isn't more of? Privacy staff to handle it all.
The Privacy and AI Trends Report exists to help privacy leaders cut through the noise, and focus on the risks and opportunities that matter. We run this analysis annually because privacy teams and business leaders make better decisions when they have real numbers to work with, not estimates or gut checks.
Companies that adapt to these trends won't just avoid fines. They'll earn trust that's become non-negotiable in an AI world. The trends are clear. How you respond is up to you.
Daniel Barber
Co-founder & CEO
DataGrail
BACKGROUND
The 5th annual trends report aims to reflect the reality of privacy work, not just how it is perceived or reported on by those in the field. As such, we forgo surveys for deep primary research that creates a rich snapshot of privacy trends across industries, geographies, and company sizes.
You'll find the previous four editions under the name Data Privacy Trends Report, but like the privacy space, we have expanded the report's scope to include AI governance this year.
Data sources for the 2026 report include anonymized privacy operations data from hundreds of DataGrail customers, a consent compliance audit of 5,000 popular websites, and continuous tracking of over 2,400 leading business systems.
REPORT PREVIEW
2025 at a glance.
Read on for the full story, but here’s what you need to know.
AI RISK IS GROWING
0.0%
of AI systems are high risk, self-disclosing sensitive data processing or enabling automated decisions.
CONSENT IS STILL A TOP CHALLENGE
0%
of websites fail to comply with universal opt-out mechanisms (UOOMs).
1 in 3 AI systems carry advanced privacy risk.
0.0%
63.6% of AI vendors don't disclose subprocessors.
DSR DELETIONS KEEP CLIMBING
0% increase in deletion requests since 2021.
AI GOVERNANCE
Rapid AI adoption adds challenges for resource-strapped privacy teams.
In 2025, AI shifted from distraction, to a top challenge for privacy teams. 90% of privacy programs expanded in 2025 due to AI. Meanwhile, only 12% of AI governance programs are considered mature. This leaves privacy teams to close the gap without stifling AI adoption or impact.
145 AI-related laws were enacted by state legislatures in 2025. A thousand more were introduced or reworked. Just as privacy teams become adept at navigating conflicting state laws, 2026 is bringing a new level of complexity.
0
Laws Enacted
by state legislatures in 2025
Shadow IT didn't go away, it evolved into shadow AI.
Seemingly every vendor released new AI capabilities in 2025. 77% of IT leaders reported discovering shadow AI operating in their business. Like its older sibling shadow IT, Shadow AI can occur when employees procure AI-enabled tools without going through the proper channels. But, unlike shadow IT, our research indicates that shadow AI can also be missed even when a new vendor goes through a formal procurement and assessment process.
0.0%
of AI vendors do not disclose subprocessors
In a review of 2,400 popular business software providers who prominently advertised AI capabilities, 63.6% did not disclose an AI subprocessor in their legal documentation. While some of these vendors may be employing their own models, additional investigation suggests at least some are using a third-party AI subprocessor that was not disclosed publicly in legal documents.
Traditional third-party risk management that depends on legal reviews alone leaves businesses exposed to the risk of undocumented AI use. Comprehensive risk management in 2026 must also include proactive scanning and detection.
Not all AI risk is created equal.
As AI becomes ubiquitous, simply tracking which systems have AI capabilities is unhelpful. Effective AI risk management requires a clear picture of how the AI is used, and with what data.
AI Systems with Additional Self-Reported Risk Factors
0%10%20%30%40%50%Processing personal data0.0%Potential to power ADM0.0%Processing sensitive data0.0%Processing biometric data0.0%SHARE OF AI SYSTEMS (%)
0.0%
of AI systems disclose at least one advanced privacy risk
32.8% of systems disclosing AI capabilities also disclose at least one other activity with high privacy risk, such as sensitive data processing or the potential to power automated decision making (ADM).
