US state consumer privacy law reference
Dated state privacy law thresholds, effective dates, opt-out signals, sensitive data, cure periods, and enforcement sources.
Source review October 24, 2026. 7 fully verified rows. 17 rows remain marked Not verified.
Scope and exclusions
General consumer privacy laws and expressly identified limited-scope counterparts. This is a verification ledger, not a complete 50-state legal opinion. Only fully verified rows enter exports.
- Sector-specific privacy laws, comprehensive exemption analysis, child-specific obligations, and a determination that any particular organization is covered.
- States or amendments without a fully verified row. Their omission does not mean no law applies.
This reference summarizes source text. It is not legal advice. A missing or unverified entry does not mean no law applies.
What the sources say
US state consumer privacy law reference. Snapshot October 24, 2026.
Scroll horizontally to see all columns. You can also focus the table region and use the arrow keys.
| Jurisdiction | Ordinary applicability | Effective date | Opt-out preference signal | Sensitive data | Cure period | Enforcer | Official provision and verification |
|---|---|---|---|---|---|---|---|
| CaliforniaPRIV-CA | Ordinary for-profit business route. Revenue over $26,625,000; or 100,000 consumers or households bought, sold, or shared annually; or at least 50% of revenue from selling or sharing. Other coverage routes and exemptions need separate review. | 2020-01-01; major CPRA amendments operative 2023-01-01. | Covered businesses must honor qualifying opt-out preference signals, including GPC. | Right to limit specified uses and disclosures. This differs from a general adult opt-in requirement. | No general mandatory cure period for public enforcement. | California Privacy Protection Agency and Attorney General. | Civil Code 1798.140(d), 1798.121, 1798.135, 1798.155; 11 CCR 7025Retrieved 2026-10-24. Civil Code 1798.140(d), 1798.121, 1798.135, 1798.155; 11 CCR 7025Retrieved 2026-10-24. Civil Code 1798.140(d), 1798.121, 1798.135, 1798.155; 11 CCR 7025Retrieved 2026-10-24. Verified. Verified 2026-10-24. Next review 2027-01-24. |
| ColoradoPRIV-CO | 100,000 Colorado consumers annually; or 25,000 consumers and revenue or a discount from selling personal data. | 2023-07-01 | Universal opt-out mechanism required from 2024-07-01. GPC is recognized. | Consent before processing sensitive data. | Mandatory 60-day cure provision expired 2025-01-01. | Attorney General and district attorneys. | C.R.S. 6-1-1304, 6-1-1306, 6-1-1308, 6-1-1311Retrieved 2026-10-24. C.R.S. 6-1-1304, 6-1-1306, 6-1-1308, 6-1-1311Retrieved 2026-10-24. Verified. Verified 2026-10-24. Next review 2027-01-24. |
| ConnecticutPRIV-CT | Current AG guidance lists 35,000 consumers excluding payment-only data; processing sensitive data; or offering personal data for sale. Consumer health data has additional coverage. | 2023-07-01; current thresholds require checking amended text. | Universal opt-out preference signals required from 2025-01-01. | Consent before processing sensitive data. | Not verified against the current amended enforcement provision. | Attorney General. | Conn. Gen. Stat. 42-515 to 42-526, as amendedRetrieved 2026-10-24. Not verified. Excluded from exports. Next review 2027-01-24. |
| VirginiaPRIV-VA | 100,000 consumers annually; or 25,000 consumers and over 50% of gross revenue from selling personal data. | 2023-01-01 | No general browser preference signal mandate in the cited chapter. | Consent before processing sensitive data; COPPA for known children. | 30 days after written notice, subject to the statutory cure conditions. | Attorney General. | Va. Code 59.1-576, 59.1-578, 59.1-584Retrieved 2026-10-24. Verified. Verified 2026-10-24. Next review 2027-01-24. |
| TexasPRIV-TX | Conducts business in Texas or provides consumed products or services, processes or sells personal data, and is not an SBA-defined small business. Sensitive-data sales have a small-business consent exception. | 2024-07-01 | Not verified against the current 541.055 text. | Consent required for small-business sales of sensitive data. Other controller duties need the full text. | Not verified. | Attorney General. | Texas Business and Commerce Code, Chapter 541Retrieved 2026-10-24. Not verified. Excluded from exports. Next review 2027-01-24. |
| NebraskaPRIV-NE | Business in Nebraska or consumed products or services; processing or selling personal data; not a small business under the referenced federal definition. Small businesses need consent to sell sensitive data. | 2025-01-01 | Not verified. | Small-business sensitive-data sales require consent. Other controller duties need the full text. | Not verified. | Attorney General. | Neb. Rev. Stat. 87-1101 to 87-1130Retrieved 2026-10-24. Not verified. Excluded from exports. Next review 2027-01-24. |
