The United States has no federal comprehensive privacy law, so any organisation handling personal data about US residents has to work to a patchwork of state statutes that share a vocabulary but differ in thresholds, definitions, deadlines and enforcement. California's CCPA, amended by the CPRA and backed by a dedicated regulator, now adds cybersecurity audits, risk assessments and automated decisionmaking rules, while Virginia, Colorado, Connecticut, Texas, Oregon and later states follow a controller and processor model. This guide compares the main laws and covers sensitive data, opt-out signals, assessments, health and biometric data, data brokers, breach notification and enforcement. It is for security, privacy and engineering leads turning the patchwork into one programme.
Key takeaways
- Two models, one programme: California has its own thresholds and agency; most other states copy Virginia's controller and processor model. Build to the strictest common rule and track differences in a register.
- Sensitive data is the dividing line: California gives a right to limit its use; Virginia, Colorado, Connecticut and Texas require consent before processing it, and Washington's My Health My Data Act goes further for health data.
- Opt-out signals are mandatory, not optional: California, Colorado (from 1 July 2024), Connecticut (from 1 January 2025) and Oregon (from 1 January 2026) require businesses to honour browser signals such as Global Privacy Control.
- California's 2025 regulations reach the security team: they took effect on 1 January 2026, with risk assessment attestations due by 1 April 2028 and cybersecurity audit certifications phased from 1 April 2028 to 1 April 2030 by revenue.
- Cure periods are disappearing: Colorado's ended on 1 January 2025; Virginia and Texas still give 30 days. Do not plan on a warning letter.
How the patchwork is built
State laws fall into two families, and knowing which one you are reading saves a lot of confusion.
- The California model: the CCPA, as amended by the California Privacy Rights Act, applies to a "business" that meets a threshold and protects a "consumer", which in California includes employees and business contacts. The California Privacy Protection Agency (CPPA, also branded CalPrivacy) and the Attorney General enforce it, with regulations in Title 11 of the California Code of Regulations.
- The Virginia model: the Virginia Consumer Data Protection Act (VCDPA) uses GDPR-style controller and processor roles, excludes people acting in an employment or commercial context, and is enforced only by the Attorney General. Colorado, Connecticut, Texas, Oregon and later laws in Iowa, Indiana, Tennessee, Montana, Delaware, New Hampshire, New Jersey, Nebraska, Kentucky, Maryland, Minnesota and Rhode Island are variations on it.
- Sector and topic laws: health data, biometric privacy, data broker and breach notification laws apply alongside, often without volume thresholds.
Some laws exempt entities covered by HIPAA or the Gramm-Leach-Bliley Act; others exempt only the regulated data, so check the wording before assuming a bank or health provider is out of scope. For how these laws sit next to GDPR, PIPL, LGPD and others, see the Global Privacy Regulatory Map.
The main state laws at a glance
Facts below are from the statute or the enforcing agency's pages as of 17 October 2026; where an official source did not confirm a detail, the cell says so. California adjusts its monetary amounts every odd-numbered year.
