US State Privacy Laws: A Compliance Guide for 2026

Last updated: 22 October 2026

Quick answer: The United States has no comprehensive federal privacy law. Instead, around 20 states have passed their own consumer privacy laws, led by California’s CCPA as amended by the CPRA. Most share a common core: consumer rights to access, delete, correct and port data, opt-outs from sale, targeted advertising and profiling, and duties around sensitive data, assessments and processor contracts. The practical way to comply is one programme built to the strictest common requirements, with state-specific rules layered on top.

US privacy compliance used to mean California and little else. That is no longer the case. Since Virginia’s law took effect in 2023, states have passed comprehensive privacy laws at a steady pace, and Indiana, Kentucky and Rhode Island joined the list on 1 January 2026.

The laws are similar enough for one programme to cover most of them, but thresholds, cure periods, sensitive data rules and opt-out signal requirements all vary.

California has also moved further ahead. New regulations on cybersecurity audits, risk assessments and automated decision-making technology (ADMT) took effect in 2026, and the Delete Act has created a single deletion platform that data brokers must process.

Is there a federal privacy law in the US?

No. There is no comprehensive federal consumer privacy law. Federal privacy rules are sector-specific, such as HIPAA for health information, GLBA for financial institutions and COPPA for children’s data online, and the Federal Trade Commission polices unfair and deceptive practices more generally.

Federal bills have been proposed several times, but none has passed. States have filled the gap, each with its own scope, thresholds, exemptions and enforcement model.

Sector laws still apply alongside the state laws. Many state laws exempt data or entities covered by HIPAA or GLBA, but the exemptions differ by state. Our guide to GRC software for US companies covers how state privacy laws sit alongside SOC 2, HIPAA, SOX and NIST.

Which US states have comprehensive privacy laws?

Around 20 states now have comprehensive consumer privacy laws. The main ones in force by 2026 are:

• California: CCPA, as amended by the CPRA
• In force from 2023: Virginia, Colorado, Connecticut and Utah
• In force from 2024: Texas, Oregon and Montana
• In force from 2025: Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota and Maryland
• In force from 1 January 2026: Indiana, Kentucky and Rhode Island

Counts vary because some states have narrower laws (Florida’s applies only to very large companies) and legislatures keep amending them, so confirm the current position for the states where you have customers.

Most of these laws follow the Virginia model: controllers and processors, a set of consumer rights, opt-outs and consent for sensitive data. California is the main outlier, with a broader definition of consumer, its own regulator and far more detailed regulations.

What does the CCPA/CPRA require?

The California Consumer Privacy Act took effect in 2020. The California Privacy Rights Act, approved by voters in November 2020, amended and expanded it from 2023 and created the California Privacy Protection Agency (CPPA), which shares enforcement with the California Attorney General.

Who is covered?

The CCPA applies to for-profit businesses that do business in California and meet at least one of these tests:

• annual gross revenue above a threshold that started at $25 million and is adjusted for inflation;
• buying, selling or sharing the personal information of 100,000 or more California consumers or households; or
• deriving 50% or more of annual revenue from selling or sharing personal information.

Unlike most other state laws, the CCPA covers employee, job applicant and business-to-business personal information. That makes it relevant to HR and sales operations, not only to consumer-facing teams.

Core CCPA obligations

• Notice at collection and a detailed privacy policy, updated at least every 12 months.
• Rights to know, delete, correct, opt out of sale or sharing, and limit the use of sensitive personal information.
• “Do Not Sell or Share My Personal Information” and “Limit the Use of My Sensitive Personal Information” links, or an alternative opt-out link, where required.
• Honouring opt-out preference signals such as Global Privacy Control (GPC) as a valid opt-out request.
• Contracts with service providers, contractors and third parties containing the terms the law specifies.
• Data minimisation and purpose limitation: collection and use must be reasonably necessary and proportionate.
• Reasonable security. Consumers have a private right of action for certain data breaches caused by a failure to maintain reasonable security.

You can find the statute and enforcement updates on the California Attorney General’s CCPA page and the regulations on the CPPA website. For how Enactia maps these requirements, see the CCPA (California) framework page.

What are the new CCPA rules on cybersecurity audits, risk assessments and ADMT?

In 2025 the CPPA finalised a major package of regulations covering three new areas: cybersecurity audits, risk assessments and automated decision-making technology. They took effect on 1 January 2026, but the obligations are phased in over several years, with deadlines that depend on the obligation and, for audits, on the size of the business.

Cybersecurity audits

Businesses whose processing presents significant risk to consumers’ security, based on criteria such as revenue and the volume of personal or sensitive personal information processed, must complete an annual independent cybersecurity audit. The auditor can be internal or external but must be qualified, objective and independent. The audit assesses the business’s cybersecurity programme against a list of components set out in the regulations, such as authentication, encryption, access controls, asset inventories, vulnerability management, incident response and staff training. A member of executive management must certify completion to the CPPA.

