US state privacy laws and privacy policy disclosures

Who this law applies to

Each state law has its own scope test. Virginia's law, in Code of Virginia section 59.1-576, applies to persons that conduct business in Virginia or produce products or services targeted to Virginia residents and that, during a calendar year, control or process the personal data of at least 100,000 consumers, or control or process the personal data of at least 25,000 consumers and derive over 50 percent of gross revenue from the sale of personal data. A growing number of states, including Colorado, Connecticut, Utah, Texas, and Oregon, have enacted comprehensive privacy laws of their own. Their thresholds differ: most count the state's residents whose data is processed each year, some combine that with the share of revenue from selling data, a few rely on revenue or small-business status instead of a consumer count, and several apply broader rules to sensitive data. Most of these laws exclude people acting in a commercial or employment context, which is a major difference from California, and many exempt certain regulated entities or data sets. Additional state laws have been enacted with effective dates after this review, so the list of covered states keeps changing. Whether a particular state law applies is a factual and legal question for each operator.

What your privacy policy must include

Virginia's section 59.1-578 requires a reasonably accessible, clear, and meaningful privacy notice that includes the categories of personal data processed; the purpose for processing; how consumers may exercise their rights, including how to appeal a decision about a request; the categories of personal data shared with third parties, if any; and the categories of third parties, if any, with which personal data is shared. If a controller sells personal data to third parties or processes it for targeted advertising, it must clearly and conspicuously disclose that processing and the way a consumer may opt out. The rights commonly described are access, correction, deletion, and a portable copy of data, together with opt-outs from targeted advertising, sale, and profiling in furtherance of decisions that produce legal or similarly significant effects. Many state laws also require consent before processing sensitive data, an appeal process with a way to contact the state attorney general if an appeal is denied, and, in several states, recognition of universal opt-out mechanisms such as Global Privacy Control. Because definitions differ, the notice should describe actual practices in plain terms and avoid importing California categories where a state law uses different ones.

How Legal Policy Generator handles it

The library handles other state laws with a small set of shared clauses rather than a clause for each state. The state-rights clause names Virginia, Colorado, Connecticut, and Texas laws only as examples, states that applicability depends on the consumer's state of residence, the operator's activities, thresholds, and exemptions, and describes access, correction, deletion, portability, and opt-outs from targeted advertising, sale, and certain profiling. It also lists the categories of personal data processed and the purposes from your answers, your description of personal data shared with third parties and the categories of those third parties, and whether sensitive data is processed only after consent. The appeals clause gives your appeal route and explains that a consumer whose appeal is denied may complain to the Attorney General of the consumer's state. When you report a sale or targeted advertising, an opt-out clause states how to opt out and whether Global Privacy Control or another universal opt-out signal is honored. The clauses do not test thresholds, so they do not claim that any particular state law applies. The US framework clause and one of the two conflicting sale-or-sharing clauses are added with them. The list below is read from the clause library each time this page is rendered.

Questionnaire answers that switch it on

Selecting Other US state privacy laws adds the state-rights, appeals, and US framework clauses and asks for three facts: the personal data shared with third parties and the categories of those third parties, whether sensitive data is processed and, if so, whether only after consent or, where state law permits, after clear notice and an opportunity to opt out, and how consumers appeal a refused request. The sale-or-sharing question also becomes required: answering yes adds a clause stating that some disclosures are a sale, sharing, or targeted-advertising processing, plus the state opt-out clause, which requires an answer on whether universal opt-out signals such as Global Privacy Control are honored; answering no adds a clause stating that the operator does not sell personal information or share it for cross-context behavioral advertising. The privacy request methods you select, such as a privacy email, account settings, or a web form, are the only methods the clauses name. Advertising, analytics, and AI facts reported elsewhere in the questionnaire feed the general sections that describe those practices.

Common mistakes

Leaving out the appeal process is a frequent gap, because most of these laws require one. Saying that no data is sold while using advertising pixels that count as targeted advertising contradicts the opt-out duty. Describing only a Do Not Sell link where a state also requires a targeted-advertising opt-out leaves one right unaddressed. Processing sensitive data such as precise location or health information on an opt-out basis where a state requires opt-in consent cannot be fixed by wording alone. Listing specific states as covered without checking thresholds, or promising every right to every US resident, turns a notice into a broader commitment than the law requires. Copying California terminology into a multi-state notice can misdescribe the rights available elsewhere.

Common questions