| State and law | In force | Who is covered | Sensitive data | Universal opt-out signal | Cure period | Enforcement and penalty |
|---|---|---|---|---|---|---|
| California: CCPA as amended by CPRA (Civ. Code 1798.100 et seq.) | CCPA 2020; CPRA amendments 2023; 2025 regulations effective 1 January 2026 | Revenue over $26,625,000 (from 1 January 2025), or buys, sells or shares PI of 100,000+ consumers or households, or 50%+ of revenue from selling or sharing | Right to limit use (1798.121); "Limit the Use of My Sensitive Personal Information" link | Required (11 CCR 7025) | None in the statute for CPPA or AG enforcement | CPPA and AG; up to $2,663 per violation or $7,988 intentional or involving under-16s (2025 amounts); private action for certain breaches |
| Virginia: VCDPA (Va. Code 59.1-575 et seq.) | 1 January 2023 | Controls or processes PI of 100,000+ consumers, or 25,000+ and over 50% of gross revenue from sale | Consent required | Not required by the statute text reviewed | 30 days' written notice | AG only; up to $7,500 per violation; no private right of action |
| Colorado: Colorado Privacy Act (rules at 4 CCR 904-3) | 1 July 2023 | PI of more than 100,000 consumers a year, or revenue or discounts from selling PI of 25,000+ | Consent required | Required from 1 July 2024; GPC the first recognised mechanism | 60 days, ended 1 January 2025 | AG and district attorneys |
| Connecticut: CTDPA | 1 July 2023 | PI of 35,000+ consumers, or any sensitive data processing, or offering PI for sale (payment-only processing excluded) | Consent required | Required from 1 January 2025 | Not confirmed on the AG page; check the current statute | AG only; up to $5,000 per violation under CUTPA; no private right of action |
| Texas: TDPSA | 1 July 2024 | Processes or sells PI; SBA-defined small businesses exempt, but need consent to sell sensitive data | Consent required | Not confirmed on the AG page; check the statute | 30 days | AG; up to $7,500 per violation |
| Oregon: OCPA (ORS 646A.570 to 646A.589) | 1 July 2024 | For-profits and nonprofits above volume thresholds; all auto manufacturers regardless of thresholds | Covered; check statute for the consent rule | Required from 1 January 2026 | Not confirmed on the DOJ page | Oregon DOJ |
| Washington: My Health My Data Act (HB 1155) | 31 March 2024 (30 June 2024 small businesses); s.10 from 23 July 2023 | Any regulated entity collecting consumer health data of Washington consumers; no volume threshold stated by the AG | All consumer health data; sale needs a signed valid authorisation | Not applicable | None stated | AG and private lawsuits under the Consumer Protection Act |
Utah's Consumer Privacy Act (in force since 31 December 2023) is generally the narrowest of the early laws; its official code pages could not be read for this guide, so check its thresholds directly in Utah Code Title 13, Chapter 61.
Consumer rights and how they differ
| Right | California | Virginia-model states | Practical note |
|---|---|---|---|
| Know or access | Yes, categories and specific pieces | Yes, confirm and access | One search process serves both |
| Delete | Yes, with exceptions | Yes | Propagate to processors; Washington covers backups |
| Correct and portability | Yes | Yes | Needs a source of truth per attribute |
| Opt out of sale | Yes ("valuable consideration") | Yes (Virginia: "monetary consideration"; other states broader) | Map every data flow to third parties |
| Opt out of targeted advertising | Opt out of "sharing" for cross-context behavioural advertising | Yes | Pixels and SDKs are the usual problem |
| Opt out of profiling | ADMT opt-out from 1 January 2027 for significant decisions | Yes, profiling for decisions with legal or similarly significant effects | Inventory models that decide on people |
| Sensitive data | Right to limit | Opt-in consent | Default to consent nationally |
| List of recipients | Categories of third parties | Oregon: list of specific entities; Connecticut: third parties that received sold data | Keep a named list |
| Response deadline | 45 calendar days, up to 90 with notice; acknowledge within 10 business days | 45 days, one 45-day extension (Virginia) | Run one clock at the shortest deadline |
Request handling, identity verification and authorised agents are covered in detail in the DSAR Guide: Handling Data Subject Requests; this guide does not repeat them.
Sensitive data: limit versus consent
Definitions overlap but differ. California's list (Civ. Code 1798.140(ae)) adds items most states lack: government identifiers, account log-in credentials, the contents of private messages, union membership and neural data, alongside health, genetic, biometric, precise geolocation, racial or ethnic origin, religion, citizenship and sexual orientation. Virginia's list (59.1-575) also covers data collected from a known child.
- Design to opt-in: Virginia 59.1-578(A)(5) says a controller shall "not process sensitive data concerning a consumer without obtaining the consumer's consent", and Colorado, Connecticut and Texas say the same. California's "limit" right is weaker, so a national programme built on consent satisfies both.
