How must my business handle consumer privacy requests in the United States?

Controller, Online retailer, Online service, SME

Businesses and controllers meeting the applicability thresholds of the California, Virginia, Colorado, Connecticut, Texas or Oregon privacy law. Thresholds differ per state; see state_matrix.

If a threshold is met, consumer requests must be received through designated methods, verified and answered within the statutory deadline.

Offer request methods, authenticate requests, respond within 45 days and provide an appeal process where the state law requires one (VA, CO, CT, TX, OR).

medium (civil_penalty_per_violation)

Penalty amounts are adjusted for inflation: current amounts.

1. Check each state threshold
2. Publish at least two request methods
3. Authenticate requests
4. Answer within 45 days or notify a single 45-day extension
5. Set up an appeal process for non-California states

45 days from receipt, extendable once by 45 days with notice to the consumer, in all six laws.

• Cal. Civ. Code 1798.130(a)(2)
• Va. Code 59.1-577(B)
• Tex. Bus. & Com. Code 541.052

sha256 e94a07d9b373698581ae7434b726c181460a79d1d8b3894f04ec93b4df6b2d96 · read 2026-10-15 · Source: NovaCopilot

• CA, CCPA as amended by CPRA · threshold: Revenue threshold (inflation adjusted), 100,000 or more consumers or households, or 50 percent or more of revenue from selling or sharing personal information. · response deadline: 45 days · extension: One extension of 45 days with notice · regulator: California Privacy Protection Agency and California Attorney General · cure period: No statutory cure period for CPPA enforcement
• VA, Virginia Consumer Data Protection Act · threshold: 100,000 consumers, or 25,000 consumers with more than half of gross revenue from the sale of personal data. · response deadline: 45 days · extension: One extension of 45 days when reasonably necessary · regulator: Virginia Attorney General · cure period: not in register
• CO, Colorado Privacy Act · threshold: 100,000 consumers, or 25,000 consumers with revenue or a discount from the sale of personal data. · response deadline: 45 days · extension: One extension of 45 days when reasonably necessary · regulator: Colorado Attorney General and district attorneys · cure period: 60-day cure period ended 1 January 2025
• CT, Connecticut Data Privacy Act · threshold: 100,000 consumers, or 25,000 consumers with more than a quarter of gross revenue from the sale of personal data. · response deadline: 45 days · extension: One extension of 45 days when reasonably necessary · regulator: Connecticut Attorney General · cure period: Mandatory cure period ended 31 December 2024
• TX, Texas Data Privacy and Security Act · threshold: No consumer number threshold. Applies to entities doing business in Texas that are not a small business under the SBA definition. · response deadline: 45 days · extension: One extension of 45 days when reasonably necessary · regulator: Texas Attorney General · cure period: 30-day cure period (541.154)
• OR, Oregon Consumer Privacy Act · threshold: 100,000 consumers, or 25,000 consumers with more than a quarter of annual revenue from the sale of personal data. · response deadline: 45 days · extension: One extension of 45 days when reasonably necessary · regulator: Oregon Attorney General · cure period: 30-day cure period until 1 January 2026

GDPR Art. 12crosswalk

• Which US states require an appeal process for privacy requests?
• Does the California privacy law apply to my business?
• Do I need parental consent to collect data from children?
• What must a clinic do after a health data breach?
• Must I report a data breach to the authority?

• agent:eu:business:gdpr-access-request (business_agent)
• agent:eu:business:gdpr-breach-72h (business_agent)
• agent:eu:business:gdpr-records (business_agent)
• agent:us:business:ccpa-consumer-requests (business_agent)
• agent:us:business:coppa-parental-consent (business_agent)
• agent:us:business:hipaa-breach-notification (business_agent)
• agent:us:business:privacy-access-request (business_agent)
• agent:us:business:privacy-deletion (business_agent)
• agent:us:business:privacy-notice (business_agent)
• agent:us:business:privacy-opt-out (business_agent)