The US state privacy patchwork, explained for global founders.

The United States still has no general federal privacy law. Instead, around twenty states have passed their own comprehensive privacy laws, and more are on the way. Oklahoma’s law takes effect on 1 January 2027 and Alabama’s on 1 May 2027, with Vermont following later.

For a founder used to the GDPR in Europe, the UK GDPR or newer laws in Asia and the Middle East, the US model can feel unfamiliar. You generally do not need a legal basis to process data. Instead, you must be transparent, honour consumer rights and opt-outs, and get consent for sensitive data in most states.

The laws look alike on the surface, but the differences in thresholds, sensitive data and children’s rules decide what you actually have to build. This guide explains the common core, the outliers and a practical way to comply once rather than twenty times.

How the patchwork formed

California moved first with the California Consumer Privacy Act (CCPA) in 2018, later strengthened by the California Privacy Rights Act (CPRA). Virginia passed a different, simpler model in 2021, and most later states copied Virginia rather than California.

Virginia, Colorado, Connecticut and Utah took effect in 2023, followed by Texas, Oregon and Montana in 2024. Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota and Maryland followed in 2025, and Indiana, Kentucky and Rhode Island from January 2026.

Several states have also amended their laws after the first round. Connecticut, for example, widened its law from 1 July 2026. So a compliance review done in 2024 may already be out of date.

Does a state law apply to you?

These laws apply to businesses that handle data about a state’s residents, wherever the business is based. A company in London, Bengaluru or Singapore selling to US consumers can be covered. Physical presence is not required.

Most states use volume thresholds, typically personal data of 100,000 residents a year, or a lower number where the business earns a significant share of revenue from selling data. California instead uses an annual revenue test of $26,625,000 (as adjusted for 2025) alongside data-volume tests.

Texas has no revenue or volume threshold; it exempts small businesses as defined by the US Small Business Administration instead
Connecticut lowered its threshold to 35,000 consumers and now applies to anyone processing sensitive data, regardless of volume
California is the only state whose law fully covers employee and business-contact data

The common core

Despite the differences, almost every state requires the same building blocks. If you build these well, most of the work is done.

Two terms need explaining. “Sale” is defined broadly and can include sharing data with advertising partners for value, not just payment for data. “Sensitive data” usually covers health, precise location, biometrics, racial or ethnic origin, sexual orientation, immigration status and children’s data.

A clear privacy notice describing data collected, purposes and recipients
Rights to access, delete, correct and port personal data, with an appeal process
Opt-outs from targeted advertising, sale of data and profiling that produces significant effects
Opt-in consent for sensitive data in most states (California instead gives a right to limit its use)
Data protection assessments for higher-risk processing such as targeted advertising or profiling
Written contracts with processors (called service providers in California)

Universal opt-out signals are now an enforcement priority

A universal opt-out signal, such as Global Privacy Control (GPC), lets a consumer set one browser setting that tells every website “do not sell or share my data”. California requires businesses to treat it as a valid opt-out, and a growing number of states do the same.

Regulators test this. California’s privacy regulator fined Honda $632,500 in March 2025 and Tractor Supply $1.35 million in September 2025; both cases included failures in opt-out handling, and Tractor Supply’s specifically involved GPC signals.

The pressure is increasing. Under California’s Opt Me Out Act, browsers must offer a built-in opt-out signal from 1 January 2027. Expect far more visitors to arrive with the signal switched on, which directly affects ad tech and analytics set-ups.

California: the most demanding state

California is the only state with a dedicated privacy regulator, the California Privacy Protection Agency, which writes detailed regulations and enforces them alongside the Attorney General. Its updated regulations took effect on 1 January 2026.

Those regulations require risk assessments for new in-scope processing from that date, with assessments for processing that began earlier due by 31 December 2027. Attestations and the first cybersecurity audit certifications follow from April 2028, phased by company size.

From 1 January 2027, rules on automated decision-making technology (ADMT) apply. If you use software to make significant decisions about people, for example in hiring, lending, housing, education or healthcare, you will need pre-use notices, an opt-out or appeal route and access rights.

California also regulates data brokers. Under the Delete Act, brokers must process deletion requests from the state’s central platform (known as DROP) from 1 August 2026, checking it at least every 45 days.

Other outliers to know

Maryland, in force since October 2025, is the strictest of the Virginia-style laws. It limits collection of sensitive data to what is strictly necessary for the product the consumer asked for, bans the sale of sensitive data and bans targeted advertising to under-18s.

Several states give teenagers extra protection, for example by requiring consent for targeted advertising to minors. Many laws also offered businesses a “cure period” to fix violations before penalties, but these have been expiring or, as in Connecticut, removed.

Automated decisions are another point of divergence. Most Virginia-style laws let consumers opt out of profiling used for decisions with legal or similarly significant effects. Colorado has gone further with a separate AI law due to take effect in January 2027, although a federal court has stayed its enforcement.

Penalties and enforcement

Penalties are calculated per violation, which can mean per consumer or per transaction. In California the maximum is $2,663 per violation, or $7,988 for intentional violations and those involving minors under 16, as adjusted for 2025. Other states’ Attorneys General can seek civil penalties of several thousand dollars per violation.

Consumers generally cannot sue under these laws. The main exception is California’s right of action for data breaches caused by poor security, with statutory damages of $107 to $799 per consumer per incident.

The bigger litigation risk often comes from sector laws. Washington’s My Health My Data Act and Illinois’ Biometric Information Privacy Act (BIPA) both let individuals sue, and BIPA has produced large class actions.

A practical way to comply once

Do not build twenty programmes. Build one, set to the strictest common standard, and add state-specific settings only where needed. California plus the strictest rules elsewhere, such as Maryland on sensitive data and Connecticut on thresholds, makes a sensible baseline.

If you already comply with the GDPR or UK GDPR, you have a head start on notices, rights and assessments. The gaps are usually US-specific: the broad meaning of “sale”, opt-out signals, the California notice formats and sector laws on health, biometrics and children, including the federal COPPA rule for under-13s.

Checklist

Map which states’ residents you collect data from and check each state’s threshold.
Inventory sensitive data, including precise location, health inferences and biometrics.
Configure your website and apps to detect and honour Global Privacy Control.
Review advertising and analytics partners for activity that counts as a “sale” or “sharing”.
Build one rights-request workflow with identity checks, deadlines and an appeal route.
Add a data protection assessment step to product launches that involve profiling or sensitive data.
List automated significant decisions ahead of California’s ADMT rules in January 2027.
Update processor contracts with the terms the state laws require.
Check whether Washington’s health data law, BIPA or COPPA applies to your product.

FAQs

We are not based in the US. Do these laws apply to us?

They can. The laws apply based on whose data you process and in what volume, not where you are incorporated. Many non-US companies with US customers are covered.

If we comply with the GDPR, are we compliant in the US?

Not fully. The GDPR covers much of the ground, but US laws add specific opt-outs for sale and targeted advertising, opt-out signals, prescribed notice content and state-specific rules on sensitive data and minors.

Is there going to be a federal privacy law?

Federal bills have been proposed for years without passing. Plan on the state model continuing, with new states and amendments each year.

What is Global Privacy Control, and how do we honour it?

It is a signal sent by a browser or extension with each web request. Your site should read it and treat that visitor as opted out of sale and sharing, including through advertising tags and pixels, without asking them to take any further step.

Do these laws cover B2B companies?

Mostly not for business-contact data, except in California. But if your B2B product processes consumer data for your customers, you will be their processor and need the right contracts and controls.

Primary sources

California Privacy Protection Agency IAPP · US State Privacy Legislation Tracker

General information, not legal advice.