B
Boring Governance

US State Privacy Laws & Global Data Protection: A Complete Jurisdiction Guide

Compare all active US state privacy laws plus the GDPR, UK GDPR, and major Commonwealth laws (Australia, Canada, New Zealand, Ireland, South Africa). Thresholds, consumer rights, penalties, and what your business needs to do.

Last updated: 2026-02-08

The United States does not have a single federal data privacy law. Instead, 19 states have now enacted their own comprehensive consumer privacy legislation, each with its own thresholds, consumer rights, enforcement mechanisms, and deadlines. For a small business owner trying to figure out what applies, the landscape can feel overwhelming. Add in the EU's GDPR, the UK GDPR, and the major Commonwealth privacy laws — Australia, Canada, New Zealand, Ireland, and South Africa — and you are looking at 26 distinct privacy frameworks that could affect your business depending on where your customers live.

This guide puts all of them in one place. You will find a summary table of every active jurisdiction, a quick-reference section to help you figure out which laws apply to your business, and a side-by-side comparison of the consumer rights each law grants. Every jurisdiction links to a detailed, standalone guide with compliance checklists and enforcement details.

Most non-US privacy laws share a crucial difference from the US model: they have no revenue or size threshold. Where a US state law might only catch you at 100,000 consumers, the GDPR, PIPEDA, New Zealand's Privacy Act, and POPIA apply to businesses of any size. Australia is the notable exception, with a small-business exemption that is steadily narrowing.

Disclaimer: This article is for informational purposes only and does not constitute legal advice. Privacy regulations are complex and change frequently. You should consult a qualified attorney for guidance specific to your business.

Complete Jurisdiction Overview

The table below lists all 26 jurisdictions covered in this guide. Each row includes the law's abbreviation, when it took effect (or will take effect), who it applies to, whether there is a cure period before enforcement, and the maximum penalty per violation.

JurisdictionLawEffective DateThreshold SummaryCure PeriodMax Penalty
CaliforniaCCPA/CPRAJan 1, 2020$26.625M revenue OR 100K consumers OR 50% data sale revenueNone$7,500/violation
VirginiaVCDPAJan 1, 2023100K consumers OR 25K consumers + 50% revenue from data sales30 days$7,500/violation
ColoradoCPAJul 1, 2023100K consumers OR 25K consumers + revenue from data sales60 days (expired Jan 2025)$20,000/violation
ConnecticutCTDPAJul 1, 2023100K consumers OR 25K + data sale revenue (drops to 35K in Jul 2026)60 days (expired Dec 2024)$5,000/violation
UtahUCPADec 31, 2023$25M+ revenue AND (100K consumers OR 25K + 50% data sale revenue)30 days (no sunset)$7,500/violation
OregonOCPAJul 1, 2024100K consumers OR 25K consumers + revenue from data sales30 days (expired Jan 2026)$7,500/violation
TexasTDPSAJul 1, 2024Any business processing personal data (SBA small business exemption)30 days (expired Jan 2026)$7,500/violation
MontanaMTCDPAOct 1, 202450K consumers OR 25K consumers + revenue from data sales60 days (expires Apr 2026)$7,500/violation
DelawareDPDPAJan 1, 202535K consumers OR 10K consumers + 20% revenue from data sales60 days (sunset Jan 2026)$10,000/violation
IowaICDPAJan 1, 2025100K consumers OR 25K consumers + 50% revenue from data sales90 days (no sunset)$7,500/violation
NebraskaNDPAJan 1, 2025No consumer count -- applies to all non-SBA-small-businesses30 days (no sunset)$7,500/violation
New HampshireNHPAJan 1, 202535K consumers OR 10K consumers + 25% revenue from data sales60 days (sunset Jan 2026)$10,000/violation
New JerseyNJDPAJan 15, 2025100K consumers OR 25K consumers + revenue from data sales30 days (expires Jul 2026)$10,000/$20,000 per violation
TennesseeTIPAJul 1, 2025$25M+ revenue AND (100K consumers OR 25K + 50% data sale revenue)60 days (sunsets Jul 2027)$7,500/violation
MinnesotaMCDPAJul 31, 2025100K consumers OR 25K consumers + 25% revenue from data sales30 days (expires Jul 2026)$7,500/violation
MarylandMODPAOct 1, 202535K consumers OR 10K consumers + 20% revenue from data salesUntil Apr 2027$10,000/$25,000 per violation
IndianaINCDPAJan 1, 2026100K consumers OR 25K consumers + 50% revenue from data sales30 days (sunsets Jan 2028)$7,500/violation
KentuckyKCDPAJan 1, 2026100K consumers OR 25K consumers + 50% revenue from data sales30 days (expired Jan 2026)$7,500/violation
Rhode IslandRIDTPPAJan 1, 202635K consumers OR 10K consumers + 20% revenue from data sales30 days (sunsets Jan 2027)$10,000/violation
GDPR (EU)GDPRMay 25, 2018No size threshold -- any business serving EU residentsNoneEUR 20M or 4% global revenue
UK GDPRUK GDPRJan 1, 2021No size threshold -- any business serving UK residentsNoneGBP 17.5M or 4% global revenue
AustraliaPrivacy Act 1988Mar 12, 2014 (APPs)AUD $3M turnover exemption (with major exceptions)NoneAUD $50M / 3x benefit / 30% adjusted turnover
CanadaPIPEDAJan 1, 2004No threshold -- commercial activityNoneCAD $100K per offence (higher proposed)
New ZealandPrivacy Act 2020Dec 1, 2020No threshold -- all agencies of any sizeNoneNZ$10,000 (court-imposed)
IrelandGDPR / DPA 2018May 25, 2018No threshold -- any business processing personal dataNoneEUR 20M or 4% global revenue
South AfricaPOPIAJul 1, 2021No threshold -- public & private bodiesNoneZAR 10M / up to 10 yrs imprisonment

