State Privacy Law Applicability Thresholds: Does Your Business Have to Comply?

The tall bars are the old standard. The newer laws in New England and the mid-Atlantic cluster at 35,000, and Montana and Alabama sit lower still, so a business that cleared every bar in 2023 can be covered in 2026 without growing at all.

If you earn money from selling personal data, ignore the first chart and look here. Vermont's law, starting in 2028, reaches a business that offers data on just 3,000 consumers for sale.

Nine laws set their data-seller test at half of revenue from selling data, which few ordinary companies reach. Colorado and New Jersey count any sale revenue or discount, so a single list rental can matter there.

The count went from 8 laws at the end of 2024 to 16 a year later. With Louisiana, Oklahoma, Alabama and Vermont scheduled, 23 will be in force by the end of 2028.

New laws and threshold changes taking effect from 2026 to 2028

Source: Connecticut Office of the Attorney General, The Connecticut Data Privacy Act; Delaware General Assembly, Delaware Code Title 6, Chapter 12D (Delaware Personal Data Privacy Act), § 12D-103; Privacy World (Squire Patton Boggs), Amendments to Delaware's Consumer Privacy Law Deepen the Morass of State Privacy Regulation; Louisiana State Legislature, Résumé Digest, Act 502 (SB 386), Louisiana Data Privacy Act; Oklahoma Legislature, Enrolled Senate Bill No. 546 (Oklahoma data privacy act), Section 15; Utah State Legislature, Utah Code § 13-61-102 Applicability (version effective 1 Jan. 2027); Alabama Legislature, HB351 Enrolled (Alabama Personal Data Protection Act), Sections 3 and 4; Vermont General Assembly, Act No. 145 (S.71), Vermont Data Privacy and Online Surveillance Act, as enacted; IAPP, US State Privacy Legislation Tracker 2026: Comprehensive Consumer Privacy Bills (chart). Download as image

State privacy laws with a dollar revenue test

Source: California Privacy Protection Agency, Updated Monetary Thresholds in CCPA; Louisiana State Legislature, Résumé Digest, Act 502 (SB 386), Louisiana Data Privacy Act; Utah State Legislature, Utah Code § 13-61-102 Applicability (version effective 1 Jan. 2027); Justia (Tennessee Code mirror), Tenn. Code § 47-18-3303 (Tennessee Information Protection Act applicability); Florida Legislature, 2026 Florida Statutes, s. 501.702 Definitions ("Controller"). Download as image

How a state privacy law decides who must comply by state

• 2No consumer-count threshold (SBA small businesses exempt)
• 8Consumer threshold under 100,000
• 2$25M+ revenue alone, or a consumer count
• 9100,000 consumers
• 3Revenue floor plus another test
• 27No comprehensive privacy law

What does a privacy law threshold actually measure?

Most thresholds count consumers: residents of that state whose personal data you control or process in a year. It does not matter where your company is based. A Florida business with a big Oregon customer list is measured against Oregon's law.

A consumer is usually a person acting for themselves, not as an employee or a business contact, so your B2B lead list often does not count. California is the big exception. Its law also covers employee and business contact data, and it counts households as well as people for the data you buy, sell or share.

Some details trip people up. Connecticut, Delaware and Maryland leave out data you hold only to finish a payment, so a checkout that never builds a customer profile may not count toward their numbers. Louisiana counts devices as well as people and households, which can inflate the tally fast for an app or ad-supported site. Delaware measures the preceding calendar year, so this year's growth shows up in next year's obligations.

Which states have the lowest thresholds in 2026?

The old rule of thumb was 100,000 consumers per state. That still holds for 11 of the 23 laws, including Virginia, Colorado, Oregon and Minnesota. But a cluster of states now sits at 35,000: Connecticut, Delaware, Maryland, New Hampshire, Rhode Island and Vermont. Montana sits at 25,000 after its 2025 amendment, and Alabama's law starts at more than 25,000 when it takes effect on 1 May 2027.

Connecticut is the one most businesses missed. Since 1 July 2026 it applies at 35,000 consumers, down from 100,000, and any processing of sensitive data or any offer to sell personal data triggers it with no minimum at all. Health details, precise location and biometric data all count as sensitive. Delaware goes further on 1 January 2027, when its bar drops to 10,000 consumers.

