All regulations / US Privacy
US state privacy laws
Know the rule before it knows you.
No federal privacy law, so around twenty states have written their own.
What it is
A growing set of state laws grants residents rights of access, deletion, correction and opt-out of targeted advertising, sales and profiling, and requires data protection assessments for high-risk processing. Thresholds, definitions and enforcement vary by state, but a GDPR-grade programme covers most of the ground.
This applies to you if
- You serve consumers in several US states and meet the state's volume or revenue thresholds
- You run targeted advertising or sell data
- You process sensitive data such as health, precise location or children's data
What it asks of you
- Privacy notices and rights processes; universal opt-out signals in several states
- Consent for sensitive data; data protection assessments
- Contracts with processors; data minimisation and purpose limitation
What it costs to ignore
Attorney General enforcement with per-violation penalties; some states allow cure periods.
Key dates
Rolling effective dates from 2023 through 2026.
How we help
Not sure which apply to you? Send us three lines about what you sell and to whom, and we will tell you which rules matter and which do not.
Have a regulatory question?
Send a short description of your situation. We reply within one working day, usually with a view on scope and a fixed fee where possible.