Every US state privacy law,
with the dates that matter.

Apart from California, the laws follow a shared model first used in Virginia. If you build for that model once, most states become a matter of thresholds and dates.

• Rights: access, correction, deletion, portability, and opt-out of sale, targeted advertising and profiling for significant decisions. Most give 45 days to respond, extendable once.
• Sensitive data: opt-in consent before processing health, biometric, precise location, children's and similar data in almost every state (California, Utah and Iowa use notice and opt-out instead).
• Notice: a privacy notice listing categories, purposes, recipients and how to use the rights, plus an appeal process if a request is refused.
• Data protection assessments for targeted advertising, sale, sensitive data and risky profiling. A DPIA built for GDPR usually covers the substance.
• Processor contracts with instructions, confidentiality, deletion and audit terms.
• Enforcement by the state Attorney General only (California also has its privacy agency), with no private right of action and, in many states, a cure period before action.

• Thresholds. From no volume test at all (Texas, Nebraska) to 175,000 consumers plus $25 million in revenue (Tennessee). The trend is downward: Connecticut and Montana both lowered theirs.
• Opt-out signals. Twelve states require you to honour them; the rest do not. See below.
• Data minimisation. Maryland limits the collection of sensitive data to what is strictly necessary for the product a consumer asked for, and bans its sale outright. Vermont, from 2028, adds its own minimisation rule.
• Cure periods. Some have expired, some sunset, some (Alabama) do not end.
• Exemptions. Most exempt data or entities covered by HIPAA and the Gramm-Leach-Bliley Act; some exempt nonprofits and universities, others do not.

Twelve states require businesses to treat a browser opt-out preference signal, which in practice means Global Privacy Control, as a valid request to opt out of sale and targeted advertising: California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon and Texas. Vermont joins in 2028. Louisiana's new law is read differently by different commentators, so plan to honour the signal there too. Because you cannot tell reliably which state a browser is in, most businesses honour GPC for every US visitor.

1. Count residents per state and test each threshold yearly. The low thresholds (25,000 in Montana and Alabama, 35,000 in Connecticut, Delaware, Maryland, New Hampshire, Rhode Island and Vermont) catch mid-sized companies.
2. Pick the strictest common denominator: one rights process, one appeal route, opt-in for sensitive data, and GPC honoured nationally.
3. Write one privacy notice with state-specific sections where the laws demand them. The privacy policy generator is a starting point.
4. Run data protection assessments for advertising, sale and sensitive data, and keep them ready for an Attorney General's request.
5. Update processor contracts once, to the strictest terms. See vendor risk management.
6. Track the calendar. New laws and amendments arrive every legislative session.

The consent platform applies a US opt-out regime per visitor, reads Global Privacy Control from the browser and records the opt-out, with the reason, in a tamper-evident ledger. A privacy-request link on the banner feeds a request queue with deadlines set by request type. US state privacy requirements are modelled in the shared control library alongside GDPR and SOC 2, so one control and one piece of evidence count everywhere they apply. See consent management and framework coverage. Deciding which laws apply to you remains a legal judgement.