Since California's CCPA took effect in 2020, twenty states have put comprehensive consumer privacy laws into effect. For a small business the first question is simple: does any of them apply to me? For most local businesses the answer is no — the laws use thresholds based on how many state residents' data you process. But the thresholds vary a lot, a few states have no numeric threshold at all, and other privacy rules apply regardless of size.
How applicability works
Most of these laws apply to a business that does business in the state or targets its residents and meets a threshold such as:
- processing the personal data of a set number of state residents in a year (100,000 is the most common figure; Delaware, New Hampshire, Maryland, and Rhode Island use 35,000), or
- processing a smaller number of residents' data while earning a significant share of revenue from selling personal data.
California, Utah, and Tennessee also use revenue tests, while Texas and Nebraska exempt businesses that qualify as small businesses under U.S. Small Business Administration standards instead of counting consumers. "Personal data" is broad: IP addresses, cookie IDs, and email addresses all count, so a busy website's analytics can add up faster than you might expect.
Comprehensive state privacy laws at a glance
| State and law | Effective | Main applicability thresholds (summary) |
|---|---|---|
| California — CCPA / CPRA | Jan 1, 2020 (CPRA amendments Jan 1, 2023) | Annual gross revenue above the inflation-adjusted threshold (originally $25M); or buys, sells, or shares personal information of 100,000+ consumers or households; or 50%+ of revenue from selling or sharing personal information. |
| Virginia — VCDPA | Jan 1, 2023 | 100,000+ consumers; or 25,000+ consumers and more than 50% of gross revenue from selling personal data. |
| Colorado — CPA | Jul 1, 2023 | 100,000+ consumers; or 25,000+ consumers and revenue or discounts from selling personal data. |
| Connecticut — CTDPA | Jul 1, 2023 | Originally 100,000+ consumers, or 25,000+ consumers and more than 25% of revenue from selling data. A 2025 amendment broadens coverage from July 1, 2026 — check the current statute. |
| Utah — UCPA | Dec 31, 2023 | $25M+ annual revenue and either 100,000+ consumers, or 25,000+ consumers and more than 50% of revenue from selling personal data. |
| Texas — TDPSA | Jul 1, 2024 | No numeric threshold: applies to businesses that are not small businesses under SBA size standards. Small businesses still need consent before selling sensitive data. |
| Oregon — OCPA | Jul 1, 2024 | 100,000+ consumers; or 25,000+ consumers and 25%+ of revenue from selling personal data. |
| Montana — MCDPA | Oct 1, 2024 | Originally 50,000+ consumers, or 25,000+ consumers and more than 25% of revenue from sales; thresholds were lowered by a 2025 amendment — check the current statute. |
| Florida — FDBR | Jul 1, 2024 | Core obligations apply only to very large companies (more than $1 billion in global revenue plus additional criteria). |
| Iowa — ICDPA | Jan 1, 2025 | 100,000+ consumers; or 25,000+ consumers and more than 50% of revenue from selling personal data. |
| Delaware — DPDPA | Jan 1, 2025 | 35,000+ consumers (excluding payment-only data); or 10,000+ consumers and more than 20% of revenue from selling personal data. |
| Nebraska — NDPA | Jan 1, 2025 | No numeric threshold; SBA small-business exemption similar to Texas. |
| New Hampshire | Jan 1, 2025 | 35,000+ consumers (excluding payment-only data); or 10,000+ consumers and more than 25% of revenue from selling personal data. |
| New Jersey — NJDPA | Jan 15, 2025 | 100,000+ consumers (excluding payment-only data); or 25,000+ consumers and revenue or discounts from selling personal data. |
| Tennessee — TIPA | Jul 1, 2025 | More than $25M in revenue and either 175,000+ consumers, or 25,000+ consumers and more than 50% of revenue from selling personal information. |
| Minnesota — MCDPA | Jul 31, 2025 | 100,000+ consumers; or 25,000+ consumers and more than 25% of revenue from selling personal data. SBA small businesses are largely exempt but may not sell sensitive data without consent. |
| Maryland — MODPA | Oct 1, 2025 | 35,000+ consumers (excluding payment-only data); or 10,000+ consumers and more than 20% of revenue from selling personal data. Includes strict data-minimization rules. |
| Indiana — ICDPA | Jan 1, 2026 | 100,000+ consumers; or 25,000+ consumers and more than 50% of revenue from selling personal data. |
| Kentucky — KCDPA | Jan 1, 2026 | 100,000+ consumers; or 25,000+ consumers and more than 50% of revenue from selling personal data. |
| Rhode Island — RIDTPPA | Jan 1, 2026 | 35,000+ consumers (excluding payment-only data); or 10,000+ consumers and more than 20% of revenue from selling personal data. |
Thresholds are simplified; most laws exclude data processed solely to complete a payment from some counts, and many exempt entities such as nonprofits, financial institutions, or HIPAA-covered entities in different ways. Always read the statute or agency guidance for your situation.