Then there are Texas and Nebraska, which skip the count entirely. Their laws apply to any business that processes personal data unless it qualifies as a small business under the federal Small Business Act. Even then, Texas still requires consent before a small business sells sensitive data.

Can revenue alone make you comply?

In two states, yes. California's law reaches any business with annual gross revenue over $26,625,000, the inflation-adjusted figure in effect since 1 January 2025, even if almost none of that revenue comes from California residents. Louisiana's new law, effective 1 January 2027, does the same for revenue over $25 million.

Tennessee and Utah use revenue the other way, as an extra gate. You need over $25,000,000 in Tennessee, or $25,000,000 or more in Utah, plus a consumer count, so a small company with a large audience can stay outside both. Tennessee's count is also the highest of any state at 175,000.

Florida's law is in its own category. It applies only to companies with over $1 billion in global revenue that also earn half their revenue from online ads, run a smart speaker service, or run an app store with 250,000 or more apps. If you are reading this page to check your own exposure, Florida's law is almost certainly not your problem.

Do privacy laws apply to small businesses and freelancers?

Directly, often not. A freelance designer, a local agency or a small software shop rarely reaches 35,000 consumers in one state, let alone 100,000. Alabama even exempts businesses with fewer than 500 employees that do not sell personal data.

Indirectly, almost always. When a covered client hires you to build its email flows, host its site or analyze its customer list, the law requires the client to bind you by contract. That is the data processing addendum you get asked to sign. It can require you to delete data on request, help with consumer requests, notify the client of a breach and pass the same terms down to your own subcontractors. You take on those duties because of your client's size, not yours.

Watch for one new wrinkle. From 1 January 2027, Delaware also covers third parties that acquire personal data from a controller, with no consumer count. If you buy or receive lists, the size test no longer protects you there.

How to check whether you have to comply

• Pull customer, subscriber and visitor counts by state for the last full calendar year. Use identifiable people, not raw page views, unless you collect device IDs.
• Compare each state's count to the map above, starting with the lowest bars: Montana, Connecticut, Delaware, Maryland, New Hampshire and Rhode Island.
• Check your revenue against California's $26,625,000 line and Louisiana's $25 million line for 2027.
• List every way you earn money from personal data, including list rentals, data shares with ad partners and discounts traded for data. In Colorado and New Jersey, any of these can lower your bar to 25,000.
• Flag sensitive data. In Connecticut, processing it at all brings you under the law.
• Look now at what changes in 2027 and 2028: Delaware's lower bar, plus new laws in Louisiana, Oklahoma, Alabama and Vermont.
• Review the contracts that move data in and out of your business, since that is where most of the obligations end up.

What to do if you cross a threshold

Start with the basics nearly every law asks for: a privacy notice that says what you collect and why, a way for people to access and delete their data (and correct it, in most states), and an opt-out for data sales and, in most states, targeted ads. Many of the newer laws, including Colorado, Connecticut, Oregon and Texas, also expect you to honor a browser-based opt-out signal.

Then go to your vendor list. Each law requires a written contract with every processor that handles personal data for you, covering confidentiality, deletion at the end of service, audits and subcontractors. Your email platform, CRM, payment processor and analytics tools all count. Many vendors bury these terms in a linked addendum or reserve the right to use your customer data for their own products. If the regulator asks, the gap is yours, not theirs. Tighten those contracts before you sign the next renewal.

Sources and method

Every number on this page comes from the sources below, each opened and read on or before October 18, 2026. A second, independent review checked every figure against its source and corrected anything that did not match. 51 of 51 state entries were confirmed; any that could not be are marked "Not yet confirmed" and left out of every count and chart.

