The Map Has Changed — Dramatically
When California’s CCPA took effect in January 2020, it was the only comprehensive state privacy law in the United States. In 2026, there are twenty.
That number is not a typo. Twenty US states now have active comprehensive consumer privacy laws, with four more — Alabama, Louisiana, Oklahoma, and Vermont — signed in 2026 and taking effect in 2027 and 2028. By the end of 2027, roughly half the US population will live under a state privacy law, and there is still no federal framework that preempts or replaces them.
For a small business serving customers across the US, the proliferation of state laws creates a compliance picture that looks complex at first glance. It’s more manageable than it looks — but only if you understand which laws actually reach your business, what the meaningful differences are, and how to build a compliance approach that works across states without rebuilding your practices for each one.
This guide covers every active state law as of October 2026: who it applies to, what it requires, and specifically what small businesses need to know about each.
The First Question: Which Laws Actually Apply to You?
Before working through the state-by-state detail, the threshold question is which laws your business is realistically subject to.
Most state privacy laws use one or more of three triggers: the number of consumers whose data you process in a year, the revenue your business generates, or a specific percentage of revenue derived from selling personal data. A small business with a local customer base of 500 people is unlikely to cross any state’s consumer-count threshold. A small business with a high-traffic website that uses analytics and retargeting could cross multiple states’ thresholds without realising it — because digital analytics records data about every website visitor, regardless of whether they purchase anything.
The key insight: these laws count all consumers you process data about, not just paying customers. Your website’s Google Analytics processes data about every visitor. If 100,000 people from Colorado visit your website in a year, Colorado’s CPA likely applies to you — even if only 200 of them bought something.
A second important point: some laws specifically exempt businesses that are “small businesses” as defined by the US Small Business Administration (SBA). Texas and Nebraska are the clearest examples. The SBA definition varies by industry, but as a rough guide, a business with under $2.25 million in annual receipts and fewer than 100 employees will likely qualify for the SBA small business classification in most industries. If you fall within the SBA definition, Texas and Nebraska largely don’t apply to you — though Texas still requires consent before you sell sensitive personal data even as a small business.
With those framing points in mind, here is every active state law.
Currently Active State Privacy Laws (as of October 2026)
California — CCPA/CPRA
Effective: January 2020 (CCPA); January 2023 (CPRA amendments)
Applies to: For-profit businesses that collect personal information from California residents AND meet one of: annual gross revenue above $26.625 million (inflation-adjusted for 2026); processing data of 100,000 or more consumers or households per year; or deriving 50% or more of annual revenue from selling or sharing personal information.
Small business reality: The revenue threshold excludes most genuine small businesses — a business with under $26.625 million in annual revenue that isn’t selling personal data is likely outside CCPA scope. The 100,000 consumer threshold is more reachable for high-traffic websites. If your website has material California traffic and you use targeted advertising tools, check your consumer counts.
Key obligations: Right to know what data is collected and how it’s used. Right to delete personal information. Right to opt out of sale or sharing of personal information. Right to correct inaccurate information. Right to limit use of sensitive personal information. Required privacy policy with specified disclosures. Required “Do Not Sell or Share My Personal Information” link or Global Privacy Control (GPC) support.
Notable: California covers employee data and B2B contact data — most other state laws exempt these. The California Privacy Protection Agency (CPPA) has active enforcement authority with fines up to $7,500 per intentional violation.
Virginia — VCDPA (Virginia Consumer Data Protection Act)
Effective: January 1, 2023
Applies to: Businesses that conduct business in Virginia or produce products or services targeted at Virginia residents AND meet one of: process data of 100,000 or more consumers per year; or process data of 25,000 or more consumers and derive over 50% of gross revenue from selling personal data.
Small business reality: Employee data and B2B contact data are excluded — only consumer data counts toward the threshold. A business with a modest customer base and no significant data-selling revenue is likely outside scope.
