Privacy Laws
US State Privacy Laws
The wave of US state comprehensive privacy statutes from 2020, and what differs between them.
Why a single national law has not happened
There is no comprehensive federal US consumer privacy statute. Sectional rules exist for health (HIPAA), financial services (GLBA), and children (COPPA), and they predate the state wave. Everything general-purpose is state law.
The statutes, in enactment order
| State | Act | Enacted | Effective |
|---|---|---|---|
| California | CCPA, as amended by the CPRA | 2018, amended 2020 | 1 January 2020, amended 1 January 2023 |
| Virginia | Virginia CDPA | 2020 | 1 January 2023 |
| Colorado | Colorado Privacy Act | 2021 | 1 July 2023 |
| Connecticut | Connecticut Data Privacy Act | 2022 | 1 July 2023 |
| Utah | Utah Consumer Privacy Act | 2023 | 31 December 2023 |
| Oregon | Oregon Consumer Privacy Act | 2023 | 1 July 2024 |
| Texas, Florida, others | Various | 2023 onward | Varies |
Where they differ
The differences are not cosmetic, and a compliance plan written for one state will often be wrong for the next:
- Definition of sale versus sharing. Colorado and Connecticut both use “sale” and “targeted advertising”; others use “sale or sharing” and treat cross-context behavioural advertising as sharing.
- Sensitive data and consent. Some states require opt-in consent for sensitive data; others require only a right to opt out. Colorado’s universal opt-out mechanism for sale of sensitive data has no direct equivalent elsewhere.
- Children. Age thresholds vary, and the definitions of “child” and “minor” are not consistent across the states.
- Private right of action. Some statutes provide one, with a cure period and limited damages; others provide no private right of action and rely entirely on regulatory enforcement.
- Thresholds and exemptions. Revenue or record-count thresholds differ, and the exemptions for HIPAA, GLBA, and nonprofits are not identical.
- Racial profiling. A small number of states added a specific prohibition on using race or ethnicity in profiling decisions, which is unusual among general privacy statutes.
What this means in practice
For a person trying to use the rights, the practical differences are: which state law covers the business you are dealing with, whether the business must respond to a request without asking you to identify yourself, and how long the response may take. All of these vary. A single “privacy request” template is not portable across states.
For an organisation, geofenced compliance is the usual approach: apply the strictest substantive standard across all covered states. The differences in drafting are what make that approach imperfect rather than impossible.
Sources
The primary records are the state code sections linked above. They are the authoritative texts; summaries of the state-law landscape change frequently and should not be relied on in place of the statutes.
Claim labels
FACT
The California Consumer Privacy Act was enacted in 2018 and amended by the California Privacy Rights Act in 2020, which took effect on 1 January 2023.
FACT
Virginia enacted the Virginia CDPA in 2020, the first state law to take effect after the CCPA amendment, on 1 January 2023.
FACT
Colorado enacted the Colorado Privacy Act in 2021, effective 1 July 2023.
FACT
Connecticut enacted the Connecticut Data Privacy Act in 2022, effective 1 July 2023.
FACT
Utah enacted the Utah Consumer Privacy Act in 2023, effective 31 December 2023.
FACT
Oregon enacted the Oregon Consumer Privacy Act in 2023, effective 1 July 2024.
FACT
Texas, Florida, and several other states have enacted statutes of varying scope. This entry tracks the legislative acts and does not attempt to summarise the current status of litigation or of every amendment.
SOURCE CLAIM
Industry bodies and civil liberties organisations have characterised the state laws variously as a patchwork and as a national floor. Both are arguments about policy, not statements of the law.
Sources
Last link check: 2026-09-27. A link check confirms reachability, not that every claim has been independently reviewed.
- Virginia CDPA — Code of Virginia, Title 59.1-5200 et seq. Accessed
- Colorado Privacy Act — CRS Title 6, Part 1 Accessed
- Connecticut Data Privacy Act — Connecticut General Statutes Accessed
- Utah Consumer Privacy Act — Utah Code Title 13-61 Accessed
- Oregon Consumer Privacy Act — Oregon Revised Statutes Chapter 646A The oregonlegislature.gov host did not respond to the automated link check from the machine that ran it, so this URL is unconfirmed and is recorded as unverifiable rather than broken. It is the canonical citation for the statute; confirm it in a browser. Accessed
- California Civil Code Title 1.81.5 Accessed