Which state consumer privacy laws reach your business
The state consumer privacy laws in our data, with the revenue and consumer-count thresholds that bring a business in scope.
Most state consumer privacy laws apply only above a revenue or consumer-count threshold, and the count usually drops for a business that sells personal data. The table lists the privacy rows in our data with the thresholds from each row. A state that is not listed has no consumer privacy law in our data yet. Data security and breach notice laws usually apply with no threshold; the check covers those too.
| State | Law | Applies at |
|---|---|---|
| Alabama | Alabama Personal Data Protection Act (HB 351, 2026) | 25,000 consumers a year or 25% of revenue from selling data |
| California | California Consumer Privacy Act, as amended by the California Privacy Rights Act | revenue over $26.6 million or 100,000 consumers a year or 50% of revenue from selling data |
| California | Delete Act (data broker registration and deletion mechanism) | Read the row |
| Colorado | Colorado Privacy Act | 100,000 consumers a year or 25,000 if selling data |
| Connecticut | Connecticut Data Privacy Act | 35,000 consumers a year |
| Delaware | Delaware Personal Data Privacy Act | 35,000 consumers a year or 10,000 if selling data |
| Delaware | Delaware Online Privacy and Protection Act | Read the row |
| Florida | Florida Digital Bill of Rights | revenue over $1,000 million |
| Indiana | Indiana Consumer Data Protection Act | 100,000 consumers a year or 25,000 if selling data |
| Iowa | Iowa Consumer Data Protection Act | 100,000 consumers a year or 25,000 if selling data |
| Kentucky | Kentucky Consumer Data Protection Act | 100,000 consumers a year or 25,000 if selling data |
| Louisiana | Louisiana Data Privacy Act (Act 502 of 2026, SB 386) | revenue over $25 million or 75,000 consumers a year or 50% of revenue from selling data |
| Maryland | Maryland Online Data Privacy Act (MODPA) | 35,000 consumers a year or 10,000 if selling data |
| Michigan | Michigan Social Security Number Privacy Act | Read the row |
| Minnesota | Minnesota Consumer Data Privacy Act | 100,000 consumers a year or 25,000 if selling data; SBA small businesses exempt |
| Montana | Montana Consumer Data Privacy Act | 25,000 consumers a year or 15,000 if selling data |
| Nebraska | Nebraska Data Privacy Act | Read the row; SBA small businesses exempt |
| Nevada | Online privacy notice and right to opt out of the sale of covered information (SB 220) | Read the row |
| New Hampshire | New Hampshire Data Privacy Act (SB 255 of 2024) | 35,000 consumers a year or 10,000 if selling data |
| New Jersey | New Jersey Data Privacy Act (P.L. 2023, c. 266) | 100,000 consumers a year or 25,000 if selling data |
| New York | New York Child Data Protection Act | Read the row |
| Oklahoma | Oklahoma Consumer Data Privacy Act (SB 546, 2026) | 100,000 consumers a year or 25,000 if selling data |
| Oregon | Oregon Consumer Privacy Act | 100,000 consumers a year or 25,000 if selling data |
| Rhode Island | Rhode Island Data Transparency and Privacy Protection Act | 35,000 consumers a year or 10,000 if selling data |
| Tennessee | Tennessee Information Protection Act (TIPA) | revenue over $25 million and 175,000 consumers a year and 25,000 if selling data |
| Texas | Texas Data Privacy and Security Act | Read the row; SBA small businesses exempt |
| Utah | Utah Consumer Privacy Act (UCPA) | revenue over $25 million and 100,000 consumers a year and 25,000 if selling data |
| Vermont | Vermont Data Privacy and Online Surveillance Act | 35,000 consumers a year or 3,000 if selling data |
| Virginia | Virginia Consumer Data Protection Act (VCDPA) | 100,000 consumers a year or 25,000 if selling data |
| Washington | My Health My Data Act, consumer health data privacy policy | no threshold |
Each state page has the full row, the official source and its stage label.
Get your own answer by email
Need a hand implementing it?
Find a Consultant Who Does This Work
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
From the publisher
Keep Your Written Policies in One Place
Whatever you are working toward, AllyMatter gets your policies approved, keeps every version and records who has read each one.