US state privacy laws
Also known as: state privacy laws, US privacy patchwork, state consumer privacy laws, comprehensive state privacy laws
The United States has no comprehensive federal consumer privacy law, so states have filled the gap.
By early 2026, roughly 20 states had passed their own laws, most following a similar template of access, deletion, and opt-out rights. While the laws look alike, the small differences in thresholds, definitions, and enforcement are what make US privacy compliance so tedious.
US state privacy laws, explained at three levels
At home
Think of US privacy law as a map where each state paints its own rules. In some states, you can ask companies what data they hold about you, have it deleted, and stop them from selling it or using it for targeted ads. In others, you have few of those rights. Your protection depends on where you live, so moving across a state line can change it.
At work
US state privacy laws are comprehensive consumer privacy statutes passed by individual states because Congress has not passed a national one. Most follow a common template: privacy notices, access and deletion rights, opt-outs for data sales and targeted advertising, and extra care for sensitive data. Businesses care because one website can fall under many of these laws at once, each enforced by a different state attorney general.
At home
Most state laws follow the Virginia model. They give you rights to access, correct, delete, and port your data, plus opt-outs from data sales, targeted advertising, and profiling that leads to significant decisions about you. Sensitive data, such as health, precise location, or children's data, usually needs your opt-in consent. A growing number of states, including California, Colorado, Connecticut, Texas, and Oregon, also require sites to honour universal opt-out signals like Global Privacy Control.
At work
Applicability usually hinges on volume rather than company size: many laws cover businesses that process data of 100,000 or more state residents, or 25,000 if a meaningful share of revenue comes from selling data, though Texas and Nebraska cover any business that isn't a small business under US federal standards. Obligations include notices, answering rights requests within about 45 days, data protection assessments for risky processing, and processor contracts. Attorneys general enforce most laws, often after a cure period, which several states have let expire.
At home
Underneath the comprehensive laws, narrower laws are tightening faster. Washington's My Health My Data Act covers any data that could reveal a health condition, like app records of pregnancy, medication, or clinic visits. It requires consent before collection, a signed authorization before any sale, and lets people sue directly. Washington and Nevada also restrict geofencing around health facilities. While the general laws mostly rely on opt-outs, in my view these narrower laws are where US privacy is actually getting stricter.
At work
Compliance teams usually design to the strictest common denominator: opt-in for sensitive data, universal opt-out support, assessments for high-risk processing, and data minimization. Outliers then get specific handling, such as Maryland's rule limiting collection of sensitive data to what is strictly necessary and banning its sale. Sector laws like HIPAA, GLBA, and COPPA interact through exemptions that vary by state, some covering whole entities and some only the regulated data. A data inventory tagged by state of residence keeps the patchwork manageable.
Real-world examples
At home
Marcus moved from Florida to Colorado and noticed new privacy links on websites he used. In Colorado, he had the right to opt out of targeted advertising and data sales, and sites had to honour his browser's Global Privacy Control signal.
At work
Aisha leads compliance at a Canadian subscription service with customers in every US state. Rather than writing a policy for each state, her team built one program based on the strictest common rules, then added specific sections for states with unique requirements.
Common confusions
- The US has a national privacy law like GDPR. — There is no comprehensive federal consumer privacy law. Sector laws exist, and states have filled the gap.
- All state privacy laws are basically the same. — They share a template but differ on thresholds, definitions, consent rules, and enforcement, which matters in practice.
- Small businesses are always exempt. — Many laws use data volume thresholds rather than company size, so a small business handling lots of data can be covered.
For analysts
Design once to the strictest common rules, then patch the outliers. I'd keep a simple state-by-state table of thresholds, sensitive data rules, and opt-out requirements, and review it every legislative season, because new laws keep arriving.
History & origin
California went first with the CCPA in 2018. Virginia passed the second comprehensive law in March 2021, effective January 1, 2023, and its model, with opt-in consent for sensitive data and data protection assessments, became the template for many other states. Colorado, Connecticut, and Utah followed, and by 2024 and 2025 a wave of states, including Texas, Oregon, Montana, Delaware, New Jersey, Minnesota, and Maryland, had laws taking effect. Washington's My Health My Data Act, effective in 2024, targeted consumer health data specifically. Federal efforts, including the American Privacy Rights Act proposal in 2024, stalled. In my opinion, the patchwork is now the system. Businesses that wait for Congress to simplify things will be waiting a long time.