State breach laws

US State Breach Notification Estimator

Map notification deadlines and AG duties across affected states, plus rough notification and credit-monitoring cost.

How US breach notification works

Every US state has its own breach notification law, and the law that applies is where the affected people live, not where your company is. A breach touching customers in ten states means ten sets of rules, and in practice the strictest deadline sets your timeline.

Deadlines in major states

State	Notify residents	Notify the regulator
California	Within 30 calendar days	Sample notice to the Attorney General within 15 days if more than 500 residents
New York	Within 30 days of discovery	Attorney General, Department of State and State Police (and DFS for covered entities)
Texas	Within 60 days	Attorney General within 30 days if 250 or more Texans
Florida	Within 30 days (15 more for good cause)	Attorney General if 500 or more
Washington	Within 30 days	Attorney General if more than 500
Colorado	Within 30 days of determining a breach	Attorney General if 500 or more
Illinois	Without unreasonable delay	Attorney General if more than 500
Pennsylvania	Without unreasonable delay	Attorney General alongside resident notice if more than 500; 12 months of credit monitoring when certain identifiers are exposed
Massachusetts	As soon as practicable	Attorney General and the Office of Consumer Affairs and Business Regulation

Industry rules can apply on top: HIPAA for health data (60 days), and FTC Safeguards Rule reporting for non-bank financial firms (to the FTC within 30 days of discovery when 500 or more consumers are affected). See the HIPAA penalty guide.

What notification costs

The estimator above adds a per-person figure for printing, postage and a call centre, and a credit monitoring figure when Social Security numbers or financial account data are involved. These are planning estimates; legal fees, forensics and regulator inquiries come on top.

Be ready before it happens

Know which states your customers and employees live in.
Keep notice templates and the regulators' contact routes ready.
Make sure your monitoring can tell you what was accessed, because that decides who must be told.
Rehearse it: a tabletop exercise exposes the gaps before a real incident does.

See incident response services.

Sources

Facts checked against the sources above on 22 October 2026. General information, not legal advice.

How this is calculated

For each state you pick, the tool looks up two things from a table compiled from the state statutes: the deadline for notifying residents and any duty to notify the attorney general or another state body. Twelve states are covered; "Other" gives a generic line.
Strictest deadline: 30 days if California, New York, Florida, Colorado or Washington is selected; 60 days if Texas is the tightest; otherwise "without unreasonable delay".
Notification cost = affected residents x US$2 (printing, postage, call centre).
Credit monitoring = residents x US$10-15, added only when Social Security numbers or financial account data are involved.
Total = notification + monitoring. Colour: red when monitoring applies, amber otherwise.

Constants the tool uses

Unless a value names a study, it is VITI Security's working estimate for budgeting - not taken from a statute or a dated study - so treat it as an adjustable assumption.

Notification handling per person: US$2
Credit or identity monitoring per person (12-24 months): US$10-15
Data types that trigger monitoring: SSN or financial account data

Worked example

The calculator run on its default inputs:

States with affected residents: California; New York; Texas
Total affected residents: 10,000 people
Data types involved: Social Security numbers

Notification plan across 3 states

$120K-$170K

Strictest applicable deadline: 30 days - plan around the strictest state clock, which starts at discovery
California - 30 calendar days (SB 446, eff. Jan 1, 2026): Sample notice to the AG within 15 calendar days of notifying consumers if >500 CA residents
New York (SHIELD Act) - Within 30 days after discovery (Dec 2024 amendment): Notify AG, Dept. of State and State Police for any breach affecting NY residents; DFS too if you are a 23 NYCRR 500 covered entity
Texas - Within 60 days of determination: AG within 30 days if ≥250 TX residents affected
Notification cost (print/mail/handling, ~$2/record): $20,000
Credit monitoring (12-24 mo, ~$10-$15/record): $100,000-$150,000
Estimated total: $120,000-$170,000

With the defaults (California, New York and Texas; 10,000 residents; Social Security numbers) the strictest clock is 30 days. Notification is 10,000 x US$2 = US$20,000 and monitoring 10,000 x US$10-15 = US$100,000-150,000, so the total is US$120,000-170,000.

Sources

Cal. Civ. Code 1798.82 - 30 calendar days; sample notice to the AG within 15 days if more than 500 residents
N.Y. Gen. Bus. Law 899-AA (NY Senate) - 30 days after discovery; AG, Department of State, State Police (and DFS for covered entities)
Tex. Bus. & Com. Code 521.053 - 60 days to individuals; AG within 30 days if 250 or more Texans
Fla. Stat. 501.171 - 30 days (15 more for good cause); AG notice at 500 or more
815 ILCS 530/10 (Illinois General Assembly) - AG notice when more than 500 Illinois residents are notified
Pennsylvania Attorney General - reporting a data breach - AG notice alongside individual notice and 12 months of credit monitoring under Act 33 of 2024
Mass. Gen. Laws ch. 93H s.3 - notice to the AG and the Office of Consumer Affairs and Business Regulation
RCW 19.255.010 (Washington) - 30 days; AG notice if more than 500 residents
Colorado Attorney General - data protection laws (C.R.S. 6-1-716) - 30 days after determining a breach; AG notice at 500 or more
Va. Code 18.2-186.6 - AG notice; AG and consumer reporting agencies above 1,000 people
O.C.G.A. 10-1-912 (Justia copy; the official code is published through LexisNexis) - consumer reporting agencies above 10,000 residents; no AG notice
N.J.S.A. 56:8-163 (Justia copy) - report to the Division of State Police before notifying customers
Conn. Gen. Stat. 36a-701b - at least 24 months of identity-theft services when SSNs are involved
HIPAA Breach Notification Rule, 45 CFR 164 Subpart D (eCFR) - 60 days; media notice above 500 residents of a state; HHS notice

Sources last checked September 2026.

Limitations

The table covers twelve states; all 50 states have breach laws, and the definition of personal information, the harm threshold and encryption safe harbours differ between them. The cost lines are planning figures, not vendor quotes, and exclude forensics, legal fees and call-centre staffing beyond basic handling. This is an indicative estimate for education and planning, not legal advice. Laws and published figures change, and regulators and courts apply discretion no calculator can model - confirm with a qualified legal or compliance professional before acting on a result.