US State Privacy Laws: What SaaS and IT Companies Must Do

The United States has no general federal privacy law, so US state privacy laws fill the gap. California went first with the CCPA in 2020, Virginia followed in 2023, and by October 2026 around 20 states had general consumer privacy laws in effect, with Oklahoma and others due to follow from January 2027. For any SaaS, e-commerce or app business with a national US customer base, several of these laws apply at once.

The good news is that most states follow a similar model, so a single well-designed privacy program can cover nearly all of them. This guide explains which states have laws, how thresholds work, the common rights and duties, where states differ, what processors (vendors) must do, and how to build one program that works across states. California has its own guide: see CCPA and CPRA.

What are US state privacy laws?

These are state statutes that give residents rights over their personal data and impose duties on businesses that collect it. They differ from older sector laws such as HIPAA for health data, GLBA for financial institutions and COPPA for children under 13, because they apply across sectors to most personal data. They also differ from state data breach notification laws, which all 50 states have, and from narrower laws on biometrics (such as Illinois BIPA) or consumer health data (such as Washington's My Health My Data Act).

Those narrower laws can matter as much as the general ones. Washington's My Health My Data Act, for example, covers consumer health data well beyond HIPAA, requires separate consent for collection and sharing, applies without a revenue or volume threshold, and gives consumers a private right of action. Apps that infer health information from fitness, purchase or location data should check it alongside the general state laws.

Most non-California laws follow the model set by the Virginia Consumer Data Protection Act, often called the Virginia or Washington Privacy Act model, using GDPR-style terms: controllers decide why and how data is processed; processors act on their behalf.

Which states have laws in effect?

The table lists the main laws and effective dates. The count changes often, so check the IAPP tracker in the sources for the current position.

State	Law	Effective
California	CCPA as amended by CPRA	1 January 2020; CPRA 1 January 2023
Virginia	Consumer Data Protection Act	1 January 2023
Colorado	Colorado Privacy Act	1 July 2023
Connecticut	Connecticut Data Privacy Act	1 July 2023; major amendments 1 July 2026
Utah	Consumer Privacy Act	31 December 2023
Texas	Data Privacy and Security Act	1 July 2024
Oregon	Consumer Privacy Act	1 July 2024
Montana	Consumer Data Privacy Act	1 October 2024
Iowa, Delaware, Nebraska, New Hampshire	Separate state acts	1 January 2025
New Jersey	Data Privacy Act	15 January 2025
Tennessee	Information Protection Act	1 July 2025
Minnesota	Consumer Data Privacy Act	31 July 2025
Maryland	Online Data Privacy Act	1 October 2025
Indiana, Kentucky, Rhode Island	Separate state acts	1 January 2026
Oklahoma	Consumer Data Privacy Act (SB 546, signed 20 March 2026)	1 January 2027

Florida has a narrower Digital Bill of Rights that applies only to very large companies, which is why trackers sometimes give different totals.

Who must comply? Thresholds

Most laws apply to businesses that conduct business in the state or target its residents and, in a calendar year, either control or process personal data of at least 100,000 state consumers (excluding data processed only to complete a payment), or of at least 25,000 consumers while earning a set share of revenue from selling personal data. States vary these numbers: some smaller states use lower counts, Connecticut lowered its threshold to 35,000 consumers from 1 July 2026, and Texas and Nebraska apply to any business that is not a small business under federal Small Business Administration definitions, with a ban on selling sensitive data without consent applying even to small businesses.

"Consumer" usually means a resident acting in an individual or household context. Unlike California, most states exclude employees and business-to-business contacts.

Common exemptions

• State and local government bodies.
• Nonprofits in many states, though Colorado, Oregon, Delaware, New Jersey, Minnesota and Maryland cover them in some form.
• Financial institutions or data subject to GLBA, at entity level or data level depending on the state.
• Covered entities and protected health information under HIPAA, again at entity or data level.
• Higher education institutions in some states.
• Data covered by FCRA, FERPA, COPPA-compliant processing and employment data.

Data-level exemptions are narrower: a bank in a data-level state must still apply the law to personal data not covered by GLBA, such as website analytics.

