Which US state privacy laws apply to my company?
There is no general federal privacy law in the United States. Application is decided state by state, by where your customers live and by the threshold each state statute sets, not by where your company is established.
The answer differs between the federal level and the states, see the rows below.
The answer by level
Federal level
There is no general federal privacy statute. Sector rules apply instead, and the FTC acts against unfair or deceptive practices under Section 5.
15 U.S.C. § 45California
Applies to a for-profit business doing business in California that meets one of the thresholds in Civ. Code § 1798.140(d), wherever the business is established.
Cal. Civ. Code § 1798.100 et seq.Virginia
Applies to controllers processing data on 100,000 Virginia consumers, or 25,000 where more than half of revenue comes from selling data.
Va. Code §§ 59.1-575 to 59.1-585Texas
Texas has no numeric threshold. The act covers anyone doing business in Texas who processes personal data and is not a small business under the SBA definition.
Tex. Bus. & Com. Code ch. 541
Source lines
- California applies its statute to a for-profit business doing business in the state that meets one of the thresholds in Civ. Code § 1798.140(d).
- Virginia, Colorado and most later states use a volume threshold, commonly 100,000 residents, or 25,000 combined with revenue from selling personal data.
- Texas removed the volume threshold and instead exempts small businesses as defined by the US Small Business Administration.
What it means for the company
Count residents per state rather than customers in total, because a single state can bring you into scope while the others do not.
| Level | Requirement | Source |
|---|---|---|
| Federal level | There is no general federal privacy statute. Sector rules apply instead, and the FTC acts against unfair or deceptive practices under Section 5. | 15 U.S.C. § 45 |
| California | Applies to a for-profit business doing business in California that meets one of the thresholds in Civ. Code § 1798.140(d), wherever the business is established. | Cal. Civ. Code § 1798.100 et seq. |
| Virginia | Applies to controllers processing data on 100,000 Virginia consumers, or 25,000 where more than half of revenue comes from selling data. | Va. Code §§ 59.1-575 to 59.1-585 |
| Texas | Texas has no numeric threshold. The act covers anyone doing business in Texas who processes personal data and is not a small business under the SBA definition. | Tex. Bus. & Com. Code ch. 541 |
Threshold by state
| State | Threshold as written | Applies from | Source |
|---|---|---|---|
| Virginia | 100,000 consumers, or 25,000 consumers with more than half of gross revenue from the sale of personal data. | 2023-01-01 | Va. Code §§ 59.1-575 to 59.1-585 |
| Colorado | 100,000 consumers, or 25,000 consumers with revenue or a discount from the sale of personal data. | 2023-07-01 | Colo. Rev. Stat. §§ 6-1-1301 to 6-1-1313 |
| Connecticut | 100,000 consumers, or 25,000 consumers with more than a quarter of gross revenue from the sale of personal data. | 2023-07-01 | Conn. Gen. Stat. §§ 42-515 to 42-525 |
| Utah | Annual revenue of 25,000,000 dollars or more, together with a consumer volume threshold. | 2023-12-31 | Utah Code §§ 13-61-101 to 13-61-404 |
| Iowa | 100,000 consumers, or 25,000 consumers with revenue from the sale of personal data. | 2025-01-01 | Iowa Code ch. 715D |
| Indiana | 100,000 consumers, or 25,000 consumers with more than half of gross revenue from the sale of personal data. | 2026-01-01 | Ind. Code § 24-15 |
| Tennessee | Revenue above 25,000,000 dollars together with a consumer volume threshold. | 2025-07-01 | Tenn. Code § 47-18-3201 et seq. |
| Montana | 50,000 consumers, or 25,000 consumers with revenue from the sale of personal data. | 2024-10-01 | Mont. Code § 30-14-2801 et seq. |
| Texas | No consumer number threshold. Applies to any entity doing business in Texas that is not a small business under the SBA definition. | 2024-07-01 | Tex. Bus. & Com. Code ch. 541 |
| Oregon | 100,000 consumers, or 25,000 consumers with more than a quarter of annual revenue from the sale of personal data. | 2024-07-01 | Or. Rev. Stat. §§ 646A.570 to 646A.589 |
| Delaware | 35,000 consumers, or 10,000 consumers with more than a fifth of gross revenue from the sale of personal data. | 2025-01-01 | Del. Code tit. 6, ch. 12D |
| New Jersey | 100,000 consumers, or 25,000 consumers where the controller receives any benefit from the sale of personal data. | 2025-01-15 | N.J.S.A. 56:8-166.4 et seq. |
| New Hampshire | 35,000 consumers, or 10,000 consumers with more than a quarter of gross revenue from the sale of personal data. | 2025-01-01 | N.H. Rev. Stat. ch. 507-H |
| Kentucky | 100,000 consumers, or 25,000 consumers with more than half of gross revenue from the sale of personal data. | 2026-01-01 | Ky. Rev. Stat. §§ 367.3611 to 367.3639 |
| Nebraska | No consumer number threshold. Applies to entities that are not small businesses under the SBA definition. | 2025-01-01 | Neb. Rev. Stat. § 87-1101 et seq. |
| Maryland | 35,000 consumers, or 10,000 consumers with more than a fifth of gross revenue from the sale of personal data. | 2025-10-01 | Md. Code, Com. Law § 14-4601 et seq. |
| Minnesota | 100,000 consumers, or 25,000 consumers with more than a quarter of gross revenue from the sale of personal data. | 2025-07-31 | Minn. Stat. § 325O.01 et seq. |
| Rhode Island | 35,000 customers, or 10,000 customers with more than a fifth of gross revenue from the sale of personal data. | 2026-01-01 | R.I. Gen. Laws ch. 6-48.1 |
| Florida | Global gross revenue above 1,000,000,000 dollars together with one of the stated business criteria. | 2024-07-01 | Fla. Stat. § 501.701 et seq. |
What it means for the individual
Your rights follow the state you live in, so the same company can owe you more in one state than in another.
Source lines
- California Consumer Privacy Act, as amended by the CPRACal. Civ. Code § 1798.100 et seq. · read 2026-08-25 · proof 98af384978413454
- Virginia consumer data privacy actVa. Code §§ 59.1-575 to 59.1-585 · read 2026-08-25 · proof 98af384978413454
- Colorado consumer data privacy actColo. Rev. Stat. §§ 6-1-1301 to 6-1-1313 · read 2026-08-25 · proof 98af384978413454
- Texas consumer data privacy actTex. Bus. & Com. Code ch. 541 · read 2026-08-25 · proof 98af384978413454
Next step
Read the threshold matrix below, mark the states where you pass, and work from those statutes rather than from a generic US policy.
This page reports what the sources say, with the identifier and address of the publisher. It is not legal advice and does not decide an individual matter.
Next step
Three ways to put the register to work in your own practice.
Start with your task
Litigation
Find support in a judgment
Search guiding decisions, see what became final and follow changes in the law.
In-house, deals
Map the rules in a transaction
Move from theme to act and on to the article that carries the duty.
Compliance
Assess the risk in a process
Risk scoring per legal area, with the sources behind every score.