US State Data Privacy Laws for Small to Mid-Sized Businesses

What "state privacy law" actually means in 2026 for a small business

The federal government has not passed a general consumer privacy law. Instead, US state legislatures have stepped in one at a time. As of June 2026, at least 20 states have an enforceable comprehensive consumer privacy law on the books, with several more passed but not yet effective and dozens of additional bills still in committee. Each one looks similar at first glance and is materially different in the details that matter to small to mid-sized businesses: which residents trigger it, which data triggers it, what counts as "sale," what counts as a sensitive category, and which enforcement authority has teeth.

California started this with the California Consumer Privacy Act (CCPA) in 2018, expanded by the California Privacy Rights Act (CPRA) in 2023. Virginia's CDPA followed, then Colorado's CPA and Connecticut's CTDPA. Texas joined with the Texas Data Privacy and Security Act (TDPSA), effective July 1, 2024 for most provisions and January 1, 2026 for opt-out signals. Newer entries include Delaware DPDPA, Maryland MODPA, Tennessee TIPA, New Jersey, Indiana, Iowa, Montana, Oregon, Utah, and Nebraska, with effective dates spread across 2025 and 2026.

The thresholds vary, and that is where most SMBs get confused

Some laws apply to any business that processes personal data of more than 100,000 residents annually. Some lower the bar to 35,000 or 25,000. Some include a sale-of-personal-data test. Several states (Delaware included) have no revenue floor at all, meaning a tiny business with the right customer mix can still fall within scope. Determining which laws apply to your specific business is the first thing to do, and the answer is rarely "none." The default assumption that a small business does not have to worry about state privacy laws is now usually wrong.

What audit-ready state privacy compliance looks like

The framework is consistent across states even when the thresholds differ. You need a privacy policy that accurately reflects your data practices in plain language. A documented data inventory listing what you collect, where it lives, and who you share it with. A consumer rights workflow that handles access, deletion, correction, and opt-out requests within the statutory window (typically 45 days, extendable once). Vendor contracts (DPAs) that meet each applicable state's processor or service-provider requirements. A breach notification protocol aligned with the state-specific timelines and thresholds. And a sensitive data audit, because most of the newer laws (Texas TDPSA included) require affirmative consent before processing sensitive categories. The articles below cover each piece by state, with the actual statute text and the patterns that survive enforcement review.