US State Privacy Law Checker

Twenty US states enforce a comprehensive privacy law today, and four more follow by 2028. Answer a few questions to see which of them apply to your organisation.

A state’s law follows its residents, not your office address. A shop in Ohio with enough customers in Delaware answers to Delaware. So the checker asks about the people whose data you handle, and it shows the statute behind every answer. Nothing you enter leaves your browser.

How to read the result

“Likely applies” means your answers meet a threshold in the statute and none of the exemptions you ticked takes you out. “Likely doesn’t apply” is the reverse. “Depends” marks the cases a form can’t settle. Texas and Nebraska are the usual ones: they have no size threshold and exempt small businesses as the US Small Business Administration defines them, and that definition changes with your industry.

Open a row for the reason, the thresholds, who is exempt, who enforces the law and whether you get time to fix a violation before a penalty (the “right to cure”). Every row links to the statute or official page we read.

Treat the result as a first sort, not as legal advice. A law that applies brings duties this page doesn’t list, such as a privacy notice, opt-outs and answering access and deletion requests. For California, our CCPA compliance guide walks through them.

What counts, and what the checker can’t see

• People. Count residents of the state who deal with you as consumers: customers, users, website visitors. Employees and business contacts stay out, except in California, which counts them too. Most laws also leave out people whose data you only use to complete a payment.
• The year. The numbers are per calendar year. Some states look at the year before.
• Selling. In some states a sale needs money to change hands. In others any valuable consideration is enough, which can include data passed to advertising partners.
• Exemptions. Some states exempt a whole organisation, such as a bank, a hospital or a nonprofit. Others exempt only the data a federal law already covers, and the rest of your data still counts. The row says which.
• Other laws. The checker covers comprehensive consumer privacy laws only. Every state also has a breach-notification law, and some have narrower laws on health data, biometrics, children or data brokers that apply whatever your size. Washington’s My Health My Data Act and Illinois’s Biometric Information Privacy Act are the best known.

What changes next

• 1 January 2027. Louisiana’s and Oklahoma’s laws start. Delaware’s thresholds drop to 10,000 residents, or 5,000 for businesses that earn more than 20% of revenue from selling data. Utah’s law starts covering car makers. California’s revenue threshold gets its two-yearly inflation adjustment.
• 1 April 2027. Maryland’s cure period ends.
• 1 May 2027. Alabama’s law starts.
• 31 July 2027. Louisiana’s 30-day cure period ends, seven months after the law starts.
• 1 January 2028. Vermont’s law starts.

Massachusetts may be next: both chambers passed versions of a comprehensive bill in 2026, and it was not law when we last checked. We go through every law again on 1 January and 1 July, when most changes take effect, and once a quarter in between.

How we built it

For each state we read the sections on scope, exemptions and enforcement in the code or the enrolled act on the legislature’s own site. Two exceptions: for Connecticut we used the Attorney General’s summary of the thresholds that apply since July 2026, and for Indiana a published copy of the code. Where a law has been amended, the checker uses the version in force on the check date and shows the next one when it is already enacted. The count of 24 laws includes Florida, whose law only reaches companies with more than $1 billion in revenue.

Sources: state codes and enrolled acts (linked in each row); CalPrivacy, FAQ and inflation adjustment of the CCPA thresholds; Connecticut Attorney General, Connecticut Data Privacy Act page; MultiState, count of state laws and pending bills (28 October 2026). Checked 12 November 2026.