U.S. State Privacy Laws: Compliance Thresholds, Requirements, Rights, and Enforcement

There's no single federal privacy law in the U.S. Instead, more than twenty states have passed their own, and that number keeps growing. If your website reaches visitors across state lines, which most do, you're likely already subject to more than one.

The good news is that despite different names and thresholds, these laws share a common backbone. Once you understand the pattern, extending compliance to a new state is a matter of degree, not starting from scratch.

Which U.S. States Have Privacy Laws?

California was first, passing the California Consumer Privacy Act (CCPA) in 2018. Progress elsewhere was slow until 2023, when momentum picked up sharply and six more states passed laws that year, and the pace has continued since, with four more states passing laws in the first half of 2026.

*Florida and Nevada are generally excluded from the "comprehensive" privacy law count. Florida's law applies only to a narrow set of large businesses meeting specific criteria (ad sales, smart speakers, app stores), rather than any business over a general threshold. Nevada's law predates the current wave, covers a narrower set of "covered information," and gives consumers only an opt-out right, without the fuller rights bundle (access, correction, portability) the newer state laws provide.

What Do These Laws Actually Require?

Strip away the state-specific language, and nearly every one of these laws asks for the same handful of things. Where the laws diverge is in the details, including specific thresholds, cure periods, and whether Global Privacy Control has to be honored. California remains the outlier on two counts: it's the only state with its own dedicated enforcement agency (CalPrivacy), and the only one that gives consumers a private right of action for data breaches.

Standard Requirements

Privacy notice

Disclose what data you collect, why, and who you share it with.

opt-out mechanism

Typically a link, for the sale of personal data, targeted advertising, or profiling.

Consumer rights

To know, access, correct, delete, and (in most states) port their data.

Prior consent

Before collecting sensitive data or data belonging to a known child.

Non-discrimination

You can't penalize a consumer for exercising these rights.

Compliance Thresholds: Do These Laws Apply to You?

Most laws use some version of the same formula. Either you process a set number of residents' data — 100,000 is fairly common, though several recent laws use lower numbers or drop the threshold altogether — or you process a smaller number but derive meaningful revenue from selling it. A shrinking number of states — Utah and Tennessee among them — still include a revenue floor on top of that; newer laws increasingly skip it.

The practical implication is that a small business with a highly-trafficked website can trigger a state privacy law without meeting any revenue bar at all, purely on volume.

Penalties and Cure Periods

Fines range from roughly USD 5,000 to USD 20,000 per violation depending on the state, with a handful of states (Alabama, Florida, Indiana, and others) linking penalties to their existing deceptive trade practices statutes rather than setting a privacy-specific number.

Most states offer a "right to cure," which is typically 30 to 60 days to fix a violation once notified, before penalties apply. However, that right typically sunsets within 12 to 18 months of the law coming into effect, after which the right to cure can be offered at the Attorney General's discretion.

Global Privacy Control: Do You Need to Honor It?

Global Privacy Control (GPC) or other Universal Opt-Out Mechanisms (UOOM) lets a visitor set their opt-out preference once, in their browser, and have it recognized automatically across every site they visit afterward, so no repeat clicking required. A growing number of states require businesses to recognize an opt-out signal — either GPC specifically or a UOOM more generally — including California, Colorado, Connecticut, Delaware, and Montana, with more joining.

A Related but Separate Risk: CIPA Litigation in California

None of the laws above cover a risk that's landed many California-facing businesses in court anyway, that of the California Invasion of Privacy Act (CIPA). CIPA is a 1967 wiretapping statute, not a modern comprehensive privacy law, and it works on different legal grounds entirely. Plaintiffs argue that common website tools like tracking pixels, chat widgets, and session replay software "intercept" communications without the consent CIPA requires, with statutory damages up to USD 5,000 per violation.

It's worth mentioning because being compliant with the CCPA or any other state privacy law does nothing to shield you from a CIPA claim, as they rest on separate legal foundations. One is a consumer-rights framework, the other is decades-old wiretapping law being applied to modern web technology, and courts have reached inconsistent conclusions on whether it even applies.

A reform bill in California, SB 690, has been narrowed sharply from its original scope and would — if passed before its August 31, 2026 deadline — shift enforcement of pen-register and trap-and-trace claims to the California Attorney General alone. It leaves the more commonly litigated wiretapping and eavesdropping provisions untouched, so even in the best case for businesses, CIPA exposure doesn't disappear.

Additionally, similar statutes in other states, and the Video Privacy Protection Act (VPPA) and Electronic Communications Privacy Act (ECPA), both of which are federal, are being used along with CIPA in claims, or in separate ones. SB 690 does nothing about any of them.

A consent management platform like Cookiebot™ CMP can help reduce this exposure by capturing consent before tracking scripts fire, but it isn't a guarantee against a CIPA claim. The safest move is a technical audit of what fires before consent, paired with legal counsel familiar with the current litigation landscape.

Managing Compliance Across Multiple States

Handling one state's privacy law manually is workable. Handling twenty is not, particularly once you factor in that thresholds, GPC requirements, and cure periods are all still shifting year to year. The complexity grows further if your business expands internationally.

Cookiebot™ CMP handles this by detecting a visitor's location and serving the right notice and opt-out mechanism automatically, recognizing GPC and other opt-out signals without manual configuration, and keeping records of consent and opt-out choices for when a regulator comes asking. See how straightforward it can be to manage all this from one place.