Rules
Privacy settlements changes 2027: what a compliance period requires
Privacy settlements changes 2027: what a compliance period requires, who certifies it, what an assessor checks, and what the end of the term does not mean.
A privacy settlement compliance period is a set of obligations with a clock attached. The payment makes the news. The clock decides what your teams do for years.
Privacy settlements changes 2027 usually mean old orders, not new ones. A privacy settlement is a compliance period; so is a license. Both run on fixed dates, named owners and records a regulator can inspect.
If your business holds a state or local license, an FTC or state privacy order adds a second track to the same calendar. The order's term, reporting cadence and certification duties belong with your license renewals and compliance filings.
Treat the order as a license condition: read the operative document, assign an owner, and track each date. This site covers the licensing, law and compliance rules that keep both tracks current. Missing a license renewal and missing an order anniversary fail in the same way: a person signs, and the record shows whether anyone looked.
What to take away
- FTC privacy orders commonly run 20 years. Multistate attorney general agreements commonly run three to five years. The order sets the real term.
- Duties fall into five groupsstop and delete, build, assess and report, notify, and survive a reopening clause.
- Reporting runs on a cadence, often an initial report within about 60 days and annual executive certifications after that.
- An assessor checks that a control exists in writing, that it operated, and that you logged failures you found yourself.
Which orders are still running in 2027
An order entered in 2019 with a 20-year term still has twelve years to run. Most periods still live in 2027 come from orders entered between 2019 and 2024.
Orders still running in 2027
- FTC v. Facebook, 2019.A $5 billion penalty and a 20-year order that created a board privacy committee, compliance officers and an independent assessment of the program.
- FTC v. Epic Games, 2022.A $275 million children's privacy penalty and $245 million over billing, resolved by two 20-year orders.
- Google location data, 2022.A $391.5 million multistate agreement. Deals of this type commonly run three to five years, so some terms end during 2027.
The five groups of obligation
Clauses sort into five groups, whatever the document says.
- Stop and delete. End the practice, remove material, delete a data category.
- Build. Reviews before launch, a named accountable officer, training, records.
- Assess and report. Periodic review, sometimes independent, sometimes filed with a regulator.
- Notify. Tell affected people something, in a set form, by a set date.
- Term and reopening. How long it lasts and what follows if conduct returns.
The general idea of an examination against stated criteria is set out in a definition of an audit. What an assessment means under a privacy order comes from that order.
[figure 1]
Durations, cadence and the calendar
Terms and dates follow a pattern, and the calendar is where these obligations usually fail. A list built in January is stale by the following January, as the yearly calendar reset explains.
| Order type | Common term | Reporting cadence |
|---|---|---|
| FTC privacy consent order | 20 years | Initial report, then annual executive certification |
| FTC children's privacy order | 20 years | Annual certification of the children's data review |
| Multistate attorney general settlement | three to five years | Annual or semi-annual compliance reports |
| State location data judgment | three to five years | Periodic disclosure and reporting duties |
The ranges are typical, not fixed. A missed anniversary gets noticed, because a named person signs the certification.
What an assessor examines
Criteria vary. The evidence pattern does not. The assessor wants the control in writing, proof it operated, and records of problems you found on your own.
That last item carries outsized weight. A company that fixes its own failures reads differently from one with a clean record and no sign that anyone looked.
Two failure patterns are worth planning against. Legal holds the obligations but cannot change a system, so nothing moves until a deadline is close.
Or engineering receives the clause with no interpretation, and the duty becomes whatever was easiest to build. Both gaps stay invisible inside the business and obvious to a reviewer, which is why violations and renewals examples help before a review year opens.
[figure 2]
Example: reading one certification clause
Open any 20-year privacy order and find the certification section. Four questions decide how the year runs.
Reading one certification clause
- Who signs. Usually a senior executive, personally, with the signature exposed to penalty.
- What it covers. Often the whole program, not one control.
- By when. An anniversary date, easy to miss.
- What a false certification costs. It is its own violation.
Write the four answers on one page and keep it with the order.
What is actually new in 2027
No federal privacy statute takes effect in 2027. Enforcement runs through the FTC Act and state law, so the settlement calendar remains the main mechanism.
- California risk assessment and automated decisionmaking rules.The California Privacy Protection Agency (CPPA) has scheduled them for 1 January 2027, and they create documented assessment duties of their own.
- The amended children's privacy rule (the COPPA Rule, 16 CFR Part 312).Its compliance date passed in April 2026, so orders entered in 2027 cite it as settled practice.
- New state statutes.Indiana, Kentucky and Rhode Island laws took effect in January 2026, and first enforcement matters are expected in 2027.
A 20-year term needs a tracked record, and tools for violations and renewals covers what belongs in it.
If children's data is involved, start with the regulator's own guidance. The FTC's children's privacy guidance covers one country's regime and no other.
What the end of the period does not mean
Meeting the terms of an order is not a finding that your practices are adequate. Nor is it a certification others can rely on, or a defense against a separate claim from a separate regulator.
Decide before the term ends which controls you wanted anyway, and give each one that matters an owner outside compliance.
