California pioneered comprehensive state privacy legislation, but other states have followed with their own consumer data protection laws. If you live in Virginia, Colorado, Connecticut, Utah, or other states with enacted privacy laws, you have significant rights over your personal information. Understanding state privacy protections helps you exercise control over your data regardless of where businesses are located.
State privacy laws continue to evolve as more states consider and enact comprehensive protections.
States with Comprehensive Privacy Laws
As of 2024, states with comprehensive privacy laws include California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and several others with laws taking effect in coming years.
Each state's law applies to residents of that state. If you live in Virginia, Virginia's law protects you when dealing with covered businesses. If you live in a state without comprehensive privacy law, your protections are more limited.
Many states are actively considering privacy legislation. The landscape is changing rapidly.
Common Rights Across State Laws
Most state privacy laws provide similar core rights. Right to know: Access information about what data is collected about you. Right to access: Obtain copies of your personal data. Right to delete: Request deletion of your data in certain circumstances.
Right to correct: Fix inaccurate personal information. Right to opt out: Stop sales of your data or targeted advertising. Right to data portability: Receive your data in a usable format.
The specific scope and exceptions vary by state, but these core concepts appear throughout state privacy legislation.
Key Differences Among State Laws
While similar in structure, state laws have meaningful differences. California's CCPA/CPRA remains the broadest, covering more businesses and providing a private right of action for data breaches.
Other state laws typically have higher thresholds for covered businesses—often requiring processing data of 100,000+ consumers before the law applies. Smaller businesses may not be covered.
Enforcement mechanisms differ. California allows private lawsuits for breaches; most other states rely solely on attorney general enforcement. This affects your remedies if violations occur.
Sensitive Data Categories
State laws often provide special protections for sensitive data. Categories typically include racial or ethnic origin, religious beliefs, health information, sexual orientation, genetic or biometric data, and data from known children.
Processing sensitive data usually requires express consent—businesses can't rely on general terms of service acceptance. Opting out of sensitive data processing should be straightforward.
How Businesses Must Comply
Covered businesses must provide clear privacy notices explaining their data practices. They must establish methods for consumers to submit rights requests and respond within specified timeframes (typically 45 days).
Businesses cannot retaliate against consumers who exercise privacy rights. Denying services, raising prices, or degrading quality because you opted out of data practices violates most state laws.
Exercising Your Rights
To exercise rights, look for privacy links or settings on company websites. Most businesses have streamlined request processes. You'll need to verify your identity before businesses fulfill requests.
Keep records of your requests and responses. If businesses fail to respond appropriately, you may want to file complaints with your state attorney general.
Authorized agents can submit requests on your behalf in some states, useful if you want someone else to manage privacy requests.
Enforcement and Remedies
Most state privacy laws are enforced by state attorneys general. Penalties for violations can be significant—often ,500 or more per intentional violation. AGs have authority to investigate and bring enforcement actions.
Private rights of action are limited—California allows them for data breaches but not general violations; most other states don't provide private rights of action at all. This means you may need to rely on government enforcement.
Report violations to your state attorney general's office. Consumer complaints help identify problem companies for investigation.
If Your State Lacks Privacy Law
If you live in a state without comprehensive privacy law, your protections are more limited. You still benefit from federal sector-specific laws (HIPAA, FERPA, etc.) and company privacy policies that may be enforceable as consumer protection matters.
Some businesses extend privacy rights to all customers regardless of location—check company privacy policies. Following state-law processes may work even if your state doesn't mandate the rights.
Getting Legal Help
Privacy law varies significantly by state. A privacy attorney can help you understand what rights apply in your state, exercise them effectively, and pursue remedies when companies fail to comply. If you've suffered harm from privacy violations or data breaches, legal consultation helps you understand whether you have viable claims and how to pursue them.