State Law Tracker

US State Privacy Law Tracker

Overview

The United States does not have a single comprehensive federal privacy law. Instead, a patchwork of state-level comprehensive privacy statutes has emerged since the California Consumer Privacy Act (CCPA) was enacted in 2018. As of early 2026, twenty states have enacted comprehensive consumer privacy laws, with additional states introducing legislation in each legislative session. This skill tracks the status of enacted laws, key provisions, effective dates, and substantive differences that drive multi-state compliance obligations.

Enacted Comprehensive State Privacy Laws

Key Compliance Variables Across States

Applicability Thresholds

States differ in what triggers applicability:

• Revenue threshold: California (USD 25 million gross revenue) is the only state with a revenue trigger
• Consumer volume: Most states use 100,000 consumers; Texas uses 50,000 (if revenue derived from data sales); Montana uses 50,000 (total population consideration)
• Revenue from data sales: Most states apply if 25% or more of revenue comes from selling personal data (for businesses processing 25,000+ consumers)

Consumer Rights Comparison

*California CPRA provides limited automated decision-making rights via regulations **California PRA limited to data breaches involving specified personal information

Cure Period Variations

• 30-day cure: Virginia, Utah, Iowa, Indiana, Tennessee, Kentucky
• 60-day cure: Colorado (expires 1 Jan 2025), Connecticut (expires 31 Dec 2024)
• No cure period: California (CPPA discretion), Texas, Oregon, New Jersey, Maryland
• AG discretion: Several states allow AG to determine cure appropriateness

Universal Opt-Out Mechanism

States increasingly recognise universal opt-out signals:

• Required: California (CPRA regulations), Colorado, Connecticut, Texas, Montana, Oregon, Delaware, New Hampshire, New Jersey, Minnesota, Maryland, Vermont
• Not required: Virginia, Utah, Iowa, Indiana, Tennessee, Kentucky

Monitoring Methodology

This tracker is updated by reviewing:

1. National Conference of State Legislatures (NCSL) privacy legislation database
2. International Association of Privacy Professionals (IAPP) state law comparison tool
3. Individual state legislature bill tracking systems
4. Attorney General enforcement announcements

Integration Points

• state-law-applicability: Uses tracker data to determine which state laws apply to a specific organisation
• multi-state-compliance: Operationalises tracker data into a unified compliance programme
• universal-opt-out: Implements technical mechanisms required by states mandating GPC/universal opt-out
• ccpa-consumer-requests: California-specific consumer request handling
• vcdpa-compliance: Virginia-specific compliance operations
• texas-tdpsa-compliance: Texas-specific compliance operations