US state privacy laws in 2026: which are in force and who they apply to

By the Privacyboard teamPublished 11 November 20269 min read

Short answer

As of 11 November 2026, 23 US states have enacted a comprehensive consumer privacy law, and 19 of them are in force. Four more start between January 2027 and January 2028. Most apply only above a threshold of state residents whose data you handle, often 100,000 or 35,000, while Texas and Nebraska cover almost every business that is not small by federal standards.

As of 11 November 2026, 23 US states have a comprehensive consumer privacy law, and 19 of them are in force. Oklahoma and Louisiana start on 1 January 2027, Alabama on 1 May 2027 and Vermont on 1 January 2028. There is still no federal law that replaces them, so a business selling across the US has to check each state's thresholds one by one.

This guide lists the laws, the dates and the tests that decide whether a law applies to you. It is a starting point, not legal advice. The statutes change often, so check the state's own text before you rely on a number.

#How many US states have a comprehensive privacy law?

Counts differ because trackers draw the line in different places. Most law-firm and IAPP counts, which we follow, put the total at 23 states as of 11 November 2026. Vermont became the 23rd when its governor signed Act 145 on 16 June 2026. Some trackers add Florida, whose full duties reach only very large companies (over USD 1 billion in global revenue, with platform criteria), which is why you will also see 24.

Massachusetts came close in 2026. Both chambers passed a data privacy bill, but they passed different versions, and the bill (S.2619) has sat in a conference committee since June 2026. It is not law. At federal level, the SECURE Data Act (H.R. 8413) was introduced on 21 April 2026 and would override most state laws, but it has not passed either chamber.

#Which state laws are in force, and from when?

Here are the 23 states and the dates their main duties start, as listed by the ComplyJet tracker (October 2026) and the IAPP tracker, and checked against state sources where noted in the next section.

State	Main duties apply from	Status on 11 Nov 2026
California	1 January 2020 (CPRA changes 1 January 2023)	In force
Virginia	1 January 2023	In force
Colorado	1 July 2023	In force
Connecticut	1 July 2023 (major amendments 1 July 2026)	In force
Utah	31 December 2023	In force
Texas	1 July 2024	In force
Oregon	1 July 2024	In force
Montana	1 October 2024	In force
Delaware, Iowa, Nebraska, New Hampshire	1 January 2025	In force
New Jersey	15 January 2025	In force
Tennessee	1 July 2025	In force
Minnesota	31 July 2025	In force
Maryland	1 October 2025 (applies to processing from 1 April 2026)	In force
Indiana, Kentucky, Rhode Island	1 January 2026	In force
Oklahoma	1 January 2027	Signed 20 March 2026
Louisiana	1 January 2027	Signed 29 May 2026
Alabama	1 May 2027	Signed in April 2026
Vermont	1 January 2028	Signed 16 June 2026

#Who do these laws apply to?

None of these laws applies to every business. Each has a test, usually based on the number of state residents whose personal data you control or process in a year, sometimes combined with revenue from selling data. Where you are based does not matter: a company in Europe with enough customers in Virginia is covered by Virginia's law.

A selection, each from the state's own text or attorney general page where we could read one, otherwise from the law firm summary named:

State	Applies to a business that, in a year...	Source
California	Has over USD 26,625,000 in revenue (the figure set for 2025, adjusted every odd year), or buys, sells or shares data of 100,000 or more consumers or households, or earns 50% or more of revenue from selling or sharing data	CPPA and California Attorney General
Virginia	Handles data of 100,000 consumers, or 25,000 while earning over 50% of gross revenue from selling data	Virginia Attorney General
Oregon	Handles data of 100,000 consumers, or 25,000 while earning over 25% of gross revenue from selling data. Car makers are covered whatever the number	Oregon DOJ
Texas	Does business in Texas, unless it is a small business as defined by the US Small Business Administration (small businesses still need consent to sell sensitive data)	Texas Attorney General
Connecticut	Since 1 July 2026: handles data of 35,000 consumers, or processes any sensitive data, or offers personal data for sale	Hunton (SB 1295)
Indiana, Kentucky	Handles data of 100,000 consumers, or 25,000 while earning over 50% of revenue from selling data	Koley Jessen
Rhode Island	Handles data of 35,000 consumers, or 10,000 while earning over 20% of revenue from selling data	Koley Jessen
Oklahoma (2027)	Handles data of 100,000 consumers, or 25,000 while earning over 50% of revenue from selling data	Mayer Brown
Louisiana (2027)	Has over USD 25 million in revenue, or buys, sells or shares data of 75,000 consumers, households or devices, or earns 50% or more of revenue from selling data	Davis Wright Tremaine
Alabama (2027)	Handles data of more than 25,000 consumers, or earns more than 25% of revenue from selling data	Future of Privacy Forum
Vermont (2028)	Handles data of 35,000 consumers, or sensitive data of 3,000, or offers data of 3,000 for sale	Act 145, § 2415b

The trend is clear: newer laws and amendments use lower thresholds (35,000, 25,000, even 3,000 for sensitive data in Vermont), so a small online business can be covered sooner than under the first wave of laws.

