US State Privacy Laws and Your Website

There's no single privacy law covering all US websites. Instead, a patchwork of state laws has grown, starting with California. Which ones apply to you depends on where your customers live, how big your business is, and what you do with their data. This is a general overview, not legal advice, and laws change often, so check current rules or consult an adviser.

The landscape

California's consumer privacy law (CCPA, as amended by CPRA) was the first comprehensive state law. Since then, many other states have passed their own, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others. Details differ, but there are common themes.

Do they apply to small businesses?

Many of these laws have thresholds. They often apply to businesses that process personal data of a certain number of state residents, or that earn a certain share of revenue from selling or sharing personal data. Some laws have no revenue threshold, or have specific rules for selling sensitive data even by small businesses. Because thresholds vary and are updated, you can't assume you're exempt. Check each state where you have significant numbers of customers.

Common rights for consumers

Depending on the state, residents may have rights to:

• Know what personal information a business collects and how it is used
• Access and obtain a copy of their data
• Correct inaccuracies
• Delete their data
• Opt out of the sale or sharing of personal data, and of targeted advertising
• Limit the use of sensitive personal information
• Not be discriminated against for exercising these rights

What it means for your website

1. A clear privacy policy. A privacy policy is expected under these laws, and California has long required one for commercial websites that collect personal information from its residents. Describe what you collect, why, who you share it with, and how people can exercise their rights. See privacy policy and cookie banner basics. Our own Privacy Policy shows how a plain-language one can be organized.

2. Notice at collection. Tell people what you collect at or before the time you collect it, such as near a signup form.

3. Ways to submit requests. Provide at least the methods the law requires, often a web form or email, and sometimes a toll-free number. Respond within the required timeframe, usually around 45 days.

4. Opt-out of sale, sharing, and targeted advertising. If you use advertising pixels or share data with advertising partners, you may need a clear "Do Not Sell or Share My Personal Information" link and must honor opt-out preference signals, such as Global Privacy Control, where required.

5. Sensitive data. Some laws require consent for processing sensitive data, such as health, precise location, or children's data.

6. Contracts with service providers. Agreements with vendors that process data on your behalf should limit how they use it.

7. Security. Use reasonable safeguards. See how to keep your website secure.

8. Children. Special rules apply to data from children, including under federal law (COPPA) for children under 13. Avoid collecting data from children unless you've planned for it.

Cookies and tracking

Marketing pixels and some analytics can count as "sharing" for targeted advertising under some laws. Audit what's on your site and why. See third-party scripts and website speed and how to set up conversion tracking.

Email marketing

The federal CAN-SPAM Act sets rules for commercial email, including honest subject lines, a physical postal address, and a working opt-out. See email newsletter basics.

Simple practices that help everywhere

• Collect only what you need
• Don't sell or share personal data unless you must
• Choose reputable vendors
• Document what you collect and why
• Review your policy at least yearly
• Respect requests promptly

International visitors

If you also serve people in Europe or the UK, a different regime applies. See GDPR and your website.

The bottom line

US privacy law is a patchwork. Know which states your customers are in, publish an accurate privacy policy, give people ways to exercise their rights, and get advice if you share or sell data.