2026 US state privacy laws: a small-business website checklist

By late 2026 a long list of US states has a comprehensive consumer privacy law, with more on the way. The IAPP keeps a running state privacy legislation tracker if you want the full picture. For most small business websites, the good news is that the big laws apply only above certain sizes. The less good news is that some rules apply to almost everyone, and the basics are worth doing anyway. Here's a practical checklist.

Step 1: check whether the big laws apply to you

Each state sets its own test. A few examples, from official sources:

California (CCPA). It applies to for-profit businesses doing business in California that meet at least one test: annual gross revenue above an inflation-adjusted figure, buying, selling or sharing the personal information of 100,000 or more consumers or households, or getting 50% or more of revenue from selling or sharing personal information (Cal. Civ. Code § 1798.140). The revenue figure has been $26,625,000 since 1 January 2025 (California Privacy Protection Agency).
Colorado. The Colorado Privacy Act applies to businesses that either process the data of 100,000 or more Colorado consumers a year, or earn revenue or discounts from selling the data of 25,000 or more (Colorado Attorney General).
Texas. The Texas Data Privacy and Security Act took effect on 1 July 2024. Businesses that are small under the SBA's definition are generally exempt, except that they must get consumer consent before selling sensitive data (Texas Attorney General).
Indiana and Kentucky. Both laws took effect on 1 January 2026. Each applies to businesses that control or process the personal data of at least 100,000 state residents, or at least 25,000 residents while getting more than 50% of gross revenue from selling personal data (Indiana Attorney General; Kentucky Attorney General).

Count visitors honestly: website analytics and ad pixels can involve personal data from far more people than your customer list. If you're close to a threshold, or you sell or share data for advertising, get advice. Thresholds are adjusted and new laws start each year, so recheck at least annually.

Step 2: post a privacy policy anyway (CalOPPA)

California's Online Privacy Protection Act has no revenue or size threshold. If you run a commercial website that collects personally identifiable information from California residents, such as names or emails through a contact form or checkout, you must conspicuously post a privacy policy (Cal. Bus. & Prof. Code § 22575). It must cover:

the categories of personal information you collect, and the categories of third parties you share it with
how people can review and request changes to their information, if you offer that
how you tell visitors about material changes to the policy
its effective date
how your site responds to Do Not Track signals or other similar choice mechanisms
whether other parties can collect information about visitors' online activities over time and across sites when they use yours

Step 3: honor Global Privacy Control where it's required

Global Privacy Control is a browser setting that tells sites "don't sell or share my data". California's Attorney General says businesses covered by the CCPA must treat it as a valid request to opt out of the sale or sharing of personal information (California AG). Colorado has required covered businesses to accept universal opt-out mechanisms since 1 July 2024, and GPC was the first one it recognized (Colorado AG). Covered businesses that sell or share personal information in California also need a "Do Not Sell or Share My Personal Information" link (California AG).

Even below the thresholds, testing your site with GPC switched on is a quick way to see what your ad tags actually do.

Step 4: make a tracker inventory

List every tool that loads on your site: analytics, ad pixels, tag managers, chat widgets, embedded videos, review widgets, email pop-ups and payment scripts. For each, note what it collects, who receives it, and whether it's used for advertising. Most privacy problems start here, because tools get added for a campaign and never removed. Remove what you don't use.

Step 5: make your notice match reality

Your privacy policy is a promise. The FTC tells businesses to reread their privacy policies and make sure they honor the promises made in them (FTC privacy and security guidance). Don't copy a template that says you "never share data" if you run an ad pixel. Don't claim compliance with laws that don't apply to you, and don't promise rights you can't deliver. Write it in plain language, date it, and update it when your tracker inventory changes.

Who enforces this

Under these laws, enforcement is mostly by the state. California's Attorney General explains that consumers can't sue businesses for most CCPA violations, only in limited circumstances after certain data breaches (California AG). Colorado, Texas and Kentucky give no private right of action under their comprehensive privacy laws, and Texas and Kentucky give businesses 30 days to cure a violation after notice (Colorado AG; Texas AG; Kentucky AG).

For California in more depth, read Does the CCPA apply to my small business website?

Quick checklist

You have checked the CCPA, Colorado, Texas, Indiana and Kentucky tests against your real numbers
You have a conspicuous privacy policy covering everything CalOPPA lists, with an effective date
Your policy says how the site responds to Do Not Track and similar signals
If covered, your site honors Global Privacy Control and has the required opt-out link
You have a written list of every tracker and third-party tool on the site
Your policy matches what the site actually does, in plain language
You recheck thresholds and new state laws at least once a year

FAQ

My business is tiny. Do I need a privacy policy at all?

If your commercial website collects personally identifiable information from California residents, for example through a contact form, sign-up or checkout, CalOPPA requires a posted privacy policy, whatever your size (§ 22575).

What is Global Privacy Control?

A browser signal meaning "don't sell or share my data". Covered businesses in California must treat it as a valid opt-out (California AG), and Colorado recognizes it as a universal opt-out mechanism (Colorado AG).

Is the CCPA revenue threshold still $25 million?

No. It has been $26,625,000 since 1 January 2025 and is adjusted every odd-numbered year (CPPA).

Why don't you list every state?

Because each law has its own tests and dates, and we only state what we have checked against an official source. The IAPP keeps a full state tracker.

Will your check make my site compliant?

No. It's a technical review that shows what we found and how to fix it. It isn't legal advice, and no check can guarantee you won't receive a complaint or lawsuit.

Official sources

Laws and guidance change. Check the sources above for the latest position. General information, not legal advice. For advice on your own situation, talk to a US-licensed attorney.