US State Data Privacy Laws: CCPA, CPRA and Beyond

The United States has no comprehensive federal privacy law. Instead, businesses operating in or selling to US consumers must navigate a growing and inconsistent patchwork of state-level privacy laws. California led the way with the CCPA in 2018; by 2025, more than 20 states have enacted or are enacting comprehensive privacy legislation. Here is what you need to know.

Why there is no US federal privacy law

Unlike the EU and UK, the US has taken a sectoral approach to privacy - specific laws cover healthcare data (HIPAA), financial data (GLBA), children's data (COPPA) and credit information (FCRA), but there is no general law covering all personal data. Repeated attempts to pass federal privacy legislation have stalled in Congress.

This means businesses must assess their obligations on a state-by-state basis, based on where their consumers are located - not where the business is headquartered. A business based in Texas that sells to California residents must comply with California's law.

California: CPRA (the successor to CCPA)

California's Consumer Privacy Rights Act (CPRA), which replaced and strengthened the California Consumer Privacy Act (CCPA), is the most comprehensive US state privacy law and the most likely to affect international businesses.

Key thresholds - the CPRA applies to for-profit businesses that do business in California AND meet one of: annual gross revenue over $25 million; buy, sell or share the personal information of 100,000+ consumers/households per year; or derive 50%+ of annual revenue from selling personal information.

• Right to know: consumers can request disclosure of what personal information is collected about them
• Right to delete: consumers can request deletion of their personal information (with exceptions)
• Right to opt-out: consumers can opt out of the sale or sharing of their personal information
• Right to correct: consumers can request correction of inaccurate personal information
• Right to limit use of sensitive personal information
• Enforcement: the California Privacy Protection Agency (CPPA) can impose fines of up to $7,500 per intentional violation

Other state laws in force

A growing number of states have passed comprehensive privacy laws modelled partly on the CPRA. Key ones include:

• Virginia Consumer Data Protection Act (CDPA): in force January 2023. Applies to businesses controlling or processing personal data of 100,000+ Virginians, or 25,000+ Virginians where 50%+ revenue derives from data sales
• Colorado Privacy Act (CPA): in force July 2023. Similar thresholds to Virginia. Includes a universal opt-out mechanism requirement
• Connecticut Data Privacy Act (CTDPA): in force July 2023
• Utah Consumer Privacy Act (UCPA): in force December 2023 - more business-friendly, fewer consumer rights
• Texas Data Privacy and Security Act: in force July 2024
• Montana, Iowa, Indiana, Tennessee, Oregon, Delaware: all enacted laws taking effect between 2024 and 2026

What applies to your business

To assess your exposure:

• Map where your customers are located - state privacy laws are triggered by the location of consumers, not the business
• Check the specific thresholds for each state - most have revenue or volume thresholds below which they do not apply
• Identify whether you sell or share personal data for advertising purposes - this triggers additional obligations in most states
• Review your privacy notice - it must disclose the categories of data collected, the purposes, and consumer rights under applicable law
• Assess your data broker status - some states require registration and impose specific obligations on businesses that sell data

Building a multi-state compliance approach

The practical approach for most businesses is to identify the most demanding law that applies to them - usually California - and use it as the baseline. This avoids the complexity of managing different standards for different states.

• Implement a universal privacy notice that discloses your data practices clearly
• Build a consumer rights fulfilment process for access, deletion and correction requests
• Implement a 'Do Not Sell or Share' mechanism if you engage in cross-context behavioural advertising
• Maintain a data inventory - you cannot respond to rights requests if you do not know what data you hold
• Sign data processing agreements with all third-party service providers who process personal data on your behalf

Back to all guides