1. IAPP, US State Privacy Legislation Tracker 2026: Comprehensive Consumer Privacy Bills (chart) (Tracker last updated 8 Sept. 2026)
2. California Privacy Protection Agency, Updated Monetary Thresholds in CCPA (Posted 17 Dec. 2024; effective 1 Jan. 2025)
3. California Privacy Protection Agency, California Consumer Privacy Act of 2018 (statute text), Civil Code § 1798.140(d) (Effective 1 Jan. 2025 text, posted January 2025)
4. Colorado Attorney General, Colorado Privacy Act (resource page and FAQ), C.R.S. § 6-1-1304 (Undated page, read October 2026)
5. Connecticut Office of the Attorney General, The Connecticut Data Privacy Act (Undated page reflecting thresholds effective 1 July 2026, read October 2026)
6. Morgan Lewis, US State Consumer Privacy Law Update: Notable Changes Across Existing Frameworks (30 July 2026)
7. Delaware General Assembly, Delaware Code Title 6, Chapter 12D (Delaware Personal Data Privacy Act), § 12D-103 (Current code, showing § 12D-103 versions effective until and from 1 Jan. 2027)
8. Privacy World (Squire Patton Boggs), Amendments to Delaware's Consumer Privacy Law Deepen the Morass of State Privacy Regulation (16 Sept. 2026)
9. Florida Legislature, 2026 Florida Statutes, s. 501.702 Definitions ("Controller") (2026 Florida Statutes)
10. Baker Donelson, Consumer Data Privacy Law Guide: Indiana (Last updated May 2025)
11. Iowa Legislature, Iowa Code § 715D.2 Scope and exemptions (Current Iowa Code, read October 2026)
12. Kentucky General Assembly, 2025 Ky. Acts Chapter 13 (HB 473), amending KRS 367.3613 (2025 Regular Session)
13. Louisiana State Legislature, Résumé Digest, Act 502 (SB 386), Louisiana Data Privacy Act (2026 Regular Session (read via Internet Archive snapshot of 12 Oct. 2026))
14. Maryland Department of Legislative Services, Fiscal and Policy Note, SB 541 Maryland Online Data Privacy Act of 2024 (Enrolled - Revised) (2024 Session)
15. Minnesota Office of the Revisor of Statutes, Minn. Stat. § 325M.12 Scope; exclusions (2025 Minnesota Statutes)
16. Montana Legislature, Mont. Code Ann. § 30-14-2803 Applicability (Montana Code Annotated 2025 (amended by Ch. 567, L. 2025))
17. Nebraska Legislature, Neb. Rev. Stat. § 87-1103 Applicability of act to persons or entities (Current statute (read via Internet Archive snapshot of 18 Oct. 2026))
18. New Hampshire General Court, N.H. RSA 507-H:2 Application (Current RSA (read via Internet Archive snapshot of 28 Feb. 2026))
19. Baker Donelson, Consumer Data Privacy Law Guide: New Jersey (Last updated May 2025)
20. Oklahoma Legislature, Enrolled Senate Bill No. 546 (Oklahoma data privacy act), Section 15 (Enrolled 2026)
21. Oregon State Legislature, ORS 646A.572 Scope and application; exclusions (ORS 2025 edition)
22. State of Rhode Island General Assembly, R.I. Gen. Laws § 6-48.1-4 (Rhode Island Data Transparency and Privacy Protection Act) (Effective 1 Jan. 2026 (read via Internet Archive snapshot, 2026))
23. Justia (Tennessee Code mirror), Tenn. Code § 47-18-3303 (Tennessee Information Protection Act applicability) (2024 Tennessee Code)
24. Texas.Public.Law (text of the official Texas statutes), Tex. Bus. & Com. Code § 541.002 Applicability of Chapter (Statute text as of 26 May 2025)
25. Office of the Texas Attorney General, Texas Data Privacy and Security Act (Undated page, read October 2026)
26. Utah State Legislature, Utah Code § 13-61-102 Applicability (version effective 1 Jan. 2027) (Version effective 1 Jan. 2027 (read via Internet Archive snapshot, 2026))
27. Virginia General Assembly (Legislative Information System), Code of Virginia § 59.1-576 Scope; exemptions (Page dated 19 Oct. 2026)
28. Alabama Legislature, HB351 Enrolled (Alabama Personal Data Protection Act), Sections 3 and 4 (2026 Regular Session, enrolled)
29. Vermont General Assembly, Act No. 145 (S.71), Vermont Data Privacy and Online Surveillance Act, as enacted (Signed 16 June 2026 (read via Internet Archive snapshot of 13 Oct. 2026))