US state privacy laws compared, all 23 side by side

As of October 2026, 23 US states have enacted comprehensive consumer privacy laws, and 19 of them are in force. The four newest, Oklahoma, Louisiana, Alabama and Vermont, were all signed in 2026 and take effect between 1 January 2027 and 1 January 2028. Twelve of the laws in force expect businesses to honour universal opt-out signals such as Global Privacy Control, and there is still no comprehensive federal privacy law.

23 state privacy laws, 19 already in force

California started it in 2018 with the CCPA. The count reached 19 laws before 2026 began, and the 2026 legislative sessions added four more, according to Hunton Andrews Kurth's report on Vermont as the 23rd state. For website owners processing data across state lines, keeping track of each framework's quirks is no small task.

The good news: most of these laws follow a template first set by the Virginia Consumer Data Protection Act (VCDPA). The bad news: each state has introduced its own variations on applicability thresholds, opt-out rights and enforcement powers. A handful of states, California, Maryland and Nebraska among them, have gone further, adding stricter data minimisation or youth privacy protections.

This guide maps every framework so you can identify which laws apply to your website and what each one requires.

Which states have privacy laws in effect

The wave of state privacy legislation began with California's CCPA in 2020 and has accelerated sharply since 2023. These are the 19 laws in force, with the date each took effect and whether it requires businesses to honour a universal opt-out signal:

Four more laws were signed in 2026 and are not yet in force: Oklahoma's (signed 20 March 2026, in force 1 January 2027), Louisiana's Data Privacy Act (in force 1 January 2027), Alabama's Personal Data Protection Act (signed 17 April 2026, in force 1 May 2027) and Vermont's Data Privacy and Online Surveillance Act (signed 16 June 2026, in force 1 January 2028). Arkansas, counted in an earlier version of this guide, passed a children's and teens' online privacy law rather than a comprehensive one.

Several of the older laws have already been amended. Kelley Drye's review of the 2025 amendments covers four of them: Montana's SB 297 (from 1 October 2025) lowered its threshold and removed the cure period, Colorado's SB 25-276 (from 1 October 2025) added sensitive data categories, Oregon's HB 2008 (from 1 January 2026) bans the sale of precise geolocation data and of data from consumers under 16, and Connecticut's SB 1295 (from 1 July 2026) lowered its threshold to 35,000 consumers and bans selling the data of, or targeting ads at, consumers under 18.

Applicability thresholds compared

Not every business falls under every law. Each state sets its own thresholds based on the volume of personal data processed and, in some cases, revenue derived from selling that data.

The Virginia template uses a two-pronged test: personal data of at least 100,000 state residents in a year, or 25,000 residents plus more than 50% of gross revenue from selling personal data. Many later laws copied the structure with their own numbers, and the trend is downwards. Montana's threshold fell to 25,000 consumers on 1 October 2025, Connecticut's to 35,000 on 1 July 2026, and Vermont's 2028 law starts at 35,000. Alabama's 2027 law applies above 25,000 consumers, or to any business earning more than 25% of gross revenue from selling personal data.

Several states diverge from that pattern. Rhode Island's law sets notably low thresholds: 35,000 consumers, or 10,000 if more than 20% of revenue comes from data sales. Texas and Nebraska take a different approach entirely, applying to businesses that process or sell personal data and are not small businesses under the US Small Business Administration definition. In Nebraska, even a small business needs consent before it sells sensitive data.

California remains unique. The CCPA applies to for-profit businesses that meet any one of three criteria: annual gross revenue above $26,625,000 (adjusted on 1 January 2025), buying, selling or sharing the personal information of 100,000 or more consumers or households, or deriving 50% or more of annual revenue from selling or sharing personal information.

Opt-out rights: what consumers can refuse

Every US state privacy law gives consumers the right to opt out of the sale of their personal data. Most also cover targeted advertising and, to varying degrees, profiling.

California's framework is the broadest, covering both "sale" and "sharing" of personal information, where sharing specifically means cross-context behavioural advertising. The CCPA opt-out requirements also mandate a visible "Do Not Sell or Share My Personal Information" link on your website.