Which Law Applies to Me?

The fastest way to figure out your exposure is to start with how many consumers you serve in each state. Below, the laws are grouped by their applicability threshold so you can quickly see which ones might cover your business.

Low Threshold: 35,000 Consumers

If you have 35,000 or more customers from any of these states, you are covered:

  • Maryland (MODPA) -- Effective October 1, 2025. Also applies at 10,000 consumers if 20%+ of revenue comes from data sales.
  • Delaware (DPDPA) -- Effective January 1, 2025. Also applies at 10,000 consumers if 20%+ of revenue comes from data sales.
  • Rhode Island (RIDTPPA) -- Effective January 1, 2026. Also applies at 10,000 consumers if 20%+ of revenue comes from data sales.
  • New Hampshire (NHPA) -- Effective January 1, 2025. Also applies at 10,000 consumers if 25%+ of revenue comes from data sales.
  • Connecticut (CTDPA) -- Currently at 100,000 consumers, but drops to 35,000 as of July 1, 2026. Plan accordingly.

These low-threshold laws are the ones most likely to catch smaller e-commerce businesses and regional SaaS products off guard. A Shopify store with 40,000 customers in Maryland is covered. A newsletter with 50,000 Delaware subscribers may be covered depending on how personal data is processed.

Mid Threshold: 50,000 Consumers

  • Montana (MTCDPA) -- Effective October 1, 2024. Also applies at 25,000 consumers if the business derives revenue from data sales.

Montana's 50,000-consumer threshold sits between the low-threshold states and the standard 100,000-consumer tier. If you serve customers across the Mountain West, this one is easy to trip.

Standard Threshold: 100,000 Consumers

Most state privacy laws use the 100,000-consumer threshold as their primary trigger. If you process personal data from 100,000 or more consumers in any of these states during a calendar year, the law applies:

Most of these also have a secondary threshold of 25,000 consumers if the business derives a significant portion of revenue from data sales. The exact revenue percentage varies by state (50% in most cases, 25% in Minnesota).

No Consumer Threshold

These laws can apply regardless of how many consumers you have. They use different criteria to determine applicability:

  • Texas (TDPSA) -- Applies to any business processing or selling personal data of Texas residents. The only exemption is for businesses that qualify as "small" under the SBA definition (and even that exemption does not apply if the business sells personal data). Effective July 1, 2024.
  • Nebraska (NDPA) -- Applies to all businesses that process personal data and are not classified as small businesses under the SBA definition. Effective January 1, 2025.
  • GDPR (EU) -- Applies to any business offering goods or services to, or monitoring the behavior of, EU residents. No revenue or size threshold. Effective May 25, 2018.
  • UK GDPR -- Applies to any business processing personal data of UK residents. No revenue or size threshold. Effective January 1, 2021.