Key obligations: Right to access, correct, delete, and port personal data. Right to opt out of targeted advertising, sale of personal data, and certain profiling. Data protection assessments required for high-risk processing. Written contracts with data processors required.
Colorado — CPA (Colorado Privacy Act)
Effective: July 1, 2023
Applies to: Businesses conducting business in Colorado or producing products or services targeted at Colorado residents AND meeting one of: process data of 100,000 or more consumers per year; or process data of 25,000 or more consumers and receive revenue or discounts from selling personal data.
Small business reality: Similar threshold structure to Virginia. The “revenue or discounts” language for the second trigger is slightly broader than Virginia’s pure revenue test.
Key obligations: Includes all standard consumer rights plus a right to opt out via universal opt-out mechanisms including Global Privacy Control (GPC) — businesses must honour GPC signals. Data protection assessments required for high-risk processing.
Notable: Colorado has specific rules around dark patterns in consent interfaces — consent obtained through deceptive design is invalid.
Connecticut — CTDPA (Connecticut Data Privacy Act)
Effective: July 1, 2023 (major amendments effective July 1, 2026)
Applies to: Businesses conducting business in Connecticut or producing products or services targeted at Connecticut residents AND meeting one of: process data of 35,000 or more consumers per year; or process data of any volume of sensitive personal data or sell personal data.
Small business reality: The July 2026 amendments significantly expanded scope. Businesses that sell personal data or process sensitive personal data are now covered regardless of consumer volume. If you use advertising tools that share consumer data, verify whether this triggers the “selling” definition.
Key obligations: Standard consumer rights including access, deletion, correction, portability, and opt-outs. GPC support required. Data protection assessments for high-risk processing. Right of appeal for refused consumer requests.
Utah — UCPA (Utah Consumer Privacy Act)
Effective: December 31, 2023
Applies to: Businesses with annual revenue of $25 million or more AND meeting one of: process data of 100,000 or more consumers; or process data of 25,000 or more consumers and derive over 50% of revenue from selling personal data.
Small business reality: Utah’s revenue floor is a genuine small business exemption. A business with under $25 million in annual revenue is outside scope regardless of consumer volume. This makes Utah one of the least likely states to affect a typical small business.
Key obligations: Consumer rights to access, delete, and port data provided directly by the consumer. Opt-out of sale of personal data and of targeted advertising. No correction right. No appeal right. No profiling opt-out.
Notable: Utah has the narrowest consumer rights of any state law — its deletion right covers only data the consumer provided directly, not data inferred or derived by the business.
Texas — TDPSA (Texas Data Privacy and Security Act)
Effective: July 1, 2024
Applies to: For-profit entities that conduct business in Texas or produce products or services consumed by Texas residents — with no consumer-count or revenue threshold.
Small business reality: Texas explicitly exempts businesses that qualify as “small businesses” under the SBA definition. The SBA standard varies by industry but roughly applies to businesses with under $2.25 million to $47 million in receipts (depending on industry NAICS code) or fewer than 100 to 1,500 employees. Most businesses with under 100 employees and modest revenue qualify.
Critical exception: Even SBA-exempt small businesses must obtain prior consent before selling sensitive personal data. This obligation applies at any size. Sensitive data includes biometric data, health data, data revealing racial or ethnic origin, religious beliefs, sexual orientation, immigration status, and precise geolocation.
Key obligations (for non-exempt businesses): Full consumer rights suite. Data protection assessments. Processor contracts. No cure period — violations are investigated directly by the Attorney General.
Oregon — OCPA (Oregon Consumer Privacy Act)
Effective: July 1, 2024
Applies to: Businesses conducting business in Oregon or providing products or services to Oregon residents AND meeting one of: process data of 100,000 or more consumers per year; or process data of 25,000 or more consumers and derive 25% or more of gross revenue from selling personal data.
Small business reality: Standard threshold structure. The 25% revenue-from-sales test (lower than other states’ 50%) makes the second trigger more reachable for businesses monetising data.
