US state privacy laws
Comprehensive consumer privacy laws passed by individual US states, led by California.
Overview
Without a single federal privacy law, a growing number of states have passed comprehensive privacy laws giving residents rights to access, delete and opt out of certain processing. California’s law is enforced by a dedicated privacy agency and the state attorney general.
As primary legislation it is binding law; regulators fill in and interpret its detail through rules, guidance and supervisory practice. The authorities most closely connected to it are State privacy agencies, State attorneys general and US state legislatures.
Check the official sources below for legal scope, applicable dates and exceptions. This entry is an explanatory reference, not legal advice.
Why it matters
The patchwork grows every year, and requirements differ in the detail.
Who it affects
Businesses processing personal data of residents of states with such laws.
Where it sits
Ten linked steps connect where you operate to the proof that you complied.
- 01Jurisdiction
- 02Industry
- 03Activity
- 04Authority
- 05Regulation
- 06Requirement
- 07Guidance
- 08Control
- 09Evidence
- 10Enforcement
Connections
The terms most closely tied to US state privacy laws. Select one to open it.
What to do about it
- 1Confirm whether you are in scope: who it covers, which activities and where.
- 2Break it into testable requirements.
- 3Map each requirement to a control and an owner.
- 4Track amendments, implementing rules and guidance.
- 5Keep sealed evidence for every control run.
From requirement to evidence.
Each state law is mapped to the shared privacy control set, with state-specific requirements flagged.
Request early access →