US State Privacy Laws List: Every State Compared (2026 Guide)

Executive Summary: The US State Privacy Laws List at a Glance

Your biggest prospect sends a security questionnaire. Question 14 reads: "Which US state privacy laws do you comply with?" Nobody on your team can name more than California's.

Twenty-four states have enacted a comprehensive consumer privacy law, and there is still no federal one. This US state privacy laws list covers every one of them, with effective dates, applicability thresholds, cure periods and penalties, current as of October 2026.

By the end of this guide, you will know which of these laws can reach a SaaS company, which cure periods have already expired, and what to put on your calendar for 2027 and 2028.

One boundary up front: California's rules run far deeper than a table row can carry. If California is your main concern, our CCPA compliance guide covers it in full. Here, California gets one entry among many.

Here's what's ahead:

• How many states have privacy laws, and whether a federal law is coming
• The full list of state laws, in effect and signed
• Who each law covers, and the cure periods and fines that follow
• How the other states differ from California, and which is strictest
• Whether B2B data and small businesses are covered
• What changes in 2026, 2027 and 2028, and a practical way to manage all of it

Which States Have Privacy Laws, and Is There a Federal Privacy Law?

The United States has no single privacy statute for consumer data. States filled the gap, one law at a time: California went first in 2018, and the count has climbed every year since.

A comprehensive state privacy law is a statute that covers most kinds of consumer personal data and gives residents rights over it (access, deletion, opting out of sale and targeted advertising). That separates it from narrow laws that cover one data type, like health data or biometrics.

How many states have comprehensive state privacy laws

Twenty states have a comprehensive privacy law in effect, and four more have signed one. One 2026 tracker puts 20 in effect as of September 2026 (Enzuzo). The four signed in 2026, Oklahoma, Alabama, Louisiana and Vermont, bring the total to 24 by our count (Morgan Lewis, Venable).

You will see 23 in some places. The difference is Florida, whose law applies its full duties only to very large platforms and is often left out of running counts (Multistate). We count it here because its sensitive-data rules reach any for-profit business.

Does the US have a federal privacy law

No. There is still no comprehensive federal privacy statute. Federal law covers specific sectors instead: HIPAA for health information, the Gramm-Leach-Bliley Act for financial institutions and the Children's Online Privacy Protection Act for children under 13. These sit on top of state laws.

A federal bill exists. House Energy and Commerce released the SECURE Data Act (H.R. 8413) in April 2026, and a subcommittee hearing on 3 June 2026 split along party lines (StateScoop). It would replace the patchwork with one national standard by preempting state laws, which is why states and privacy advocates are fighting it. It has not become law.

US State Privacy Laws List: All 24 States With Effective Dates

Here is the full US privacy laws by state reference. Start with the 20 laws already in force, then the four that arrive in 2027 and 2028.

US state privacy laws list: the 20 laws in effect today

The table shows the state privacy laws effective dates you will be asked about in vendor questionnaires. Dates come from the statutes as summarized by the Enzuzo tracker (updated 23 September 2026), Multistate and Baker Donelson.

Maryland's two dates trip people up. The law took effect on 1 October 2025 but does not reach processing activity before 1 April 2026 (Koley Jessen).

US state privacy laws list: the four laws signed in 2026

Four states enacted laws this year. None is in effect yet, but all four are close enough that a 2027 contract renewal can already raise them.

Sources: Hunton on Oklahoma, FPF on Alabama, FPF on Louisiana, Hunton on Vermont. Some summaries date Alabama's signing 17 April; the 16 April date is FPF's.

State Privacy Laws by State: Who Each Law Covers

A state privacy law comparison starts with one question: does the law reach you at all? Thresholds come in three styles, and the style tells you how likely a small SaaS company is to be caught.

Figures come from the Enzuzo tracker and the law-firm summaries linked in the previous section.

A few state-specific rules matter for early-stage teams. Texas and Nebraska have no volume test at all, so the question is whether you count as a small business under the Small Business Administration's definition.

Florida's full duties fall only on companies with $1 billion or more in global revenue plus platform criteria, but its sensitive-data rules apply to any for-profit business. Alabama exempts businesses under 500 employees that do not sell personal data, and nonprofits under 100 employees that do not sell it (FPF).

Louisiana is the odd one. Its test is any one of three: annual gross revenue above $25 million, personal data of 75,000 or more consumers, households or devices, or 50% or more of revenue from selling personal data (DWT). A company with revenue over $25 million can be in scope even with few Louisiana users.

US State Privacy Laws List: Cure Periods and Penalties Compared

A cure period is a window after a regulator's notice during which you can fix a violation before a penalty applies. Most state laws started with one. Most have now lost it.

The table below is the state privacy laws cure period and penalty reference for the 20 laws in effect. Every state is attorney-general enforced except California (the California Privacy Protection Agency plus the AG), and only California gives consumers a private right of action, limited to data breaches.

