US State Privacy Law Applicability Checker

How this is calculated

For each state you pick, the tool compares your consumer count with that state’s volume threshold (for example 100,000 in Virginia, 35,000 in Maryland, 175,000 in Tennessee).
It then tries the alternate prong: a lower consumer count plus a minimum share of revenue from selling personal data (in Colorado and New Jersey any such revenue counts). Connecticut, since July 2026, also applies to anyone who sells personal data.
Texas and Nebraska have no volume threshold, so they are always flagged, subject to their small-business exception.
Utah and Tennessee also require more than US$25 million in annual revenue; the tool flags this but cannot test it.
The headline counts the states that likely apply; amber if any do, green if none.

Worked example

The calculator run on its default inputs:

States where you have consumers: Virginia (VCDPA); Texas (TDPSA); Colorado (CPA)
Consumers in those states: 150,000 consumers
Revenue from selling personal data: 0%

3 state privacy laws likely apply

Virginia (VCDPA) (in force since 2023): Likely applies - >= 100,000 consumers
Texas (TDPSA) (in force since July 2024): Likely applies - no volume/revenue threshold (small-business exception aside)
Colorado (CPA) (in force since 2023): Likely applies - >= 100,000 consumers

With the defaults (Virginia, Texas and Colorado; 150,000 consumers; no revenue from selling data) all three laws are flagged: Virginia and Colorado because 150,000 is above their 100,000-consumer thresholds, and Texas because it has no volume threshold.

Sources

Va. Code 59.1-576 - Virginia: 100,000, or 25,000 plus over 50% of revenue from sales
Colorado Attorney General - Colorado Privacy Act - Colorado: 100,000, or 25,000 plus any revenue or discount from sales
Conn. Gen. Stat. 42-516 (2026 supplement) - Connecticut from 1 July 2026: 35,000, sensitive data, or selling personal data
Utah Code 13-61-102 - Utah: US$25M revenue plus 100,000, or 25,000 plus over 50%
Tex. Bus. & Com. Code 541 - Texas: no volume threshold; SBA small-business exception; universal opt-out via a global device setting
ORS 646A.572 (Oregon) - Oregon: 100,000, or 25,000 plus 25% or more
Montana DOJ - Consumer Data Privacy Act - Montana: 25,000, or 15,000 plus 25%, from 1 October 2025 (SB 297)
Del. Code tit. 6, ch. 12D - Delaware: 35,000, or 10,000 plus over 20%; lower thresholds from 2027
Iowa Code 715D.2 - Iowa: 100,000, or 25,000 plus over 50%
Neb. Rev. Stat. 87-1103 - Nebraska: no volume threshold; SBA small-business exception
New Jersey P.L. 2023, c.266 - New Jersey: 100,000, or 25,000 plus any revenue or discount from sales; effective 15 January 2025
N.H. RSA 507-H - New Hampshire: 35,000, or 10,000 plus over 25%
Ky. Rev. Stat. (Consumer Data Protection) - Kentucky: 100,000, or 25,000 plus over 50%; effective 1 January 2026
Indiana Attorney General - Consumer Data Protection Act - Indiana: 100,000, or 25,000 plus over 50%
R.I. Gen. Laws 6-48.1-4 - Rhode Island: 35,000, or 10,000 plus over 20%
Md. Code, Com. Law 14-4702 - Maryland: 35,000, or 10,000 plus over 20%
Minn. Stat. 325M.12 - Minnesota: 100,000, or 25,000 plus over 25%
Tennessee Attorney General - Information Protection Act - Tennessee: over US$25M revenue plus 175,000, or 25,000 plus over 50%

Sources last checked September 2026.

Limitations

The consumer count is one total across the states you pick, while each law counts only its own residents, and these laws exclude people acting in a commercial or employment context. Entity and data exemptions (GLBA, HIPAA, non-profits in some states) are not modelled, and California is covered by the separate CCPA calculator. This is an indicative estimate for education and planning, not legal advice. Laws and published figures change, and regulators and courts apply discretion no calculator can model - confirm with a qualified legal or compliance professional before acting on a result.