--- title: "Compare state privacy laws: applicability" canonical: "https://dposchool.com/state-privacy-laws/topic/applicability" source: - "https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5." - "https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/" - "https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf" - "https://www.cga.ct.gov/current/pub/chap_743jj.htm" - "https://le.utah.gov/xcode/Title13/Chapter61/13-61.html" - "https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html" - "https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm" - "https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html" - "https://delcode.delaware.gov/title6/c012d/index.html" - "https://www.legis.iowa.gov/docs/code/715D.pdf" - "https://nebraskalegislature.gov/laws/statutes.php?statute=87-1101" - "https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm" - "https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM" - "https://publications.tnsosfiles.com/acts/113/pub/pc0408.pdf" - "https://www.revisor.mn.gov/statutes/cite/325M.10" - "https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4701&enactments=false" - "https://iga.in.gov/ic/2026/Title_24.pdf" - "https://apps.legislature.ky.gov/law/statutes/chapter.aspx?id=39092" - "https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm" - "https://legis.la.gov/legis/ViewDocument.aspx?d=1480202" - "https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.pdf" - "https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf" - "https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf" - "http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/0501PartVContentsIndex.html" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en-US" publisher: "DPO School" --- # Compare state privacy laws: applicability Who the law applies to: thresholds, exemptions and nonprofits. Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review) Each entry gives the statute section it comes from. "None" means the law has no such test, period or right. Reference material, not legal advice. | State | Consumer threshold | Sale threshold | Revenue threshold | GLBA exemption (data or entity level) | Nonprofits covered | | --- | --- | --- | --- | --- | --- | | [California](https://dposchool.com/state-privacy-laws/state/california/applicability) | 100,000 consumers or households (bought, sold or shared) (Cal. Civ. Code § 1798.140(d)(1)(B)) | 50% or more of annual revenue from selling or sharing (Cal. Civ. Code § 1798.140(d)(1)(C)) | $26,625,000 (from 2025-01-01, inflation-adjusted) (Cal. Civ. Code §§ 1798.140(d)(1)(A), 1798.199.95(d)) | data (Cal. Civ. Code § 1798.145(e)) | no (Cal. Civ. Code § 1798.140(d)(1)) | | [Virginia](https://dposchool.com/state-privacy-laws/state/virginia/applicability) | 100,000 (§ 59.1-576(A)(i)) | 25,000 + over 50% of gross revenue from sale (§ 59.1-576(A)(ii)) | None | entity (§ 59.1-576(B)(ii)) | no (§ 59.1-576(B)(iv)) | | [Colorado](https://dposchool.com/state-privacy-laws/state/colorado/applicability) | 100,000 (C.R.S. § 6-1-1304(1)(a)(I)(B)) | 25,000 + any revenue or discount from sale (C.R.S. § 6-1-1304(1)(a)(I)(B)) | None | entity (C.R.S. § 6-1-1304(2)(q)) | yes (C.R.S. § 6-1-1304(2)) | | [Connecticut](https://dposchool.com/state-privacy-laws/state/connecticut/applicability) | 35,000 (from 2026-07-01; was 100,000) (Conn. Gen. Stat. § 42-516(1)) | any sale of personal data (from 2026-07-01; was 25,000 + over 25% of gross revenue from sale) (Conn. Gen. Stat. § 42-516(3)) | None | data (Conn. Gen. Stat. § 42-517(a)(10) to (12), (b)(17)) | no (Conn. Gen. Stat. § 42-517(a)(3)) | | [Utah](https://dposchool.com/state-privacy-laws/state/utah/applicability) | 100,000 (and $25M revenue) (§ 13-61-102(1)(c)(i)) | 25,000 + over 50% of gross revenue from sale (and $25M revenue) (§ 13-61-102(1)(c)(ii)) | $25,000,000 annual revenue (required in addition) (§ 13-61-102(1)(b)) | entity (§ 13-61-102(2)(k)) | no (§ 13-61-102(2)(d)) | | [Oregon](https://dposchool.com/state-privacy-laws/state/oregon/applicability) | 100,000 (ORS 646A.572(1)(a)(A)) | 25,000 + 25% or more of gross revenue from sale (ORS 646A.572(1)(a)(B)) | None | data (entity-level only for financial institutions under ORS 706.008 and insurers) (ORS 646A.572(2)(k)(A), (L), (n)) | yes (ORS 646A.572(2); 2023 c.369 § 13) | | [Texas](https://dposchool.com/state-privacy-laws/state/texas/applicability) | none (SBA small-business test instead) (§ 541.002(a)) | None (§ 541.002(a)) | None | entity (§ 541.002(b)(2)) | no (§ 541.002(b)(4)) | | [Montana](https://dposchool.com/state-privacy-laws/state/montana/applicability) | 25,000 (§ 30-14-2803(1)(a)) | 15,000 + over 25% of gross revenue from sale (§ 30-14-2803(1)(b)) | None | data (entity-level only for banks, credit unions and insurers) (§ 30-14-2804(1)(e), (f), (h)) | yes (§ 30-14-2804(1)(b)) | | [Delaware](https://dposchool.com/state-privacy-laws/state/delaware/applicability) | 35,000 (10,000 from 2027-01-01) (§ 12D-103(a)(1)) | 10,000 + over 20% of gross revenue from sale (5,000 from 2027-01-01) (§ 12D-103(a)(2)) | None | entity (until 2026-12-31; from 2027-01-01 data-level, with banks, credit unions, insurers and certain securities firms still exempt as entities) (§ 12D-103(b)(2), (c)(14)) | yes (§ 12D-103(b)(3)) | | [Iowa](https://dposchool.com/state-privacy-laws/state/iowa/applicability) | 100,000 (§ 715D.2(1)(a)) | 25,000 + over 50% of gross revenue from sale (§ 715D.2(1)(b)) | None | entity (§ 715D.2(2)) | no (§ 715D.2(2)) | | [Nebraska](https://dposchool.com/state-privacy-laws/state/nebraska/applicability) | none (all businesses that are not SBA small businesses) (§ 87-1103(1)) | None | None | entity (§ 87-1103(2)(b)) | no (§ 87-1103(2)(d)) | | [New Hampshire](https://dposchool.com/state-privacy-laws/state/new-hampshire/applicability) | 35,000 (RSA 507-H:2, I(a)) | 10,000 + over 25% of gross revenue from sale (RSA 507-H:2, I(b)) | None | entity (RSA 507-H:3, I(e)) | no (RSA 507-H:3, I(b)) | | [New Jersey](https://dposchool.com/state-privacy-laws/state/new-jersey/applicability) | 100,000 (C.56:8-166.5(a)) | 25,000 + any revenue or discount from sale (C.56:8-166.5(b)) | None | entity (C.56:8-166.13(b)) | yes (C.56:8-166.13) | | [Tennessee](https://dposchool.com/state-privacy-laws/state/tennessee/applicability) | 175,000 (Tenn. Code Ann. § 47-18-3303(2)(B)) | 25,000 + over 50% of gross revenue from sale (Tenn. Code Ann. § 47-18-3303(2)(A)) | over $25 million in revenue (required in addition to a consumer test) (Tenn. Code Ann. § 47-18-3303(1)) | entity (Tenn. Code Ann. § 47-18-3311(a)(2)) | no (Tenn. Code Ann. § 47-18-3311(a)(5)) | | [Minnesota](https://dposchool.com/state-privacy-laws/state/minnesota/applicability) | 100,000 (§ 325M.12, subd. 1(a)(1)) | 25,000 + over 25% of gross revenue from sale (§ 325M.12, subd. 1(a)(2)) | None | data (§ 325M.12, subd. 2(a)(9)) | yes (§ 325M.12, subd. 2(a)(20)) | | [Maryland](https://dposchool.com/state-privacy-laws/state/maryland/applicability) | 35,000 (§ 14-4702(1)) | 10,000 + over 20% of gross revenue from sale (§ 14-4702(2)) | None | entity (§ 14-4703(a)(3)) | yes (§ 14-4703(a)(4)) | | [Indiana](https://dposchool.com/state-privacy-laws/state/indiana/applicability) | 100,000 (IC 24-15-1-1(a)(1)) | 25,000 + over 50% of gross revenue from sale (IC 24-15-1-1(a)(2)) | None | entity (IC 24-15-1-1(b)(2)) | no (IC 24-15-1-1(b)(4)) | | [Kentucky](https://dposchool.com/state-privacy-laws/state/kentucky/applicability) | 100,000 (KRS 367.3613(1)(a)) | 25,000 + over 50% of gross revenue from sale (KRS 367.3613(1)(b)) | None | entity (KRS 367.3613(2)(b)) | no (KRS 367.3613(2)(d)) | | [Rhode Island](https://dposchool.com/state-privacy-laws/state/rhode-island/applicability) | 35,000 (§ 6-48.1-4(a)(1)) | 10,000 + over 20% of gross revenue from sale (§ 6-48.1-4(a)(2)) | None | entity (§ 6-48.1-3(d); § 6-48.1-10(a)) | no (§ 6-48.1-3(d); § 6-48.1-10(c)) | | [Louisiana](https://dposchool.com/state-privacy-laws/state/louisiana/applicability) | 75,000 consumers, households or devices (bought, received, sold or shared for commercial purposes) (La. R.S. 51:1780.2(A)(2)) | 50% or more of annual revenue from selling personal information (no consumer minimum) (La. R.S. 51:1780.2(A)(3)) | over $25 million annual gross revenue (La. R.S. 51:1780.2(A)(1)) | entity (La. R.S. 51:1780.2(B)(2)) | no (La. R.S. 51:1780.2(B)(4)) | | [Oklahoma](https://dposchool.com/state-privacy-laws/state/oklahoma/applicability) | 100,000 (SB 546 § 15(A)(2)(a) (75A O.S. § 314)) | 25,000 + over 50% of gross revenue from sale (SB 546 § 15(A)(2)(b) (75A O.S. § 314)) | None | entity (SB 546 § 15(B)(2) (75A O.S. § 314)) | no (SB 546 § 15(B)(4) (75A O.S. § 314)) | | [Alabama](https://dposchool.com/state-privacy-laws/state/alabama/applicability) | more than 25,000 (Act 2026-552, § 3(1) (Ala. Code § 8-44-3)) | more than 25% of gross revenue from sale (no consumer minimum) (Act 2026-552, § 3(2) (Ala. Code § 8-44-3)) | None | entity (Act 2026-552, § 4(a)(4), (5) (Ala. Code § 8-44-4)) | partly (Act 2026-552, § 4(a)(8) (Ala. Code § 8-44-4)) | | [Vermont](https://dposchool.com/state-privacy-laws/state/vermont/applicability) | 35,000 (or 3,000 for sensitive data) (Act 145, Sec. 1, 9 V.S.A. § 2415b(a)(1), (2)) | offered for sale personal data of 3,000+ consumers (no revenue test) (Act 145, Sec. 1, 9 V.S.A. § 2415b(a)(3)) | None | data (entity-level only for banks, credit unions and their financial affiliates) (Act 145, Sec. 1, 9 V.S.A. § 2415c(a)(13), (14)) | yes (Act 145, Sec. 1, 9 V.S.A. § 2415c(a)) | | **Narrower laws** | | | | | | | [Florida](https://dposchool.com/state-privacy-laws/state/florida/applicability) | None (Fla. Stat. § 501.702(9)) | None (Fla. Stat. § 501.702(9)) | over $1 billion global revenue, plus 50% online ad revenue, a smart speaker service or an app store with 250,000+ apps (Fla. Stat. § 501.702(9)(a)5.-6.) | entity (Fla. Stat. § 501.703(2)(b)) | no (Fla. Stat. § 501.703(2)(d)) | ## Other comparisons - [Consumer rights](https://dposchool.com/state-privacy-laws/topic/consumer-rights) - [Sensitive data](https://dposchool.com/state-privacy-laws/topic/sensitive-data) - [Controller duties](https://dposchool.com/state-privacy-laws/topic/controller-duties) - [Processors](https://dposchool.com/state-privacy-laws/topic/processors) - [Enforcement](https://dposchool.com/state-privacy-laws/topic/enforcement) ## Navigation [US State Privacy Laws](https://dposchool.com/state-privacy-laws) / Compare: Applicability Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt - JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents