The United States has no single federal privacy law for businesses that collect customer data. Instead, states are passing their own. 20 state laws are in effect today, 4 more have been signed and start between 2027 and 2028, and more are on the way. Whether a law applies to your business depends on where your customers live, how much data you handle, and in some states how much revenue you earn. Your customers' location decides which laws apply to you, NOT where your business is based. These laws are also changing quickly: states keep passing new ones and amending the ones they have, so check the last updated date on each table.
This page is general information. Only an attorney can advise you on which laws apply to your business.
United States
Last updated
| State and law | Who it applies to | Top penalty | More info |
|---|---|---|---|
| CaliforniaCCPA / CPRA | Revenue over $26.625 million, or 100,000+ consumers or households, or 50%+ of revenue from selling or sharing data. | $2,663 per violation; $7,988 if intentional or involving a minor under 16 | California privacy law: official page |
| VirginiaVCDPA | 100,000+ consumers, or 25,000+ consumers and over 50% of revenue from selling data. | $7,500 per violation | Virginia privacy law: official page |
| ColoradoColorado Privacy Act | 100,000+ consumers, or 25,000+ consumers if you sell data for revenue or a discount. Any business handling biometric data since Jul 1, 2025. | Up to $20,000 per violation | Colorado privacy law: official page |
| ConnecticutCTDPA | Since Jul 1, 2026: 35,000+ consumers, or any handling of sensitive data, or any sale of personal data. No revenue test. | Up to $5,000 per willful violation | Connecticut privacy law: official page |
| UtahUCPA | Revenue of $25 million or more, and either 100,000+ consumers or 25,000+ consumers with over 50% of revenue from selling data. | Actual damages plus up to $7,500 per violation | Utah privacy law: official page |
| TexasTDPSA | Any business that is not an SBA-defined small business. No consumer count or revenue threshold. Small businesses may not sell sensitive data without consent. | Up to $7,500 per violation | Texas privacy law: official page |
| OregonOCPA | 100,000+ consumers, or 25,000+ consumers and 25%+ of revenue from selling data. | Up to $7,500 per violation | Oregon privacy law: official page |
| FloridaFlorida Digital Bill of Rights | Narrow: over $1 billion in global revenue plus an ad, smart speaker or app store test. The ban on selling sensitive data without consent reaches any for-profit business. | Up to $50,000 per violation; up to $150,000 in some cases | Florida privacy law: official page |
| MontanaMTCDPA (amended 2025) | 25,000+ consumers, or 15,000+ consumers and over 25% of revenue from selling data. | Up to $7,500 per violation | Montana privacy law: official page |
| DelawareDPDPA | 35,000+ consumers, or 10,000+ consumers and over 20% of revenue from selling data. From Jan 1, 2027: 10,000+, or 5,000+ with the same revenue test. | Up to $10,000 per willful violation | Delaware privacy law: official page |
| IowaIowa Consumer Data Protection Act | 100,000+ consumers, or 25,000+ consumers and over 50% of revenue from selling data. | Up to $7,500 per violation | Iowa privacy law: official page |
| NebraskaNebraska Data Privacy Act | Any business that is not an SBA-defined small business. No consumer count or revenue threshold. Small businesses may not sell sensitive data without consent. | Up to $7,500 per violation | Nebraska privacy law: official page |
| New HampshireNew Hampshire Privacy Act | 35,000+ consumers, or 10,000+ consumers and over 25% of revenue from selling data. | Up to $10,000 per violation | New Hampshire privacy law: official page |
| New JerseyNJDPA | 100,000+ consumers, or 25,000+ consumers if you sell data for revenue or a discount. | Up to $10,000 first offense; $20,000 after | New Jersey privacy law: official page |
| TennesseeTIPA | Revenue over $25 million, and either 175,000+ consumers or 25,000+ consumers with over 50% of revenue from selling data. | Up to $7,500 per violation; triple damages if willful | Tennessee privacy law: official page |
| MinnesotaMCDPA | 100,000+ consumers, or 25,000+ consumers and over 25% of revenue from selling data. SBA-defined small businesses may not sell sensitive data without consent. | Up to $7,500 per violation | Minnesota privacy law: official page |
| MarylandMODPA | 35,000+ consumers, or 10,000+ consumers and over 20% of revenue from selling data. Applies to processing from Apr 1, 2026. Selling sensitive data is banned. | Up to $10,000 per violation; $25,000 for repeats | Maryland privacy law: official page |
| IndianaICDPA | 100,000+ consumers, or 25,000+ consumers and over 50% of revenue from selling data. | Up to $7,500 per violation | Indiana privacy law: official page |
| KentuckyKCDPA | 100,000+ consumers, or 25,000+ consumers and over 50% of revenue from selling data. | Up to $7,500 per violation | Kentucky privacy law: official page |
| Rhode IslandRIDTPPA | 35,000+ customers, or 10,000+ customers and over 20% of revenue from selling data. | Up to $10,000 per violation | Rhode Island privacy law: official page |
| OklahomaOklahoma Consumer Data Privacy ActUpcoming | 100,000+ consumers, or 25,000+ consumers and over 50% of revenue from selling data. | Up to $7,500 per violation | Oklahoma privacy law: official page |
| LouisianaLouisiana Data Privacy ActUpcoming | Revenue over $25 million, or 75,000+ consumers, households or devices, or 50%+ of revenue from selling data. | Up to $5,000 per violation | Louisiana privacy law: official page |
| AlabamaAlabama Personal Data Protection ActUpcoming | More than 25,000 consumers, or over 25% of revenue from selling data at any size. | Up to $15,000 per violation | Alabama privacy law: official page |
| VermontVermont Data Privacy and Online Surveillance ActUpcoming | 35,000+ consumers, or 3,000+ consumers whose sensitive data you handle or whose data you sell. | Up to $10,000 per violation | Vermont privacy law: official page |
How to read the state table
Consumers means people who live in the state, counted across your whole customer and visitor base for the year. A small business can cross a threshold without meaning to, for example through an email list, an online store or a website that tracks visitors.