Source: Enzuzo tracker, 23 September 2026, checked against the Montana SB 297 text, Baker Donelson on New Hampshire and law-firm summaries; California figures from the CPPA (effective 1 January 2025, next adjustment due 2027). Where "mandatory cure ended" appears, the attorney general may still choose to offer a cure period.

The four new laws are mixed. Oklahoma has a mandatory 30-day cure with no sunset, and a $7,500 penalty (Hunton). Alabama allows 45 days and up to $15,000, the highest penalty among the new laws. Louisiana's cure applies only from 1 January to 31 July 2027. Vermont's 60-day cure runs from 1 January 2028 to 30 June 2029. Both sunset, so the safest plan is to be compliant on day one.

How the US State Privacy Laws List Differs From California's CCPA

Most of the 19 other laws follow the Virginia template: attorney-general enforcement only, opt-in consent for sensitive data, opt-out for sale and targeted advertising, and data protection assessments for high-risk processing. California is the exception, and it is the one most SaaS companies hit first.

The differences that matter in practice:

• A dedicated agency. California has the California Privacy Protection Agency alongside the attorney general. Every other state leaves enforcement to the AG alone.
• No mandatory cure period. California removed it on 1 January 2023.
• B2B and employee data are in scope. California's exemptions for these categories expired on 1 January 2023. Most other states never covered them (more on this below).
• A limited private right of action. Consumers can sue after certain data breaches. No other comprehensive state law gives them that right.
• Heavier rulemaking. Regulations on automated decision-making technology (ADMT), risk assessments and cybersecurity audits took effect on 1 January 2026. ADMT obligations begin on 1 January 2027, and risk-assessment and audit filings phase in from 2028 (White & Case).

For the full California picture, see our CCPA compliance guide, and for tooling, best CCPA compliance software.

Which state has the strictest privacy law

There is no single winner, because "strict" depends on what you do with data. Four laws stand out, each for a different reason.

California: the broadest enforcement. A dedicated agency, no cure period, B2B and employee data in scope, and the most detailed regulations. Verdict: the one most likely to find you.

Maryland: the tightest data rules. It bans selling sensitive data unless the sale is necessary to provide a product the consumer asked for, with no consent exception, and limits collection to what is reasonably necessary and proportionate (Koley Jessen). Penalties reach $10,000, or $25,000 for a repeat violation. Verdict: the strictest on what you may sell.

Connecticut: the widest reach after July 2026. The amendments added a 35,000-consumer threshold, triggers for any sensitive-data processing or sale, a "reasonably necessary and proportionate" test for collection, a disclosure when data is used to train large language models, and impact assessments for profiling (Morgan Lewis). Verdict: the biggest jump in scope of any existing law.

Vermont: the strictest of the new laws. It has the lowest sensitive-data and sales triggers of the four 2026 laws (3,000 consumers, on top of a 35,000-consumer general threshold), no blanket nonprofit exemption, a "reasonably necessary and proportionate" standard and a ban on geofencing within 1,850 feet of healthcare facilities (Hunton). Verdict: the one to design for if you want to be ready for 2028.

Global Privacy Control: Which States Require Universal Opt-Out Signals

Global Privacy Control (GPC) is a browser setting that tells every site a person visits, in one signal, that they opt out of the sale and sharing of their data. Twelve states now require businesses to honor a universal opt-out signal like it: California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon and Texas (Enzuzo, Cookie-Script). Oregon's duty became mandatory on 1 January 2026.

Louisiana will add a route in 2027: consumers may use an authorized agent or technology such as a browser extension or device setting to opt out (DWT).

In practice, honoring GPC means your site checks for the signal on page load and treats it as a valid opt-out of sale and targeted advertising for that browser. It is also an easy audit finding, because a regulator can test it in minutes. Enforcement is real: Baker Hostetler's Q1 2026 round-up lists a $2.75 million CCPA settlement with a family entertainment company over GPC and children's data violations (Baker Hostetler).

Do State Privacy Laws Apply to B2B Data and SaaS Companies?

This is the question that decides how much of the list matters to you. Most state privacy laws protect "consumers," meaning residents acting in a personal or household context, and exclude people acting in a commercial or employment context. A buyer logging in to your product on behalf of their employer is usually outside that definition.

California breaks the pattern. Its law covers employee and business-to-business data, which Virginia's excludes (Enzuzo). Oklahoma and Louisiana, the two 2027 laws we checked, both exclude commercial and employment-context data (Hunton, DWT). Colorado, Connecticut, Utah and Virginia also exclude individuals acting in a commercial or employment context from their definition of a consumer.

That is good news for a B2B SaaS company, with three caveats.

First, your own marketing website is consumer-facing: visitors who are not yet customers are consumers, and the cookies, forms and ad tags you run on them are in scope. Second, California still reaches your customer-contact and employee records. Third, a product that handles end-user data on behalf of a customer makes you a processor, and a processor still owes the controller (your customer) contractual and security commitments under most of these laws.

Then use this table to decide what to check first:

State Privacy Laws 2026 and Beyond: Amendments and What Comes Next

Several amendments to existing laws land in 2026, and the next wave of new laws starts on 1 January 2027. Here is the dated list, as of October 2026 (Morgan Lewis, Venable).