Risk assessments

Businesses must carry out a risk assessment before processing that presents significant risk to consumers’ privacy. This includes selling or sharing personal information, processing sensitive personal information, using ADMT for significant decisions and certain other uses such as training ADMT. The assessment weighs the benefits of the processing against the risks to consumers and must be reviewed and updated. Businesses submit information about their assessments to the CPPA, including an attestation by an executive.

Automated decision-making technology

Businesses that use ADMT to make significant decisions about consumers, such as decisions about financial or lending services, housing, education, employment or healthcare, must:

• give consumers a pre-use notice explaining how the technology is used;
• offer a right to opt out of the use of ADMT, subject to defined exceptions such as offering a human appeal; and
• respond to requests for access to information about how the ADMT is used and its outcome for that consumer.

The ADMT rules apply where technology replaces or substantially replaces human decision-making. Existing AI governance work, for example under ISO 42001, can often be reused.

In practice: start with an inventory. You cannot scope audits, risk assessments or ADMT obligations without knowing which systems process which categories of personal information and which make or support decisions about people.

What is the California Delete Act and the DROP platform?

The Delete Act (SB 362), signed into law in October 2023, targets data brokers: businesses that collect and sell personal information about consumers with whom they have no direct relationship. It moved the data broker registry to the CPPA and required the agency to build a single, free mechanism through which a consumer can ask every registered data broker to delete their personal information in one request.

That mechanism is the Delete Request and Opt-out Platform (DROP). Consumers have been able to submit requests since early 2026, and registered data brokers must now access the platform regularly, process deletion requests and, in general, stop selling or sharing the consumer’s data. The Act also imposes registration, disclosure and, in later years, independent audit requirements on data brokers.

The Delete Act applies to data brokers, not to every business, but check whether any part of your business meets the definition.

What rights and obligations do most state privacy laws share?

Despite their differences, the state laws share a common core. Building to this core covers most of the work.

Consumer rights

• Access: confirm whether personal data is processed and provide a copy.
• Deletion: delete personal data provided by or obtained about the consumer, subject to exceptions.
• Correction: correct inaccurate data (included in almost all laws; Utah and Iowa are notable exceptions).
• Portability: provide data in a portable, readily usable format.
• Opt-outs: opt out of the sale of personal data, targeted advertising and profiling in furtherance of decisions that produce legal or similarly significant effects.
• Appeal: most non-California laws require a process for consumers to appeal a refused request.

Most laws give businesses 45 days to respond, extendable by a further 45 days where reasonably necessary. Our guide to DSAR response times in the EU, UK and US compares the deadlines, and what a DSAR is and how to handle one covers the process end to end.

Business obligations

• Sensitive data: most states require opt-in consent before processing sensitive data such as health information, precise geolocation, racial or ethnic origin, biometric data and children’s data. California instead gives consumers a right to limit its use.
• Universal opt-out signals: a growing number of states, including California, Colorado, Connecticut and Texas, require businesses to honour browser-based signals such as GPC as an opt-out of sale and targeted advertising.
• Data protection assessments: most states require documented assessments for targeted advertising, sale, sensitive data processing and certain profiling. Utah and Iowa are the main exceptions.
• Processor contracts: contracts with processors must set out instructions, confidentiality, deletion or return of data, assistance with compliance and sub-processor terms.
• Privacy notices: clear notices describing categories of data, purposes, sharing and how to exercise rights.
• Data minimisation and security: collect what is adequate, relevant and reasonably necessary, and protect it with reasonable security measures.
• Non-discrimination: do not penalise consumers for exercising their rights.

Verification is a common weak point: confirm identity without collecting more data than the request warrants. See our guide to proportionate DSAR identity verification.

What changed on 1 January 2026: Indiana, Kentucky and Rhode Island

Three new comprehensive laws took effect on 1 January 2026.

Indiana

The Indiana Consumer Data Protection Act closely follows the Virginia model. It applies to businesses that control or process the personal data of at least 100,000 Indiana consumers, or at least 25,000 consumers while deriving more than 50% of gross revenue from the sale of personal data. It provides the standard rights, opt-in consent for sensitive data and data protection assessments, and is enforced by the Attorney General with a 30-day cure period.

Kentucky

The Kentucky Consumer Data Protection Act is also Virginia-style, with the same 100,000 and 25,000-plus-50% thresholds. It is enforced by the Attorney General and gives businesses a 30-day period to cure violations after notice.

Rhode Island

The Rhode Island Data Transparency and Privacy Protection Act has lower thresholds: 35,000 consumers, or 10,000 consumers where more than 20% of gross revenue comes from selling personal data. It has no cure period. It also has a distinctive transparency rule: commercial websites and internet service providers that collect personal data from Rhode Island customers must identify in their privacy notice the third parties to which they have sold, or may sell, personal data.

Amendments to existing laws

New laws are only part of the picture. States also amend existing laws. Connecticut, for example, passed amendments taking effect in July 2026 that lower its applicability thresholds and expand its sensitive data definition, bringing more and smaller businesses into scope. Review your scoping assessment at least annually.