Consumer rights

Almost every law gives consumers rights to:

• Confirm and access whether their data is processed.
• Correct inaccuracies (Utah added this from 2026; Iowa does not provide it).
• Delete personal data provided by or obtained about them.
• Obtain a portable copy.
• Opt out of targeted advertising, sale of personal data and profiling in furtherance of decisions with legal or similarly significant effects.

Some states add more: Oregon and Minnesota give a right to a list of specific third parties to which data was disclosed; Minnesota lets consumers question the result of profiling decisions and learn the reasons. Controllers usually have 45 days to respond, extendable once by 45 days, and must provide an appeal process with a further response deadline.

Sensitive data and children

Sensitive data typically includes racial or ethnic origin, religious beliefs, health diagnoses, sex life or sexual orientation, citizenship or immigration status, genetic and biometric data used for identification, precise geolocation and data of a known child. Many newer laws add transgender or non-binary status, national origin, and neural data. Most states require opt-in consent before processing sensitive data; California and Utah use opt-out for some uses. Maryland goes further: collecting and processing sensitive data must be strictly necessary to provide the requested product or service, and selling sensitive data is prohibited.

For children under 13, processing must follow COPPA consent. Several states, including Connecticut, Colorado, Oregon and Maryland, add protections for teenagers, such as bans on targeted advertising and sale for known minors under 16 or 18 and duties to assess risks to minors.

Universal opt-out signals

A growing number of states require controllers to honour universal opt-out mechanisms, such as the Global Privacy Control (GPC) browser signal, as a valid request to opt out of targeted advertising and sale. These include California, Colorado, Connecticut, Texas, Oregon, Montana, Delaware, New Hampshire, New Jersey, Nebraska, Minnesota and Maryland, with effective dates that vary. Colorado maintains a list of recognised mechanisms. In practice, any site that sells data or runs targeted advertising to US users should detect GPC and suppress advertising tags or data sharing for that browser.

Controller duties

• Privacy notice describing categories of data, purposes, rights, how to exercise them, third parties and sales or targeted advertising.
• Data minimisation and purpose limitation: collect what is adequate, relevant and reasonably necessary for disclosed purposes; Maryland and Minnesota set stricter standards.
• Reasonable security appropriate to the volume and nature of data.
• No discrimination against consumers who exercise rights, with allowances for loyalty programs.
• Data protection assessments before processing for targeted advertising, sale, sensitive data, and profiling with significant risks, kept available for the attorney general on request.
• Processor contracts with required terms.
• Clear methods for exercising rights, at least one of which must be online for businesses operating online in several states.

What processors (vendors) must do

Most SaaS and IT companies act as processors for their business customers. Processors must:

• Follow the controller's documented instructions.
• Sign a contract specifying processing instructions, nature and purpose, data types, duration, and the parties' rights and obligations.
• Ensure staff are bound by confidentiality.
• Delete or return data at the end of services.
• Make information available to show compliance and allow reasonable assessments or provide an independent assessment report.
• Engage subprocessors only under written contracts with the same obligations, after giving the controller an opportunity to object.
• Help the controller respond to rights requests, secure data, notify breaches and complete data protection assessments.

A processor that starts determining purposes and means becomes a controller for that processing. A single data processing addendum written to cover the common state requirements, GDPR and CCPA service provider terms is the usual approach.

Enforcement and penalties

State attorneys general enforce these laws; California also has a dedicated agency. Penalties are typically up to $7,500 per violation, with some states higher. Most laws had cure periods in their early years, letting businesses fix violations within 30 or 60 days after notice; several have expired, while Texas, Oklahoma and others keep a permanent cure right. None of the non-California laws gives consumers a private right of action under the privacy law itself. Attorneys general in Texas, Connecticut and California have been the most active, with actions on data sales, connected vehicles, location data and opt-out failures.

How to comply across states, step by step

1. Map where your users are and estimate consumer counts per state to see which laws apply.
2. Inventory personal data, flagging sensitive data, children's data, sales and targeted advertising.
3. Adopt the strictest common denominator: opt-in for sensitive data, opt-outs for all states, GPC honoured everywhere.
4. Write one US privacy notice with state-specific sections where needed.
5. Build one rights request workflow with identity verification, 45-day deadlines and appeals.
6. Run data protection assessments for advertising, sensitive data and profiling.
7. Update contracts with processors and customers.
8. Watch new laws and amendments each quarter.

