Making Tax Digital for Income Tax — Quarterly Update Due
US State Privacy Laws Check (Beyond California)
Why this matters.
There is still no single federal privacy law in the US, but around twenty states now have their own comprehensive consumer privacy laws on top of California’s CCPA. They include the Virginia Consumer Data Protection Act (Va. Code §59.1-575 et seq.), the Colorado Privacy Act (C.R.S. §6-1-1301 et seq.), the Connecticut Data Privacy Act, the Texas Data Privacy and Security Act (Tex. Bus. & Com. Code ch. 541), and laws in Oregon, Montana, Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island. Most apply once you process the personal data of 100,000 or more residents of that state in a year, or a lower number (often 25,000) if you make money from selling data. Some have much lower or no numeric thresholds: Texas and Nebraska cover most businesses that are not SBA-defined small businesses, and both ban selling sensitive data without consent even for small businesses.
These laws share a common core. You need a clear privacy notice, a way for people to access, correct, delete and port their data, an opt-out from targeted advertising, sale of data and profiling, opt-in consent before processing sensitive data such as health, precise location or children’s data, data protection assessments for high-risk processing, and written contracts with processors. Many states also require you to honour browser-based universal opt-out signals such as Global Privacy Control. State attorneys general enforce them, with civil penalties that typically run up to $7,500 per violation in several states, and several have already brought actions. This check shows which state laws are likely to apply and where your gaps are.
