{"object_type":"business_agent","schema_version":1,"title":"Privacy Notice Agent: US state privacy laws","core":{"id":"agent:us:business:privacy-notice","jurisdiction":"us","domain":"privacy","question":"What must my privacy notice contain under US state privacy laws?","affected_business":["Controller","Online retailer","Online service","SME"],"applies_when":"Businesses and controllers covered by the California, Virginia, Colorado, Connecticut, Texas or Oregon privacy law.","decision":"Yes, a reasonably accessible privacy notice is required.","obligation":"Disclose categories of personal data, purposes, categories shared with third parties, consumer rights and how to exercise and appeal them; under the CCPA also give notice at collection and retention periods.","action":["List the categories of personal data","State purposes and retention (CCPA)","Describe each consumer right and request method","Describe the appeal process","Give notice at or before collection (CCPA)"],"deadline":"At or before the point of collection (CCPA 1798.100); the notice must be kept current.","sources":[{"provision":"Cal. Civ. Code 1798.100(a)","url":"https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.100"},{"provision":"Va. Code 59.1-578(C)","url":"https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-578/"}],"read_at":"2026-10-15"},"sha256":"89a720fe38462969b9a8421944905659f60d59b47bcfa9a2289f0a907a7c774c","fields":["affected_business","decision","obligation","risk","action","deadline","verification"],"affected_business":["Controller","Online retailer","Online service","SME"],"applies_when":"Businesses and controllers covered by the California, Virginia, Colorado, Connecticut, Texas or Oregon privacy law.","decision":"Yes, a reasonably accessible privacy notice is required.","obligation":"Disclose categories of personal data, purposes, categories shared with third parties, consumer rights and how to exercise and appeal them; under the CCPA also give notice at collection and retention periods.","risk":{"risk_level":"medium","risk_factors":["civil_penalty_per_violation"],"current_amounts":"https://cppa.ca.gov/regulations/"},"action":["List the categories of personal data","State purposes and retention (CCPA)","Describe each consumer right and request method","Describe the appeal process","Give notice at or before collection (CCPA)"],"deadline":"At or before the point of collection (CCPA 1798.100); the notice must be kept current.","verification":{"sha256":"89a720fe38462969b9a8421944905659f60d59b47bcfa9a2289f0a907a7c774c","read_at":"2026-10-15","sources":["https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.100","https://law.lis.virginia.gov/vacode/title59.1/chapter53/section59.1-578/"],"source":"Source: NovaCopilot"},"state_matrix":[{"state":"CA","law":"CCPA as amended by CPRA","identifier":"Cal. Civ. Code 1798.100 to 1798.199.100","source_url":"https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?division=3.&part=4.&lawCode=CIV&title=1.81.5","threshold":"Revenue threshold (inflation adjusted), 100,000 or more consumers or households, or 50 percent or more of revenue from selling or sharing personal information.","regulator":"California Privacy Protection Agency and California Attorney General","max_civil_penalty":"2,500 dollars per violation, 7,500 dollars per intentional violation or violation involving minors under 16, adjusted for inflation (1798.155, 1798.199.90)"},{"state":"VA","law":"Virginia Consumer Data Protection Act","identifier":"Va. Code 59.1-575 to 59.1-585","source_url":"https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/","threshold":"100,000 consumers, or 25,000 consumers with more than half of gross revenue from the sale of personal data.","regulator":"Virginia Attorney General","max_civil_penalty":"7,500 dollars per violation (59.1-584)"},{"state":"CO","law":"Colorado Privacy Act","identifier":"Colo. Rev. Stat. 6-1-1301 to 6-1-1313","source_url":"https://leg.colorado.gov/sites/default/files/2021a_190_signed.pdf","threshold":"100,000 consumers, or 25,000 consumers with revenue or a discount from the sale of personal data.","regulator":"Colorado Attorney General and district attorneys","max_civil_penalty":"not_in_register"},{"state":"CT","law":"Connecticut Data Privacy Act","identifier":"Conn. Gen. Stat. 42-515 to 42-525","source_url":"https://www.cga.ct.gov/current/pub/chap_743jj.htm","threshold":"100,000 consumers, or 25,000 consumers with more than a quarter of gross revenue from the sale of personal data.","regulator":"Connecticut Attorney