{
  "schemaVersion": "1.0",
  "version": "2026-10-24.1",
  "title": "US state consumer privacy law reference",
  "scope": "General consumer privacy laws and expressly identified limited-scope counterparts. This is a verification ledger, not a complete 50-state legal opinion. Only fully verified rows enter exports.",
  "exclusions": [
    "Sector-specific privacy laws, comprehensive exemption analysis, child-specific obligations, and a determination that any particular organization is covered.",
    "States or amendments without a fully verified row. Their omission does not mean no law applies."
  ],
  "verifiedOn": "2026-10-24",
  "nextVerificationOn": "2027-01-24",
  "rows": [
    {
      "id": "PRIV-CA",
      "jurisdiction": "California",
      "code": "CA",
      "citation": "Civil Code 1798.140(d), 1798.121, 1798.135, 1798.155; 11 CCR 7025",
      "fields": {
        "threshold": "Ordinary for-profit business route. Revenue over $26,625,000; or 100,000 consumers or households bought, sold, or shared annually; or at least 50% of revenue from selling or sharing. Other coverage routes and exemptions need separate review.",
        "effective": "2020-01-01; major CPRA amendments operative 2023-01-01.",
        "gpc": "Covered businesses must honor qualifying opt-out preference signals, including GPC.",
        "sensitive": "Right to limit specified uses and disclosures. This differs from a general adult opt-in requirement.",
        "cure": "No general mandatory cure period for public enforcement.",
        "enforcer": "California Privacy Protection Agency and Attorney General."
      },
      "sources": [
        {
          "url": "https://cppa.ca.gov/pdf/20260101_ccpa_statute.pdf",
          "title": "Civil Code 1798.140(d), 1798.121, 1798.135, 1798.155; 11 CCR 7025",
          "retrievedOn": "2026-10-24"
        },
        {
          "url": "https://cppa.ca.gov/regulations/pdf/ccpa_statute_eff_20260101.pdf",
          "title": "Civil Code 1798.140(d), 1798.121, 1798.135, 1798.155; 11 CCR 7025",
          "retrievedOn": "2026-10-24"
        },
        {
          "url": "https://cppa.ca.gov/regulations/cpi_adjustment.html",
          "title": "Civil Code 1798.140(d), 1798.121, 1798.135, 1798.155; 11 CCR 7025",
          "retrievedOn": "2026-10-24"
        }
      ],
      "status": "Verified",
      "verifiedOn": "2026-10-24",
      "nextVerificationOn": "2027-01-24"
    },
    {
      "id": "PRIV-CO",
      "jurisdiction": "Colorado",
      "code": "CO",
      "citation": "C.R.S. 6-1-1304, 6-1-1306, 6-1-1308, 6-1-1311",
      "fields": {
        "threshold": "100,000 Colorado consumers annually; or 25,000 consumers and revenue or a discount from selling personal data.",
        "effective": "2023-07-01",
        "gpc": "Universal opt-out mechanism required from 2024-07-01. GPC is recognized.",
        "sensitive": "Consent before processing sensitive data.",
        "cure": "Mandatory 60-day cure provision expired 2025-01-01.",
        "enforcer": "Attorney General and district attorneys."
      },
      "sources": [
        {
          "url": "https://coag.gov/resources/colorado-privacy-act/",
          "title": "C.R.S. 6-1-1304, 6-1-1306, 6-1-1308, 6-1-1311",
          "retrievedOn": "2026-10-24"
        },
        {
          "url": "https://coag.gov/opt-out/",
          "title": "C.R.S. 6-1-1304, 6-1-1306, 6-1-1308, 6-1-1311",
          "retrievedOn": "2026-10-24"
        }
      ],
      "status": "Verified",
      "verifiedOn": "2026-10-24",
      "nextVerificationOn": "2027-01-24"
    },
    {
      "id": "PRIV-VA",
      "jurisdiction": "Virginia",
      "code": "VA",
      "citation": "Va. Code 59.1-576, 59.1-578, 59.1-584",
      "fields": {
        "threshold": "100,000 consumers annually; or 25,000 consumers and over 50% of gross revenue from selling personal data.",
        "effective": "2023-01-01",
        "gpc": "No general browser preference signal mandate in the cited chapter.",
        "sensitive": "Consent before processing sensitive data; COPPA for known children.",
        "cure": "30 days after written notice, subject to the statutory cure conditions.",
        "enforcer": "Attorney General."
      },
      "sources": [
        {
          "url": "https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/",
          "title": "Va. Code 59.1-576, 59.1-578, 59.1-584",
          "retrievedOn": "2026-10-24"
        }
      ],
      "status": "Verified",
      "verifiedOn": "2026-10-24",
      "nextVerificationOn": "2027-01-24"
    },
    {
      "id": "PRIV-MN",
      "jurisdiction": "Minnesota",
      "code": "MN",
      "citation": "Minn. Stat. 325M.10 to 325M.21",
      "fields": {
        "threshold": "100,000 Minnesota consumers; or 25,000 consumers and over 25% of revenue from data sales. Separate education-technology provisions also apply.",
        "effective": "2025-07-31",
        "gpc": "Universal opt-out mechanisms required for the covered opt-out purposes, according to the cited AG overview.",
        "sensitive": "Consent before collecting or selling sensitive data, according to the cited AG overview.",
        "cure": "Mandatory warning period ended 2026-01-31.",
        "enforcer": "Attorney General."