Key obligations: Full consumer rights suite. GPC support required. No cure period (the 30-day cure period that applied initially was removed effective January 2026).
Florida — FDBR (Florida Digital Bill of Rights)
Effective: July 1, 2024
Applies to: The full FDBR obligations apply only to businesses with over $1 billion in global gross annual revenue that meet at least one of several tech-platform criteria. This effectively limits full obligations to very large technology companies.
Small business reality: Most small businesses fall entirely outside the FDBR’s full requirements. However, provisions relating to sale of sensitive personal data apply more broadly to any for-profit business. If your business sells sensitive data about Florida consumers, verify specific obligations with a privacy attorney.
Montana — MCDPA (Montana Consumer Data Privacy Act)
Effective: October 1, 2024
Applies to: Businesses conducting business in Montana or targeting Montana consumers AND meeting one of: process data of 50,000 or more residents (excluding payment-only processing); or process data of 25,000 or more consumers and derive 25% or more of revenue from selling personal data.
Small business reality: Montana’s lower threshold (50,000 vs 100,000 for most states) makes it slightly more reachable for smaller businesses with national web traffic.
Key obligations: Full consumer rights suite. Data protection assessments. Processor contracts. 60-day cure period.
Notable: Montana’s duty-of-care provisions for minors apply regardless of business size.
Delaware — DPDPA (Delaware Personal Data Privacy Act)
Effective: January 1, 2025
Applies to: Businesses conducting business in Delaware or targeting Delaware consumers AND meeting one of: process data of 35,000 or more consumers (excluding payment-only processing); or process data of 10,000 or more consumers and derive over 20% of revenue from selling personal data.
Small business reality: Delaware’s thresholds are lower than most states (35,000 vs 100,000 for the first trigger; 10,000 for the second). A business with significant web traffic from Delaware could reach these thresholds more easily than higher-threshold states.
Key obligations: Full consumer rights suite including access, correction, deletion, portability, and opt-outs. GPC support required. Data protection assessments. No cure period.
Iowa — ICDPA (Iowa Consumer Data Protection Act)
Effective: January 1, 2025
Applies to: Businesses conducting business in Iowa or targeting Iowa residents AND meeting one of: process data of 100,000 or more consumers per year; or process data of 25,000 or more consumers and derive over 50% of gross revenue from selling personal data.
Small business reality: Iowa’s thresholds are relatively high, making it less likely to reach small businesses.
Key obligations: Consumer rights to access, delete, and port data. Right to opt out of sale of personal data and targeted advertising. No correction right (unusual omission). No profiling opt-out. 90-day cure period.
Nebraska — NDPA (Nebraska Data Privacy Act)
Effective: January 1, 2025
Applies to: Businesses conducting business in Nebraska or targeting Nebraska consumers — with no consumer-count or revenue threshold.
Small business reality: Like Texas, Nebraska explicitly exempts SBA-defined small businesses from most obligations. The SBA definition applies. If your business qualifies as an SBA small business, Nebraska’s main obligations don’t apply.
Key obligations (for non-exempt businesses): Full consumer rights suite. Data protection assessments. Processor contracts. GPC support required.
New Hampshire — NHDPA (New Hampshire Data Privacy Act)
Effective: January 1, 2025
Applies to: Businesses conducting business in New Hampshire or targeting New Hampshire residents AND meeting one of: process data of 35,000 or more consumers (excluding payment-only processing); or process data of 10,000 or more consumers and derive over 25% of revenue from selling personal data.
Small business reality: New Hampshire’s lower thresholds (matching Delaware) make it more reachable than many states.
Key obligations: Full consumer rights suite. GPC support required. Violations are treated as deceptive trade practices under New Hampshire consumer protection law.
New Jersey — NJDPA (New Jersey Data Privacy Act)
Effective: January 15, 2025
Applies to: Businesses conducting business in New Jersey or targeting New Jersey residents AND meeting one of: process data of 100,000 or more consumers per year; or process data of 25,000 or more consumers and derive revenue or discounts from selling personal data.