Most laws also exempt some organisations, such as financial institutions covered by the Gramm-Leach-Bliley Act or entities covered by HIPAA, and many exempt nonprofits. Check the exemptions in each text; they are not identical.

#What do the laws have in common?

Apart from California, which has its own model, the state laws follow a similar pattern, often traced back to Virginia's:

Rights. People can access, correct and delete their data, get a copy, and opt out of the sale of their data, targeted advertising and some profiling.
Deadlines. Where we read the text or the regulator's page (Virginia, Oregon, Texas, Louisiana and Vermont), the reply is due within 45 days, with one 45-day extension if you tell the person in time.
Appeals. If you refuse a request, the person can appeal to you, and many laws then point them to the attorney general.
Sensitive data. Most laws require consent before processing sensitive data such as health, precise location or data about children.
Assessments. Most require a data protection assessment for higher-risk processing, such as targeted advertising or selling data.
Opt-out signals. A growing number require businesses to honour browser signals such as Global Privacy Control. Oregon has required it since 1 January 2026; see our GPC guide.

Enforcement is by the state attorney general in almost all of them. Several give companies a "cure period" to fix a problem after a notice, but many of those periods have ended: Oregon's ended on 1 January 2026, for example, while Virginia, Texas, Indiana and Kentucky keep a 30-day cure. Rhode Island has none. Penalties are commonly up to USD 7,500 per violation (Virginia, Texas, Oklahoma), and higher in some states, such as up to USD 15,000 in Alabama.

#What changed in 2026?

2026 was busy, even without a federal law:

Three laws took effect on 1 January 2026: Indiana, Kentucky and Rhode Island.
Four new laws were signed: Oklahoma (20 March), Alabama (April), Louisiana (29 May) and Vermont (16 June).
Connecticut lowered its threshold to 35,000 consumers and widened its scope from 1 July 2026.
Virginia banned the sale of precise geolocation data from 1 July 2026, and Oregon did the same from 1 January 2026, along with a ban on selling the data of people under 16.
Maryland's law, in force since 1 October 2025, applies to processing activities from 1 April 2026.

#How do you work out which laws apply to you?

A short checklist for a small business:

Estimate how many residents of each state are in your data in a year: customers, leads, newsletter subscribers and website visitors identified by cookies or device IDs.
Compare each number with the state's threshold, starting with the low ones (Vermont from 2028, Alabama, Connecticut, Rhode Island, Delaware, New Hampshire, Maryland).
If you are not a small business under SBA rules, assume Texas and Nebraska apply.
Check whether you "sell" or "share" data. Advertising pixels and some analytics tags can count, and selling data lowers several thresholds.
List any sensitive data you collect (health, precise location, children's data) and get consent where the law requires it.
Add a US section to your privacy policy and a way to opt out of sale and targeted advertising.
Honour opt-out browser signals such as Global Privacy Control.
Set up a request process with 45-day deadlines and an appeal step.
Put the 2027 and 2028 start dates in your calendar and recheck your numbers before each one.

If you already follow the GDPR, much of this is familiar, but the logic is different: US state laws are mostly opt-out, not opt-in. Our GDPR vs CCPA/CPRA comparison explains the gap.

In Privacyboard, answering "Yes" to US state privacy laws in the company profile adds a US notice to your privacy policy, a Do Not Sell or Share page to your privacy center and the US deadlines to the request form; see requests from people in the United States. It does not decide which laws apply to you.

#FAQ

#Is there a federal privacy law in the United States?

No comprehensive one. Sector laws exist, such as HIPAA for health data and COPPA for children's data online. The SECURE Data Act (H.R. 8413), introduced on 21 April 2026, would set a federal standard and override most state laws, but as of 11 November 2026 it has not passed the House or the Senate.

#Do US state privacy laws apply to companies outside the US?

Yes, if they meet the thresholds. The laws apply to businesses that do business in the state or target its residents, and that handle enough residents' data. Being based in Europe or Canada does not exempt you.

#Does the 45-day deadline pause while I verify the person's identity?

Not under California's rules, and the texts we read for other states count the 45 days from receipt of the request. Plan identity checks so they fit inside the period, and use the one 45-day extension only when you need it, telling the person why within the first 45 days.

#Is Florida a comprehensive privacy law state?

It depends on the tracker. Florida's Digital Bill of Rights gives its full set of duties only to very large companies, over USD 1 billion in global revenue with further platform criteria. Its rules on selling sensitive data reach more businesses. That is why some counts say 24 states and others say 23.

#When will Massachusetts have a privacy law?

We cannot say. Both chambers passed versions of a Massachusetts data privacy act in 2026, and the bill went to a conference committee in June 2026. Until a final text is passed and signed, nothing applies.

#Sources

Privacyboard is a guidance tool, not legal advice. This article explains general rules in plain language and was accurate on the date above; laws and guidance change. For an unusual situation, ask a qualified professional. Spotted a mistake? Write to hello@privacyboard.io.