      },
      "sources": [
        {
          "url": "https://www.revisor.mn.gov/statutes/cite/325M/full",
          "title": "Minn. Stat. 325M.10 to 325M.21",
          "retrievedOn": "2026-10-24"
        },
        {
          "url": "https://www.ag.state.mn.us/Office/Communications/2025/07/28_MCDPA.asp",
          "title": "Minn. Stat. 325M.10 to 325M.21",
          "retrievedOn": "2026-10-24"
        },
        {
          "url": "https://www.ag.state.mn.us/Office/Communications/2026/02/05_MCDPA.asp",
          "title": "Minn. Stat. 325M.10 to 325M.21",
          "retrievedOn": "2026-10-24"
        }
      ],
      "status": "Verified",
      "verifiedOn": "2026-10-24",
      "nextVerificationOn": "2027-01-24"
    },
    {
      "id": "PRIV-DE",
      "jurisdiction": "Delaware",
      "code": "DE",
      "citation": "6 Del. C. Chapter 12D",
      "fields": {
        "threshold": "Through 2026, 35,000 consumers excluding payment-only processing; or 10,000 consumers and over 20% gross revenue from data sales. Amendments change coverage from 2027.",
        "effective": "2025-01-01",
        "gpc": "Qualifying opt-out preference signals required for targeted advertising and data sales by January 1, 2026, under 12D-106(e).",
        "sensitive": "Consent before sensitive-data processing. Known-child processing has parental-consent and child-data conditions.",
        "cure": "From January 1, 2026, a cure opportunity is discretionary. The mandatory 60-day notice provision applied during 2025.",
        "enforcer": "Department of Justice."
      },
      "sources": [
        {
          "url": "https://delcode.delaware.gov/title6/c012d/index.html",
          "title": "6 Del. C. Chapter 12D",
          "retrievedOn": "2026-10-24"
        }
      ],
      "status": "Verified",
      "verifiedOn": "2026-10-24",
      "nextVerificationOn": "2027-01-24"
    },
    {
      "id": "PRIV-IA",
      "jurisdiction": "Iowa",
      "code": "IA",
      "citation": "Iowa Code Chapter 715D",
      "fields": {
        "threshold": "100,000 consumers; or 25,000 consumers and over 50% gross revenue from data sales.",
        "effective": "2025-01-01",
        "gpc": "No general browser opt-out preference signal mandate appears in the cited Chapter 715D.",
        "sensitive": "Clear notice and an opportunity to opt out for nonexempt sensitive-data processing. Known-child processing must follow COPPA.",
        "cure": "90 days under 715D.8, with the statutory written correction conditions.",
        "enforcer": "Attorney General."
      },
      "sources": [
        {
          "url": "https://www.legis.iowa.gov/docs/code/2026/715D.pdf",
          "title": "Iowa Code Chapter 715D",
          "retrievedOn": "2026-10-24"
        }
      ],
      "status": "Verified",
      "verifiedOn": "2026-10-24",
      "nextVerificationOn": "2027-01-24"
    },
    {
      "id": "PRIV-LA",
      "jurisdiction": "Louisiana",
      "code": "LA",
      "citation": "Louisiana Act 502 of 2026; R.S. 51:1780.1 to 1780.5",
      "fields": {
        "threshold": "Revenue over $25 million; or 75,000 consumers, households, or devices; or at least 50% annual revenue from data sales.",
        "effective": "2027-01-01.",
        "gpc": "Authorized agents may use a browser or device setting to communicate targeted-advertising or sale opt-outs. Verification conditions and statutory exceptions apply.",
        "sensitive": "Consent before sensitive-data processing, with COPPA treatment for known children.",
        "cure": "January 1 through July 31, 2027, a 30-day notice and correction process applies, with written statement and supporting-documentation conditions.",
        "enforcer": "Attorney General."
      },
      "sources": [
        {
          "url": "https://www.legis.la.gov/Legis/ViewDocument.aspx?d=1480202",
          "title": "Louisiana Act 502 of 2026; R.S. 51:1780.1 to 1780.5",
          "retrievedOn": "2026-10-24"
        },
        {
          "url": "https://www.legis.la.gov/legis/BillInfo.aspx?b=SB386&s=26RS",
          "title": "Louisiana Act 502 of 2026; R.S. 51:1780.1 to 1780.5",
          "retrievedOn": "2026-10-24"
        }
      ],
      "status": "Verified",
      "verifiedOn": "2026-10-24",
      "nextVerificationOn": "2027-01-24"
    }
  ],
  "unverifiedRowsExcluded": [
    "PRIV-CT",
    "PRIV-TX",
    "PRIV-NE",
    "PRIV-OR",
    "PRIV-MT",
    "PRIV-NJ",
    "PRIV-NH",
    "PRIV-IN",
    "PRIV-KY",
    "PRIV-TN",
    "PRIV-UT",
    "PRIV-RI",
    "PRIV-VT",
    "PRIV-MD",
    "PRIV-FL",
    "PRIV-AL",
    "PRIV-OK"
  ],
  "notes": [
    "Read the current enacted instrument before relying on a threshold. AG summaries can lag amendments or simplify the text.",
    "The California adjusted revenue amount differs from the unadjusted $25 million printed in some summaries."
  ],
  "additionalSources": [],
  "changelog": [
    {
      "date": "2026-10-24",
      "change": "Initial source-backed snapshot. Unverified rows are visibly marked and excluded from downloads. No nationwide completeness claim is made."
    }
  ]
}