Small business reality: New Jersey’s thresholds are similar to Virginia and Colorado. Financial information is classified as sensitive data — relevant for businesses in financial services adjacent sectors.
Key obligations: Full consumer rights suite. Data protection assessments. Processor contracts. Cure period ended July 15, 2026 — no cure period is now available.
Tennessee — TIPA (Tennessee Information Protection Act)
Effective: July 1, 2025
Applies to: Businesses with annual revenue of $25 million or more AND meeting one of: process data of 175,000 or more consumers per year; or process data of 25,000 or more consumers and derive over 50% of gross revenue from selling personal data.
Small business reality: Tennessee’s combined revenue floor ($25 million) and high consumer threshold (175,000) make it one of the least likely state laws to apply to a small business.
Notable: Tennessee allows a written, NIST CSF-aligned privacy programme to serve as an affirmative defence in enforcement actions. This is unique among state privacy laws.
Minnesota — MCDPA (Minnesota Consumer Data Privacy Act)
Effective: July 31, 2025
Applies to: Businesses conducting business in Minnesota or targeting Minnesota residents AND meeting one of: process data of 100,000 or more consumers per year; or process data of 25,000 or more consumers and derive 25% or more of gross revenue from selling personal data.
Small business reality: Standard high-threshold structure. The 25% revenue-from-sales trigger (lower than many states’ 50%) is the meaningful differentiator.
Key obligations: Full consumer rights suite including right of appeal. Cure period ended January 31, 2026 — no cure period now available.
Maryland — MODPA (Maryland Online Data Privacy Act)
Effective: October 1, 2025
Applies to: Businesses conducting business in Maryland or targeting Maryland residents AND meeting one of: process data of 35,000 or more consumers (excluding payment-only processing); or process data of 10,000 or more consumers and derive over 20% of revenue from selling personal data.
Small business reality: Maryland’s lower thresholds (matching Delaware and New Hampshire) make it more reachable.
Key obligations: Maryland has some of the strictest substantive requirements. Controllers must minimise data collection to what is necessary for specified purposes. Sale and processing of sensitive data is largely prohibited rather than just subject to opt-out. Data protection assessments required for high-risk processing. Nonprofits and universities are not exempt as organisations (unusual).
Indiana — INCDPA (Indiana Consumer Data Protection Act)
Effective: January 1, 2026
Applies to: Businesses conducting business in Indiana or targeting Indiana residents AND meeting one of: process data of 100,000 or more Indiana residents per year; or process data of 25,000 or more consumers and derive over 50% of gross revenue from selling personal data.
Small business reality: High threshold structure. The permanent 30-day cure period is more business-friendly than states that have removed the cure period.
Key obligations: Full consumer rights suite. Data protection assessments. Processor contracts. Permanent 30-day cure period.
Kentucky — KCDPA (Kentucky Consumer Data Protection Act)
Effective: January 1, 2026
Applies to: Businesses conducting business in Kentucky or targeting Kentucky residents AND meeting one of: process data of 100,000 or more consumers per year; or process data of 25,000 or more consumers and derive over 50% of gross revenue from selling personal data.
Small business reality: High threshold structure. Like Indiana, Kentucky maintains a permanent cure period.
Key obligations: Full consumer rights suite. Data protection assessments. Processor contracts. Permanent 30-day cure period.
Rhode Island — RIDTPPA (Rhode Island Data Transparency and Privacy Protection Act)
Effective: January 1, 2026
Applies to: Businesses conducting business in Rhode Island or targeting Rhode Island residents AND meeting one of: process data of 35,000 or more residents (excluding payment-only processing); or process data of 10,000 or more consumers and derive over 20% of revenue from selling personal data.
Small business reality: Lower thresholds (matching Delaware, New Hampshire, Maryland) make Rhode Island more reachable.
Key obligations: Consumer rights to access, correct, delete, and opt out of sales and targeted advertising. Consent required for processing sensitive data. No cure period.
