Which US state privacy laws apply to a small business?

The short version

• There’s no single federal privacy law for websites. States have their own, and the list keeps growing.
• Most state laws apply only if you’re above a size threshold. Check each state where you have customers.
• If one applies, you need a detailed notice. You answer requests. People can opt out of selling, sharing and targeted ads.
• Some rules apply at any size. Examples: California’s privacy policy law, Texas’s rule on selling sensitive data, and the FTC’s rule that your promises must be true.
• Check the official pages below before relying on any threshold. They change.

This isn’t legal advice. Thresholds, exemptions and definitions differ by state.

How do I check whether a state law applies?

Step 1: Know where your customers are

State laws protect residents of that state. A business in Pennsylvania can be covered by California’s law if it does business in California and meets a threshold. List the states where you have customers or market to people.

Step 2: Check the threshold in each state

Here’s how three states with clear official guidance set them, as of October 31, 2026:

Connecticut’s Attorney General page now lists the 35,000-consumer test and the sensitive-data trigger, which reach smaller businesses than many earlier state laws. Other states have their own numbers, so check the Attorney General’s site for each state you serve.

Step 3: If a law applies, know the core duties

The California Attorney General lists the rights a covered business must support:

• Know what personal information is collected, used, shared or sold.
• Delete it.
• Correct it.
• Opt out of its sale or sharing.
• Limit the use of sensitive personal information.
• Not be discriminated against for using these rights.

A business that sells or shares personal information needs a “Do Not Sell or Share My Personal Information” link. It must also treat Global Privacy Control as a valid opt-out. Colorado’s Attorney General lists GPC as a recognized opt-out from July 1, 2024. Connecticut says businesses must honor such signals from January 1, 2025. See what Global Privacy Control means for your site.

The CPPA’s FAQ ties “sharing” to cross-context behavioral advertising: ads based on what someone does on other sites. Ad pixels and remarketing tags can fall under it, which is why a small site running retargeting ads needs to look carefully.

Step 4: Check the rules that apply at any size

• California’s online privacy law (CalOPPA) requires a posted privacy policy on any commercial site that collects personal information from Californians. There’s no revenue threshold, according to the Attorney General’s guide.
• The FTC Act applies to almost every business. The FTC’s consumer privacy guidance tells businesses to honor the promises in their privacy policy.
• Children’s data: COPPA applies at any size. It covers sites aimed at children under 13, or that know they collect a child’s data.

Why does it matter?

State attorneys general enforce these laws. The Texas Attorney General notes that businesses get 30 days to fix a problem after notice. After that, it can sue for civil penalties. Even when no law applies, customers and partners increasingly expect a clear opt-out and honest answers.

What are the common mistakes?

• Assuming “small” means exempt everywhere. Thresholds differ, and some rules have none.
• Ignoring ad pixels. Retargeting can count as “sharing” under California’s law.
• Copying a CCPA policy you don’t need, then not following it. If you promise rights, you have to honor them.
• Using old numbers. California’s revenue figure is adjusted every odd-numbered year.

What if I can’t tell whether I’m covered?

• Gather your numbers: annual revenue, roughly how many people’s data you hold per state, and whether you run ad tracking.
• Take them to a privacy lawyer. That’s a short conversation with the facts in hand.
• Meanwhile, do the cheap things anyway: an accurate policy, fewer trackers and an easy way to ask for deletion.

How much does it cost, and how long does it take?

Checking thresholds takes an hour with your figures. If a law applies, setting up an opt-out link, GPC handling and a request process takes longer. Legal review costs vary, so ask for a quote.

How does E-3 handle this?

We don’t give legal opinions on which laws apply. Under website care, we can show you which trackers and ad tags run on your site and remove the ones you don’t need. Once you and your adviser decide what’s required, we can set up an opt-out link or GPC handling. You decide which changes to make.

Related questions

• What is Global Privacy Control, and do I have to honor it?
• How do I handle a request to see or delete someone’s data?
• What should a small business privacy policy cover?
• Which vendors handle my customers’ data?
• Back to the complete privacy and cookies guide

Sources

1. California Consumer Privacy Act (CCPA) (California Attorney General)
2. Updated monetary thresholds in CCPA (California Privacy Protection Agency)
3. Frequently asked questions (California Privacy Protection Agency)
4. CCPA regulations (California Privacy Protection Agency)
5. The Connecticut Data Privacy Act (Connecticut Attorney General)
6. Universal opt-out and the Colorado Privacy Act (Colorado Attorney General)
7. Texas Data Privacy and Security Act (Texas Attorney General)
8. Attorney General issues guide on privacy policies and Do Not Track disclosures (California Attorney General)
9. Consumer privacy (FTC business guidance)