US state privacy laws, handled next to the GDPR.
The CCPA and more than twenty other state laws give US residents rights close to the GDPR’s, plus an opt-out of sale and sharing. Privacyboard adds the US notice, 45-day requests, a Do Not Sell page and Global Privacy Control.
Free to set up · No credit card · Checked 12 November 2026
In short
- Applies to
- Businesses above each state’s threshold
- States
- 23 with a law, 19 in force
- Deadline
- 45 days per request
- In Privacyboard
- On every plan, Free included
What US laws ask, and where it lives
Pick a duty to see the screen that handles it.
What the law asks
What you collect, why, and whether you sell or share it.
In Privacyboard
A US notice added to your privacy policy from two answers.
Every plan
Show all 5 duties as a list
NoticeTell US residents what you doEvery plan
What the law asks: What you collect, why, and whether you sell or share it.
In Privacyboard: A US notice added to your privacy policy from two answers.
RightsAnswer within 45 daysEvery plan
What the law asks: Know, access, correct, delete: 45 days, plus 45 if needed.
In Privacyboard: US deadlines, opt-outs in 15 business days, appeal wording. Request form on Pro.
Opt-outOffer “Do Not Sell or Share”Every plan
What the law asks: A clear opt-out of sale and sharing for advertising.
In Privacyboard: A Do Not Sell page, linked in the banner for US visitors.
GPCHonour Global Privacy ControlEvery plan
What the law asks: California and about a dozen states require it.
In Privacyboard: Marketing turned off automatically, and the opt-out logged.
By regionOne banner, the right ruleEvery plan
What the law asks: Opt-out in the US, consent first in the EU.
In Privacyboard: The banner applies the right rule to each visitor.
The numbers to know
with a comprehensive privacy law, in most counts
to answer a request, plus 45 if needed
per intentional violation in California
Thresholds and fines differ by state. California’s are adjusted every two years.
How the laws arrived
CCPA
California goes first.
CPRA, Virginia
Sharing opt-out, right to correct.
17 more states
Up to Rhode Island in January 2026.
Oklahoma, Louisiana
And California’s ADMT rules.
ComingAlabama, Vermont
The latest laws.
Coming
What Privacyboard covers, and what it does not
Covered
- A US notice in your privacy policy
- US rights and deadlines in requests
- A Do Not Sell or Share page
- Global Privacy Control in the banner
- Opt-out mode for US visitors
Not covered
- Checking which state thresholds you meet
- Automated decision-making rights (from 2027)
- Risk assessments, audits, data broker registration
Privacyboard is a guidance tool, not legal advice.
Your first hour
- 1
Answer two questions
In your company profile.
- 2
Validate your policy
It now has a US notice.
- 3
Publish your center
The Do Not Sell page appears.
- 4
Add the footer link
Shown to US visitors only.
Go online for free. Grow when you need to.
Free puts you online. Pro adds requests, monitoring and your team; Business, security questionnaires and only your brand.
Free
$0 forever
No card, no time limit
For getting compliant and going online on your own.
Start for freeKey features:
- Privacy and cookie policies
- Vendor and processing registers
- Requests and breaches tracked
- Impact assessment screening
- AI Act screening
- Privacy center on privacyboard.io
- Cookie banner on 1 domain
- 1 person
- And 1 more on the pricing page
No card needed
ProRecommended
$20 per month
Billed $240 a year Save $48
For founders who want to be compliant in a few clicks and stay that way.
Start with ProEverything in Free, plus:
- DPA for your clients
- Vendor monitoring
- Reminders for documents and reviews
- Request form and replies
- Your own domain
- Banner on 3 domains, every choice logged
- Weekly site scan
- Complete DPIAs and TIAs
- AI assistant connector
- 2 people
- And 1 more on the pricing page
Cancel any time
Business
$109 per month
Billed $1,308 a year Save $240
For the person in charge of privacy: every detail in order, a team with roles, and proof for audits and customers.
Start with BusinessEverything in Pro, plus:
- Up to 50 people, with roles
- PDF and Excel exports
- Signed agreements on vendors
- Activity log kept 3 years
- Security questionnaires answered for you
- No Privacyboard mention
- Center in English and French
- Evidence pack in one click
- Banner on 10 domains, daily scan
- Two-step verification required
- And 3 more on the pricing page
Bank transfer on request
Questions, answered.
Does the CCPA apply to a non-US company?
Yes, above USD 26,625,000 in revenue, or data of 100,000 California consumers, or half its revenue from selling data.
Is GDPR compliance enough for US laws?
Mostly, but US laws add the opt-out of sale and sharing, the Do Not Sell link and GPC.
Do advertising pixels count as “sharing”?
Often, yes: sharing covers cross-context behavioural advertising.
Must I honour Global Privacy Control?
In California and about a dozen other states, yes.
Official sources
- CCPA statute
- CCPA regulations (2026)
- CPPA, adjusted thresholds and fines
- IAPP, US state privacy legislation tracker
Checked on 12 November 2026. Laws and guidance change: read the official text before you rely on a figure.
Read more
Guides on the blog
- US state privacy laws in 2026: which are in force and who they apply to9 min read
- Privacy laws around the world: a plain-language overview for 202610 min read
- Global Privacy Control (GPC): what it is and who has to honour it9 min read
- GDPR vs CCPA/CPRA: the differences that matter for small businesses9 min read
- Data subject request reply templates: access, erasure and more10 min read
In the documentation