Us State Privacy Laws

US State Privacy Laws

Overview

After California CPRA, comprehensive state privacy laws form a patchwork of consumer rights, controller/processor roles, and assessment requirements. This skill operationalizes multi-state compliance for organizations processing US residents' personal data—including agent prompts, MCP logs, and LLM vendor chains.

Harmonized rights (most states): access, delete, correct, portability, opt-out of targeted advertising, sale, and profiling for significant decisions; sensitive data consent; DPIA/assessment for high-risk processing (varies by state).

Reference: references/us-state-privacy-matrix.md

When to Use

Use this skill when:

• Operating nationally and need state-by-state gap analysis beyond California
• Building unified US privacy program (single notice, multi-state DSAR, GPC/opt-out)
• Agent/LLM systems process state residents' PI in prompts, embeddings, or analytics
• Data protection assessments required (Colorado, Virginia, Connecticut, etc.)
• Universal opt-out (Global Privacy Control, state-specific links) implementation review
• Vendor contracts for LLM/MCP need processor terms aligned to VCDPA/CPA
• Texas TDPSA small business exemption or SBO analysis

Do not use this skill when:

• California-only scope (use ccpa-cpra-privacy-rights—deeper CPRA detail)
• HIPAA-covered entity PHI workflows (HIPAA may preempt for PHI)
• EU data subjects (use gdpr-us-multinational)
• Breach notification only (use hitech-breach-notification or breach-incident-response)

Core Process

Execute steps in order.

Step 1: Applicability matrix

1. For each state in references/us-state-privacy-matrix.md, evaluate:
   • Consumer count thresholds
   • Revenue/sale thresholds
   • Exemptions: GLBA-covered, HIPAA-covered, FERPA, B2B employee data (varies)
2. Mark entity as controller, processor, or third party per state definitions.
3. Artifact: templates/state-privacy-assessment.yaml — applicability grid.

Step 2: Data inventory for agent systems

1. Map PI categories in agent pipeline:
   • Prompts, session logs, MCP Postgres, Slack notifications, GitHub evidence
2. Flag sensitive data per state (biometric, geolocation, health, minors):
   • Health data in agent prompts may trigger consent even outside HIPAA
3. Identify sale, share, and targeted advertising (analytics SDKs, ad IDs in agent telemetry).

Step 3: Consumer rights harmonization

Build lowest-common-denominator + state overlays program:

1. Do not route DSARs through unredacted LLM—use Postgres MCP read-only queries.
2. Log in templates/dsar-request-log.yaml with state of residency field.

Step 4: Privacy notices and transparency

1. Privacy policy must list states covered and rights per state (or unified section with state addenda).
2. Notice at collection for agent chat widgets—categories, purposes, retention, automated decision-making.
3. Processor/subprocessor list includes LLM and MCP vendors.

Step 5: Data protection assessments (DPA)

States requiring DPIA/assessment for high-risk processing (e.g., CO CPA, VCDPA profiling, sensitive data):

1. Assess agent use cases: automated eligibility, health inferences, large-scale profiling.
2. Document: processing description, necessity, risks, mitigations (redaction gate, retention limits).
3. Cross-link gdpr-us-multinational if EU subjects also processed.

Step 6: Processor contracts

1. LLM/MCP vendors as processors—contract must include:
   • Processing instructions, confidentiality, deletion/return, subprocessors, audit rights
2. Align to Colorado/Virginia mandatory terms where applicable.
3. Use vendor-third-party-risk for SOC report + state addendum review.

Step 7: Universal opt-out and signals

1. Honor Global Privacy Control (GPC) where required (CO, CT, CA, MT, etc.).
2. Texas universal opt-out mechanism for sale/targeted advertising/sharing.
3. Agent telemetry: disable ad identifiers when opt-out flag set in session context.

Step 8: Children's and sensitive data

1. Knowingly process 13–16 (varies) minors—parental consent states differ.
2. Sensitive PI in agent prompts requires opt-in in most comprehensive states.
3. Apply hipaa-phi-redaction-pipeline before LLM—state health PI ≠ HIPAA exempt path.

Step 9: Enforcement readiness

1. Document AG notification contacts per state (breach may overlap breach-incident-response).
2. Maintain 30-day cure awareness (repealed in some states—verify current law).
3. Evidence package for regulatory inquiry: data map, DPAs, DSAR logs, opt-out stats.

Common Rationalizations

Red Flags

• No state applicability analysis documented
• DSAR responses include other consumers' PI from shared agent logs
• Targeted advertising in agent SDK without opt-out
• Sensitive health PI in prompts without consent
• Texas operations without TDPSA SBO/threshold review
• No DPA for agent profiling use case in Colorado

Verification

• State applicability matrix completed with thresholds and exemptions
• Agent/LLM data map includes PI categories and sensitive flags
• Harmonized consumer rights program with state overlays documented
• Privacy notices updated for multi-state rights and subprocessors
• Data protection assessments completed for high-risk agent processing
• Processor contracts reviewed for VCDPA/CPA mandatory terms
• GPC/universal opt-out implemented and tested
• DSAR log includes state residency and response deadlines
• Evidence retained for regulatory inquiry readiness