Why are there state laws?
The United States has no single, comprehensive federal privacy law. Federal rules cover particular sectors, such as health data under HIPAA, financial data under the Gramm-Leach-Bliley Act and children’s data online under COPPA. To fill the gap, states have passed their own comprehensive consumer privacy laws. California went first, with the California Consumer Privacy Act (CCPA), which took effect in 2020 and was strengthened by the CPRA.
Which states have them?
The IAPP’s US state privacy legislation tracker, last updated on 8 September 2026, shows 23 states with signed comprehensive laws: Alabama, California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Louisiana, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oklahoma, Oregon, Rhode Island, Tennessee, Texas, Utah, Vermont and Virginia. Several more have bills in progress. Effective dates differ, and some of the newest laws are not yet in force, so check each law you may fall under.
Florida’s Digital Bill of Rights is narrower, applying only to very large businesses, and trackers usually list it separately.
Who do they apply to?
Most laws apply to businesses that process the personal data of a set number of the state’s residents, often 100,000 consumers a year, or a smaller number if they make much of their revenue from selling data. California instead uses an annual revenue threshold as one of its tests. A few states apply to almost any business that handles residents’ data. Many exempt data already covered by HIPAA or the Gramm-Leach-Bliley Act, and some exempt nonprofits.
What rights do consumers get?
The laws share a common core. Consumers can usually:
- access the personal data held about them, and get a portable copy;
- have it corrected and deleted;
- opt out of the sale of their data, of targeted advertising, and of profiling used for significant decisions.
Businesses must respond within set deadlines, often 45 days, and provide a way to appeal a refusal.
What do businesses have to do?
- Privacy notices explaining what is collected, why and with whom it is shared.
- Sensitive data, such as health, precise location, biometric data and children’s data: most states require opt-in consent; California instead gives a right to limit its use.
- Universal opt-out signals: several states require businesses to honour browser signals such as Global Privacy Control as an opt-out request.
- Data protection assessments for higher-risk processing, such as targeted advertising, selling data or processing sensitive data.
- Contracts with processors setting out their duties, similar to GDPR’s processor terms.
- Reasonable security for the data.
How are they enforced?
Mainly by each state’s attorney general, and in California also by the California Privacy Protection Agency. Some laws give businesses a short period to fix a violation before penalties, though several of those cure periods are expiring. Private lawsuits are rare: California allows them only for certain data breaches.
How should you approach compliance?
Build one programme around the common core, often modelled on the strictest requirements, then add each state’s differences. If you already comply with GDPR, much of the work carries over, but not all: US laws focus on opt-out rights and the sale of data rather than needing a legal basis for every use.
Open questions and items to watch
Points that were unsettled, contested or likely to change when this page was last reviewed. Check the official sources before relying on them.
- New state laws are passed most years, and existing ones are amended. Check each state's own statute and attorney general guidance for current thresholds and effective dates.
Sources and official references
- California Privacy Protection Agency — State of California (official source)
- US State Privacy Legislation Tracker — International Association of Privacy Professionals (IAPP) (secondary commentary)
Links go to the publisher's own site. Where a standard is sold or copyrighted, MajorCyber™ summarises it in original words and links to the official listing instead of reproducing its text.
Listen to this page
Read aloud by your own device, in the most natural English voice it has. Nothing is sent anywhere. Pick another voice or speed if you prefer.
This page is general educational information, not legal, audit or certification advice. Requirements depend on your organisation's circumstances and the current official text. MajorCyber™ is not affiliated with Topic guide. Each law is passed by a state legislature and enforced mainly by that state's attorney general (in California, also the California Privacy Protection Agency).
