Step-by-Step Instructions to Work Out Which US Privacy Laws Apply to Your Business in 2026

Most privacy compliance projects start in the wrong place. A team reads about CCPA, assumes it applies, and begins building controls for a law that may not cover them — while missing two states that do. Applicability is now the genuinely difficult part of US privacy work, because every state drew its own line. Some count consumers, some count revenue, and two count nothing at all. This guide walks the check in order.

Why Applicability Became the Hard Part

In 2026 there are twenty states with comprehensive consumer privacy laws in effect, according to MultiState's February 2026 tracker. That figure includes Florida, whose scope is narrower than the rest. The thresholds diverge sharply: Virginia and Colorado start at 100,000 consumers, Connecticut and Maryland at 35,000, Delaware at 10,000. Only Utah, Tennessee and Louisiana attach a dollar revenue floor, each at $25 million. A company can comfortably sit outside California's reach and still be squarely inside Delaware's. Aggregate national numbers tell you nothing here — the counting is per state.

Step 1: Count Your Consumers State by State, Not in Total

Pull your customer and visitor data and segment it by state of residence, not by billing address or shipping destination. Then compare each state's count against that state's own trigger. Most follow a two-branch pattern: coverage at 100,000 consumers, or at 25,000 consumers if a share of revenue comes from selling personal data. The smaller states run considerably lower — Delaware at 10,000 consumers, or 5,000 if more than 20% of revenue comes from data sales. Note that several states, including Connecticut, Maryland and New Jersey, exclude consumers whose only data is payment transaction data, which can pull you back under a line you appeared to cross.

Step 2: Establish Whether You "Sell" or "Share" Data

This determines which branch of each threshold you land on, and it catches more businesses than expected. The definition is broader than a cash transaction. Passing personal data to an advertising partner, loading a third-party pixel that transmits identifiers, or syncing audiences to a platform can all qualify, depending on the state. The percentage that matters varies: Virginia, Iowa, Kentucky and Oklahoma use more than 50% of revenue, while Oregon and Minnesota use 25%, and Delaware, Maryland and Rhode Island use 20%. Answer this before counting, because it changes which number you measure against.

Step 3: Check the States With No Volume Threshold at All

Two states skip the counting entirely. Texas applies its law to any business operating in Texas or serving Texas residents, with no revenue or consumer-volume threshold. Nebraska does the same, exempting only entities that qualify as small businesses under the federal Small Business Act. Montana and Indiana impose no revenue threshold either, relying on consumer counts alone. If you have any meaningful US traffic, assume Texas and Nebraska reach you and verify the exemption rather than the obligation.

Step 4: Map Which Laws Require Universal Opt-Out Signals

Honouring a browser-level opt-out such as Global Privacy Control is a mandatory technical requirement in a growing group of states, not a best practice. Texas, Nebraska, Delaware, New Hampshire and Vermont require recognition of universal opt-out mechanisms, and Louisiana reaches a similar outcome through its authorised agent provisions. Rhode Island, Oklahoma and Alabama do not. This matters for sequencing: if any state on your applicability list requires it, the signal has to be respected site-wide, which makes it an early engineering task rather than a later refinement.

Step 5: Diarise the Dates That Still Fall This Year

Three laws took effect on 1 January 2026 — Indiana, Kentucky and Rhode Island — and three more follow on 1 July 2026, covering Connecticut, Arkansas and Utah. Cure periods are also narrowing. Oregon's HB 2008 removed the 30-day right to cure as of 1 January 2026, and Rhode Island's law provides no cure period at all. Where a cure window has closed, a first violation can proceed straight to enforcement.

Reviewing Applicability as the Business Changes

Applicability is a moving line, not a one-time finding. A single successful campaign can push a state count past 25,000, and a new advertising integration can change whether you "sell" data at all. Re-run the count quarterly and re-run it after any change to your martech stack. Penalties are concrete: most states cap civil penalties around $7,500 per violation, Delaware and Maryland reach $10,000, and Maryland rises to $25,000 for repeat violations. Because penalties are assessed per violation rather than per incident, exposure scales with the size of the affected group.

This article is general information, not legal advice. Thresholds and definitions are amended frequently — confirm your position with qualified counsel before relying on it.

Frequently Asked Questions

Do these laws apply if my business isn't located in that state? ▾ Generally yes. These statutes attach to the residency of the consumer, not the location of the business. Texas, for example, applies to any business that operates in the state or serves Texas residents. A company with no US office can still fall within scope purely on the basis of who visits its website and buys from it.

Does using advertising pixels count as "selling" personal data? ▾ Often, yes. Most state definitions cover disclosure of personal data to a third party for monetary or other valuable consideration, which is broad enough to capture advertising pixels and audience syncs. Because this determines which threshold branch applies to you, it is worth resolving with counsel rather than assuming the narrower reading.

What if we are only slightly above a threshold? ▾ There is no de minimis allowance. Crossing a state's consumer count brings the full set of obligations, including consumer rights requests and opt-out handling. Several states exclude consumers whose only data is payment transaction data, so an accurate count may place you below a line you appeared to have crossed — but that calculation has to be documented.