Coming in 2027 and 2028: Four More Laws
Four additional states enacted comprehensive privacy laws in 2026, none of which is yet effective.
Louisiana — LDPA (Louisiana Data Privacy Act)
Effective: January 1, 2027
Applies to: Businesses meeting one of: annual gross revenue over $25 million; handling data of 75,000 or more Louisiana consumers, households, or devices; or 50% or more of annual revenue from selling personal information.
Small business reality: Louisiana’s $25 million revenue floor echoes Utah and Tennessee, potentially excluding many small businesses on revenue grounds alone.
Oklahoma — Oklahoma Consumer Data Privacy Act
Effective: January 1, 2027
Applies to: Businesses meeting one of: process data of 100,000 or more Oklahoma residents per year; or process data of at least 25,000 consumers and derive over 50% of gross revenue from selling personal data.
Small business reality: Standard high-threshold structure similar to Virginia and Colorado.
Alabama — Alabama Personal Data Protection Act
Effective: May 1, 2027
Applies to: Businesses meeting one of: process data of more than 25,000 Alabama consumers (excluding payment-only processing); or earn over 25% of gross revenue from selling personal data.
Small business reality: Alabama explicitly exempts businesses with fewer than 500 employees — unless they sell personal data. For a business that doesn’t sell personal data, this is a broad small business exemption.
Vermont — VTDPOSA (Vermont Data Privacy and Online Surveillance Act)
Effective: January 1, 2028
Applies to: Businesses that, in the prior calendar year, processed data of 35,000 or more Vermont consumers (excluding payment-only processing), processed sensitive data of 3,000 or more consumers, or sold personal data of 3,000 or more consumers.
Small business reality: Vermont’s sensitive data and data sales triggers at 3,000 consumers are the lowest thresholds in any US state privacy law — potentially catching smaller businesses that process health or biometric data or that monetise personal data in any way. Vermont has no broad nonprofit exemption.
Comparison Table: Active State Laws at a Glance
| State | Law | Effective | Consumer threshold | Revenue threshold | SBA exemption | Cure period |
|---|---|---|---|---|---|---|
| California | CCPA/CPRA | Jan 2020 | 100,000 consumers | $26.625M OR 50% rev from sales | No | No |
| Virginia | VCDPA | Jan 2023 | 100,000 consumers | 50% rev from sales (secondary) | No | 30 days (AG) |
| Colorado | CPA | Jul 2023 | 100,000 consumers | Any rev from sales (secondary) | No | No |
| Connecticut | CTDPA | Jul 2023 | 35,000 consumers OR sensitive data | None | No | No |
| Utah | UCPA | Dec 2023 | 100,000 consumers | $25M AND (threshold) | No | 60 days |
| Texas | TDPSA | Jul 2024 | None | None | Yes | No |
| Oregon | OCPA | Jul 2024 | 100,000 consumers | 25% rev from sales (secondary) | No | No |
| Florida | FDBR | Jul 2024 | $1B+ rev + tech criteria | $1B+ | No | 30 days |
| Montana | MCDPA | Oct 2024 | 50,000 consumers | 25% rev from sales (secondary) | No | 60 days |
| Delaware | DPDPA | Jan 2025 | 35,000 consumers | 20% rev from sales (secondary) | No | No |
| Iowa | ICDPA | Jan 2025 | 100,000 consumers | 50% rev from sales (secondary) | No | 90 days |
| Nebraska | NDPA | Jan 2025 | None | None | Yes | 30 days |
| New Hampshire | NHDPA | Jan 2025 | 35,000 consumers | 25% rev from sales (secondary) | No | 60 days |
| New Jersey | NJDPA | Jan 2025 | 100,000 consumers | Any rev or discount from sales | No | No |
| Tennessee | TIPA | Jul 2025 | 175,000 consumers | $25M AND (threshold) | No | 60 days |
| Minnesota | MCDPA | Jul 2025 | 100,000 consumers | 25% rev from sales (secondary) | No | No |
| Maryland | MODPA | Oct 2025 | 35,000 consumers | 20% rev from sales (secondary) | No | No |
| Indiana | INCDPA | Jan 2026 | 100,000 consumers | 50% rev from sales (secondary) | No | 30 days (perm) |
| Kentucky | KCDPA | Jan 2026 | 100,000 consumers | 50% rev from sales (secondary) | No | 30 days (perm) |
| Rhode Island | RIDTPPA | Jan 2026 | 35,000 consumers | 20% rev from sales (secondary) | No | No |
Targeted Laws That Apply Regardless of Size
Three state laws apply to specific data types without consumer-count or revenue thresholds, and every business that handles the relevant data type should be aware of them.
