US State Law United States

US State Privacy Law Comparison: 20 States Side by Side

Compare US state privacy laws on thresholds, sensitive data, GPC mandates, cure periods, and penalties, with the strict-tier states identified for baseline design.

Regulation

Comprehensive state privacy laws in effect through 2026 (California through New Jersey and beyond)

Max Penalty

$2,500 to $50,000 per violation depending on state; California and Texas lead enforcement volume

Enforcing Authority

State attorneys general; California adds the CPPA

Official Source

cppa.ca.gov

Executive Summary

  • Twenty states have comprehensive privacy laws in effect through 2026, in three broad families: California's sui generis regime, the strict Virginia-lineage states (Colorado, Connecticut, Oregon, Texas, Delaware, New Jersey, Montana, Minnesota, Maryland), and the lighter Utah/Iowa model.
  • The variables that actually change program design are seven: applicability thresholds, sensitive-data breadth, universal opt-out mandates, minors' rules, assessment duties, cure-period status, and exemption structure.
  • Twelve-plus states now mandate honoring universal opt-out signals (GPC), making signal handling a de facto national requirement.
  • Cure periods are disappearing: California and Texas make them discretionary or conditional, and most sunset provisions expired in 2025-2026, shifting states to immediate-enforcement postures.
  • The efficient strategy is one national baseline built to the strictest common denominator (roughly Colorado + Oregon + Texas + California), with state-specific deltas handled as configuration.

Twenty state privacy laws sound unmanageable until you notice they are three laws wearing twenty names. California is genuinely its own regime. Utah and Iowa are deliberately light. Everything else descends from Virginia’s template, differing in the seven variables that matter: who is covered, what counts as sensitive, whether signals are mandatory, how minors are treated, when assessments are due, whether cure survives, and which entities escape. Compare on those axes and the program design falls out.

The comparison that drives design

VariableLightest (Utah/Iowa)Middle (Virginia)Strictest (CO/OR/TX/NJ/MD)California
Threshold100k + $25M revenue100k consumersDown to 35k, or none (TX)$25M revenue alone suffices
Sensitive dataOpt-out noticeOpt-in consentOpt-in, broadest listsLimit-use right (opt-out)
GPCNot requiredNot requiredMandatoryMandatory
AssessmentsNoneRequiredRequired, some filedRequired + CPPA submission regime
CurePermanentPermanent 30dSunset/expiredDiscretionary
EnforcementAG onlyAG onlyAG (+rulemaking in CO/NJ)CPPA + AG, active docket

Program strategy from the matrix

Anchor to four states. A build satisfying California (opt-out infrastructure, SPI limits, CPPA rules), Colorado (consent, signals, assessment depth), Oregon (exemption narrowness, third-party lists), and Texas (universal applicability, notices) satisfies the other sixteen with configuration-level deltas, the approach detailed in the multi-state strategy guide.

Treat the union lists as the spec. Sensitive-data categories from the state-by-state consent guide, minors’ rules from the children’s privacy overlay, and assessment triggers from the assessments comparison.

Plan for cure’s end. The cure-period tracker maps the sunsets; the enforcement tracker shows what AGs check first (opt-out mechanics, GPC, notice accuracy), all externally visible.

Test your own visible surface against the strictest-state spec with a free scan.

Frequently Asked Questions

Which states have comprehensive privacy laws in effect?

In effect through 2026: California, Virginia, Colorado, Connecticut, Utah (2023); Texas, Oregon, Montana (2024); Iowa, Delaware, Nebraska, New Hampshire, New Jersey (January 2025), Tennessee (July 2025), Minnesota (July 2025), Maryland (October 2025); Indiana and Kentucky (January 2026), Rhode Island (January 2026). Florida's FDBR (2024) is comprehensive in name but scoped to billion-dollar platforms. Others have signed laws with later dates, the count moves every legislative session.

How do the applicability thresholds differ?

Three patterns. Population-scaled counts: 100,000 consumers in most states, dropping to 50,000 (Montana) and 35,000 (Delaware, New Hampshire) in small states. Revenue-linked alternates: 25,000 consumers plus a sale-revenue share, with New Jersey requiring no minimum percentage. Outliers: Texas covers any non-small-business (no counts at all), California uses $25M revenue OR 50,000+ consumers/households OR 50% revenue from selling, and Florida requires $1B+. Texas plus the low-count states mean mid-size national businesses should assume multistate coverage.

Where do sensitive-data definitions diverge most?

The common core (race, religion, health, sexual orientation, genetics, biometrics, children, precise geolocation) is consent-gated everywhere except California and Utah, which use opt-out/limit models. Divergences: New Jersey adds financial account data; Oregon and Delaware add transgender/nonbinary status (Oregon also crime-victim status); several add immigration status; Maryland bans selling sensitive data outright rather than gating it. Consent-by-default to the union of all lists is the only maintainable position.

What is the current cure-period landscape?

Permanent cure rights: Virginia (30 days), Utah (30), Iowa (90), Tennessee (60), Texas (30, with written no-recurrence statements). Expired or expiring: Colorado and Connecticut (expired), Oregon, Delaware, New Hampshire, New Jersey, Montana (sunset windows through 2026). Discretionary: California (never mandatory). The direction is uniform: cure as grace period is ending, and regulators increasingly treat cure letters as evidence-gathering, not amnesty.

Which states require honoring GPC or similar signals?

Mandatory now or by their laws' schedules: California, Colorado, Connecticut, Texas, Oregon, Montana, Delaware, New Hampshire, New Jersey, Minnesota, Maryland, and Nebraska, with Colorado maintaining the official recognized-mechanism list (GPC is on it). Virginia, Utah, Iowa, and Tennessee do not require signal recognition. Since the mandating states include the largest and strictest markets, a single always-on GPC pipeline is simpler than geo-fencing recognition.

Regulatory Crosswalk

CCPA/CPRAGDPRCOPPA

Organizations subject to this regulation often operate under these overlapping frameworks. BD Emerson maps controls across frameworks to reduce duplicated compliance effort.

Evaluate your compliance posture now

BD Emerson's automated scanner audits your public-facing properties against your applicable regulations in minutes, not weeks.

Run Free Scan Speak to an Expert