- Credentials are sensitive data: California treats account log-in credentials as sensitive personal information. Credential stores, reset flows and identity provider logs are therefore in scope. See the Identity Data Privacy and Consent Guide.
- Children and teens: Virginia routes known-child data through COPPA consent; Oregon bars targeted advertising and certain profiling for under-16s without permission.
Sale, sharing and universal opt-out signals
"Sale" is the term most likely to catch an organisation out. Virginia limits it to an exchange "for monetary consideration". California covers exchange for "monetary or other valuable consideration" and adds "sharing", defined as disclosure "for cross-context behavioral advertising, whether or not for monetary or other valuable consideration". A marketing pixel that sends identifiers to an ad platform is therefore a sale or share in California even if no money changes hands; the 2022 California Attorney General settlement with Sephora ($1.2 million) turned on exactly this and on not honouring Global Privacy Control.
- California: 11 CCR 7025 makes an opt-out preference signal a valid opt-out for that browser and any associated consumer profile.
- Colorado: from 1 July 2024, using the Department of Law's list under 4 CCR 904-3 Rule 5.07; GPC was the first recognised mechanism.
- Connecticut and Oregon: from 1 January 2025 and 1 January 2026 respectively; in Oregon the data may be kept but not sold or used for targeted advertising.
Implementation detail (the Sec-GPC: 1 header, logged-in profiles, consent platforms) is in the Consent Management Guide: Cookies, CMPs and GPC.
California's 2025 regulations: cybersecurity audits, risk assessments and ADMT
The CPPA board adopted the package on 24 July 2025, the Office of Administrative Law approved it on 22 September 2025, and it took effect on 1 January 2026, with the deadlines below.
| Obligation | Applies to | Key dates (CPPA) | What the security team owns |
|---|---|---|---|
| Cybersecurity audit | Businesses whose processing presents significant risk to consumers' security (thresholds in 11 CCR 7120(b)) | Certification due 1 April 2028 if revenue over $100 million; 1 April 2029 for $50 million to $100 million; 1 April 2030 if under $50 million | An annual, independent audit of the cybersecurity programme; evidence of controls such as multi-factor authentication |
| Risk assessment | Businesses whose processing presents significant risk to consumers' privacy (11 CCR 7150) | Comply from 1 January 2026; by 1 April 2028 submit an attestation and a summary of risk assessment information | Security safeguards section of each assessment; data flow and retention facts |
| Automated decisionmaking technology (ADMT) | Businesses using ADMT to make significant decisions | Comply from 1 January 2027 | Model inventory, access and opt-out handling, logging of decisions |
- ADMT definition: 11 CCR 7001(e) covers technology that uses computation on personal information to replace or substantially replace human decisionmaking. Human review only counts if the reviewer can interpret the output, weighs other information and can change the decision.
- Significant decision: 11 CCR 7001(ddd) covers the provision or denial of financial or lending services, housing, education enrolment, employment or contracting opportunities, and healthcare services; advertising is excluded.
- MFA defined: the regulations define multi-factor authentication as at least two different factor types (knowledge, possession, inherence). Credentials are sensitive data and MFA is a defined term, so the identity team owns much of the audit evidence.
Read sections 7120 to 7124 (audits), 7150 to 7157 (risk assessments) and 7200 to 7222 (ADMT) in the approved text before scoping; this guide does not summarise their detailed lists. For running the assessment itself, see the DPIA Guide: Running a Data Protection Impact Assessment, and for the ADMT and AI overlap, the AI and Privacy Guide.
Data protection assessments outside California
The Virginia model requires a documented data protection assessment (DPA) before certain processing, available to the Attorney General on request rather than filed.
- Virginia (59.1-580): targeted advertising, sale, sensitive data, profiling with reasonably foreseeable risks of unfair treatment, financial or physical injury, or intrusion, and any processing presenting a heightened risk of harm.