Illinois — BIPA (Biometric Information Privacy Act) Illinois BIPA applies to any private entity in Illinois that collects, stores, uses, or sells biometric data — including fingerprints, iris scans, and face geometry. There is no size exemption. Time-clock systems that use fingerprint scanning, employee access systems using face recognition, and customer-facing features using biometric authentication are all covered. Statutory damages of $1,000–$5,000 per violation make BIPA the most heavily litigated privacy law in the US — class actions are common.
Washington — MHMDA (My Health My Data Act) Washington’s MHMDA applies to any business that collects, shares, or sells consumer health data about Washington state consumers. Consumer health data is broadly defined to include any information that identifies a consumer’s past, present, or future physical or mental health condition — extending well beyond HIPAA’s scope to include fitness tracker data, period tracking app data, and location data inferring health conditions. No size threshold applies.
California — COPPA-adjacent protections for minors California’s AADC (Age-Appropriate Design Code) and related rules apply specific requirements to online services that are likely to be accessed by children under 18. These apply without a size threshold to any service designed for or likely to attract minor users.
What This Means for Your Business: A Practical Framework
Faced with twenty state laws, the practical question is: how do you build a compliance approach that doesn’t require rebuilding your privacy programme for every state?
Step 1: Determine Which Laws Actually Reach You
Start with your data. How many website visitors do you have per state? If you have analytics installed (Google Analytics, Plausible, any other traffic analytics), you can pull a breakdown of visitor sessions by US state for the past 12 months. Compare those numbers against each state’s threshold.
Remember: consumer count thresholds count data subjects processed, not paying customers. Every website visitor counts.
For revenue-based thresholds (California, Utah, Tennessee): if your annual revenue is under $25 million, you’re outside the revenue-floor laws unless you fall into the data-selling revenue percentage test.
For SBA-based exemptions (Texas, Nebraska): verify your SBA size classification for your industry NAICS code before assuming you’re exempt.
Step 2: Build to the Strictest Standard
If you determine that multiple state laws apply, building your privacy programme to the strictest applicable requirements satisfies all of them simultaneously. In practice, that means:
- California’s CCPA/CPRA sets the baseline for consumer rights and privacy policy requirements
- Maryland’s MODPA sets the baseline for data minimisation (only collect what’s strictly necessary)
- Connecticut and Colorado set the baseline for GPC signal support
- Vermont (effective 2028) sets the strictest sensitive data and data-selling thresholds at 3,000 consumers
A programme built to California + Maryland + GPC support satisfies the substantive requirements of every other active state law. This is more efficient than maintaining state-specific programmes.
Step 3: Implement These Five Core Requirements
Regardless of which specific laws apply, these five requirements appear across virtually every state privacy law and should be your implementation priority:
1. Accurate, current privacy policy. Every active state law requires a privacy policy disclosing what data you collect, why, how long you retain it, who you share it with, and how consumers can exercise their rights. One comprehensive privacy policy that addresses all applicable laws is sufficient — you don’t need separate policies per state.
2. Consumer rights mechanism. You need a way for consumers to submit access, deletion, correction, and opt-out requests. A dedicated privacy email address (privacy@yourdomain.com) plus a response process that meets the 30–45 day response timelines required by most laws is the minimum viable implementation.
