Skip to content
VITI Security
Contact

State privacy laws

US State Privacy Law Applicability Checker

See which state comprehensive privacy laws likely apply and what obligations come with them.

Rough count of consumers whose personal data you control or process in the selected states.

How the thresholds work

There is no single federal privacy law in the US. A growing number of states have their own comprehensive privacy law, and most apply when you handle the personal data of a minimum number of that state's residents, or a smaller number plus a share of revenue from selling personal data. Where your company is based does not matter; where your customers live does.

StateApplies if you control or process data of
Virginia100,000 consumers, or 25,000 plus over 50% of revenue from selling data
Colorado100,000 consumers, or 25,000 plus any revenue or discount from selling data
Connecticut (from 1 July 2026)35,000 consumers, or any sensitive data, or if you sell personal data
UtahOver $25 million revenue plus 100,000 consumers, or 25,000 plus over 50% from sales
TexasNo volume threshold; small businesses as defined by the SBA are largely exempt
Oregon100,000 consumers, or 25,000 plus 25% or more of revenue from sales
Montana (from 1 October 2025)25,000 consumers, or 15,000 plus 25% from sales
Delaware35,000 consumers, or 10,000 plus over 20% from sales
Iowa100,000 consumers, or 25,000 plus over 50% from sales
NebraskaNo volume threshold, with a small-business exception

California works differently, with a revenue test. See the CCPA guide and calculator.

What these laws usually require

  • A privacy notice that explains what you collect and why
  • Consumer rights: access, deletion, correction, portability, and opting out of targeted advertising, sale and certain profiling
  • Consent before processing sensitive data, in most states
  • Data protection assessments for higher-risk processing
  • Honouring universal opt-out signals in some states (for example Texas, through a global device setting)
  • Reasonable data security, and contracts with processors

The checker above tests the volume and revenue-share thresholds for the states you pick. It cannot test revenue figures it does not ask for, or the many exemptions (for example data covered by HIPAA or GLBA), so treat a "likely applies" as a prompt to check with counsel.

Sources

Facts checked against the sources above on 22 October 2026. General information, not legal advice.

How this is calculated

  1. For each state you pick, the tool compares your consumer count with that state’s volume threshold (for example 100,000 in Virginia, 35,000 in Maryland, 175,000 in Tennessee).
  2. It then tries the alternate prong: a lower consumer count plus a minimum share of revenue from selling personal data (in Colorado and New Jersey any such revenue counts). Connecticut, since July 2026, also applies to anyone who sells personal data.
  3. Texas and Nebraska have no volume threshold, so they are always flagged, subject to their small-business exception.
  4. Utah and Tennessee also require more than US$25 million in annual revenue; the tool flags this but cannot test it.
  5. The headline counts the states that likely apply; amber if any do, green if none.

Worked example

The calculator run on its default inputs:

States where you have consumers
Virginia (VCDPA); Texas (TDPSA); Colorado (CPA)
Consumers in those states
150,000 consumers
Revenue from selling personal data
0%

3 state privacy laws likely apply

Virginia (VCDPA) (in force since 2023)
Likely applies - >= 100,000 consumers
Texas (TDPSA) (in force since July 2024)
Likely applies - no volume/revenue threshold (small-business exception aside)
Colorado (CPA) (in force since 2023)
Likely applies - >= 100,000 consumers

With the defaults (Virginia, Texas and Colorado; 150,000 consumers; no revenue from selling data) all three laws are flagged: Virginia and Colorado because 150,000 is above their 100,000-consumer thresholds, and Texas because it has no volume threshold.

Sources

Sources last checked September 2026.

Limitations

The consumer count is one total across the states you pick, while each law counts only its own residents, and these laws exclude people acting in a commercial or employment context. Entity and data exemptions (GLBA, HIPAA, non-profits in some states) are not modelled, and California is covered by the separate CCPA calculator. This is an indicative estimate for education and planning, not legal advice. Laws and published figures change, and regulators and courts apply discretion no calculator can model - confirm with a qualified legal or compliance professional before acting on a result.