# US state privacy laws and privacy policy disclosures > Privacy notice duties under comprehensive US state laws such as Virginia's VCDPA, with the opt-outs, appeals, and clauses the generator adds. Most comprehensive US state privacy laws outside California require a privacy notice that lists the categories of personal data processed, the purposes, how consumers can exercise rights and appeal a refused request, the categories of data shared with third parties, and the categories of those third parties. A controller that sells personal data or uses it for targeted advertising must also disclose that clearly and explain how to opt out. The Virginia Consumer Data Protection Act is a representative model, and many later state laws follow a similar structure with differences in thresholds, definitions, and exemptions. Canonical URL: https://legalpolicygenerator.com/laws/us-state-privacy-laws ## Who this law applies to Each state law has its own scope test. Virginia's law, in Code of Virginia section 59.1-576, applies to persons that conduct business in Virginia or produce products or services targeted to Virginia residents and that, during a calendar year, control or process the personal data of at least 100,000 consumers, or control or process the personal data of at least 25,000 consumers and derive over 50 percent of gross revenue from the sale of personal data. A growing number of states, including Colorado, Connecticut, Utah, Texas, and Oregon, have enacted comprehensive privacy laws of their own. Their thresholds differ: most count the state's residents whose data is processed each year, some combine that with the share of revenue from selling data, a few rely on revenue or small-business status instead of a consumer count, and several apply broader rules to sensitive data. Most of these laws exclude people acting in a commercial or employment context, which is a major difference from California, and many exempt certain regulated entities or data sets. Additional state laws have been enacted with effective dates after this review, so the list of covered states keeps changing. Whether a particular state law applies is a factual and legal question for each operator. ## What your privacy policy must include Virginia's section 59.1-578 requires a reasonably accessible, clear, and meaningful privacy notice that includes the categories of personal data processed; the purpose for processing; how consumers may exercise their rights, including how to appeal a decision about a request; the categories of personal data shared with third parties, if any; and the categories of third parties, if any, with which personal data is shared. If a controller sells personal data to third parties or processes it for targeted advertising, it must clearly and conspicuously disclose that processing and the way a consumer may opt out. The rights commonly described are access, correction, deletion, and a portable copy of data, together with opt-outs from targeted advertising, sale, and profiling in furtherance of decisions that produce legal or similarly significant effects. Many state laws also require consent before processing sensitive data, an appeal process with a way to contact the state attorney general if an appeal is denied, and, in several states, recognition of universal opt-out mechanisms such as Global Privacy Control. Because definitions differ, the notice should describe actual practices in plain terms and avoid importing California categories where a state law uses different ones. ## How Legal Policy Generator handles it The library handles other state laws with a small set of shared clauses rather than a clause for each state. The state-rights clause names Virginia, Colorado, Connecticut, and Texas laws only as examples, states that applicability depends on the consumer's state of residence, the operator's activities, thresholds, and exemptions, and describes access, correction, deletion, portability, and opt-outs from targeted advertising, sale, and certain profiling. It also lists the categories of personal data processed and the purposes from your answers, your description of personal data shared with third parties and the categories of those third parties, and whether sensitive data is processed only after consent. The appeals clause gives your appeal route and explains that a consumer whose appeal is denied may complain to the Attorney General of the consumer's state. When you report a sale or targeted advertising, an opt-out clause states how to opt out and whether Global Privacy Control or another universal opt-out signal is honored. The clauses do not test thresholds, so they do not claim that any particular state law applies. The US framework clause and one of the two conflicting sale-or-sharing clauses are added with them. The list below is read from the clause library each time this page is rendered. ## Questionnaire answers that switch it on Selecting Other US state privacy laws adds the state-rights, appeals, and US framework clauses and asks for three facts: the personal data shared with third parties and the categories of those third parties, whether sensitive data is processed and, if so, whether only after consent or, where state law permits, after clear notice and an opportunity to opt out, and how consumers appeal a refused request. The sale-or-sharing question also becomes required: answering yes adds a clause stating that some disclosures are a sale, sharing, or targeted-advertising processing, plus the state opt-out clause, which requires an answer on whether universal opt-out signals such as Global Privacy Control are honored; answering no adds a clause stating that the operator does not sell personal information or share it for cross-context behavioral advertising. The privacy request methods you select, such as a privacy email, account settings, or a web form, are the only methods the clauses name. Advertising, analytics, and AI facts reported elsewhere in the questionnaire feed the general sections that describe those practices. ## Common mistakes Leaving out the appeal process is a frequent gap, because most of these laws require one. Saying that no data is sold while using advertising pixels that count as targeted advertising contradicts the opt-out duty. Describing only a Do Not Sell link where a state also requires a targeted-advertising opt-out leaves one right unaddressed. Processing sensitive data such as precise location or health information on an opt-out basis where a state requires opt-in consent cannot be fixed by wording alone. Listing specific states as covered without checking thresholds, or promising every right to every US resident, turns a notice into a broader commitment than the law requires. Copying California terminology into a multi-state notice can misdescribe the rights available elsewhere. ## Common questions ### Which states does the generator cover? It adds shared rights, appeals, and opt-out clauses for comprehensive state laws other than California's. Virginia, Colorado, Connecticut, and Texas laws are named only as examples, and the clauses do not list every state's specific rules. You decide which laws apply to your business; California has its own separate modules. ### Does the generator check state thresholds for me? No. Thresholds depend on your consumer counts, revenue, and data practices, which only you can confirm. The clause is written so that it does not expand or waive statutory rights. ### What is a typical state-law threshold? Virginia's is a common model: personal data of at least 100,000 consumers in a calendar year, or at least 25,000 consumers plus over 50 percent of gross revenue from selling personal data. Other states differ. ### Do I need a separate privacy policy for each state? Usually not. One notice can describe the rights and opt-outs that apply, provided it is accurate for each state whose law applies. ### Is the generated state-law wording legal advice? No. It reflects the facts you supply and does not guarantee compliance with any state law. Generated wording reflects supplied facts. It is not legal advice or a guarantee of compliance or enforceability.