How do the state privacy laws differ?

The table below compares key differences for a selection of states. It is a summary, not a substitute for the statutes, and thresholds and enforcement provisions are amended often.

Other notable differences: Maryland sets stricter data minimisation standards and prohibits the sale of sensitive data, Minnesota lets consumers question the result of certain profiling decisions, and California alone has a dedicated privacy regulator and a private right of action for data breaches.

Common mistake: scoping by headcount or revenue alone. Most states other than California use consumer counts, and the counts are per state. A mid-sized business with a large online customer base can be in scope in many states while falling under California’s revenue test.

How do you build a multi-state privacy compliance programme?

Running a separate programme for each state is not sustainable. A more practical approach is to build one programme to a strong common baseline, then manage state-specific variations as configuration.

1. Scope by state. For each state, check whether you meet its thresholds and whether any entity or data-level exemptions apply. Record the reasoning, and repeat the exercise annually or when your customer base changes.
2. Map your data once. Build an inventory of systems, processing activities, data categories (including sensitive data), sources, recipients and purposes. A record of processing activities gives you a structure that serves US laws, GDPR and ISO 27701 at the same time.
3. Set a high common baseline. Adopt the strictest common requirements across your in-scope states: opt-in consent for sensitive data, honouring GPC everywhere, assessments for all high-risk processing and an appeal process for refused requests. Exceptions are easier to manage than gaps.
4. Operationalise consumer requests. Use a single intake for all requests, with workflows that apply the right deadline, verification standard and response content by state. Keep a log for each request as evidence.
5. Run assessments to one template. Design a single assessment that satisfies the data protection assessment requirements of the Virginia-model states and California’s risk assessment rules, then add state-specific fields where needed. Our DPIA module shows how assessments can be structured and tracked.
6. Fix your contracts. Review processor, service provider and third-party contracts against the required terms, and assess vendors’ privacy and security practices. A vendor risk assessment questionnaire is a practical place to start.
7. Cross-map controls. Many requirements overlap with frameworks you may already use, such as the NIST Privacy Framework, ISO 27701 or SOC 2. Map each control to every law and framework it satisfies so one piece of evidence does several jobs.
8. Monitor and update. Assign an owner to track new laws, amendments and enforcement, and review the programme annually.

In practice: the hardest part is rarely knowing the law. It is making sure your back-end systems do what your privacy notice promises.

How can GRC software help with US state privacy compliance?

Spreadsheets and shared inboxes can work for a handful of requests in one state. As states, requests and assessments multiply, you need a system that ties together consumer request workflows with deadlines and audit trails, data mapping linked to assets and vendors, adaptable assessment templates, vendor contract and due diligence tracking, and a central risk register and evidence repository.

Enterprise privacy suites tend to suit organisations with dedicated administrators; mid-sized organisations often prioritise faster setup and combined privacy and security. Enactia combines data subject and consumer request management, ROPA, DPIA, vendor and third-party management, compliance assessments, risk and policy management in one platform, with support for the CCPA, NIST, SOC 2, HIPAA and ISO 27701.

Frequently asked questions

How many US states have comprehensive privacy laws?
Around 20 states have comprehensive consumer privacy laws, with Indiana, Kentucky and Rhode Island the most recent to take effect on 1 January 2026. Counts vary depending on whether narrower laws, such as Florida’s, are included.

Does the CCPA apply to companies outside California?
Yes. The CCPA applies to for-profit businesses that do business in California and meet one of its thresholds, wherever they are based. That includes companies headquartered in other states or outside the US.

Do I have to honour Global Privacy Control signals?
In California, Colorado, Connecticut, Texas and several other states, yes: you must treat a valid universal opt-out signal as a request to opt out of sale and, in most of those states, targeted advertising. Many organisations honour GPC nationwide because it is simpler than applying it state by state.

What is the difference between a data protection assessment and a CCPA risk assessment?
Both document the risks and benefits of high-risk processing. Data protection assessments are required by most Virginia-model state laws for activities such as targeted advertising, sale and sensitive data processing. California’s risk assessment rules, introduced in the 2025 regulations, are more detailed and include submissions to the CPPA. One well-designed template can usually serve both.

Does the Delete Act affect my business if we are not a data broker?
Not directly. Indirectly, if you buy personal information from data brokers, DROP deletion requests will reduce what they can supply.

How long do I have to respond to a consumer privacy request in the US?
Most state laws, including the CCPA, allow 45 days, with one extension of a further 45 days where reasonably necessary and the consumer is told. Opt-out requests may have shorter deadlines, so check the rules for each state.

Building a US privacy programme that scales

The US patchwork will keep growing, and California will keep adding detail. Organisations that map their data once, build to a strong common baseline and manage state differences as configuration will spend less time reacting to each new law. Enactia’s compliance assessments help you measure your posture against the CCPA alongside your other privacy and security frameworks.

To discuss your US privacy programme, contact us or book a demo or start your 14-day free trial.

This article is for general information and is not legal advice.