US State Privacy Laws

What are US state privacy laws?

US state privacy laws are the broad consumer privacy laws that states pass one at a time. They give residents rights over their personal data, such as access, deletion and opting out of its sale, and they set rules for businesses and the vendors that process data for them. California came first with the CCPA.

Each law has its own thresholds, often based on how many residents' data a business handles. Alabama's new law, for example, applies to businesses that handle the personal data of more than 25,000 consumers or earn more than 25% of gross revenue from selling it. A small company can cross a line like that faster than you might expect.

About 20 comprehensive state laws were in force at the start of 2026, per Squire Patton Boggs. They took effect in waves:

1. 2023: Virginia, California (CPRA amendments), Colorado, Connecticut and Utah.
2. 2024: Oregon, Texas, Florida and Montana.
3. 2025: Delaware, Iowa, New Hampshire, Nebraska, New Jersey, Tennessee, Minnesota and Maryland.
4. January 1, 2026: Indiana, Kentucky and Rhode Island, per Baker Donelson.

Four more states passed laws in 2026: Alabama, Louisiana, Oklahoma and Vermont, per Squire Patton Boggs. Oklahoma and Louisiana take effect on January 1, 2027, and Alabama on May 1, 2027. Vermont's law takes effect on January 1, 2028.

Older laws keep changing too. Connecticut is lowering its threshold from 100,000 to 35,000 consumers from mid-2026, per Baker Donelson. Virginia banned the sale of precise geolocation data from July 1, 2026, and Kentucky amended its law with changes effective July 1, 2027, per Moore & Van Allen.

What it looks like in a vendor's terms

A vendor DPA may not list every state. A typical clause reads like this:

"US State Privacy Laws" means all state laws relating to the protection of personal information that apply to the processing under this DPA, which may include the CCPA and the privacy laws of Virginia, Colorado, Connecticut and Utah. When we process personal data for you, we act as your processor or service provider under those laws.

• "May include": the list is examples, so newer state laws can be covered without a change to the DPA.
• Processor or service provider: the vendor takes the role that limits it to using data only for you.

Stripe's DPA is a real example: it names the laws of California, Virginia, Colorado, Connecticut and Utah in a definition that "may include, among others."

A real change we caught

Venpo flagged that Uber now says its ad partners may combine your data with other sources. Opting out of targeted advertising is a right under many of these laws, so changes to how ad partners use data are worth watching.

Why it matters to you

One stack, many laws. You may have users in a dozen states. Every vendor that handles their data has to fit each state's rules for processors, and its DPA should not freeze on an old list.

Opt-outs reach your vendors. Many of these laws, such as Indiana's, let people opt out of the sale of their data and of targeted advertising, per Baker Donelson. If a vendor on your site uses visitor data for ads, you may have to offer that opt-out and make it work, for example by honoring Global Privacy Control signals where a law requires it.

Your customers ask. Enterprise buyers may send you a DPA that names these laws. You can only sign what your own vendors back up.

What to check

• Each vendor's DPA covers US state privacy laws in general terms, not only the CCPA.
• The vendor acts as your processor or service provider, not a third party, for the data you send.
• Its privacy policy does not reserve the right to sell your data or use it for targeted ads.
• The vendor will help you answer access, deletion and opt-out requests.
• Which states your users live in, so you know which laws and dates apply to you.
• Whether each vendor will pass on opt-out requests and stop using the data for ads once a person opts out.

How Venpo helps

Venpo watches your vendors' privacy policies, DPAs and cookie policies and emails you a plain-English alert when language on selling data, targeted ads or covered state laws changes. The Fine Print Scan answers, for each vendor, whether it sells data or uses it for ads.