| OregonPRIV-OR | 100,000 consumers excluding payment-only processing; or 25,000 consumers and at least 25% of annual gross revenue from data sales. Motor vehicle manufacturers have separate coverage. | 2024-07-01; qualifying nonprofits 2025-07-01. | Not verified against current amended text. | Not verified. | Not verified. | Attorney General. | ORS 646A.570 to 646A.589Retrieved 2026-10-24. Not verified. Excluded from exports. Next review 2027-01-24. |
| MinnesotaPRIV-MN | 100,000 Minnesota consumers; or 25,000 consumers and over 25% of revenue from data sales. Separate education-technology provisions also apply. | 2025-07-31 | Universal opt-out mechanisms required for the covered opt-out purposes, according to the cited AG overview. | Consent before collecting or selling sensitive data, according to the cited AG overview. | Mandatory warning period ended 2026-01-31. | Attorney General. | Minn. Stat. 325M.10 to 325M.21Retrieved 2026-10-24. Minn. Stat. 325M.10 to 325M.21Retrieved 2026-10-24. Minn. Stat. 325M.10 to 325M.21Retrieved 2026-10-24. Verified. Verified 2026-10-24. Next review 2027-01-24. |
| DelawarePRIV-DE | Through 2026, 35,000 consumers excluding payment-only processing; or 10,000 consumers and over 20% gross revenue from data sales. Amendments change coverage from 2027. | 2025-01-01 | Qualifying opt-out preference signals required for targeted advertising and data sales by January 1, 2026, under 12D-106(e). | Consent before sensitive-data processing. Known-child processing has parental-consent and child-data conditions. | From January 1, 2026, a cure opportunity is discretionary. The mandatory 60-day notice provision applied during 2025. | Department of Justice. | 6 Del. C. Chapter 12DRetrieved 2026-10-24. Verified. Verified 2026-10-24. Next review 2027-01-24. |
| MontanaPRIV-MT | Current DOJ overview lists 25,000 consumers; or 15,000 consumers and over 25% revenue from data sales. | 2024-10-01; SB 297 amendments 2025-10-01. | Not verified. | Not verified. | Not verified. | Department of Justice Office of Consumer Protection. | MCA 30-14-2801 et seq.; SB 297Retrieved 2026-10-24. Not verified. Excluded from exports. Next review 2027-01-24. |
| IowaPRIV-IA | 100,000 consumers; or 25,000 consumers and over 50% gross revenue from data sales. | 2025-01-01 | No general browser opt-out preference signal mandate appears in the cited Chapter 715D. | Clear notice and an opportunity to opt out for nonexempt sensitive-data processing. Known-child processing must follow COPPA. | 90 days under 715D.8, with the statutory written correction conditions. | Attorney General. | Iowa Code Chapter 715DRetrieved 2026-10-24. Verified. Verified 2026-10-24. Next review 2027-01-24. |
| New JerseyPRIV-NJ | 100,000 consumers excluding payment-only processing; or 25,000 consumers and revenue or a discount from data sales. | 2025-01-15 | Not verified against current rules. | Not verified. | Not verified. | Attorney General, Division of Consumer Affairs. | N.J.S.A. 56:8-166.4 et seq.Retrieved 2026-10-24. N.J.S.A. 56:8-166.4 et seq.Retrieved 2026-10-24. Not verified. Excluded from exports. Next review 2027-01-24. |
| New HampshirePRIV-NH | 35,000 unique consumers excluding payment-only processing; or 10,000 unique consumers and over 25% gross revenue from data sales. | 2025-01-01 | Not verified against 507-H:6. | Consent before processing sensitive data; COPPA for known children. | From 2026, the AG may offer a 60-day cure opportunity. It is no longer generally mandatory. | Attorney General. | RSA Chapter 507-HRetrieved 2026-10-24. Not verified. Excluded from exports. Next review 2027-01-24. |
| IndianaPRIV-IN | 100,000 consumers; or 25,000 consumers and over 50% gross revenue from data sales. | 2026-01-01 | Not verified. | Not verified. | Not verified. | Attorney General. | Indiana Code Article 24-15Retrieved 2026-10-24. Not verified. Excluded from exports. Next review 2027-01-24. |
| KentuckyPRIV-KY | Not verified against the current text and 2026 amendments. | 2026-01-01 | Not verified. | Not verified. | Not verified. | Attorney General. | KRS 367.3611 to 367.3629Retrieved 2026-10-24. Not verified. Excluded from exports. Next review 2027-01-24. |
| TennesseePRIV-TN | Not verified against the current monetary and consumer thresholds. | 2025-07-01 | Not verified. | Not verified. | Not verified. | Attorney General. | Tennessee Information Protection ActRetrieved 2026-10-24. Not verified. Excluded from exports. Next review 2027-01-24. |
