US State Privacy Laws
A comparison of comprehensive state privacy laws across the United States
In the absence of a comprehensive federal privacy law, US states have enacted their own data privacy legislation, creating a complex patchwork of requirements for businesses operating across state lines. California led the way with the CCPA in 2020 (amended by the CPRA in 2023), and since then, a growing number of states have followed with their own comprehensive privacy statutes.
Each law varies in its applicability thresholds, consumer rights, enforcement mechanisms, and unique provisions. Organizations that collect personal data from residents of multiple states must understand these differences to build a compliant, scalable privacy program.
California
CCPA/CPRACalifornia Consumer Privacy Act / California Privacy Rights Act
- $25M+ annual revenue
- 100K+ consumers/households
- 50%+ revenue from selling data
Virginia
VCDPAVirginia Consumer Data Protection Act
- 100K+ consumers' data processed
- 25K+ consumers' data processed AND 50%+ revenue from data sales
Colorado
CPAColorado Privacy Act
- 100K+ consumers' data processed
- 25K+ consumers' data processed AND revenue from data sales
Connecticut
CTDPAConnecticut Data Privacy Act
- 100K+ consumers' data processed
- 25K+ consumers' data processed AND 25%+ revenue from data sales
Utah
UCPAUtah Consumer Privacy Act
- $25M+ annual revenue
- 100K+ consumers' data processed OR 50%+ revenue from data sales
Texas
TDPSATexas Data Privacy and Security Act
- Conducts business in Texas or produces products/services consumed by Texas residents
- Not a small business as defined by the SBA
Oregon
OCPAOregon Consumer Privacy Act
- 100K+ consumers' data processed
- 25K+ consumers' data processed AND 25%+ revenue from data sales
Montana
MCDPAMontana Consumer Data Privacy Act
- 50K+ consumers' data processed
- 25K+ consumers' data processed AND 25%+ revenue from data sales
Delaware
DPDPADelaware Personal Data Privacy Act
- 35K+ consumers' data processed
- 10K+ consumers' data processed AND 20%+ revenue from data sales
New Jersey
NJDPANew Jersey Data Privacy Act
- 100K+ consumers' data processed
- 25K+ consumers' data processed AND revenue from data sales
Need Help with Multi-State Compliance?
Building a privacy program that satisfies multiple state laws requires a unified strategy. We can help you navigate the patchwork.
Learn About Our Privacy Services