Compare state privacy laws: applicability
Who the law applies to: thresholds, exemptions and nonprofits.
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Each entry gives the statute section it comes from. "None" means the law has no such test, period or right. Reference material, not legal advice.
| State | Consumer threshold | Sale threshold | Revenue threshold | GLBA exemption (data or entity level) | Nonprofits covered |
|---|---|---|---|---|---|
| California | 100,000 consumers or households (bought, sold or shared)Cal. Civ. Code § 1798.140(d)(1)(B) | 50% or more of annual revenue from selling or sharingCal. Civ. Code § 1798.140(d)(1)(C) | $26,625,000 (from 2025-01-01, inflation-adjusted)Cal. Civ. Code §§ 1798.140(d)(1)(A), 1798.199.95(d) | dataCal. Civ. Code § 1798.145(e) | noCal. Civ. Code § 1798.140(d)(1) |
| Virginia | 100,000§ 59.1-576(A)(i) | 25,000 + over 50% of gross revenue from sale§ 59.1-576(A)(ii) | None | entity§ 59.1-576(B)(ii) | no§ 59.1-576(B)(iv) |
| Colorado | 100,000C.R.S. § 6-1-1304(1)(a)(I)(B) | 25,000 + any revenue or discount from saleC.R.S. § 6-1-1304(1)(a)(I)(B) | None | entityC.R.S. § 6-1-1304(2)(q) | yesC.R.S. § 6-1-1304(2) |
| Connecticut | 35,000 (from 2026-07-01; was 100,000)Conn. Gen. Stat. § 42-516(1) | any sale of personal data (from 2026-07-01; was 25,000 + over 25% of gross revenue from sale)Conn. Gen. Stat. § 42-516(3) | None | dataConn. Gen. Stat. § 42-517(a)(10) to (12), (b)(17) | noConn. Gen. Stat. § 42-517(a)(3) |
| Utah | 100,000 (and $25M revenue)§ 13-61-102(1)(c)(i) | 25,000 + over 50% of gross revenue from sale (and $25M revenue)§ 13-61-102(1)(c)(ii) | $25,000,000 annual revenue (required in addition)§ 13-61-102(1)(b) | entity§ 13-61-102(2)(k) | no§ 13-61-102(2)(d) |
| Oregon | 100,000ORS 646A.572(1)(a)(A) | 25,000 + 25% or more of gross revenue from saleORS 646A.572(1)(a)(B) | None | data (entity-level only for financial institutions under ORS 706.008 and insurers)ORS 646A.572(2)(k)(A), (L), (n) | yesORS 646A.572(2); 2023 c.369 § 13 |
| Texas | none (SBA small-business test instead)§ 541.002(a) | None§ 541.002(a) | None | entity§ 541.002(b)(2) | no§ 541.002(b)(4) |
| Montana | 25,000§ 30-14-2803(1)(a) | 15,000 + over 25% of gross revenue from sale§ 30-14-2803(1)(b) | None | data (entity-level only for banks, credit unions and insurers)§ 30-14-2804(1)(e), (f), (h) | yes§ 30-14-2804(1)(b) |
| Delaware | 35,000 (10,000 from 2027-01-01)§ 12D-103(a)(1) | 10,000 + over 20% of gross revenue from sale (5,000 from 2027-01-01)§ 12D-103(a)(2) | None | entity (until 2026-12-31; from 2027-01-01 data-level, with banks, credit unions, insurers and certain securities firms still exempt as entities)§ 12D-103(b)(2), (c)(14) | yes§ 12D-103(b)(3) |
| Iowa | 100,000§ 715D.2(1)(a) | 25,000 + over 50% of gross revenue from sale§ 715D.2(1)(b) | None | entity§ 715D.2(2) | no§ 715D.2(2) |
| Nebraska | none (all businesses that are not SBA small businesses)§ 87-1103(1) | None | None | entity§ 87-1103(2)(b) | no§ 87-1103(2)(d) |