SBA-defined small business means a business under the size limits the U.S. Small Business Administration sets for its industry. Texas and Nebraska use this test in place of a consumer count, and Minnesota uses it to exclude small businesses from most of its rules.
Outside the United States
Last updated
A business does not need an office in a country to be covered by its privacy law. If you market to people in the EU, the UK or Canada, their laws can apply to you. Penalties for the Canadian laws are in Canadian dollars. Both the EU and Canada are considering changes: the EU has proposed amendments to the GDPR, and a bill introduced in Canada's Parliament in June 2026 would change the federal law. Neither has passed.
| Region and law | Who it applies to | Top penalty | More info |
|---|---|---|---|
| European UnionGDPR | Any business, anywhere, that offers goods or services to people in the EU or tracks their behavior there. No small-business exemption; only the record-keeping duty is eased for firms under 250 people. | Up to EUR 20 million or 4% of worldwide annual revenue, whichever is higher | European Union privacy law: official page |
| United KingdomUK GDPR and Data Protection Act 2018 | Same test as the EU: any business that offers goods or services to people in the UK or tracks their behavior there. Separate rules cover cookies and marketing messages. | Up to GBP 17.5 million or 4% of worldwide annual revenue, whichever is higher | United Kingdom privacy law: official page |
| Canada (federal)PIPEDA | Any organization that collects, uses or discloses personal information in the course of commercial activity. The Privacy Commissioner applies a “real and substantial connection” test to businesses outside Canada. No size exemption. | Fines up to $100,000 for knowing violations of specific rules, imposed by a court | Canada (federal) privacy law: official page |
| QuebecLaw 25 (private sector privacy act) | Any business that collects, holds or uses personal information while carrying on an enterprise. No size exemption. Regulators have said a business outside Quebec cannot avoid the law when it collects Quebec residents' data. | Administrative penalties up to $10 million or 2% of worldwide revenue; fines up to $25 million or 4% | Quebec privacy law: official page |
| AlbertaPersonal Information Protection Act | Every private-sector organization, whatever its size. Regulators have said a business outside the province cannot avoid the law when it collects Albertans' data. | Fines up to $100,000 for an organization, imposed by a court | Alberta privacy law: official page |
| British ColumbiaPersonal Information Protection Act | Every private-sector organization, whatever its size. Regulators have said a business outside the province cannot avoid the law when it collects British Columbians' data. | Fines up to $100,000 for an organization, imposed by a court | British Columbia privacy law: official page |
Related laws the tables leave out
The tables cover only comprehensive privacy laws. Other rules can apply even if none of these does:
- All 50 states have a data breach notification law.
- California's online privacy policy law applies to any website that collects personal information from California residents.
- Washington's My Health My Data Act, Illinois' biometric privacy law and Nevada's privacy law cover narrower kinds of data.
- New Jersey signed a separate law in June 2026 that bans selling sensitive data and creates a data broker registry.
About this table
Thresholds, dates and penalties change as states amend their laws, so each table carries a last updated date. Penalties are the amounts the statute allows per violation, and what a state actually seeks varies. This table is general information, not legal advice. If you think a law applies to your business, a privacy attorney can confirm it.
How Risingline can help
Risingline offers privacy compliance solutions for websites, built to help meet current privacy standards. They include a cookie consent banner and preference center that honors opt-out signals such as Global Privacy Control. Read more about consent management and privacy controls, or contact us to talk about your website.