Twenty-Five State Privacy Laws: Thresholds-and-Exemptions Matrix

Twenty-five US states have passed consumer data privacy laws – twenty-one are in force today and four more take effect between now and Jan. 1, 2028. Most of these are comprehensive, regulating consumer data privacy protection across (nearly) every industry – they don't only apply to online services.

These laws generally follow the same basic structure:

• Providing individual rights of consumers with respect to their personal data
• Placing obligations (such as disclosure, security, and data minimization requirements) on organizations that collect, process, and transfer consumers' personal data
• Defining consent requirements around the processing of sensitive and children's data
• Providing for enforcement, typically by the state's attorney general

We'll discuss the details of nationwide compliance in a later post. For now, we're focused on determining which of these laws -- if any -- apply to your activities.

Whereas the EU GDPR regulates essentially all processing of personal data, regardless of the scale, states have limited the scope of their data privacy laws to exclude smaller companies/services, and many have excluded nonprofit organizations entirely.

Why is this useful?

You might reasonably say to yourself, "This looks like a lot. Shouldn't I just assume they all apply and comply with all of it?"

Well, maybe. Even if you run an online service that's available everywhere, it's worth taking a closer look if you're subject to a common exemption (e.g. you're a nonprofit or deal mostly with HIPAA data), you're not selling data, and you have relatively low per-state user/data subject numbers.

And if you run a more traditional business that genuinely only serves customers or handles data about people in a handful of states, your obligations may be meaningfully limited compared to across-the-board compliance. Some of the more expensive requirements, like ongoing impact assessments of "high-risk" processing activities and universal opt-out compliance, vary by state.

The structure of state privacy law applicability thresholds

While the details vary in important ways between states, nearly every comprehensive state data privacy laws screen organizations according to some combination of the following thresholds:

• Total annual revenue
• The number of state residents whose personal data they process
• The percentage of its revenue the organization makes from selling or sharing personal data of state residents

States mix and match these criteria in different ways. For example, California applies to an organization meeting any of three thresholds: (1) over $25M in total revenue (adjusted for inflation); (2) buying, selling, or sharing personal data of over 100,000 California consumers or households; or (3) deriving 50% of its annual revenue from selling or sharing personal data of California consumers. By contrast, several states (including Virginia, Indiana, and Iowa) have no "total revenue" threshold, but apply to organizations that either: (1) process personal data of over 100,000 state residents, or (2) process personal data of over 25,000 state residents and derive at least 50% of their revenue from selling that data. Other states, like Texas and Nebraska, have no such statutory thresholds, but exclude small businesses as defined by the federal Small Business Act (SBA) from most of their requirements.

Each state data privacy law also includes statutory exemptions for certain categories of (a) entities and (b) data. For example, many states exclude nonprofits or employment-related data (processed by employers) entirely, and make exceptions for HIPAA-regulated data (or entities) and financial institutions (or data regulated by the Gramm-Leach-Bliley Act). (Most laws also contain a fairly long list of exemptions for more niche entities and data, most of which are not applicable to the average company.)

Four questions to rule them all

To determine which laws (if any) are applicable to your organization, you first need to answer the following questions:

1. What is your organization's total annual revenue?
2. What sector is your organization in? (If the answer is nonprofit, healthcare, or financial services, you may be exempt from most requirements.)

And for each state where your data subjects reside:
3. How many people do you have personal data about in that state?
4. What share of your total revenue (if any) do you derive from selling or sharing personal data? (For most states, this analysis focuses on personal data of people in that state but some, including Virginia, do not make this distinction.)

Breakdown of main thresholds and exemptions by state

The table below contains information about the key thresholds and exemptions for every comprehensive (or near-comprehensive) US state data privacy law as of July 15, 2026. A detailed spreadsheet with more information about these laws can be found here or at the end of the post.

A handful of outliers

While the basic structure of thresholds and exemptions are pretty similar state-to-state, there are some distinct outliers worth mentioning. A few of particular note:

• Texas and its copycat Nebraska have no revenue, volume, or data-sales thresholds at all. Instead, they exempt "small businesses" as defined by the SBA
• Florida has such a high annual-revenue threshold ($1B in global revenue) that it basically only applies to big-tech companies. Even then, it only applies to companies that either (a) derive 50%+ of their annual revenue from online ad sales, (b) sell voice-operated smart speakers, or (c) operate app stores containing at least 250,000 apps.
• California, always in its own category, is the only state that doesn't exempt processing of employment-related data by employers. It is also unique insofar as it established a new government agency (the California Privacy Protection Agency) to enforce its privacy law.
• Maryland's thresholds are similar to other states, but its data protections are sharper than most: the law bans all sales of "sensitive data" and limits processing of all personal data to only what is strictly necessary.

Important: exemption doesn't mean unregulated

Keep in mind that, even if your activities are mostly exempted from state data privacy laws or don't meet the minimum thresholds, that doesn't mean they're totally unregulated. For one thing, some states regulate certain activities (such as sale of sensitive data) regardless of whether you meet the threshold.

There are also many other state and federal laws regulating data privacy to one degree or another, including:

• The Illinois Biometric Information Privacy Act (BIPA), regulating the collection and sharing of biometric data.
• The Washington My Health My Data Act (MHMDA), regulating the processing and sharing of personal health data that falls outside of HIPAA.
• The federal Children's Online Privacy Protection Act (COPPA), strictly regulating the collection and use of children's personal data.
• State breach-notification laws, which require disclosure and remediation of data breaches affecting personal data, without exemption.

And finally, the Federal Trade Commission has broad latitude under Section 5 of the FTC Act to regulate data processing and sharing activities to the extent they constitute unfair trade practices (though its reach does not extend to nonprofit organizations, banks and credit unions, common carriers, or most insurance companies).

Take action

This week, run down the answers to the four questions above, and identify which states' thresholds your organization meets. This will be a good first step in determining your compliance obligations in the US. Run the analysis again after any fund-raise, growth spurt, or expansion to a new state.