| UtahPRIV-UT | Not verified against the current monetary and consumer thresholds. | 2023-12-31 | Not verified. | Not verified. | Not verified. | Division of Consumer Protection and Attorney General, under the statutory process. | Utah Code Chapter 13-61Retrieved 2026-10-24. Not verified. Excluded from exports. Next review 2027-01-24. |
| Rhode IslandPRIV-RI | Not verified. The chapter includes a website notice provision that requires separate scope review. | 2026-01-01 | Not verified. | Not verified. | Not verified. | Attorney General. | R.I. Gen. Laws Chapter 6-48.1Retrieved 2026-10-24. Not verified. Excluded from exports. Next review 2027-01-24. |
| LouisianaPRIV-LA | Revenue over $25 million; or 75,000 consumers, households, or devices; or at least 50% annual revenue from data sales. | 2027-01-01. | Authorized agents may use a browser or device setting to communicate targeted-advertising or sale opt-outs. Verification conditions and statutory exceptions apply. | Consent before sensitive-data processing, with COPPA treatment for known children. | January 1 through July 31, 2027, a 30-day notice and correction process applies, with written statement and supporting-documentation conditions. | Attorney General. | Louisiana Act 502 of 2026; R.S. 51:1780.1 to 1780.5Retrieved 2026-10-24. Louisiana Act 502 of 2026; R.S. 51:1780.1 to 1780.5Retrieved 2026-10-24. Verified. Verified 2026-10-24. Next review 2027-01-24. |
| VermontPRIV-VT | Not verified against the enacted applicability section. | 2028-01-01 | Not verified. | Not verified. | Not verified. | Not verified against the enacted enforcement section. | Act 145 of 2026; 9 V.S.A. 2415a to 2415kRetrieved 2026-10-24. Not verified. Excluded from exports. Next review 2027-01-24. |
| MarylandPRIV-MD | 35,000 consumers; or 10,000 consumers and over 20% gross revenue from selling personal data, during the prior calendar year. | 2025-10-01 | Not verified against current 14-4705. | Sensitive-data sales prohibited. Other processing restrictions require review of the statute. | Not verified against current enforcement text. | Attorney General. | Md. Commercial Law 14-4701 to 14-4714Retrieved 2026-10-24. Not verified. Excluded from exports. Next review 2027-01-24. |
| FloridaPRIV-FL | Not verified against all controller-definition conditions. The law has a narrow large-business route and a broader sensitive-data sales provision. | 2024-07-01 | Not verified against the current authorized-agent and signal provisions. | Prior consent for sensitive-data sales under 501.715; processing and child-data rules have additional conditions. | Not verified against current 501.72. | Department of Legal Affairs. | Fla. Stat. 501.701 to 501.722Retrieved 2026-10-24. Fla. Stat. 501.701 to 501.722Retrieved 2026-10-24. Not verified. Excluded from exports. Next review 2027-01-24. |
| AlabamaPRIV-AL | Not verified against all enacted scope exclusions and threshold conditions. | 2027-05-01 | Not verified against the final enrolled signal provision. | Not verified against the final enrolled sensitive-data provision. | 45 days after notice under section 11, with a written correction statement and the statutory conditions. | Attorney General. | Alabama HB 351, enrolled 2026; sections 3, 5, 6, 11, 12Retrieved 2026-10-24. Not verified. Excluded from exports. Next review 2027-01-24. |
| OklahomaPRIV-OK | Official House summary states over 100,000 consumers; or 25,000 consumers and a majority of revenue from data sales. Confirm the enacted threshold wording and exclusions. | 2027-01-01 | Not verified against the enrolled act. | Consent before sensitive-data processing, according to the official House summary. | Not verified against the enrolled act. | Attorney General. | Oklahoma SB 546, 2026Retrieved 2026-10-24. Oklahoma SB 546, 2026Retrieved 2026-10-24. Not verified. Excluded from exports. Next review 2027-01-24. |
Reading notes
Read the current enacted instrument before relying on a threshold. AG summaries can lag amendments or simplify the text.
The California adjusted revenue amount differs from the unadjusted $25 million printed in some summaries.
Update policy and changelog
Business Compliance Tools reviews this table quarterly and when an identified source change affects a row. Next scheduled review 2027-01-24.
Exports include only fully verified rows. Unknown fields remain visible in the HTML ledger, with the row excluded from both downloads.
- . Initial source-backed snapshot. Unverified rows are visibly marked and excluded from downloads. No nationwide completeness claim is made.
Apply the reference to a website review
A manual review checks the related parts of your website within a fixed scope. Website privacy and tracking review.
Compare manual website review scopes. Prepare your website checklist.