| New Hampshire | 35,000RSA 507-H:2, I(a) | 10,000 + over 25% of gross revenue from saleRSA 507-H:2, I(b) | None | entityRSA 507-H:3, I(e) | noRSA 507-H:3, I(b) |
| New Jersey | 100,000C.56:8-166.5(a) | 25,000 + any revenue or discount from saleC.56:8-166.5(b) | None | entityC.56:8-166.13(b) | yesC.56:8-166.13 |
| Tennessee | 175,000Tenn. Code Ann. § 47-18-3303(2)(B) | 25,000 + over 50% of gross revenue from saleTenn. Code Ann. § 47-18-3303(2)(A) | over $25 million in revenue (required in addition to a consumer test)Tenn. Code Ann. § 47-18-3303(1) | entityTenn. Code Ann. § 47-18-3311(a)(2) | noTenn. Code Ann. § 47-18-3311(a)(5) |
| Minnesota | 100,000§ 325M.12, subd. 1(a)(1) | 25,000 + over 25% of gross revenue from sale§ 325M.12, subd. 1(a)(2) | None | data§ 325M.12, subd. 2(a)(9) | yes§ 325M.12, subd. 2(a)(20) |
| Maryland | 35,000§ 14-4702(1) | 10,000 + over 20% of gross revenue from sale§ 14-4702(2) | None | entity§ 14-4703(a)(3) | yes§ 14-4703(a)(4) |
| Indiana | 100,000IC 24-15-1-1(a)(1) | 25,000 + over 50% of gross revenue from saleIC 24-15-1-1(a)(2) | None | entityIC 24-15-1-1(b)(2) | noIC 24-15-1-1(b)(4) |
| Kentucky | 100,000KRS 367.3613(1)(a) | 25,000 + over 50% of gross revenue from saleKRS 367.3613(1)(b) | None | entityKRS 367.3613(2)(b) | noKRS 367.3613(2)(d) |
| Rhode Island | 35,000§ 6-48.1-4(a)(1) | 10,000 + over 20% of gross revenue from sale§ 6-48.1-4(a)(2) | None | entity§ 6-48.1-3(d); § 6-48.1-10(a) | no§ 6-48.1-3(d); § 6-48.1-10(c) |
| Louisiana | 75,000 consumers, households or devices (bought, received, sold or shared for commercial purposes)La. R.S. 51:1780.2(A)(2) | 50% or more of annual revenue from selling personal information (no consumer minimum)La. R.S. 51:1780.2(A)(3) | over $25 million annual gross revenueLa. R.S. 51:1780.2(A)(1) | entityLa. R.S. 51:1780.2(B)(2) | noLa. R.S. 51:1780.2(B)(4) |
| Oklahoma | 100,000SB 546 § 15(A)(2)(a) (75A O.S. § 314) | 25,000 + over 50% of gross revenue from saleSB 546 § 15(A)(2)(b) (75A O.S. § 314) | None | entitySB 546 § 15(B)(2) (75A O.S. § 314) | noSB 546 § 15(B)(4) (75A O.S. § 314) |
| Alabama | more than 25,000Act 2026-552, § 3(1) (Ala. Code § 8-44-3) | more than 25% of gross revenue from sale (no consumer minimum)Act 2026-552, § 3(2) (Ala. Code § 8-44-3) | None | entityAct 2026-552, § 4(a)(4), (5) (Ala. Code § 8-44-4) | partlyAct 2026-552, § 4(a)(8) (Ala. Code § 8-44-4) |
| Vermont | 35,000 (or 3,000 for sensitive data)Act 145, Sec. 1, 9 V.S.A. § 2415b(a)(1), (2) | offered for sale personal data of 3,000+ consumers (no revenue test)Act 145, Sec. 1, 9 V.S.A. § 2415b(a)(3) | None | data (entity-level only for banks, credit unions and their financial affiliates)Act 145, Sec. 1, 9 V.S.A. § 2415c(a)(13), (14) | yesAct 145, Sec. 1, 9 V.S.A. § 2415c(a) |
| Narrower laws | |||||
| Florida | NoneFla. Stat. § 501.702(9) | NoneFla. Stat. § 501.702(9) | over $1 billion global revenue, plus 50% online ad revenue, a smart speaker service or an app store with 250,000+ appsFla. Stat. § 501.702(9)(a)5.-6. | entityFla. Stat. § 501.703(2)(b) | noFla. Stat. § 501.703(2)(d) |