These figures almost certainly undercount actual exposure, since they reflect only what vendors have formally disclosed. As AI capabilities are not always disclosed in legal documentation, vendors could underreport access to personal data. One great advantage to AI is the flexibility in its application, so even good faith vendors might not predict riskier user applications.
REGULATORY CHECK
Processing sensitive data with AI can trigger additional obligations under the EU AI Act. Using AI for ADM necessitates additional data subject rights in states like Minnesota.
THE BOTTOM LINE
Working with higher risk AI systems can have consequences, but if privacy teams are aware of system risks, privacy can mitigate them. Don't rely solely on legal documentation for risk assessments, implement continuous detection of system risks.
CONSENT MANAGEMENT
Consent management was the busiest enforcement topic of 2025.
California alone publicly reported settlements regarding consent management crises totaling $4.3 million in 2025, and that does not include non-public settlements.
2025 also saw over 1,400 class action wiretapping suits, largely driven by private firms proactively investigating tracking pixel and session replay software. This figure also doesn't include the estimated thousands more settled out of court. Consent enforcement has become far too expensive to treat as acceptable risk.
Before a regulator's audit even begins, over 63% of businesses miss the mark.
The easiest compliance win is still the most commonly missed.
Before anyone can look at a company's data subject request process, record of processing activities, or anything else they might want to inspect, they land on the company's website. With the help of a simple consent tracking check, regulatory auditors get their first look at a company's privacy compliance posture before they even open the privacy policy. The culprit? Browser opt-out signals.
0%
of websites fail to comply with universal opt-out mechanisms (UOOMs)
UOOM Noncompliance by Year via trackers continued after opt-out
NON-COMPLIANCE RATE (%)0%25%50%75%100%0%20230%20240%2025YEAR
REGULATORY CHECK
As of 2026, 10+ states require businesses to observe universal opt-out mechanisms (UOOMs) such as the Global Privacy Control (GPC).
Cross-state enforcement groups can easily verify if a company honors these browser-based signals and opt users out of tracking when requested.
0.0%
of all trackers firing after a UOOM signal are from Google Analytics
0.0%
of trackers fire targeted ads via platforms like Meta and Microsoft
THE BOTTOM LINE
Failing to honor UOOM signals doesn't immediately fail an audit, but it does draw increased scrutiny, and if the website is unable to repair the situation to the satisfaction of the regulator, UOOM non-compliance becomes another layer of fines to face.
Although websites have made some progress honoring browser opt-outs, UOOM and GPC compliance remains easy in principle, and deceptively challenging in practice.
Low opt-out rates, high enforcement risk.
As an increasing number of regulations require organizations to proactively check for cookie consent, how are users reacting to the consequential influx of pop-up banners?
How Users Respond to Cookie Consent Banner Options
Accept all
48.3%
Exit without a selection
37.0%
Essential only
12.4%
Custom
2.3%
Across all possible consent banner configurations and industry types, less than 15% of users make a conscious choice to opt out of some or all non-essential tracking today. Note that the tracking outcome of exiting without a selection can differ depending on website and region, which may influence this pattern.
REGULATORY CHECK · COOKIE BANNERS
Regulators increasingly ban "dark patterns" or deceptive design practices in cookie compliance banners. In some cases, this may include defaulting consent selections to "accept all" when the banner is ignored or dismissed.
THE BOTTOM LINE · COOKIE BANNERS
Few consumers make a deliberate choice to opt out of tracking today. Implementing a functional consent banner is a low-risk entry point for any privacy program.
DATA SUBJECT REQUEST MANAGEMENT
DSR volume hits an all-time high, automation is no longer optional.
Data subject request (DSR) volume rose for the fifth year in a row. At this volume, manual request processing isn't just inefficient, it's irresponsible. Organizations don't have the capacity to handle this many requests individually and still ensure they are completed thoroughly.