Documentation you will need

• Data inventory and map, with state applicability analysis.
• Privacy notice and version history.
• Rights request log with outcomes, timing and appeals.
• Consent records for sensitive data.
• Evidence of opt-out signal handling.
• Data protection assessments.
• Processor and subprocessor contracts.
• Security policies and incident records.

Timeline and cost considerations

A business already compliant with the CCPA or GDPR can usually extend its program to other states in a few weeks: adding states to notices, enabling GPC, adding consent for sensitive data and updating contracts. A business starting from nothing might need three to six months. The main costs are engineering for rights requests and consent, legal review and consent management tools.

Common mistakes for SaaS and IT companies

• Assuming only California matters.
• Ignoring GPC or only showing a cookie banner without blocking tags.
• Collecting sensitive data, such as health inferences or precise location, without opt-in consent.
• Treating pixels and ad tags as harmless when they amount to sale or targeted advertising.
• Using processor contracts that lack state-required terms.
• No appeal process for denied requests.

Best practices, tools and technologies

• Use a consent management platform configured for US states, honouring GPC server-side as well as in the browser.
• Automate rights requests with a portal, verification and data discovery across systems.
• Tag sensitive data fields in schemas so consent and retention rules can be enforced.
• Keep a register of third parties receiving data.
• Use privacy by design reviews for new features, aligned with the NIST Privacy Framework.

We build rights request workflows, consent-aware tag loading and GPC handling into web and SaaS platforms through our web application development service.

How state laws relate to other frameworks

Law or framework	Relationship
CCPA/CPRA	California's broader law, covering employees and B2B data, with regulations and a dedicated agency.
GDPR	Many concepts are borrowed from it; GDPR requires a lawful basis for all processing, while US states mostly use opt-outs.
COPPA	Federal rule for children under 13 that state laws build on.
GLBA and HIPAA	Sector laws whose covered data or entities are exempt.
ISO/IEC 27701	Certifiable privacy management system that can support compliance.

Real-world example

An Indian-built US fitness app with users in all 50 states has over 100,000 users in several states. It treats workout-derived health data as sensitive and asks for opt-in consent, honours GPC by disabling advertising SDK sharing for those users, lets users access, correct, delete and export data from the app settings, answers requests within 45 days with an appeal link, runs a data protection assessment for its advertising and health data processing, and signs processor contracts with its analytics and cloud vendors. One program covers every state law that applies.

Next steps

1. Estimate your users per state and list applicable laws.
2. Find sensitive data, sales and targeted advertising in your product.
3. Enable GPC and consent controls.
4. Publish one US privacy notice and rights workflow.
5. Set a quarterly review for new state laws.

Frequently asked questions

How many US states have privacy laws?

Around 20 states had general consumer privacy laws in effect as of October 2026, with more taking effect from 2027. Trackers differ slightly depending on whether narrower laws are counted.

Is there a federal US privacy law?

No general one. Federal privacy rules are sector-specific, such as HIPAA, GLBA and COPPA, and the FTC enforces against unfair or deceptive practices.

Do state privacy laws apply to companies outside the US?

Yes, if they conduct business in the state or target its residents and meet the thresholds.

What is the typical threshold?

Personal data of 100,000 state consumers a year, or 25,000 with significant revenue from selling data, though several states use lower or different tests.

Do I have to honour Global Privacy Control?

In a growing number of states, yes, as an opt-out of sale and targeted advertising.

Do these laws cover employee data?

Generally no, except in California.

How long do I have to respond to a rights request?

Usually 45 days, extendable once by another 45 days when reasonably necessary.

Is consent required for sensitive data?

In most states, yes, as opt-in consent; Maryland restricts processing to what is strictly necessary and bans its sale.

Can consumers sue under these laws?

Not under the non-California laws; enforcement is by the attorney general. California allows suits for certain data breaches.

What must a processor contract include?

Instructions, data types, duration, confidentiality, deletion or return, assistance, audit or assessment rights and subprocessor terms.

What are the penalties?

Typically up to $7,500 per violation, enforced by state attorneys general.