3. Opt-out of sale/sharing of personal data. If your business shares consumer data with third-party advertisers or analytics providers in ways that could constitute “selling” personal data under applicable law, you must provide a clear opt-out mechanism. Most laws require this to be accessible from your website’s homepage. Under California law and several others, this must now include support for the Global Privacy Control (GPC) browser signal.
4. Consent for sensitive data. Sensitive personal data — health data, biometric data, precise geolocation, racial or ethnic origin, religious beliefs, sexual orientation, immigration status — requires explicit opt-in consent before processing under most state laws. This is an opt-in requirement, not an opt-out. If you process sensitive data without explicit consent, you have a substantive violation regardless of whether a consumer has complained.
5. Vendor contracts. Most state laws require data processing agreements with vendors who process personal data on your behalf (data processors). Your cloud providers, email marketing platform, CRM, analytics tools, and payment processors are all processors. Standard data processing addenda (DPAs) are available from most major vendors at no cost — Google, Microsoft, Mailchimp, Salesforce all offer them. Requesting and signing them is a paperwork task, not a technical one.
Buyer’s Guide: How to Stay Compliant Without Drowning in Legal Fees
Do you need a privacy lawyer for every state law?
For a small business subject to a single state’s law with standard data practices, a privacy attorney engagement of $1,500–$3,000 to review your privacy policy, set up a consumer rights response process, and identify vendor DPAs to request will typically achieve baseline compliance. You don’t need a separate legal engagement per state.
For a business subject to multiple state laws, a single privacy attorney engagement covering multi-state compliance is more efficient than separate engagements. Most privacy attorneys who work with small businesses are familiar with the multi-state landscape.
What tools help manage multi-state compliance?
Consent management platforms (CMPs) — Termly, iubenda, CookieYes, Complianz — address cookie consent and GPC signal support across all applicable state laws from one configuration. A CMP is not optional if you’re subject to Colorado, Connecticut, or any law requiring GPC support.
Data Subject Request (DSR) management tools — some CMPs include this, as do platforms like OneTrust (enterprise) and DataGrail (mid-market) — automate the intake and tracking of consumer access, deletion, and opt-out requests across multiple state frameworks.
For most small businesses, a CMP plus a dedicated privacy email address plus a well-drafted privacy policy is sufficient infrastructure for multi-state compliance.
What does multi-state compliance actually cost?
Privacy attorney for multi-state policy and programme review: $2,000–$5,000 initial engagement. Annual review: $500–$1,500.
CMP subscription (Termly, iubenda, CookieYes): $10–$50/month.
DSR management: handled by email for most small businesses; dedicated tools start at $200–$500/month and are typically unnecessary at the SMB scale.
Total first-year cost for a small business building a multi-state compliant programme from scratch: $3,000–$8,000, dominated by legal fees. Annual maintenance: $1,000–$3,000.
What to Avoid
Assuming your state’s lack of a privacy law means you have no obligations. Privacy laws in other states apply based on where your customers are, not where your business is. A business headquartered in a state with no privacy law — no comprehensive state law currently exists in Georgia, South Carolina, or most of the South — is still subject to California, Virginia, Colorado, and other states’ laws if it serves customers in those states.
Treating the “no threshold” laws as automatically inapplicable. Texas and Nebraska have no consumer-count threshold, which initially sounds like they apply to every business. They don’t — both exempt SBA-defined small businesses. But the SBA definition is industry-specific and based on average receipts over five years. Don’t assume you qualify without verifying your NAICS code and the relevant SBA size standard.
Ignoring the targeted laws in favour of the comprehensive ones. Illinois BIPA and Washington MHMDA apply regardless of size or consumer count. If you use biometric timekeeping, face recognition access systems, or if your business handles consumer health data, these laws may apply to you even if none of the twenty comprehensive state laws do. BIPA in particular is aggressively litigated — the first class action can arrive before you’ve had any regulatory contact.
