IN EFFECT since January 1, 2026
Last verified against primary sources:
US State Comprehensive Privacy Laws
US-State · Effective January 1, 2026
About 20 US states now have comprehensive consumer-privacy laws (Colorado, Connecticut, Virginia, Oregon, Montana, and more). Most apply at 100K+ consumers; thresholds are trending downward.
Overview
Twenty states have laws in effect in 2026 (Arkansas joins July 1). Most use a 100K-consumer threshold, or 25K consumers plus 50%+ revenue from data sales; Rhode Island is lower (35K, or 10K with 20%+ data-sale revenue). The 2026 trend is dropping thresholds and removing cure periods. Common obligations: privacy notice, opt-outs (sale/targeted ads/profiling), deletion, and GPC honoring. Texas and Nebraska have no volume threshold (see the Texas entry); Florida applies only to $1B+ companies.
Official text: https://iapp.org/resources/article/us-state-privacy-legislation-tracker/
See where your app stands
SaaSalyst scans your website in 30 seconds across 118 business readiness checks: compliance signals, security headers, SEO, accessibility, and AI readiness.
Scan Your App