US business questions

There is no general federal privacy law in the United States. Application is decided state by state, by where your customers live and by the threshold each state statute sets, not by where your company is established.

Cal. Civ. Code § 1798.100 et seq. · Va. Code §§ 59.1-575 to 59.1-585 · Colo. Rev. Stat. §§ 6-1-1301 to 6-1-1313 · Tex. Bus. & Com. Code ch. 541 · read 2026-08-25

In a growing group of states, yes. Where the statute recognises a universal opt-out mechanism, an automated browser signal is a legally binding request, not a preference you may weigh.

Colo. Rev. Stat. §§ 6-1-1301 to 6-1-1313 · Cal. Civ. Code § 1798.100 et seq. · Conn. Gen. Stat. §§ 42-515 to 42-525 · Tex. Bus. & Com. Code ch. 541 · read 2026-08-25

Biometric data is regulated by state law, and Illinois is the sharpest of them: written notice and a written release before collection, with a private right of action for the individual.

740 ILCS 14 · Tex. Bus. & Com. Code § 503.001 · RCW 19.373 · Colo. Rev. Stat. §§ 6-1-1301 to 6-1-1313 · read 2026-08-25

The GDPR asks for a lawful basis before processing starts; California lets processing start and gives the consumer the right to stop sale, sharing and certain uses afterwards. The compliance work is therefore ordered differently, not simply lighter.

Cal. Civ. Code § 1798.100 et seq. · Va. Code §§ 59.1-575 to 59.1-585 · 15 U.S.C. § 45 · read 2026-08-25

Exemption requires both parts to be met: the duties actually performed must fall within an exempt category, and the employee must be paid on a salary basis at the level set in the regulation. A job title alone never creates an exemption.

29 U.S.C. §§ 201 to 219, 29 CFR Parts 500 to 899 · read 2026-08-25

Federal law requires sixty calendar days of written notice, but several states require more and start at a lower headcount. The binding deadline is the longest of the ones that apply to the site in question.

29 U.S.C. §§ 2101 to 2109, 20 CFR Part 639 · read 2026-08-25

It is decided by state law. There is no federal ban in force, California voids such clauses outright, and Texas enforces them when they are ancillary to a valid agreement and reasonable in time, area and scope.

16 CFR Part 910, 89 Fed. Reg. 38342 · 15 U.S.C. § 45 · read 2026-08-25

There is no single federal AI hiring statute. Duties come from state and city law on notice, consent and bias auditing, while the federal question stays what it has always been: whether the outcome discriminates.

775 ILCS 5/2-102 · Colo. Rev. Stat. § 6-1-1701 et seq. · 42 U.S.C. §§ 2000e to 2000e-17, 29 CFR Parts 1600 to 1614 · read 2026-08-25

Within four business days of determining that the incident is material, on Form 8-K Item 1.05. The four days run from the materiality determination, not from discovery, and the determination itself must be made without unreasonable delay.

23 NYCRR Part 500 · read 2026-08-25

Individuals must be notified without unreasonable delay and no later than 60 calendar days after discovery. Breaches affecting 500 or more residents of a state also require media notice and notice to the Secretary within the same 60 days; smaller breaches are reported annually.

45 CFR Part 164, Subpart C · read 2026-08-25

No general federal statute sets the list. In practice the record is built on the four NIST functions, on the consumer protection rule that governs claims and uses, and on state statutes such as Colorado's, which requires impact assessments for high risk systems.

NIST AI 100-1 · 15 U.S.C. § 45 · read 2026-08-25

A written security program owned by a named qualified individual, built on a written risk assessment, with access controls, inventory, encryption, multi-factor authentication, secure disposal, monitoring, training, oversight of service providers, an incident response plan and an annual written report to the board.

16 CFR Part 314 · 23 NYCRR Part 500 · read 2026-08-25

Not under the federal securities rules, which were adopted and then stayed. The binding obligations today come from California's statutes for companies doing business in the state and from the federal facility reporting programme.

Release No. 33-11275, 17 CFR Parts 210, 229, 232, 239 and 249 · Cal. Health & Safety Code §§ 38532 and 38533 · 40 CFR Part 98 · read 2026-08-25

For the period set for each record type under the books and records rules, with the first two years in an easily accessible place, and stored either in a non-rewriteable format or under the audit trail alternative introduced in the 2022 amendments.