Average Cost of Manual DSR Management
$0K$425K$850K$1.3M$1.7M$238K2021$647K2022$881K2023$1.26M2024$1.51M2025ANNUAL COST (USD)YEAR
AVG ANNUAL COST OF MANUAL DSRS
$1.5M
for a medium-sized business receiving 5 million unique web visitors annually.
Based on Gartner's estimated cost per manual DSR of $1,524.
0% increase in deletion requests since 2021
Deletion requests continue to dominate.
Consumers continue to skip visibility and reach straight for the delete button. While access requests gradually decline, deletion requests show no sign of slowing.
Annual DSR Volume per 5M Unique Website Visitors
03006009001,2001,500DSR VOLUME20212022202320242025YEAR
DeletionAccessDo Not Sell or Share
0%
of Data Subject Requests are deletion requests
Data subject request volume data was normalized based on average annual website visitors and benchmarks were established using a 10% trim mean to account for variability across business types. Industries with exceptional request volume, such as data brokers, were excluded.
Data brokers are in their own league.
Unsurprisingly, data brokers saw the largest increase in deletion requests this year. Here are the numbers.
0%
more deletion requests in 2025 compared to 2024
0k+ average deletion requests handled per month
0+ average do not sell or share requests handled per month
REGULATORY CHECK · DATA BROKERS
All of this before the Delete Act went into effect on January 1. Though data brokers do not begin processing requests until August 2026, CalPrivacy kicked off consumer education in late 2025 and hundreds of thousands of consumers have already submitted requests to the Delete Request and Opt-out Platform (DROP).
Data broker here is defined as organizations currently registered as data brokers with CalPrivacy. According to the Agency and the CCPA's broad definition of selling or sharing data, far more organizations qualify as data brokers than the 575+ currently registered.
11+ companies have been fined for failing to register so far, settling for over half a million dollars and counting.
LOOKING AHEAD
2026 will see data brokers process more requests than ever before, though some percentage of requests will shift from data subject requests to DROP requests. We'll also see more companies register as brokers this year as enforcement continues, and each of these companies will face an absolutely unprecedented DSR volume.
DSR volume cuts across industries.
Industries dealing with sensitive data such as health, financial, and location information have long carried the highest volume of data subject requests. But several categories that barely registered in previous years burst into the top five in 2025. Meanwhile, B2B data subject access request (DSAR) volume continued to grow, especially relative to other industries. Professional Services companies received 4.6× times the number of DSARs than the average company in 2025.
Industries with the Highest Monthly Average DSR Volume per 5M unique annual web visitors
Deletion Requests
Jobs & Professional Development
0
Health & Wellness
0
Financial Services
0
Consumer Tech
0
Gambling
0
Access Requests
Professional Services
0
Gambling
0
Health & Wellness
0
Consumer Tech
0
Real Estate
0
Do Not Sell or Share
Health & Wellness
0
Gambling
0
Professional Services
0
Financial Services
0
Retail & D2C
0
RISK ASSESSMENTS
California raised the bar on risk assessments in 2026. Most programs aren't ready.
REGULATORY CHECK
January 1, 2026
California has made privacy risk assessments a legal requirement. Organizations must conduct assessments proactively and submit them to CalPrivacy for an annual audit beginning April 2028. Each submission must be personally attested to by a company executive under penalty of perjury.
The CCPA just took risk assessments in the U.S. from a best practice recommendation to a foundational priority. The CCPA's privacy assessment requirement is now arguably the strictest in the world, surpassing even the GDPR. This may be the first time many U.S. companies consider completing any risk assessments at all.
So where did privacy teams enter the year on privacy assessments, and how far do they have to go to close the compliance gap with California?
Average Annual Volume of Privacy Assessments by Industry
ASSESSMENTS PER YEAR0387511311500Entertainment0Real Estate0Financial Services0Consumer Tech0GamblingINDUSTRY
LOOKING AHEAD
PIA and risk assessment volume is set to dramatically increase in 2026 and each year after as the CalPrivacy audit deadline approaches.