What covered businesses must do on their website
The laws differ in detail, but most follow the same pattern:
- Privacy notice: categories of personal data collected, purposes, categories of third parties, how to exercise rights, and how to appeal a denied request.
- Consumer rights: access, correction, deletion, and portability, with response deadlines (commonly 45 days).
- Opt-outs: for sale of personal data, targeted advertising, and certain profiling — and in a growing number of states, honoring universal opt-out signals such as Global Privacy Control.
- Sensitive data: opt-in consent before processing health, precise geolocation, biometric, children's, and similar data (California uses a "limit the use" right instead).
- Assessments and contracts: data protection assessments for high-risk processing, and written contracts with processors such as analytics or email vendors.
Privacy rules that apply regardless of size
- California's CalOPPA requires a privacy policy on commercial websites that collect personal information from California residents.
- Washington's My Health My Data Act covers "consumer health data" with no revenue or volume threshold and can be enforced through private lawsuits; Nevada has a similar consumer-health-data law.
- Illinois' Biometric Information Privacy Act (BIPA) regulates fingerprints, face geometry, and other biometrics and allows private lawsuits.
- Data-breach notification laws exist in all 50 states.
- Federal rules such as COPPA (children under 13), CAN-SPAM, and the FTC Act apply nationwide.
A practical approach for small businesses
- Inventory what your site collects: forms, analytics, ad pixels, chat widgets, checkout data.
- Estimate how many residents of each state you reach per year using your analytics — device identifiers can count as personal data, so don't rely on customer counts alone.
- Remove tracking you don't use. Fewer pixels means less risk and a faster site.
- Publish an accurate privacy policy and keep it updated.
- If you are close to any threshold, or you sell or share data for advertising, build in an opt-out link and Global Privacy Control support now.
See the website compliance checklist for the rest of the launch basics.
Related guides
Frequently asked questions
Which states have comprehensive privacy laws in effect in 2026?
As of October 2026, comprehensive consumer privacy laws are in effect in California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Florida (for very large companies), Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, and Rhode Island.
Do state privacy laws apply to small businesses?
Usually not. Most use consumer-count thresholds (commonly 100,000 state residents a year) or revenue tests that small businesses don't meet. Texas and Nebraska instead exempt businesses that are small under SBA standards — but even small businesses there need consent before selling sensitive data.
What is Global Privacy Control?
Global Privacy Control (GPC) is a browser setting that sends a signal asking websites not to sell or share the visitor's personal data. California and a growing number of other states require covered businesses to treat it as a valid opt-out request.
Is there a federal privacy law for business websites?
There is no comprehensive federal consumer privacy law. Federal rules cover specific areas — children's data (COPPA), health data held by covered entities (HIPAA), financial data (GLBA), and email marketing (CAN-SPAM) — and the FTC can act against deceptive or unfair data practices.