- Colorado and Texas: similar triggers; Colorado's rules in 4 CCR 904-3 add detailed content requirements.
- Reuse: one assessment template mapped to the strictest content list (Colorado's rules and California's 7150-series) avoids repeating the work per state.
Health, biometric and data broker laws
Consumer health data
Washington's My Health My Data Act covers health inferences drawn from non-health data such as purchases. Selling it needs a valid authorisation that seller and buyer keep for six years, deletion reaches backups, and a violation is a per se Consumer Protection Act violation open to private suits. Connecticut's consumer health data rules have no thresholds, require consent to sell and ban geofences around mental, reproductive or sexual health facilities. See the Healthcare Identity Security Guide for the HIPAA side.
Biometric privacy
Illinois' Biometric Information Privacy Act (BIPA) requires written notice and release before collecting biometric identifiers and gives a private right of action with liquidated damages of $1,000 per negligent and $5,000 per intentional or reckless violation; a 2024 amendment limited repeated scans of the same person to a single recovery. Texas' Capture or Use of Biometric Identifier Act (CUBI) is enforced by the Attorney General. Face login, voice authentication and workforce time clocks are the usual exposures. See the Biometrics Guide.
Data brokers and the Delete Act
California data brokers must register and pay the annual fee between 1 and 31 January (the fee for 2026 was $6,000) through the Delete Request and Opt-out Platform (DROP). From 1 August 2026, brokers must access DROP at least once every 45 days and process the deletion requests it holds, and from 1 January 2028 they need an independent audit every three years. Buyers of broker data should expect records to disappear on that cycle.
Breach notification and the CCPA private right of action
All 50 states, the District of Columbia, Guam, Puerto Rico and the US Virgin Islands have breach notification laws. Most define a breach as unauthorised acquisition of a name combined with identifiers such as a Social Security, driver's licence or financial account number, and most exempt encrypted data. Deadlines and regulator notice vary, so keep a jurisdiction matrix in the incident response plan (see the Incident Response Guide).
California adds a private right of action (Civ. Code 1798.150) where certain personal information is exposed because the business failed to maintain reasonable security. From 1 January 2025 the statutory damages are $107 to $799 per consumer per incident, or actual damages if greater. The 23andMe breach shows the pattern: credential stuffing against accounts without mandatory MFA exposed genetic data, which California and the Virginia-model laws treat as sensitive. The audit regulations now give "reasonable security" more shape, so privacy and security should share evidence.
Enforcement and cure periods
In California the CPPA brings administrative enforcement and the Attorney General civil actions; the CPRA removed the original 30-day cure right. In Virginia and Texas a controller that cures within 30 days and gives a written statement avoids action, but breaching the statement brings penalties. Colorado's cure process ended on 1 January 2025. No comprehensive law in the table has a general private right of action; private exposure comes from California breach claims, Washington's health data law and BIPA.
How to implement a multi-state programme
- Determine applicability per state: count consumers by state for the last calendar year, record revenue and sale revenue, and note sector exemptions.
- Map data and flows: identify sensitive data, health inferences, biometrics, precise location and every third-party recipient by name. See the Data Mapping and ROPA Guide.
- Set a national baseline: opt-in for sensitive data, honour GPC everywhere, one 45-day request clock, named recipient lists and one assessment template.
- Fix the advertising stack first: test pixels, SDKs and server-side tags in staging with GPC on and off. Roll out by property and keep the previous tag configuration so you can roll back if a legitimate first-party function breaks.
- Prepare California's 2025 obligations: scope the cybersecurity audit against the revenue tier date, start risk assessments for in-scope processing now, and inventory ADMT used for significant decisions before 1 January 2027.
- Contract and monitor: update service provider and processor terms per state, and review the register quarterly against legislative and CPPA changes.
Small versus large organisations
A small business below every volume threshold can still be caught by Texas' sensitive data sale rule, Washington's health data law, Connecticut's sensitive-data trigger, BIPA and breach laws. A large organisation should run one preference centre and one request platform, propagating choices by API to every downstream system.
