Do US privacy laws apply to a small business?
Often not by size alone, but frequently by volume or by sector. The state laws use revenue and consumer count thresholds that many small companies stay below, while health, financial and biometric rules apply with no size threshold at all.
The answer differs between the federal level and the states, see the rows below.
The answer by level
Threshold
California applies its consumer privacy law to a business that meets a revenue test, a volume test on personal information, or a revenue share from selling or sharing personal information.
Cal. Civ. Code § 1798.100 et seq.State level
Most other state laws apply from a volume of consumers whose data is processed in a calendar year, with a lower threshold where personal data is sold.
Va. Code §§ 59.1-575 to 59.1-585Federal level
Sector rules apply regardless of size where the data is health, financial or biometric, and a small vendor to a covered entity is bound through its contract.
13 CFR Part 121, small business size regulations
Source lines
- The California law applies on a revenue test, a volume test, or a revenue share from selling or sharing personal information.
- Other state laws apply from a stated number of consumers processed in a calendar year, with a lower figure where data is sold.
- Sector rules on health, financial and biometric data contain no small business exemption, and reach vendors through the contract.
What it means for the company
The threshold test is repeated every year and can be crossed by growth alone. Documenting the count is what makes the exemption defensible later.
| Level | Requirement | Source |
|---|---|---|
| Threshold | California applies its consumer privacy law to a business that meets a revenue test, a volume test on personal information, or a revenue share from selling or sharing personal information. | Cal. Civ. Code § 1798.100 et seq. |
| State level | Most other state laws apply from a volume of consumers whose data is processed in a calendar year, with a lower threshold where personal data is sold. | Va. Code §§ 59.1-575 to 59.1-585 |
| Federal level | Sector rules apply regardless of size where the data is health, financial or biometric, and a small vendor to a covered entity is bound through its contract. | 13 CFR Part 121, small business size regulations |
Threshold by state
| State | Threshold as written | Applies from | Source |
|---|---|---|---|
| Virginia | 100,000 consumers, or 25,000 consumers with more than half of gross revenue from the sale of personal data. | 2023-01-01 | Va. Code §§ 59.1-575 to 59.1-585 |
| Colorado | 100,000 consumers, or 25,000 consumers with revenue or a discount from the sale of personal data. | 2023-07-01 | Colo. Rev. Stat. §§ 6-1-1301 to 6-1-1313 |
| Connecticut | 100,000 consumers, or 25,000 consumers with more than a quarter of gross revenue from the sale of personal data. | 2023-07-01 | Conn. Gen. Stat. §§ 42-515 to 42-525 |
| Utah | Annual revenue of 25,000,000 dollars or more, together with a consumer volume threshold. | 2023-12-31 | Utah Code §§ 13-61-101 to 13-61-404 |
| Iowa | 100,000 consumers, or 25,000 consumers with revenue from the sale of personal data. | 2025-01-01 | Iowa Code ch. 715D |
| Indiana | 100,000 consumers, or 25,000 consumers with more than half of gross revenue from the sale of personal data. | 2026-01-01 | Ind. Code § 24-15 |
| Tennessee | Revenue above 25,000,000 dollars together with a consumer volume threshold. | 2025-07-01 | Tenn. Code § 47-18-3201 et seq. |
| Montana | 50,000 consumers, or 25,000 consumers with revenue from the sale of personal data. | 2024-10-01 | Mont. Code § 30-14-2801 et seq. |
| Texas | No consumer number threshold. Applies to any entity doing business in Texas that is not a small business under the SBA definition. | 2024-07-01 | Tex. Bus. & Com. Code ch. 541 |
| Oregon | 100,000 consumers, or 25,000 consumers with more than a quarter of annual revenue from the sale of personal data. | 2024-07-01 | Or. Rev. Stat. §§ 646A.570 to 646A.589 |
| Delaware | 35,000 consumers, or 10,000 consumers with more than a fifth of gross revenue from the sale of personal data. | 2025-01-01 | Del. Code tit. 6, ch. 12D |
| New Jersey | 100,000 consumers, or 25,000 consumers where the controller receives any benefit from the sale of personal data. | 2025-01-15 | N.J.S.A. 56:8-166.4 et seq. |
| New Hampshire | 35,000 consumers, or 10,000 consumers with more than a quarter of gross revenue from the sale of personal data. | 2025-01-01 | N.H. Rev. Stat. ch. 507-H |
| Kentucky | 100,000 consumers, or 25,000 consumers with more than half of gross revenue from the sale of personal data. | 2026-01-01 | Ky. Rev. Stat. §§ 367.3611 to 367.3639 |
| Nebraska | No consumer number threshold. Applies to entities that are not small businesses under the SBA definition. | 2025-01-01 | Neb. Rev. Stat. § 87-1101 et seq. |
| Maryland | 35,000 consumers, or 10,000 consumers with more than a fifth of gross revenue from the sale of personal data. | 2025-10-01 | Md. Code, Com. Law § 14-4601 et seq. |
| Minnesota | 100,000 consumers, or 25,000 consumers with more than a quarter of gross revenue from the sale of personal data. | 2025-07-31 | Minn. Stat. § 325O.01 et seq. |
| Rhode Island | 35,000 customers, or 10,000 customers with more than a fifth of gross revenue from the sale of personal data. | 2026-01-01 | R.I. Gen. Laws ch. 6-48.1 |
| Florida | Global gross revenue above 1,000,000,000 dollars together with one of the stated business criteria. | 2024-07-01 | Fla. Stat. § 501.701 et seq. |
What it means for the individual
A consumer's rights depend on the company crossing a threshold, except for biometric and health data, where the protection does not depend on company size.
Source lines
- California Consumer Privacy Act, as amended by the CPRACal. Civ. Code § 1798.100 et seq. · read 2026-08-25 · proof 1a93a249ab168b99
- Virginia consumer data privacy actVa. Code §§ 59.1-575 to 59.1-585 · read 2026-08-25 · proof 1a93a249ab168b99
- Electronic Code of Federal Regulations13 CFR Part 121, small business size regulations · read 2026-08-25 · proof 1a93a249ab168b99Official source
Next step
Count consumers and revenue per state annually, and treat health, financial and biometric processing as in scope regardless of the count.
This page reports what the sources say, with the identifier and address of the publisher. It is not legal advice and does not decide an individual matter.
Next step
Three ways to put the register to work in your own practice.
Start with your task
Litigation
Find support in a judgment
Search guiding decisions, see what became final and follow changes in the law.
In-house, deals
Map the rules in a transaction
Move from theme to act and on to the article that carries the duty.
Compliance
Assess the risk in a process
Risk scoring per legal area, with the sources behind every score.