Final Verdict
Twenty active state privacy laws sounds overwhelming. The reality is more manageable: if your small business has under 100,000 website visitors per year, under $25 million in annual revenue, and doesn’t sell personal data, you’re likely outside the scope of most state laws — except possibly California if you have material California web traffic, and possibly Connecticut, Delaware, New Hampshire, Maryland, and Rhode Island if you cross their lower thresholds.
If you do cross any state’s threshold, building to the California + Maryland + GPC standard simultaneously satisfies every other active law. One privacy policy, one consumer rights process, one CMP, and vendor DPAs for your main processors covers the substantive requirements across all twenty states.
The three things to do first: check your web traffic by state against the threshold tables above; sign the standard data processing addenda your main vendors already have available; and ensure your privacy policy is current and accurately describes your actual data practices. Those three steps address the most common compliance gaps without requiring a full legal programme rebuild.
Frequently Asked Questions
Which US states have comprehensive privacy laws in effect right now?
As of October 2026, twenty states have active comprehensive consumer privacy laws: California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Florida, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, and Rhode Island. Four more — Louisiana, Oklahoma, Alabama, and Vermont — were enacted in 2026 and take effect in 2027 and 2028. There is no federal comprehensive privacy law currently in effect.
Does my small business need to comply with all twenty state privacy laws?
Not necessarily. Each law has applicability thresholds — typically based on how many consumers’ data you process per year, your annual revenue, or the percentage of revenue from selling personal data. Most small businesses with under 100,000 annual data subjects and under $25 million in revenue will be outside the scope of most laws. Texas and Nebraska explicitly exempt SBA-defined small businesses. That said, if you have significant web traffic across multiple states, check your actual consumer counts — analytics data counts every visitor, not just customers.
What is the difference between “selling” personal data and normal business data use?
“Selling” personal data under most state privacy laws means exchanging personal data for monetary or other valuable consideration. This is broader than it sounds. Many advertising arrangements — particularly those involving third-party ad networks that receive consumer data in exchange for serving targeted ads — may qualify as “selling” under some state definitions. The California CCPA/CPRA definition of “sharing” extends to cross-context behavioural advertising even without a direct monetary exchange. If your website uses Google Ads, Meta Pixel, or other targeted advertising tools, review whether data sharing under those arrangements constitutes “selling” under the laws applicable to your business.
What happens if I violate a state privacy law?
Enforcement varies by state. Most state privacy laws are enforced by the state Attorney General, who typically must provide a cure period (ranging from 30 days in several states to 90 days in Iowa) before commencing formal enforcement action — though many states have removed cure periods entirely. Penalties range from $2,500 to $7,500 per violation, with some states calculating per-consumer (which can accumulate rapidly in a data breach scenario). California has an independent enforcement agency (the CPPA) with full rulemaking and enforcement authority. Private rights of action (the ability for individual consumers to sue) are limited in most states — California has the broadest private right of action, triggered by data breaches where reasonable security was lacking.
Is there a federal US privacy law I should know about?
As of October 2026, there is no comprehensive federal consumer privacy law in effect. The American Privacy Rights Act (APRA) passed committee in 2024 but did not advance to a floor vote. Federal sectoral laws — HIPAA for health data, GLBA for financial data, COPPA for children under 13, FERPA for education records — continue to apply in their specific domains. The FTC continues to enforce data privacy and security requirements through its Section 5 authority against unfair and deceptive practices, which applies to all businesses regardless of size. A comprehensive federal law that would preempt state laws remains an ongoing legislative priority but has not passed as of this writing.
This article provides general educational information. Privacy law applicability depends on your specific business model, data practices, and consumer volumes — and changes frequently as new laws take effect and existing laws are amended. Consult a qualified privacy attorney to assess your specific obligations. For US government guidance on privacy for small businesses, see CISA’s Small Business Cybersecurity Resources.
Related reading on SmallBiz Defense: