Which US state privacy laws apply to my website? Free checker

Rhinehart Studio · US Website Compliance Check

Want to know what your website actually does?

The checker tells you which laws are likely to apply. Our US Compliance Check looks at your real site: whether your privacy policy can be found and what it covers, whether there’s a “Do Not Sell or Share” / “Your Privacy Choices” link, whether ad trackers still load when the browser sends Global Privacy Control, and which tracking tags we find. You get a human-reviewed PDF report within 2 working days.

Add the Fix Pack for paste-ready text and step-by-step settings, then keep watch with the Compliance Monitor, a weekly re-scan that emails you what changed.

Order the check · $99 Add the Fix Pack · $199 Start monitoring · $29/month

Fixed prices in US dollars, paid securely by Stripe. Any tax that applies is shown before you pay. We don’t guarantee results, and our reports are not legal advice. See the terms.

The thresholds, state by state

These are the tests the checker uses, in plain English. “Residents” means consumers in that state whose personal data you control or process. Each law has its own definitions and exemptions, so check the official text in the sources below.

State	Law	In force from	Who it covers
California	California Consumer Privacy Act (CCPA, as amended by the CPRA)	1 January 2020	A for-profit business doing business in California that meets any one of: annual gross revenue over $26,625,000 (the 2025–26 figure, adjusted for inflation every odd-numbered year); buys, sells or shares the personal information of 100,000 or more California consumers or households a year; or earns 50% or more of annual revenue from selling or sharing personal information.
Colorado	Colorado Privacy Act (CPA)	1 July 2023	Controls or processes the personal data of 100,000 or more Colorado consumers a year, or of 25,000 or more while getting any revenue, or a discount on goods or services, from selling personal data.
Connecticut	Connecticut Data Privacy Act (CTDPA, as amended from 1 July 2026)	1 July 2026	From 1 July 2026: in the previous calendar year, controlled or processed the personal data of 35,000 or more Connecticut consumers (not counting data used only to complete a payment), or controlled or processed any sensitive data, or offered any personal data for sale. The sensitive-data and sale tests have no minimum number.
Delaware	Delaware Personal Data Privacy Act (DPDPA)	1 January 2025	Until 31 December 2026: controls or processes the personal data of 35,000 or more Delaware consumers (not counting data used only to complete a payment), or of 10,000 or more while getting over 20% of gross revenue from selling personal data.
Delaware	Delaware Personal Data Privacy Act (DPDPA)	1 January 2027	From 1 January 2027 (HB 380): 10,000 or more Delaware consumers, or 5,000 or more while getting over 20% of gross revenue from selling personal data. The amendment also covers third parties that acquire personal data from a controller.
Florida	Florida Digital Bill of Rights (FDBR)	1 July 2024	The main obligations reach only businesses with over $1 billion in global annual revenue that also get 50% or more of revenue from online ads, run a smart speaker and voice command service, or run an app store with 250,000 or more apps. One section, on selling sensitive data, applies to for-profit businesses of any size (see below).
Indiana	Indiana Consumer Data Protection Act	1 January 2026	In a calendar year, controls or processes the personal data of 100,000 or more Indiana consumers, or of 25,000 or more while getting over 50% of gross revenue from selling personal data.
Iowa	Iowa Consumer Data Protection Act (ICDPA)	1 January 2025	In a calendar year, controls or processes the personal data of 100,000 or more Iowa consumers, or of 25,000 or more while getting over 50% of gross revenue from selling personal data.
Kentucky	Kentucky Consumer Data Protection Act (KCDPA)	1 January 2026	In a calendar year, controls or processes the personal data of 100,000 or more Kentucky consumers, or of 25,000 or more while getting over 50% of gross revenue from selling personal data.
Maryland	Maryland Online Data Privacy Act (MODPA)	1 October 2025	In a calendar year, controls or processes the personal data of 35,000 or more Maryland consumers (not counting data used only to complete a payment), or of 10,000 or more while getting over 20% of gross revenue from selling personal data. In force from 1 October 2025, applying to processing from 1 April 2026.
Minnesota	Minnesota Consumer Data Privacy Act (MCDPA)	31 July 2025	In a calendar year, controls or processes the personal data of 100,000 or more Minnesota consumers (not counting data used only to complete a payment), or of 25,000 or more while getting over 25% of gross revenue from selling personal data. SBA small businesses are excluded, but must still get consent before selling sensitive data.
Montana	Montana Consumer Data Privacy Act (MCDPA, as amended from 1 October 2025)	1 October 2024	Controls or processes the personal data of 25,000 or more Montana consumers (not counting data used only to complete a payment), or of 15,000 or more while getting over 25% of gross revenue from selling personal data. These lower numbers apply from 1 October 2025.
Nebraska	Nebraska Data Privacy Act (NDPA)	1 January 2025	No customer-count or revenue threshold. Applies to anyone doing business in Nebraska, or whose products or services Nebraska residents use, who processes or sells personal data, unless they are a small business as defined by the SBA. Even SBA small businesses must get consent before selling sensitive data.
New Hampshire	New Hampshire privacy act (RSA 507-H)	1 January 2025	Controls or processes the personal data of 35,000 or more New Hampshire consumers a year (not counting data used only to complete a payment), or of 10,000 or more while getting over 25% of gross revenue from selling personal data.
New Jersey	New Jersey Data Privacy Act (NJDPA)	15 January 2025	In a calendar year, controls or processes the personal data of 100,000 or more New Jersey consumers (not counting data used only to complete a payment), or of 25,000 or more while getting any revenue, or a discount on goods or services, from selling personal data.
Oregon	Oregon Consumer Privacy Act (OCPA)	1 July 2024	In a calendar year, controls or processes the personal data of 100,000 or more Oregon consumers (not counting data used only to complete a payment), or of 25,000 or more while getting 25% or more of gross revenue from selling personal data.
Rhode Island	Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA)	1 January 2026	The main consumer-rights duties apply if, in the previous calendar year, you controlled or processed the personal data of 35,000 or more Rhode Island customers (not counting data used only to complete a payment), or of 10,000 or more while getting over 20% of gross revenue from selling personal data. A separate disclosure duty applies to commercial websites of any size (see below).
Tennessee	Tennessee Information Protection Act (TIPA)	1 July 2025	Annual revenue over $25,000,000, and either controls or processes the personal data of 175,000 or more Tennessee consumers in a calendar year, or of 25,000 or more while getting over 50% of gross revenue from selling personal data. Both parts must be met.
Texas	Texas Data Privacy and Security Act (TDPSA)	1 July 2024	No customer-count or revenue threshold. Applies to anyone doing business in Texas, or whose products or services Texas residents use, who processes or sells personal data, unless they are a small business as defined by the US Small Business Administration (SBA). Even SBA small businesses must get consent before selling sensitive data.
Utah	Utah Consumer Privacy Act (UCPA)	31 December 2023	Annual revenue of $25,000,000 or more, and either controls or processes the personal data of 100,000 or more Utah consumers a year, or of 25,000 or more while getting over 50% of gross revenue from selling personal data. Both parts must be met.
Virginia	Virginia Consumer Data Protection Act (VCDPA)	1 January 2023	Controls or processes the personal data of 100,000 or more Virginia consumers a year, or of 25,000 or more while getting over 50% of gross revenue from selling personal data.
Alabama	Alabama Personal Data Protection Act (HB 351, Act 2026-552)	1 May 2027	From 1 May 2027: controls or processes the personal data of more than 25,000 Alabama consumers (not counting data used only to complete a payment), or gets more than 25% of gross revenue from selling personal data. Businesses with fewer than 500 employees that don't sell personal data are exempt.
Louisiana	Louisiana Data Privacy Act (SB 386, Act 502 of 2026)	1 January 2027	From 1 January 2027: doing business in Louisiana and any one of: annual gross revenue over $25,000,000; buying, receiving for a commercial purpose, selling or sharing the personal information of 75,000 or more Louisiana consumers, households or devices a year; or getting 50% or more of annual revenue from selling personal information. There is no general small-business exemption.
Oklahoma	Oklahoma consumer data privacy law (SB 546, 2026)	1 January 2027	From 1 January 2027: in a calendar year, controls or processes the personal data of 100,000 or more Oklahoma consumers, or of 25,000 or more while getting over 50% of gross revenue from selling personal data.
Vermont	Vermont Data Privacy and Online Surveillance Act (S.71, Act 145 of 2026)	1 January 2028	From 1 January 2028: controls or processes the personal data of 35,000 or more Vermont consumers (not counting data used only to complete a payment), or the sensitive data of 3,000 or more, or sells the personal data of 3,000 or more.

Rules that apply whatever your size

Texas and Nebraska: no numeric threshold. These laws apply unless you are a small business under the SBA size standards for your industry. Even then, you need consent before selling sensitive data. Minnesota excludes SBA small businesses from its main duties but applies the same consent rule.
Connecticut: since 1 July 2026, processing any sensitive data or offering any personal data for sale brings you under the law, with no minimum number of residents.
Florida: any for-profit business that collects personal data in Florida needs consent before selling sensitive data, and must show the notice “NOTICE: This website may sell your sensitive personal data.” if it does.
Rhode Island: commercial websites with Rhode Island customers must identify a controller and, if they sell personally identifiable information, disclose what they collect and who receives it.
California (CalOPPA): a commercial website that collects personally identifiable information from California residents must post a conspicuous privacy policy.
Everywhere: the FTC can act against misleading privacy or security claims, and the COPPA rule applies to sites aimed at children under 13.

For a longer explanation, read our 2026 US state privacy laws checklist and Does the CCPA apply to my small business website?

FAQ

Which US states have a comprehensive privacy law in force?

As checked on 1 November 2026, 20 states: California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia. Four more have been enacted but are not yet in force: Oklahoma (1 January 2027); Louisiana (1 January 2027); Alabama (1 May 2027); Vermont (1 January 2028). Delaware also lowers its thresholds from 1 January 2027.

Do state privacy laws apply to small businesses?

Most of them only apply above a number of state residents (often 100,000, 35,000 or 25,000) or a revenue figure, so many small websites are below them. Some rules apply whatever your size: Texas and Nebraska cover anyone who is not a small business under the SBA size standards, Connecticut covers anyone who processes sensitive data or offers personal data for sale, Florida requires consent before selling sensitive data, Rhode Island requires certain disclosures from commercial websites, and California’s CalOPPA requires a privacy policy on commercial websites that collect personal information from California residents.

What is the SBA small business test in Texas and Nebraska?

The Texas and Nebraska laws have no customer or revenue threshold. Instead, they exclude businesses that are small businesses as defined by the US Small Business Administration. The SBA size standard depends on your industry (your NAICS code) and is usually set by average annual receipts or number of employees. If you are over the standard for your industry, these laws can apply even if you have few customers there. Even SBA small businesses must get consent before selling sensitive data. Minnesota excludes SBA small businesses too, but also has numeric thresholds.

How do I count the residents of a state?

Count the residents of that state (the laws usually say “consumers”) whose personal data you control or process in a year, or in the previous calendar year for some states. That can include customers, subscribers, people who use your contact form and, where cookies, pixels or analytics identify devices, website visitors. Many laws leave out data processed only to complete a payment. If you only know a US total, the checker estimates each state’s share from Census Bureau population figures, which is a rough guide.

Does this checker save or send my answers?

No. It runs entirely in your browser. Nothing you enter is sent to us or stored, and the page makes no outside calls.

Can this checker tell me for certain whether a law applies?

No. It compares your answers with the published thresholds and flags cases that are unclear or close. Definitions such as “sale”, “consumer” and “sensitive data” differ by state and have exemptions, for example for some financial, health and nonprofit organizations. It is general information, not legal advice. For advice on your own situation, talk to a US-licensed attorney.

Official sources

Where an official page blocked automated checks or was unclear, we also cross-checked against the IAPP tracker and law-firm summaries listed here.

Last checked 1 November 2026. Laws, thresholds and dates change, so check the sources above for the latest position. This page is general information, not legal advice, and it can’t tell you for certain whether a law applies to you. For advice on your own situation, talk to a US-licensed attorney. Built with help from AI tools and checked against the sources listed.

Which US state privacy laws apply to my website?

Check your states

The thresholds, state by state

Rules that apply whatever your size

FAQ

Official sources

Related