U.S. privacy law is no longer limited to California. A growing number of states now have comprehensive consumer privacy laws. These laws affect how businesses collect, use, share, sell, retain, and secure personal information.

For business owners and in-house teams, the challenge is practical. You need to know whether a law applies, what changes are required, and how to manage privacy duties without slowing down normal operations. This overview explains the main issues to review and the steps most companies should consider.

Bronfman Law advises companies on privacy programs, online platforms, technology contracts, and data incidents through its Technology and Privacy Law practice.

1. Start with where your customers and users live

Most state privacy laws are based on the location of the consumer, not only the location of the business. A company in Texas, for example, may need to comply with California, Colorado, Connecticut, Virginia, or other state laws if it collects personal information from residents of those states and meets the law’s thresholds.

The main state laws include the California Consumer Privacy Act, as amended by the California Privacy Rights Act, the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Utah Consumer Privacy Act, the Texas Data Privacy and Security Act, and similar laws in other states. More states are continuing to adopt privacy laws, so this is an area that requires periodic review.

These laws differ, but they often use similar concepts. They generally apply to businesses that meet one or more thresholds based on revenue, the number of consumers whose data is processed, or the percentage of revenue derived from selling personal data or targeted advertising. California has its own revenue threshold. Texas has a broader structure, but it excludes small businesses as defined by the U.S. Small Business Administration, except for certain sensitive data sale restrictions.

A compliance review should begin with a short jurisdictional assessment. Identify where your customers, website visitors, app users, employees, and business contacts are located. Then compare your data volumes and business model to each state’s threshold.

2. Know what counts as personal information

State privacy laws define personal information broadly. It is not limited to names, Social Security numbers, or credit card details. It can include email addresses, device identifiers, IP addresses, account information, purchase history, precise geolocation, cookie data, and inferences used to create a profile about a person.

Many laws also regulate sensitive data. This may include information about health, race or ethnicity, religious beliefs, citizenship or immigration status, genetic or biometric data, precise geolocation, and personal data collected from children. Some states require opt-in consent before processing sensitive data. Others require clear notice and a right to limit or opt out.

Businesses should map personal information before drafting notices or procedures. A useful data map usually answers these questions:

  • What personal information do we collect?
  • Where does it come from?
  • Why do we use it?
  • Where is it stored?
  • Who can access it?
  • Which vendors, platforms, or affiliates receive it?
  • How long do we keep it?

This work also helps with cybersecurity, litigation readiness, and contract management. If a company does not know where its data is, it will have trouble honoring privacy rights or responding to a data incident.

3. Update privacy notices and consumer rights processes

Most state privacy laws require a clear privacy notice. The notice should describe the categories of personal information collected, the purposes for collection, the categories of third parties that receive the data, and the rights available to consumers. It should also explain how consumers can submit requests.

Common consumer rights include the right to access personal data, correct inaccurate data, delete data, obtain a portable copy of data, opt out of sale, opt out of targeted advertising, and opt out of certain profiling. Some states also require an appeal process if the business denies a consumer request.

It is not enough to post a policy and leave it there. A business should have an internal process for intake, verification, response, documentation, and escalation. Teams should know who handles requests and how quickly responses are due. Response periods vary by state, but many laws use a 45-day response period, with a possible extension in appropriate circumstances.

Companies that use cookies, pixels, software development kits, analytics tools, or advertising networks should review whether their practices may be considered a sale, sharing, or targeted advertising. These terms do not always require money to change hands. Data exchanged for advertising or analytics benefits can create opt-out duties under some laws.

Universal opt-out mechanisms are also becoming more important. Colorado requires recognition of certain universal opt-out signals. California requires businesses to honor valid opt-out preference signals in many circumstances. Other states are moving in the same direction.

4. Review vendor and service provider contracts

Privacy compliance often depends on vendors. Cloud hosts, payment processors, email platforms, customer relationship management tools, analytics providers, fulfillment companies, marketing agencies, and AI tools may process personal information for your business.

