There is no US federal privacy law. There are twenty comprehensive state laws in force, twelve states where a Global Privacy Control signal must be honoured, sector statutes that sit on top of all of them, and more arriving in 2027 and 2028. In our builds this is an engineering constraint, not a legal opinion — so we state what changes in the funnel, and route the interpretation to your counsel.
StateLawIn forceTriggerWhat changes in your funnel
CaliforniaCCPA / CPRA2020 / 2023$26.6M+ gross revenue or 100K consumers/householdsSell/share disclosure, opt-out links, GPC honoured, and a 'Right to Know' notice that is a page, not a popup. The CPPA adjusts the revenue threshold on a schedule, so it is not a static config.
TexasTDPSAJul 2024No consumer-count thresholdTexas applies to entities processing Texan personal data beyond a small-business exemption — the most common 'we are too small to be covered' assumption in the country fails here first.
ConnecticutCTDPA (+ 2025 amendments)Jul 2023 / Jul 202635,000 consumers, or any sensitive data at any volumeThe lowest broad trigger in the top tier, with the 2026 amendment removing the revenue-percentage escape hatch. Sensitive-data processing at any volume pulls you in.
ColoradoCPAJul 2023100,000 consumersUniversal opt-out signal honoured, plus profiling rules that bite on automated decisions — relevant the moment you score or route leads with a model.
OregonOCPAJul 2024100,000 consumersGPC enforcement switched on in January 2026: the signal has to be respected in the tag layer, not answered by a cookie banner.
MarylandMODPAOct 202535,000 consumers, or 3,000 sensitiveThe strictest data-minimisation and sensitive-data sales rules in the country — a reason to stop collecting what the funnel does not need, everywhere.
FloridaFDBRJul 2024$1B revenue + 100K consumersNarrow applicability and a short cure window. If you are big enough to be covered, you are big enough to be noticed by the AG.
IllinoisBIPA2008Any biometric collection from an IllinoisanNot a privacy-comprehensive law, and the one with the private right of action: face or voice data in an AR filter, a virtual try-on or a call-recording vendor is a live exposure in that state.
WashingtonMy Health My Data2023Consumer health data, any volumeGeofence and health-data rules that reach outside the healthcare vertical — wellness, fitness, insurance and clinic-adjacent brands are inside it.
Federal layerTCPA · CAN-SPAM · GLBA · HIPAA · COPPAongoingChannel- and category-specificSMS consent, quiet hours, opt-out language, financial and health sector rules, and children's-data limits. These govern how you may contact, whatever the state says about tracking.
AccessibilityADA Title III · WCAG 2.2 AAongoingUS-facing commerce and servicesLanding systems are audited to WCAG 2.2 AA: the checkout you optimised for conversion should not be the one that generates a demand letter.
On the wayOklahoma · Louisiana · Alabama · Vermont2027 / 2028signed, not yet in forceOklahoma and Louisiana land Jan 1 2027, Alabama May 1 2027, Vermont Jan 1 2028. We build the geo layer to absorb a new state with a config change, not a project.