US state privacy laws and your website

The US has no single federal privacy law for consumer data. Instead, California (the CCPA, as amended by the CPRA) and a growing list of other states, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon and others, have their own consumer privacy laws. Each applies only to businesses above certain thresholds, usually based on revenue or how many state residents' data you handle. Many small businesses fall under none of them. If one does apply, your website needs a clear privacy notice, a way to opt out of data "sale", "sharing" or targeted advertising, and a process for consumer requests.

This guide covers who the US state privacy laws apply to, what they mean in practice for your website, forms and ad pixels, and a checklist to work through with your attorney. It is not legal advice. The laws differ in details and keep changing, so confirm your situation with a lawyer.

Who the laws apply to

California (CCPA/CPRA) applies to for-profit businesses that do business in California and meet at least one of these:

• Annual gross revenue above roughly $25 million, adjusted for inflation
• Buy, sell or share personal information of 100,000 or more California consumers or households a year
• Earn 50% or more of annual revenue from selling or sharing personal information

Most other states use thresholds based on how many state residents' data you process each year, commonly 100,000, or a lower number such as 25,000 combined with earning a share of revenue from selling data. Several newer laws set lower numbers, so a mid-sized business with a popular website in a smaller state can cross them. Texas and Nebraska take a different approach: they apply broadly but exempt businesses that count as small under federal Small Business Administration definitions, while still requiring consent before a small business sells sensitive data.

The key word is "residents". A business in Ohio with many customers in California or Colorado may be covered there, even with no office in that state.

What rights consumers get

The rights are similar across states, with differences in detail:

• Know and access: what personal data you hold about them
• Delete: with exceptions, for example data you need to complete a transaction
• Correct inaccurate data
• Opt out of sale, targeted advertising and certain profiling
• Portability: a copy in a usable format
• Non-discrimination: you cannot punish people for using their rights

Covered businesses usually must respond to requests within 45 days, with a possible extension.

Where your website comes in

For most small and mid-sized businesses, the website is where privacy law touches daily operations.

Ad pixels and retargeting. When your site sends visitor data to Meta, Google or other ad platforms for targeted advertising, that can count as "selling" or "sharing" under these laws. This is the point that surprises owners most. If a law applies, you need an opt-out route, often a "Do Not Sell or Share My Personal Information" or "Your Privacy Choices" link.

Universal opt-out signals. California, Colorado, Connecticut, Texas, Oregon and several other states require covered businesses to honor browser signals such as Global Privacy Control. Your site has to detect them and switch off the relevant tracking for that visitor.

Forms and lead data. What you collect on forms, where it goes (CRM, email platform, spreadsheet) and how long you keep it should match your privacy notice.

Chat, session recording and heatmaps. These tools capture what visitors type and do. Disclose them, configure them to mask personal data and consider whether you need them at all.

Sensitive data. Health conditions, precise location, children's data and similar categories often require opt-in consent. Health-related businesses also face HIPAA and laws such as Washington's My Health My Data Act; see HIPAA and website tracking.

Old and new laws side by side

The last row matters for everyone. Even if no state law applies, the Federal Trade Commission can act against a business whose privacy promises do not match reality.

A practical checklist

1. Map your data. List what you collect on the site, in forms, in your CRM and in ad tools, and where it goes.
2. Check thresholds for each state where you have many customers. Your attorney can help here.
3. Update your privacy notice so it matches what you actually do. Generic templates usually do not.
4. Audit your tags. Remove pixels and tools you no longer use. Every tag is a liability without a benefit.
5. Set up opt-out handling if required: link, consent tool, GPC detection, and switching off ad tags for people who opt out.
6. Create a request process: a form or email address, an identity check and a log.
7. Review vendor contracts with your CRM, email platform and analytics tools.
8. Repeat every year, and whenever you add a new marketing tool.

Small business, reasonable effort

If no comprehensive law applies to you today, you still benefit from the basics: an accurate privacy policy, no unnecessary tracking, opt-outs that work and care with sensitive data. They protect you as your business grows into the thresholds, and they build trust with customers. The cookie banner guide covers the visible part, and legal pages for US websites covers the policy itself.

My part is technical: I audit and set up tags, consent tools and opt-out handling, and connect forms and CRM so data flows match your policy. Analytics setup with GA4, Tag Manager and pixels costs $550; see the analytics page for details. The legal decisions stay with your attorney.