What must my privacy notice contain under US state privacy laws?

Controller, Online retailer, Online service, SME

Businesses and controllers covered by the California, Virginia, Colorado, Connecticut, Texas or Oregon privacy law.

Yes, a reasonably accessible privacy notice is required.

Disclose categories of personal data, purposes, categories shared with third parties, consumer rights and how to exercise and appeal them; under the CCPA also give notice at collection and retention periods.

medium (civil_penalty_per_violation)

Penalty amounts are adjusted for inflation: current amounts.

1. List the categories of personal data
2. State purposes and retention (CCPA)
3. Describe each consumer right and request method
4. Describe the appeal process
5. Give notice at or before collection (CCPA)

At or before the point of collection (CCPA 1798.100); the notice must be kept current.

• Cal. Civ. Code 1798.100(a)
• Va. Code 59.1-578(C)

sha256 89a720fe38462969b9a8421944905659f60d59b47bcfa9a2289f0a907a7c774c · read 2026-10-15 · Source: NovaCopilot

• CA, CCPA as amended by CPRA · threshold: Revenue threshold (inflation adjusted), 100,000 or more consumers or households, or 50 percent or more of revenue from selling or sharing personal information. · regulator: California Privacy Protection Agency and California Attorney General · max civil penalty: 2,500 dollars per violation, 7,500 dollars per intentional violation or violation involving minors under 16, adjusted for inflation (1798.155, 1798.199.90)
• VA, Virginia Consumer Data Protection Act · threshold: 100,000 consumers, or 25,000 consumers with more than half of gross revenue from the sale of personal data. · regulator: Virginia Attorney General · max civil penalty: 7,500 dollars per violation (59.1-584)
• CO, Colorado Privacy Act · threshold: 100,000 consumers, or 25,000 consumers with revenue or a discount from the sale of personal data. · regulator: Colorado Attorney General and district attorneys · max civil penalty: not in register
• CT, Connecticut Data Privacy Act · threshold: 100,000 consumers, or 25,000 consumers with more than a quarter of gross revenue from the sale of personal data. · regulator: Connecticut Attorney General · max civil penalty: not in register
• TX, Texas Data Privacy and Security Act · threshold: No consumer number threshold. Applies to entities doing business in Texas that are not a small business under the SBA definition. · regulator: Texas Attorney General · max civil penalty: 7,500 dollars per violation (541.155)
• OR, Oregon Consumer Privacy Act · threshold: 100,000 consumers, or 25,000 consumers with more than a quarter of annual revenue from the sale of personal data. · regulator: Oregon Attorney General · max civil penalty: 7,500 dollars per violation (646A.589)

GDPR Art. 13GDPR Art. 14crosswalk

• What is notice at collection under the CCPA?
• Does the California privacy law apply to my business?
• Do I need parental consent to collect data from children?
• What must a clinic do after a health data breach?
• Must I report a data breach to the authority?

• agent:eu:business:gdpr-access-request (business_agent)
• agent:eu:business:gdpr-breach-72h (business_agent)
• agent:eu:business:gdpr-records (business_agent)
• agent:us:business:ccpa-consumer-requests (business_agent)
• agent:us:business:coppa-parental-consent (business_agent)
• agent:us:business:hipaa-breach-notification (business_agent)
• agent:us:business:privacy-access-request (business_agent)
• agent:us:business:privacy-consumer-request (business_agent)
• agent:us:business:privacy-deletion (business_agent)
• agent:us:business:privacy-opt-out (business_agent)