If you do business online and have customers in Texas, Nebraska, the EU, or the UK, you should review these laws regardless of your company's size.

Revenue-Based Threshold

Some laws use annual revenue as a trigger, either as the sole criterion or in combination with a consumer count:

  • California (CCPA/CPRA) -- $26.625 million in annual gross revenue (inflation-adjusted, started at $25M). Revenue alone is enough to trigger coverage, even if you have very few California consumers.
  • Utah (UCPA) -- $25 million in annual revenue AND either 100,000 consumers or 25,000 consumers + 50% revenue from data sales. Both prongs are required, making Utah the most business-friendly state privacy law.
  • Tennessee (TIPA) -- $25 million in annual revenue AND either 100,000 consumers or 25,000 consumers + 50% revenue from data sales. Same dual-prong structure as Utah.

Revenue triggers mean the law can apply even if you serve relatively few consumers in that state, as long as your business is large enough by revenue.

Outside the US: International Privacy Laws

If you have customers, staff, or suppliers outside the United States, US state laws are only half the picture. The major Commonwealth and EU laws generally apply regardless of your size:

  • GDPR (EU) and Ireland — any business offering goods or services to, or monitoring, people in the EU. No threshold.
  • UK GDPR — any business processing UK residents' data. No threshold.
  • Canada (PIPEDA) — any commercial handling of personal information. No threshold (Quebec, Alberta, and BC have their own laws).
  • New Zealand (Privacy Act 2020) — all agencies of any size, including overseas businesses operating in NZ. No threshold.
  • South Africa (POPIA) — all public and private bodies, and uniquely it protects companies as well as individuals. No threshold.
  • Australia (Privacy Act 1988) — the exception: businesses under AUD $3 million turnover are exempt, but the exemption has wide exceptions (health, AML/CTF reporting entities from 1 July 2026, and more) and is under reform.

The practical takeaway: if you sell across borders, don't assume a US-style revenue threshold protects you. A 10-person business with a handful of EU, UK, Canadian, or New Zealand customers is very likely covered there.

What Rights Do Consumers Have Across States?

Not every state grants the same set of rights. The table below compares consumer rights across six representative laws -- from the broadest (California and GDPR) to the most typical (Virginia and Colorado) to the most restrictive (Texas and Maryland). For a full breakdown of any specific law, click through to its dedicated guide.

RightCalifornia (CCPA/CPRA)Virginia (VCDPA)Colorado (CPA)Texas (TDPSA)Maryland (MODPA)GDPR
Right to access✅✅✅✅✅✅
Right to correct✅✅✅✅✅✅
Right to delete✅✅✅✅✅✅
Right to portability✅✅✅✅✅✅
Opt out of sale✅✅✅✅✅✅
Opt out of targeted advertising✅✅✅✅✅❌
Opt out of profiling❌✅✅✅✅✅
Limit sensitive data use✅❌❌❌❌❌
Right to appeal❌✅✅✅✅❌
Private right of action✅ (breaches)❌❌❌❌✅
Universal opt-out (GPC) required✅❌✅✅❌❌

A few patterns stand out:

  • Access, correction, deletion, and portability are universal. Every comprehensive privacy law grants these four rights.
  • Opt-out of targeted advertising is standard in US state laws but is handled differently under the GDPR, which uses a consent-based model instead.
  • Private right of action is rare. Only California (for data breaches) and the GDPR grant consumers the ability to sue directly. In all other US states, only the Attorney General can bring enforcement actions.
  • Universal opt-out mechanisms like Global Privacy Control (GPC) are increasingly required. California, Colorado, and Texas all mandate that businesses honor GPC signals.

References

Last reviewed: June 2026. Privacy laws change frequently. New states and countries may enact laws and existing laws may be amended. Verify all statutory references against the current text of each law and consult qualified legal counsel before making compliance decisions for your business.

Need help handling data subject requests? Download our free DSAR Response Templates -- ready-to-use templates that work across all US state privacy laws.