Understanding US State Privacy Law Applicability & Thresholds (2026 Edition)
The landscape of consumer privacy in the United States is represented by a highly dynamic, complex patchwork of state-level statutory regulations. Rather than a singular federal baseline like the European Union's GDPR, US companies must navigate individual frameworks passed by individual state assemblies. Because these laws overlap in terms of consumer protections, yet diverge on structural elements like entity-level exemptions and statutory thresholds, determining compliance applicability is an ongoing operational challenge for modern organizations.
Key Diagnostic Drivers
To evaluate whether your enterprise falls within the jurisdictional boundaries of these distinct laws, compliance practitioners assess three key metrics:
- Global Gross Annual Revenue: Statutory thresholds often leverage flat-rate global gross revenues (e.g., California’s $25,000,000 trigger, or Florida’s $1,000,000,000 gatekeeper definition). Note that these limits refer to global corporate turnover, not merely revenue sourced within the state.
- Data Processing and Monetization Volume: Most statutes apply rules when a firm processes records belonging to a target volume of resident consumers. A typical threshold is 100,000 residents. However, this count frequently drops down to 25,000 records if a substantial portion (usually 25% to 50%) of revenue is derived from transactional sales or monetization of that consumer information.
- Entity-level Exemptions: Laws in Virginia (VCDPA), Connecticut (CTDPA), and Utah (UCPA) grant broad, comprehensive entity-level exemptions to organizations subject to Gramm-Leach-Bliley Act (GLBA) frameworks or HIPAA regulations. Conversely, California (CCPA) primarily applies only narrow, data-level exemptions, meaning financial institutions or healthcare firms might still need to comply with CCPA for standard consumer marketing data.
The SBA Conundrum & Texas Exception
One of the most notable exceptions is the Texas Data Privacy and Security Act (TDPSA). Unlike other states that deploy flat financial thresholds to exempt smaller companies, Texas applies to any commercial entity doing business in the state unless they qualify as a Small Business Administration (SBA) Small Business. However, TDPSA outlines an important operational carve-out: even small businesses are strictly prohibited from selling sensitive consumer data without acquiring explicit, prior opt-in consent.
Implementing a Defense-in-Depth Privacy Program
As additional states continuously join the regulatory fray (including Colorado's updated oversight for non-profit entities), building distinct privacy routines for individual states is becoming untenable. Best practices dictate adopting unified privacy notices, deploying universal opt-out processing mechanisms (such as the Global Privacy Control signal), and maintaining active registers of processing activities (ROPA) to quickly scale as new thresholds are met.
Frequently Asked Questions
Which US state privacy laws are active in 2026?
Comprehensive state privacy laws are active in California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Utah (UCPA), Connecticut (CTDPA), Texas (TDPSA), and Florida (FDBR).
What are the common revenue thresholds for state privacy laws?
Many state privacy laws trigger at $25 million in global gross revenue (such as California and Utah). However, other states do not use flat revenue thresholds but rely on data processing volumes instead.
What is the Texas TDPSA small business exemption?
Unlike other states, the Texas TDPSA applies to any business operating in Texas unless it is classified as an SBA small business. However, SBA small businesses must still get opt-in consent to sell sensitive data.
Do state privacy laws exempt non-profit organizations?
Most state privacy laws (including Virginia, Utah, Texas, and Connecticut) exempt non-profits. However, California's CCPA has narrow exemptions, and Colorado's CPA eliminated its general non-profit exemption as of July 1, 2025.