US state privacy laws compliance consulting for one programme that holds up in every state you serve.

What it is

What are US state privacy laws and what do they require?

Alongside sector rules such as HIPAA, a number of US states have passed their own comprehensive consumer privacy laws. Each one gives residents rights over their personal data, places duties on the businesses that decide how that data is used (controllers) and on the service providers that handle it for them (processors), and hands enforcement to a state authority. Virginia's Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Texas Data Privacy and Security Act and the Oregon Consumer Privacy Act are examples.

The laws share a recognisable shape, yet they differ in thresholds, exemptions, definitions of sensitive data, opt-out signal rules and deadlines. A business selling to consumers nationwide therefore needs one programme with state-specific settings, not a separate project per state. California has its own, more detailed regime and its own page on this site; this page covers the other comprehensive state laws and the common programme that serves them.

Current position. Each law has its own commencement date and later amendments, set by its legislature. Virginia's Act has applied since 1 January 2023; Colorado's and Connecticut's since 1 July 2023; Texas's and Oregon's since 1 July 2024. No certificate exists under any of them. Your legal advisers confirm which laws apply to you; Sterling builds and runs the programme that meets them.

Who it is for

Who needs to comply with US state privacy laws?

These laws follow the consumer, not the company's headquarters. An organisation in Manila, Dubai or London that sells to or tracks residents of a covered state can fall within scope once it passes that state's thresholds, which are usually set by the number of consumers whose data it handles and, in some states, by revenue from selling data. Organisations come to Sterling from four starting points:

• A US customer sends a privacy questionnaire or data processing addendum. Enterprise buyers pass their own obligations down to suppliers and want to see instructions, confidentiality, deletion and audit terms answered with evidence.
• A tender or partnership requires a documented privacy programme. Retailers, platforms and marketing partners ask how you honour opt-outs, handle requests and govern sensitive data before they share it.
• A regulator, complaint or opt-out signal forces the issue. A consumer request you cannot answer in time, or a browser signal your site ignores, turns a paper policy into a live exposure.
• A group company already runs GDPR or CCPA work. The parent wants the US operation, or a shared service centre, aligned to the same controls with the state-specific differences recorded.

The intended benefit is a privacy programme that consumers, customers and regulators can test. Results depend on how the controls are run after the project, not on the documents alone.

Requirements

What are the main US state privacy law requirements?

Every statute is drafted separately, but the comprehensive laws in the states named on this page ask for the same families of controls. The list below is a plain-language summary at title level; each duty is mapped to the wording of every applicable law, with your legal advisers, during the programme.

• Scope and applicability: confirm which state laws apply, which exemptions cover your data or your sector, and whether you act as controller, processor or both.
• Privacy notice: tell consumers what categories of data you process, why, who receives it and how to exercise their rights.
• Consumer rights: confirm and give access, correct, delete and provide a portable copy, answer within the statutory deadline and run an appeal route when a request is refused.
• Opt-outs: let consumers refuse sale of their data, targeted advertising and certain profiling, and honour recognised opt-out preference signals where the state requires it.
• Sensitive data: obtain consent before processing the categories each law defines as sensitive, including data about children.
• Data protection assessments: assess and document higher-risk processing such as targeted advertising, sale, profiling and the use of sensitive data.
• Processor contracts: bind service providers to your instructions, confidentiality, deletion or return of data and cooperation with oversight, with subcontractors held to the same terms.
• Security and minimisation: keep collection proportionate to the stated purpose and protect the data with reasonable safeguards.

Compliance process

How do you comply with US state privacy laws?

There is no audit to pass and no certificate to hang. Compliance is shown when a consumer, a customer or a state authority tests what you do. Sterling builds the programme with you; the applicability decisions and legal interpretation stay with your legal advisers.

1. 01
   Map the data and the states.Inventory the consumer data you collect, the systems and vendors that hold it, and the states its owners live in.
2. 02
   Gap analysis: compare current practice with each applicable law.The gap analysis records what already works, what differs by state and the actions, owners and dates needed to close each gap.
3. 03
   Build notices, request handling and consent.Publish the notice, set up request intake, identity checks and appeals, configure opt-out signal detection and consent capture for sensitive data.
4. 04
   Assess risk and fix the contracts.Complete data protection assessments for higher-risk processing and put compliant terms in place with every processor and subcontractor.
5. 05
   Test, review and keep it current.Test requests end to end, review the programme with management and track new state laws and amendments as they take effect.

Check the route before you sign. No state issues or recognises a privacy certificate under these laws, so treat any offer of a "state privacy certificate" with caution. Ask what evidence the provider will leave you with, and confirm applicability and interpretation with a qualified lawyer.

Cost

How much does US state privacy law compliance cost?

A single-website retailer with one customer database and a platform company with dozens of data flows need very different programmes. The cost follows the data, the states and the systems, and a Sterling proposal shows every part of it in one all-inclusive proposal.

Timeline

How long does US state privacy law compliance take?

Most first programmes take three to six months, an estimate that depends on how quickly systems can be mapped and changed. Reusing sound GDPR or CCPA work shortens it; scattered data and many vendors lengthen it.

Share any customer or contract deadline at the start, and we will say what can be in place by then.

Your engagement

What your US state privacy engagement includes

The work runs on Sterling OS™. Choose Design™, where your team implements with our guidance, or Drive™, where Sterling manages delivery; they are alternative levels of support, not stages. Sustain™ keeps the programme current once it is in place, and Automate™ is Effivity. Sterling does not certify, attest or validate compliance with any state law, and does not give legal advice.

• Applicability map and gap analysis

  States, data, roles and exemptions recorded, with gaps and owners agreed with your legal advisers.

• Notices, request handling and appeals

  Notice drafts, request procedures, identity checks and response templates, built on Sterling's template sets.

• Effivity ISO & GRC software

  Data map, requests, assessments and vendors in one workspace, included with the engagement at no additional cost.

• Training for everyone

  Internal auditor training for your review team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

• Assessments and processor terms

  Data protection assessments for higher-risk processing and a contract checklist for every processor.

• Internal review and Sustain™

  An end-to-end test of the programme, then monitoring of new state laws and amendments.

Decisions on applicability and legal interpretation remain with your legal advisers; enforcement remains with each state's authority.

Often combined with

Standards organisations pair with US state privacy laws

• ADGM Data Protection Regulations 2021ADGM data protection compliance for entities under the 2021 Regulations: lawful bases, DPO, impact assessments, 72-hour breach notice and transfers, all-inclusive proposal.
• APEC CBPRAPEC CBPR certification and requirements explained: Global CBPR and PRP, Accountability Agent review, annual renewal and how Sterling prepares your team.
• APPI (Japan)APPI compliance for Japan's Act on the Protection of Personal Information: the requirements, PPC breach reporting, cross-border rules and an all-inclusive programme.
• Bahrain PDPLBahrain PDPL compliance and requirements explained: consent, notification to the Authority, transfers abroad, 72-hour breach reporting, rights, cost and timing.
• CCPA / CPRACCPA compliance and requirements under the CPRA: notices, consumer rights, opt-outs, risk assessments, cybersecurity audits and ADMT, in an all-inclusive programme.
• Cyber and Data Protection Act (Zimbabwe)Zimbabwe's Cyber and Data Protection Act [Chapter 12:07]: POTRAZ licensing, lawful processing, security and transfers, built into a programme.