State privacy laws often require contracts with processors, service providers, contractors, or similar parties. The required terms vary, but many laws require the vendor to process data only under instructions, maintain confidentiality, assist with consumer rights requests, support security duties, limit subcontracting, and delete or return data at the end of the relationship.

A practical vendor review should include:

  • A list of vendors that receive personal information.
  • The type of data each vendor receives.
  • The business purpose for the transfer.
  • Whether the vendor uses the data for its own purposes.
  • Whether the contract includes required privacy and security terms.
  • Whether high-risk vendors should provide security documentation.

Technology contracts should match how data is actually used. If a software provider uses customer data for product improvement, advertising, model training, or benchmarking, the contract should say so clearly and should address whether that use is permitted. Our practice areas include technology transactions, licensing, data privacy, and related commercial disputes.

5. Build privacy into security and incident response

Privacy laws and data breach laws are related, but they are not the same. State privacy laws regulate ongoing collection, use, disclosure, and rights. State breach notification laws govern notice duties after certain security incidents involving personal information. A business may have duties under both.

Most state privacy laws require reasonable security safeguards. The exact standard depends on the law and the facts. In practice, regulators often look at whether the business had reasonable administrative, technical, and physical controls for the type and volume of data involved.

Basic measures may include access controls, multi-factor authentication, encryption where appropriate, secure backups, vendor security review, employee training, logging, patch management, and a written incident response plan. These measures should be scaled to the company’s size, systems, and data risk.

Companies should also decide in advance who will handle an incident. That group may include leadership, IT, legal, communications, outside forensic support, cyber insurance contacts, and affected business units. If litigation is possible, counsel can help manage privilege and preserve evidence. Bronfman Law’s Civil Litigation team works with clients when data disputes, platform issues, injunctions, or related business claims arise.

6. Do not overlook data protection assessments

Several state privacy laws require data protection assessments for higher-risk processing. This can include targeted advertising, sale of personal data, profiling that presents certain risks, processing sensitive data, or other activities that create a heightened risk of harm.

A data protection assessment is a written review of the benefits and risks of the processing. It should consider the purpose of the activity, the type of data used, the safeguards in place, the reasonable expectations of consumers, and the availability of less intrusive alternatives.

These assessments do not need to be overly long, but they should be real. A short, accurate assessment is usually better than a generic document that does not reflect the business. Regulators may ask for assessments during an investigation, depending on the state law involved.

Assessments are especially useful when launching new products, adding advertising tools, using precise location data, adopting AI systems, or changing how user data is shared with third parties. They also help business teams explain why a data use is needed and what limits should apply.

7. Enforcement risk is practical, not theoretical

Most state privacy laws are enforced by state attorneys general or privacy regulators. California also has the California Privacy Protection Agency. Cure periods vary by state and may expire or depend on the nature of the violation. Many comprehensive state privacy laws do not create a broad private right of action, although California allows limited private claims for certain data breaches involving specified personal information.

Regulators often focus on basic failures. These may include inaccurate privacy notices, missing opt-out links, failure to honor consumer requests, using sensitive data without proper consent, weak vendor contracts, or advertising practices that do not match the posted policy.

Companies should also consider related laws. Sector rules such as HIPAA, GLBA, COPPA, the CAN-SPAM Act, and state biometric, health data, and breach notification laws may apply depending on the business. Privacy issues can also overlap with intellectual property, online enforcement, and platform terms, especially for companies that operate websites, apps, marketplaces, or content platforms. Our Intellectual Property practice often works with businesses where data, content, licensing, and online enforcement issues meet.

A good compliance plan is usually staged. First, determine which laws apply. Second, map data. Third, update notices and rights procedures. Fourth, review cookies and advertising. Fifth, update vendor contracts. Sixth, address security and incident response. Seventh, schedule periodic reviews as laws and business practices change.

State privacy compliance is not a one-time document project. It is an operating process. The goal is to make privacy duties understandable, assign responsibility, and keep records that show the business took reasonable steps.

If your business needs help assessing state privacy law obligations, updating privacy documents, reviewing vendor contracts, or responding to a data incident, contact Bronfman Law through our contact page.

This article is general information, not legal advice.