Detection and measurement
- Opt-out signal honour rate: sampled GPC sessions where no sale or share tags fired (target 100%).
- Request timeliness: rights requests closed within 45 days, by state.
- Assessment coverage: high-risk processing activities with a current, signed assessment.
- Recipient accuracy: recipients found by tag scans but missing from the named list (target zero).
- Audit readiness: open findings against the California cybersecurity audit scope, trending down before the certification date.
Framework mapping
| Obligation | NIST SP 800-53 Rev. 5 | ISO/IEC 27001:2022 Annex A | NIST CSF 2.0 |
|---|---|---|---|
| Legal applicability register | PM-28 (risk framing), PT-2 (authority to process) | A.5.31 legal, statutory, regulatory and contractual requirements | GV.OC-03 |
| Notice, consent and purpose | PT-3, PT-4, PT-5 | A.5.34 privacy and protection of PII | GV.OC-03 |
| Sensitive data handling | PT-7 (specific categories of PII) | A.5.12 classification, A.5.34 | ID.AM-07 |
| Risk and data protection assessments | RA-3, RA-8 (privacy impact assessments) | Clause 6.1.2, A.5.34 | ID.RA |
| Cybersecurity audit evidence | CA-2, CA-7, IA-2(1) | A.5.35 independent review, A.8.5 secure authentication | ID.IM, PR.AA |
| Breach notification | IR-6, IR-8 | A.5.24 to A.5.26 | RS.CO |
For crosswalking these controls to SOC 2 or ISO 27001 evidence, see the Control Mapping Guide.
Common failure patterns
- Treating California as the whole answer: California's "limit" right does not satisfy consent-based sensitive data rules in Virginia, Colorado, Connecticut and Texas.
- Ignoring the signal in the logged-in experience: honouring GPC on the anonymous site but not applying it to the account profile, which 11 CCR 7025 requires where the business knows the consumer.
- Calling ad pixels "not a sale": sharing does not depend on payment, as the Sephora settlement showed.
- Assuming a HIPAA entity is exempt from everything: data-level exemptions leave non-PHI data, such as marketing and website analytics, in scope, and Washington's health data law has no volume threshold.
Practitioner checklist
- Refresh a state applicability register (consumer counts, revenue tests, exemptions) each January.
- Require opt-in consent for sensitive data in every state, including account credentials, precise location and health inferences.
- Honour GPC on every property and propagate it to logged-in profiles and server-side tags.
- Run one data protection or risk assessment template that meets Colorado's rules and California's 7150-series.
- Plan the California cybersecurity audit against your revenue tier deadline and collect MFA and access control evidence now.
- Inventory automated decisionmaking used for significant decisions before 1 January 2027.
- Screen health, biometric and data broker exposure separately from the comprehensive laws.
- Keep a breach notification matrix for every state, DC and the territories.
Standards and references
- California Privacy Protection Agency: California Consumer Privacy Act of 2018 (statute text)
- California Privacy Protection Agency: CCPA Updates, Cybersecurity Audits, Risk Assessments, ADMT and Insurance Regulations
- California Privacy Protection Agency: California Finalizes Regulations to Strengthen Consumers' Privacy
- Code of Virginia: Chapter 53, Consumer Data Protection Act
- Colorado Attorney General: Colorado Privacy Act
- Connecticut Attorney General: The Connecticut Data Privacy Act
- Washington Attorney General: Protecting Washingtonians' Personal Health Data and Privacy
- National Conference of State Legislatures: Security Breach Notification Laws
Related NHI Mgmt Group resources: Global Privacy Regulatory Map · DSAR Guide: Handling Data Subject Requests · Consent Management Guide: Cookies, CMPs and GPC · Privacy Programme Guide for Security Teams. This guide summarises US state privacy, health data, biometric, data broker and breach notification laws as they stood on 17 October 2026 and is not legal advice.