17 CFR § 240.17a-4, FINRA Rules 3110 and 4511 · read 2026-08-25

Liability comes from state entity law, taxation comes from a separate federal election. A sole proprietorship gives no liability shield; an LLC gives the shield and is taxed through the owner unless an election is filed; the S corporation is a tax election, not a separate entity form.

8 Del. C. Chapter 1 · read 2026-08-25

The obligation attaches to entities created by a filing with a state office, unless one of the 23 exemptions applies. Small companies are the target group, because the largest exemption requires more than 20 employees, more than 5 million dollars in receipts and a US office at the same time.

31 U.S.C. § 5336, 31 CFR 1010.380 · read 2026-08-25

Yes, where the activity in that state amounts to doing business there. Registration, tax nexus and sales tax nexus are three separate thresholds, tested state by state, and meeting one does not decide the others.

8 Del. C. Chapter 1 · read 2026-08-25

Four things recur: the federal employer identification number, the state annual report and franchise fee, any local business licence, and the beneficial ownership determination. Each has its own authority and its own due date.

31 U.S.C. § 5336, 31 CFR 1010.380 · read 2026-08-25

Three tests run in parallel: the tax test, the federal wage and hour test, and the state test, which in several states is the stricter three part test. A worker can be a contractor for one and an employee for another.

29 U.S.C. §§ 201 to 219, 29 CFR Parts 500 to 899 · read 2026-08-25

Wage and overtime rules apply from the first employee. Discrimination and disability duties start at 15, age discrimination at 20, family and medical leave at 50 within 75 miles, and layoff notice at 100. State law often starts lower.

29 U.S.C. §§ 201 to 219, 29 CFR Parts 500 to 899 · 42 U.S.C. §§ 2000e to 2000e-17, 29 CFR Parts 1600 to 1614 · 42 U.S.C. §§ 12111 to 12117, 29 CFR Part 1630 · 29 U.S.C. §§ 621 to 634, 29 CFR Part 1625 · 29 U.S.C. §§ 2601 to 2654, 29 CFR Part 825 · 29 U.S.C. §§ 2101 to 2109, 20 CFR Part 639 · read 2026-08-25

In almost every state, yes, and in several the duty starts at the first employee. Texas is the main exception, but an uninsured employer there loses its defences in an injury claim, which is usually the more expensive outcome.

29 U.S.C. §§ 651 to 678, 29 CFR Parts 1904 and 1910 · read 2026-08-25

The federal floor of 7.25 dollars per hour and time and a half beyond 40 hours per week, unless the state or city rate is higher, in which case that rate applies. Exemption from overtime requires the salary level and the duties test together.

29 U.S.C. §§ 201 to 219, 29 CFR Parts 500 to 899 · read 2026-08-25

When the sales into that state cross its economic threshold, measured over a rolling or calendar twelve month period, or when there is physical presence such as inventory, an employee or an office. The threshold is set separately by each state.

U.C.C. Article 2, as enacted state by state · read 2026-08-25

Income without withholding is paid in four estimated instalments during the year, and net earnings from self employment carry the social security and medicare contributions on top of income tax. Underpayment triggers an addition to tax even where the return is filed on time.

Form 1040-ES, Estimated Tax for Individuals · Schedule SE, self-employment tax, 26 U.S.C. § 1401 · 13 CFR Part 121, small business size regulations · read 2026-08-25

Four layers apply at once: the default sales law of the state, the federal prohibition of deceptive practices, the rules for recurring charges, and the conditions for a binding electronic signature. Silence in the contract does not mean absence of terms, it means the default terms apply.

U.C.C. Article 2, as enacted state by state · 15 U.S.C. § 45 · read 2026-08-25

Often not by size alone, but frequently by volume or by sector. The state laws use revenue and consumer count thresholds that many small companies stay below, while health, financial and biometric rules apply with no size threshold at all.

Cal. Civ. Code § 1798.100 et seq. · Va. Code §§ 59.1-575 to 59.1-585 · read 2026-08-25