The Donor-List Breach Is Now a Regulatory Event
The nonprofit donor list used to be the most jealously guarded document in the building. In 2026 it is the most regulated. Multiple state privacy laws, an active U.S. Supreme Court ruling on donor confidentiality, accelerating state attorney general enforcement, and the first wave of state data-breach notification laws that explicitly include nonprofits have moved the donor list from a fundraising asset into a regulatory exposure.
The federal headline is the U.S. Supreme Court's unanimous April 29, 2026 opinion in First Choice Women's Resource Centers, Inc. v. Davenport. The Court held that a nonprofit suffered an injury to its First Amendment right of association when a state attorney general subpoenaed donor identities — and that the nonprofit could challenge the subpoena immediately in federal court, rather than waiting through the state's enforcement process.
The default nonprofit assumption — that 501(c)(3) status carries an implicit privacy-law carve-out — was always wrong, and is now demonstrably wrong. Multiple state privacy laws cover nonprofits explicitly or by operational scope. Oregon AG enforcement of its state privacy law began July 1, 2026. The Oregon AG is no longer required to provide controllers with notice and opportunity to cure as of January 1, 2026 — meaning the AG can proceed directly to enforcement, including civil investigative demands and lawsuits.
Oklahoma's new nonprofit-applicable data breach notification law requires nonprofit notification to the state attorney general within sixty days when a breach affects 500 or more Oklahoma residents. The nonprofit that maintains donor data on residents in multiple states is now operating inside a fifty-jurisdiction notification regime with different timelines, thresholds, and content requirements in each.
The First Choice Women's Resource Centers ruling made the nonprofit's own donor-confidentiality policy — the data retention rules, the access controls, the response protocol for government demands — into a board governance artifact that the nonprofit's D&O underwriter is now going to ask about.
A nonprofit cyber policy that responds to ransomware encryption but does not respond to state AG notification, regulatory fine and penalty exposure, multistate breach counsel, donor credit monitoring, and First Amendment counsel — is a policy that was written for the 2022 environment.
Most nonprofit donor-data breaches in 2025 traced back to volunteer access, departing employee credentials, or contractor portals — not external attackers. The 2026 cyber underwriter is asking about access-revocation timeline for departing volunteers, MFA enforcement on donor management platforms, and the third-party vendor footprint that touches donor records.
PFTN's nonprofit approach treats the donor list the way the regulator treats it. Strategic Discovery surfaces the donor management platform, the data retention policy, the volunteer access protocol, the multistate footprint, and the government-demand response procedure. Risk Assessment quantifies the state-by-state notification exposure. Solution Design pairs the cyber tower with D&O and EPL programs. Ongoing Optimization keeps the policy current as the state privacy patchwork develops.
The donor list used to be a fundraising asset. In 2026 it is a regulatory event waiting to happen. The shift starts with one conversation — and preferably before the next state AG letter arrives.
— Ryan Mefford, President & Risk Advisor