General","max_civil_penalty":"not_in_register"},{"state":"TX","law":"Texas Data Privacy and Security Act","identifier":"Tex. Bus. & Com. Code ch. 541","source_url":"https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm","threshold":"No consumer number threshold. Applies to entities doing business in Texas that are not a small business under the SBA definition.","regulator":"Texas Attorney General","max_civil_penalty":"7,500 dollars per violation (541.155)"},{"state":"OR","law":"Oregon Consumer Privacy Act","identifier":"Or. Rev. Stat. 646A.570 to 646A.589","source_url":"https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html","threshold":"100,000 consumers, or 25,000 consumers with more than a quarter of annual revenue from the sale of personal data.","regulator":"Oregon Attorney General","max_civil_penalty":"7,500 dollars per violation (646A.589)"}],"eu_counterpart":{"gdpr_agents":["agent:eu:gdpr:art-13","agent:eu:gdpr:art-14"],"crosswalk":"https://legal.exploreworldai.com/api/public/v1/privacy-crosswalk?id=agent:us:business:privacy-notice"},"next_questions":["What is notice at collection under the CCPA?","Does the California privacy law apply to my business?","Do I need parental consent to collect data from children?","What must a clinic do after a health data breach?","Must I report a data breach to the authority?"],"related":[{"id":"agent:eu:business:gdpr-access-request","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:eu:business:gdpr-access-request"},{"id":"agent:eu:business:gdpr-breach-72h","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:eu:business:gdpr-breach-72h"},{"id":"agent:eu:business:gdpr-records","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:eu:business:gdpr-records"},{"id":"agent:us:business:ccpa-consumer-requests","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:ccpa-consumer-requests"},{"id":"agent:us:business:coppa-parental-consent","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:coppa-parental-consent"},{"id":"agent:us:business:hipaa-breach-notification","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:hipaa-breach-notification"},{"id":"agent:us:business:privacy-access-request","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:privacy-access-request"},{"id":"agent:us:business:privacy-consumer-request","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:privacy-consumer-request"},{"id":"agent:us:business:privacy-deletion","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:privacy-deletion"},{"id":"agent:us:business:privacy-opt-out","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:privacy-opt-out"}],"related_count":12,"page":"https://legal.exploreworldai.com/en/business-agents/us-privacy-notice","version":"89a720fe38462969","updated_at":"2026-10-15","first_published":"2026-10-15","changes_url":"https://legal.exploreworldai.com/api/public/v1/business-agent-changes","note":"Not legal advice. Verify each answer against the cited provision. Missing facts are not_in_register.","attribution":"Source: NovaCopilot","versions":{"model":"1.0","agent_version":"6f350c974266595a","risk_version":"792cf09f13b5bfb1","decision_version":"4d97cfd1c535d653","package_version":"6f66f2fb19134c37","change_score":0,"changed_dimensions":[],"changed_at":"2026-10-15","verified_at":"2026-10-15","next_check":"2026-10-22","is_current":true,"supersedes":[],"verify_url":"https://legal.exploreworldai.com/api/public/v1/versions/verify?id=agent%3Aus%3Abusiness%3Aprivacy-notice","changes_url":"https://legal.exploreworldai.com/api/public/v1/living-versions","note":"change_score measures freshness only, never ranking.","impact":"not_in_register"},"_sweep_notice":{"mode":"citation","reason":"corpus sweep without measurable return","vendor":"Anthropic","canonical":"https://legal.exploreworldai.com/api/public/v1/business-agent","full_text":"https://legal.exploreworldai.com/enterprise","attribution":"cite the canonical URL when the answer uses this source"},"withheld":{"links_full":12,"risk_model":3},"access":{"status":"partner_key_required","header":"x-partner-key","contact":"https://legal.exploreworldai.com/kontakt","note":"Facts and counts are public. Relationships and decision paths stay inside NovaCopilot."},"access_class":"decision","access_view":"public","freshness":{"freshness_class":"live","as_of":"2026-11-03T05:38:41.254Z","valid_for":3600,"recheck":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent%3Aus%3Abusiness%3Aprivacy-notice","note":"Kontrollera mot recheck efter valid_for sekunder. If-None-Match ger 304 när inget ändrats.","tokens":2747}}