State Consumer Privacy Laws

State consumer privacy laws govern certain uses of personal information under the laws of individual U.S. states. They are not one nationwide statute with identical rules. Depending on the jurisdiction, covered organizations may need to publish notices, respond to access or deletion requests, recognize applicable opt-out choices, limit sensitive-data processing, or assess higher-risk activities. The definition of a covered business and the handling of exemptions differ significantly across states.

California’s CCPA, as amended by the CPRA, provides rights that include knowing, deleting, correcting, and opting out of certain sales or sharing. Colorado’s Privacy Act includes consumer rights and obligations for organizations meeting statutory conditions, including rules on certain opt-out mechanisms. Texas’s Data Privacy and Security Act has different scope rules; small businesses are generally exempt, with a specific exception concerning selling sensitive data. None of those examples establishes that every local contractor with a website is covered by every law.

A service company collecting lead-form entries, call recordings, or advertising identifiers should map what data it handles, which states are relevant, its processors, and whether legal thresholds or exemptions apply. A privacy policy is only one possible compliance component; publishing a generic template is not proof of compliance. Because statutes, rules, thresholds, and enforcement practices change, qualified jurisdiction-specific review is necessary before giving operational legal advice.