Privacy regulations in the United States have expanded dramatically by 2025. What began as a single state law in California has grown to include 15 states with varying requirements. Each state has created its own approach to consumer opt-out rights.
This expansion reflects growing public concern about data privacy. It also shows increasing regulatory attention to how businesses handle consumer information. Understanding the differences between these regulations is crucial for effective compliance.
California
Virginia
Colorado
Connecticut
Utah
Texas
Nevada
Delaware
Iowa
Nebraska
New Hampshire
New Jersey
Definition of Personal Information
Definition of "Sale"
Definition of Targeted Advertising
Definition of Profiling
Definition of Sensitive Data
Data Sale Opt-Out Requirements
Targeted Advertising Opt-Out Requirements
Data Sharing Opt-Outs (California-Specific)
Profiling Opt-Outs
Website Mechanisms
Universal Opt-Out Signals
Timing Requirements
Anti-Deceptive Interface Provisions
California pioneered comprehensive consumer privacy rights in the United States. The California Consumer Privacy Act (CCPA), enhanced by the California Privacy Rights Act (CPRA), created a robust framework. Many other states have used it as inspiration.
Key features of California's framework include:
The California model has influenced other states while maintaining unique elements. This makes compliance particularly important for businesses operating in the nation's largest state economy.
Virginia's Consumer Data Protection Act took effect in January 2023. It differs from California in several key aspects:
Virginia's approach balances consumer privacy with business practicality. It has created a framework that many other states have followed.
Colorado implemented a privacy framework with several distinctive features:
Colorado's requirement that businesses recognize universal opt-out mechanisms presents a significant technical challenge. This requirement has influenced how many businesses approach privacy compliance across all states.
Connecticut closely follows Colorado's model with these key elements:
Connecticut's approach combines elements from several other state frameworks while adding unique protections for state residents.
Utah's Consumer Privacy Act takes a more business-friendly approach:
Texas adopted a hybrid approach with the Texas Data Privacy and Security Act:
Texas exempts specific industries from certain requirements to protect consumers while supporting business growth.
Nevada implemented a narrower law focused specifically on online sales:
Nevada's early entry into privacy regulation focuses primarily on online data sales rather than comprehensive privacy protections.
January 2025 marked a significant expansion of privacy regulations with five new state laws taking effect:
Delaware's Personal Data Privacy Act closely follows Virginia's model with:
Iowa implemented a business-friendly approach to privacy:
Nebraska's Consumer Data Privacy Act features:
The New Hampshire Information Privacy Act implemented:
New Jersey's privacy law became effective January 15, featuring:
Later in 2025, three more states will implement privacy laws:
Tennessee's law employs a tiered approach to business compliance based on data processing volume. This balances regulatory requirements with business capabilities.
Minnesota combines opt-out rights with specific data security requirements. It emphasizes both consumer choice and data protection.
Maryland's approach emphasizes transparency and consumer choice through comprehensive opt-out mechanisms and clear disclosure requirements.
Most state privacy laws define personal information broadly. Personal information includes any data that names a person, describes them, or connects to them or their home.
This includes:
The broad definition covers more than traditional personally identifiable information (PII). This creates broader compliance obligations.
How states define "sale" creates significant differences in compliance requirements:
California considers it a 'sale' when businesses exchange personal information for money or other benefits.
These states limit "sale" to exchanges of personal information for monetary consideration only, excluding many data-sharing arrangements.
These states follow California's broader approach. They include valuable non-monetary considerations, capturing more data-sharing activities.
These definitions require businesses to carefully track how they share consumer data and implement state-specific compliance measures.
Targeted advertising generally refers to displaying advertisements based on personal data obtained from a consumer's activities over time and across different websites or applications.
Key elements include:
All major state privacy laws now allow consumers to opt out of targeted advertising. The specific definitions and implementation requirements vary by state.
Profiling involves the automated processing of personal data to evaluate, analyze, or predict aspects of an individual's behavior, preferences, interests, or characteristics.
Colorado and Connecticut let consumers stop automated decisions about important matters like:
State laws generally define sensitive data as categories requiring special protection, including:
Most state privacy laws require explicit consent for processing sensitive data. This creates additional compliance obligations beyond standard opt-out requirements.
All comprehensive state privacy laws provide consumers the right to opt out of sales of their personal information. Practical implementation varies based on how each state defines "sale."
Example scenarios affected by varying definitions:
These differences significantly impact compliance strategies across states.
All major state laws let consumers stop companies from using their data for targeted ads.
Implementation typically requires:
California addresses targeted advertising within its "sharing" concept. Other states make it a distinct opt-out category.
California's CPRA uniquely established "sharing" as a specific opt-out category:
Sephora paid $1.2 million because they ignored customer opt-out requests. This shows regulatory seriousness about this requirement.
States like Colorado and Connecticut extend opt-out rights to include automated decision-making:
State privacy laws specify how businesses must implement opt-out mechanisms:
Most states require:
California specifically requires that business home pages prominently display a "Do Not Sell or Share My Personal Information" link.
A significant trend is the requirement to honor universal opt-out mechanisms:
These requirements mean businesses must automatically implement technical solutions to detect and honor browser-based privacy signals.
State laws specify how quickly businesses must honor opt-out requests:
Several states prohibit using deceptive interfaces to undermine privacy choices:
Disclaimer: This guide provides general information about privacy regulations and does not constitute legal advice.
We’ll send you practical tips and ideas that we use ourselves and show you how to apply them to your sales and marketing workflow
