US State Privacy Laws

Who has to comply

Businesses that process personal data of state residents and meet the state's threshold, typically a count of consumers (often 100,000; lower in some states, such as 35,000 in Rhode Island and Connecticut, 25,000 in Montana since October 1, 2025, and 10,000 in Delaware from January 1, 2027) or a percentage of revenue from data sales.

Exemptions commonly cover data already regulated under HIPAA, GLBA, and FCRA, and some states exempt nonprofits or higher education; Connecticut removed its entity-level GLBA exemption on July 1, 2026. Texas has no volume threshold and applies to any non-small business that processes personal data.

What the assessor asks to see

When a regulator inquires or a customer performs due diligence: applicability analysis by state; privacy notice and notice at collection; data inventory and map; processor and service provider contracts; data protection assessments; opt-out mechanisms and GPC handling records; rights-request logs with response times and verification method; sensitive data consent records; data retention schedule; security program summary; training records; data broker registrations where applicable.

Where the requirement sits: CO, VA, CT, TX et al. comprehensive privacy acts

2026 effective dates and amendments

Indiana, Kentucky and Rhode Island took effect on January 1, 2026. Amendments to existing laws that took effect in 2026 include Oregon HB 2008 and Texas HB 149 (January 1), New Jersey A5328 (June 30), Connecticut SB 1295, Maryland HB 711, Virginia SB 338 and Utah HB 418 (July 1), and Connecticut SB 4 (October 1).

Several cure periods ended: Oregon's general cure period on January 1, 2026, Minnesota's on January 31, 2026 and New Jersey's on July 1, 2026; Montana removed its cure period in 2025. Alabama's act (Act 2026-552) was enacted in April 2026 and takes effect May 1, 2027.