THE BOTTOM LINE
If you're not already in the habit of completing risk assessments, start embedding risk assessments in product and procurement workflows now. Businesses in less regulated industries like Retail/D2C, or those not already operating under GDPR will be the hardest hit for the CCPA's new requirement.
AI risk assessments underpin successful AI projects.
Risk assessments are required for any processing activity that could introduce privacy risk for consumers, but privacy teams should pay extra attention to their AI risk assessments.
Research shows that 42% of companies abandoned AI initiatives in 2025, with data privacy concerns cited as a primary obstacle. Privacy teams can help prevent loss of valuable time and resources by getting involved with AI projects early to ensure appropriate safeguards are in place and help the business bring products to the market that may otherwise be crushed before their release. An AI risk assessment is the right place to start.
0%
of AI initiatives failed
REGULATORY LANDSCAPE
Regulators aren't just watching anymore. The enforcement era is here.
Nearly half of U.S. states have a comprehensive privacy law in effect today, plus over 160 AI-specific laws. According to Gartner, over 50% of the U.S. population is now covered, and 24 additional states are expected to pass privacy laws within the next five years.
While the federal government has signaled interest in national privacy and AI regulation to preempt state-specific governance, the legal landscape remains incredibly complex today.
20 STATES TOTAL
New Comprehensive State Privacy Laws by Year
NEW LAWS ENACTED03581002020020210202202023020240202502026 YTDYEAR
LOOKING AHEAD
The introduction of new comprehensive state privacy laws seem to be slowing down, but privacy teams should watch amendments closely. Just as the CCPA first shaped a generation of state laws in 2020, the CCPA's more recent amendments requiring GPC compliance, executive attestation for risk assessments, and proactive audit requirements could soon become the de facto across states.
The cost of non-compliance is growing.
$0.000B
state-issued privacy fines in 2025
Enforcement of these regulations is also dramatically ramping up, regardless of industry or company size. Gartner estimates that U.S. states gave out a total of $3.425 billion in privacy-related fines in 2025, more than the last five years combined, and expected to accelerate through 2028.
Cross-State Partnerships
With 20+ state privacy laws in effect, several AGs have created cross-state partnerships to advance consent enforcement. These partnerships are now sufficiently resourced to look beyond a privacy policy and pressure-test actual privacy measures.
Wiretapping Litigation
Plaintiff law firms continue to argue that web analytics and advertising pixels constitute wiretapping under CIPA, ECPA, and VPPA. While results vary, these cases remain profitable for prosecution and expensive for defense.
THE CHALLENGE
Privacy teams lost headcount while their workload grew. AI is closing the gap.
Growing regulatory demands, AI risks, privacy request volume are putting new levels of pressure on privacy teams and their business leaders. Risk management is a top 10 priority for CEOs in 2026, and Cisco found that 95% of organizations recognize privacy as essential for building consumer trust.
In spite of these increased demands on the profession and the strategic importance of getting privacy right, privacy teams have not had access to increasing resources. In fact, rather than hire new team members to support growing AI governance responsibilities, privacy teams lost headcount by as much as 33% last year. Privacy professionals turned to AI to close the gap. 74% of privacy teams made plans to apply AI to privacy-related tasks in 2026.
To be successful this year, privacy teams must help their leadership team understand how the resources they need will drive business outcomes.
THE SOLUTION
DataGrail is built to solve 2026 privacy challenges.
Powered by Vera, the first complete AI privacy agent, DataGrail is built for exactly this moment. Vera works within DataGrail's complete, no-compromise platform to deliver context-aware risk guidance, surface hidden data exposure, and automate privacy workflows across your entire system inventory.
Human-governed Fully auditable 2,500+ integrations
THE FULL REPORT
Take it with you.
The 2026 Privacy & AI Trends Report as a PDF — same data, same charts, ready to share.
Download the report
All ten sections in a single document · 40MB.