The Virginia-model states, which include Colorado, Connecticut, Indiana, Kentucky, Montana, Oregon and others, provide three distinct opt-out rights: sale of personal data, targeted advertising and certain types of profiling. Iowa is the narrowest, covering only sale and targeted advertising without a profiling opt-out.

Youth consent requirements

States vary on when opt-in consent is required for younger users. California requires opt-in consent for selling or sharing the data of consumers under 16. New Jersey raises this to 17, while Delaware sets the bar at 18.

Some states now ban rather than allow with consent. Maryland restricts the sale of personal data of minors under 18 and prohibits targeted advertising directed at them. Since 1 July 2026, Connecticut bans selling the data of consumers under 18 or using it for targeted advertising, and since 1 January 2026 Oregon bans selling the data of consumers under 16.

Global Privacy Control and universal opt-out signals

Global Privacy Control (GPC) is a browser-level signal that tells websites a visitor wants to opt out of the sale or sharing of their personal data. A growing list of states requires businesses to honour it.

The states with mandatory GPC or universal opt-out signal recognition are California, Colorado, Connecticut, Delaware, Minnesota, Montana, New Hampshire, New Jersey, Oregon and Texas, with Nebraska requiring it under a condition its own law sets; Maryland lists the signal as one permitted way to offer the opt-out. That is 12 of the 19 laws in force.

On 9 September 2025, the California Privacy Protection Agency and the Attorneys General of California, Colorado and Connecticut announced a joint investigative sweep of businesses that may not be honouring GPC opt-outs. If your website receives traffic from these states, implementing GPC detection is not optional.

The remaining states do not yet require universal opt-out signal recognition. Utah and Iowa, for example, do not mandate GPC support, and neither Oklahoma's nor Alabama's 2027 law adds a universal opt-out requirement.

Enforcement and penalties

Every state privacy law is enforced by the state Attorney General. California is the only state that also has a dedicated enforcement agency, the California Privacy Protection Agency (CPPA).

Many laws started with a cure period, typically 30 to 60 days, during which businesses could remedy a violation before facing penalties. Several have ended. Colorado's cure period expired on 1 January 2025, Montana removed its cure period on 1 October 2025, and Delaware's mandatory cure period ended on 31 December 2025. Others are permanent: Virginia's enforcement section still requires 30 days' notice and a chance to cure, and Iowa gives 90 days.

Maximum civil penalties are set state by state. Virginia, Iowa and Oklahoma allow up to $7,500 per violation, Alabama up to $15,000, and California up to $2,663, or $7,988 for intentional violations and those involving known minors under 16. Some states set penalties through their consumer protection acts instead, so the cap depends on that law. Because fines count per violation, the cumulative effect across many consumers can be substantial.

Key differences at a glance

Texas and Nebraska follow the Virginia model on opt-out rights but have no numeric threshold: they apply to any business that processes personal data and is not a small business. Texas requires businesses to honour opt-out signals, Nebraska does so under a condition, and both give a 30-day cure period.

What this means for your website

If your website attracts visitors from multiple US states, you are almost certainly subject to at least one of these laws. The practical approach is to build your consent mechanism around the strictest requirements and apply it broadly.

Start by scanning your site to identify every cookie and tracker in use. A free cookie scan shows what third-party scripts are loading and which ones set non-essential cookies like _ga, _fbp or _gcl_au.

Configure your cookie banner to detect visitor location and apply the consent model you choose for each region. For US visitors from states with privacy laws, this means honouring opt-out requests and recognising GPC signals where required. For visitors from states without privacy laws, you may still want to provide an opt-out as a matter of good practice, and because new laws continue to pass each year.

Short answers on US state privacy laws

Know exactly what your website stores

Most sites set more cookies than their owners expect. Run a scan to see the full picture: Kukie.io sorts the cookies it finds into categories, collects visitors' choices with region rules for each state you serve, and keeps a record of every consent.

Start free