🇺🇸US state privacy laws

← Back to laws in United States

US state privacy laws create a second layer of compliance

United States privacy compliance is not limited to federal sectoral laws. Several states have enacted consumer privacy statutes that regulate how businesses collect, use, disclose, sell and profile personal data. These state laws usually apply by reference to the consumer’s residence, the controller’s activities in the state, processing volume, revenue from sale of data or similar thresholds.

The laws are not identical, but they often follow a recognisable pattern: controller duties, processor contracts, consumer rights, privacy notices, sensitive data controls, opt-out rights, appeal mechanisms, data protection assessments and Attorney General enforcement.

The common structure of state privacy laws

State privacy laws generally distinguish between a controller, which determines the purpose and means of processing personal data, and a processor, which processes personal data on behalf of the controller. This distinction matters because the controller usually carries the primary duty to respond to consumer rights, publish privacy notices, limit unnecessary processing and ensure that processor contracts contain required terms.

Consumers are usually given rights to access, delete and obtain a copy of personal data. Many state laws also include rights to correct inaccuracies and opt out of targeted advertising, sale of personal data or profiling that produces legal or similarly significant effects. Some states provide more detailed rights than others.

California is more detailed than most state laws

California’s framework is more mature and operationally detailed than many other state privacy laws. The CCPA gives rights around access, deletion, correction, sale, sharing and sensitive personal information. The California regulations then add detailed rules for privacy policies, notices at collection, opt-out links, opt-out preference signals, authorised agents, training, record-keeping, cybersecurity audits, risk assessments and automated decisionmaking technology.

This makes California a useful benchmark, but it should not be treated as the only state privacy model. Other state laws may use similar concepts but different thresholds, exemptions, response rules and enforcement mechanisms.

Delaware, Iowa, Texas and Virginia show the state-by-state variation

Delaware provides a broad set of rights, including access, correction, deletion, portability, a list of third-party categories and opt-out rights for targeted advertising, sale and certain profiling. Iowa follows a consumer data protection model but is narrower in some respects and has its own request and controller duty structure. Texas uses a distinctive applicability test tied to doing business in Texas, processing or sale of personal data and not being a small business, with additional obligations for privacy notices and data protection assessments. Virginia uses processing thresholds and includes controller duties, processor contracts, consumer rights and data protection assessments.

Because these laws differ, businesses should avoid one generic “US state law” checklist. A better approach is to maintain a state matrix that tracks applicability, exemptions, consumer rights, appeal rules, opt-out requirements, sensitive data controls, processor terms, assessment triggers and enforcement timelines.

What businesses should build

A practical state privacy programme should begin with consumer location mapping and data flow mapping. The organisation should know which states its consumers live in, what personal data is processed, whether sensitive data is involved, whether data is sold or used for targeted advertising, and whether profiling affects important consumer outcomes.

Then the organisation should build a rights workflow that can authenticate requests, respond within state timelines, handle appeals where required, record opt-outs and communicate those choices to processors and relevant third parties. The privacy notice should explain categories of data, purposes of processing, categories of third parties, rights mechanisms and sale or targeted advertising practices where applicable.