New Jersey's sensitive-data sale ban took effect on 30 June 2026 and Connecticut's geolocation ban follows on 1 October 2026 (Venable).

Watch two things. The first is more states: the 2026 session added four, and nothing suggests the pace has stopped. The second is the SECURE Data Act. If a version with broad preemption passed, it could replace much of this list with one federal standard. Until it does, plan for the list as it stands.

How to Manage the US State Privacy Laws List as a Startup

You do not need 24 compliance projects. You need one program built to the strictest common standard, with a calendar for the exceptions. A practical order:

1. Count users by state. Pull website visitors, sign-ups and customers by US state, and mark every state near a threshold. Revisit it each quarter, because thresholds are measured on the preceding calendar year.
2. Build to the highest common bar. Use California's rights and notice requirements as the base, then add Maryland's sensitive-data rule and Connecticut's minimization test where you can.
3. Publish one privacy notice and one request process. A single page that lists the rights (access, correction, deletion, portability, opt-out) and two ways to submit a request covers nearly every state.
4. Honor universal opt-out signals. Make GPC work on your website, since 12 states already require it.
5. Map your data and set retention limits. Know what personal data you hold, where it flows and when it is deleted. Our data retention policy guide shows how to set the schedule.
6. Run assessments for high-risk processing. Targeted advertising, sales of data, sensitive data and profiling trigger data protection assessments in most Virginia-model states.
7. Calendar the dates. Put 1 January 2027, 1 May 2027 and 1 January 2028 on the roadmap now, and the expiry date of any cure period that still protects you.

Common Mistakes When Using the US State Privacy Laws List

These are the errors we see most often when a team first reads the list:

• Counting offices instead of consumers. A state law applies based on residents whose data you process, wherever your company sits.
• Treating California as the only law. California is the strictest on enforcement, but 19 others apply the same day-to-day duties, and several have lower thresholds.
• Assuming a cure period will save you. In more than half of the in-effect states it has already expired.
• Ignoring the marketing site. B2B products often pass the "consumer" test on their website, not in their app.
• Skipping the 2027 and 2028 laws. Oklahoma and Louisiana arrive in January 2027, and the notice and assessment work takes months.
• Forgetting processors. If you handle customer data, your customers will flow state-law obligations down to you through contracts.

How ComplyJet Fits Into Multi-State Privacy Compliance

We built ComplyJet for early-stage teams who need privacy and security controls to hold up in an enterprise review. GDPR is among the frameworks we support, alongside SOC 2, ISO 27001 and HIPAA, and a team that has done the data mapping, policy and evidence work once can reuse it across several of the laws in this guide.

Be clear about what that means. ComplyJet is compliance automation software, not a law firm, and it does not interpret state statutes or replace counsel for a question like whether you cross Texas's small-business line. What it does is keep your policies, controls and evidence in one place, so a customer's privacy questionnaire is answered from a system instead of a scramble. If a formal privacy certification is on your roadmap, our ISO 27701 guide explains how it fits.

FAQs

Which states have data privacy laws?

Twenty states have a comprehensive law in effect: California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Florida, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island. Oklahoma, Louisiana, Alabama and Vermont have signed laws that take effect between 2027 and 2028.

How many states have privacy laws?

Twenty-four have enacted a comprehensive consumer privacy law as of October 2026, and 20 of those are in effect. Some law-firm counts say 23 because they leave out Florida's narrower law.

Does the US have a federal privacy law?

No comprehensive one. The US relies on state laws plus federal sector laws like HIPAA, GLBA and COPPA. The SECURE Data Act was released in April 2026 and would preempt many state laws, but it has not passed.

Which state has the strictest privacy law?

It depends on what you measure. California has the broadest enforcement and no cure period. Maryland has the tightest data rules, including a ban on selling sensitive data. Vermont has the strictest of the new laws, with a 3,000-consumer trigger for sensitive data and sales.

Do state privacy laws apply to small businesses?

Often yes, if you cross a consumer threshold. Texas and Nebraska have no volume threshold and exempt only SBA-defined small businesses. Rhode Island and Connecticut reach companies with 35,000 residents' data. Alabama exempts businesses under 500 employees that do not sell personal data.

Do state privacy laws apply to B2B data?

Mostly not. Most laws define a consumer as a resident acting in a personal or household context, which excludes employment and commercial roles. California is the main exception, and your public marketing site can still put you in scope.

Which state privacy laws are coming next?

Oklahoma and Louisiana take effect on 1 January 2027, Alabama on 1 May 2027 and Vermont on 1 January 2028. More bills are likely in future sessions, and a federal law could change the picture.

Related Reading

• CCPA compliance guide: California's rules in full, which this list only summarizes
• Best CCPA compliance software: tooling options for California and other state laws
• GDPR compliance for US companies: when EU law reaches a US business
• GDPR countries: the EU and EEA list and adequacy decisions
• ISO 27701 guide: a privacy certification that maps across several laws
• Data retention policy: setting the schedule these laws expect