U.S. State Privacy Laws: The 2026 Comparison Guide

Twenty U.S. states now have comprehensive data privacy laws in effect. Five years ago, it was one. If your business collects personal data from American residents, the compliance picture has changed dramatically since California first passed the California Consumer Privacy Act (CCPA) in 2018. Indiana, Kentucky, and Rhode Island all joined the landscape on January 1, 2026, and more states are expected to follow in 2027.

This guide maps every active U.S. state privacy law, compares the thresholds that determine whether your business is in scope, explains the consumer rights each law requires you to support, and shows you what the 2026 changes mean in practice.

Which states have data privacy laws in 2026?

According to the IAPP's U.S. State Privacy Legislation Tracker, 20 states now have comprehensive consumer privacy laws on the books. The first five were California, Virginia, Colorado, Connecticut, and Utah. The most recent three, Indiana, Kentucky, and Rhode Island, became effective on January 1, 2026.

Here is the full list as of June 2026:

Note: Florida's Digital Bill of Rights has a narrower scope than other comprehensive state laws and applies only to large technology companies with annual global revenues over $1 billion.

How do U.S. state privacy laws compare?

The laws share a common structure but differ on the details that matter most: who they apply to, what rights consumers get, and how aggressively they are enforced. The table below compares the six most significant state privacy laws.

For a detailed comparison of the CCPA and VCDPA specifically, see our post on the differences between the VCDPA and CCPA.

For the complete breakdown of Colorado and Connecticut requirements, see our guide to Colorado and Connecticut privacy laws.

What consumer rights do state privacy laws require?

Despite the variation across states, six core consumer rights appear in virtually every active state privacy law. Understanding these rights helps you build a compliance framework that holds across the whole map, not just one state.

The six core rights

Right to access: Consumers can request a copy of the personal data a business holds about them, including the categories of data collected, the purpose of collection, and any third parties it has been shared with.

Right to deletion: Consumers can request that a business delete their personal data. Most laws allow exceptions for data needed to complete a transaction, for security purposes, or where another law requires retention.

Right to correction: Consumers can ask a business to correct inaccurate personal data. This right is present in most state laws, though California only added it with the CPRA in 2023.

Right to portability: Consumers can request their data in a machine-readable format, making it easier to transfer to another service provider.

Right to opt out: Consumers can opt out of the sale of their personal data, the use of their data for targeted advertising, and, in most states, automated decision-making that produces significant legal effects.

Right to non-discrimination Businesses cannot deny services, charge higher prices, or provide a lower quality of service to consumers who exercise their privacy rights.

What are the applicability thresholds for each state privacy law?

Most state privacy laws only apply to businesses above a certain size, measured by the number of consumers whose data they process or their annual revenue. If you fall below these thresholds, most laws do not apply to you, though it is worth monitoring as thresholds can be amended.

How are U.S. state privacy laws enforced?

Enforcement in almost all states runs through the state Attorney General's office. Businesses typically receive notice of a violation and a window to cure it before formal action is taken, though several states have removed cure periods entirely.

Key enforcement differences to know:

• California is the only state where consumers can bring private lawsuits directly for data breaches under the CCPA. All other states limit enforcement to the AG.

• California's CPPA has the most active enforcement record, with multiple investigations and fines since its formation.

• Colorado and Rhode Island have no cure period, meaning violations can result in immediate formal enforcement action.

• Virginia allows a 30-day cure period; Connecticut allows 60 days (reduced from 90 after 2024).

Indiana and Kentucky removed their cure periods before their laws even took effect, following the trend toward stricter enforcement that the 2026 state law changes highlighted by MultiState.

What do the 2026 changes mean for your business?

If you were already dealing with CCPA, you have a head start. Most of the new state laws follow a similar template. But the details that differ are the ones that can catch businesses off guard.

Three things that changed on January 1, 2026

Indiana, Kentucky, and Rhode Island went live. All three follow the Virginia-style template, which is slightly less demanding than California's. But Indiana and Kentucky removed their 30-day cure periods before the laws even took effect, a signal that enforcement will not be lenient.

Rhode Island lowered the bar for who is in scope. At 35,000 consumers, Rhode Island's threshold is roughly one-third of the 100,000-consumer bar most other states use. Many businesses that were below the threshold for every other state law may now need to act.

California added mandatory risk assessments. New California regulations that took effect January 1, 2026 require businesses to conduct privacy risk assessments for processing activities that present significant consumer risk. Initial assessments are due to the CPPA by April 1, 2028.

What most businesses need to do now

• Audit which states where your website visitors come from. If Rhode Island residents are in your user base and you process their data, apply the 35,000-consumer threshold test.

• Review your consent setup for each state. States vary on whether they require opt-in or opt-out models, how they handle sensitive data categories, and whether targeted advertising requires a separate opt-out signal.

• Update your privacy policy to reflect which state laws now apply to your business and what rights consumers in each state can exercise.

• Establish a process for data subject requests. Every active state law requires a response mechanism. If you are handling these manually, the addition of three new states is the time to automate.

How Clym supports multi-state consent and data privacy management

Managing consent requirements across 20 different state laws is not a project you want to handle manually. The requirements differ by state: what triggers the consent banner, whether the default is opt-in or opt-out, which tracking technologies need prior consent, and which signals like Global Privacy Controls (GPC) you need to honour.

Clym's consent management platform (CMP) uses location-based detection to identify each visitor's regulatory context and serves the appropriate consent experience automatically. A California visitor sees a CCPA-compliant experience. A Virginia visitor sees one built around the VCDPA. A Rhode Island visitor, effective January 2026, sees what that law now requires.

Clym's localization feature and geofencing handle this detection in the background. You configure the platform once; it adapts to every visitor's jurisdiction from there.

You can also browse all active U.S. and global data privacy regulations in Clym's regulations hub.

Conclusion

The U.S. privacy law landscape has changed more in the past five years than in the previous two decades. With 20 states now active and more expected before 2028, the question for most businesses is no longer whether state privacy laws apply to them. It is how many of them do.

The good news is that most state laws share a common architecture: similar consumer rights, similar applicability structures, and enforcement through state Attorneys General. If you understand how California, Virginia, and Colorado work, you have a solid foundation to build on. The differences that matter most are thresholds (Rhode Island's is the lowest), cure periods (several states have removed them), and sensitive data rules (California and Colorado are the most demanding).

Keeping up with a landscape that changes every year is where having the right tools makes a real difference. A consent management platform that adapts to each visitor's state saves you from building and maintaining 20 separate consent configurations yourself.