Which US state privacy law applies to you

Twenty US states now have a comprehensive consumer privacy law in force. They are more alike than not, and LegalBanner is configured the same way for almost all of them — so this article is about the handful of decisions that actually differ, not a tour of twenty statutes.

For what a particular law says, each state has its own page: the table below links to them.

The short answer

If you sell to consumers across the United States, configure for the strictest common denominator and stop thinking about state lines:

1. Set the consent mode to opt-out. None of the twenty requires the opt-in banner the GDPR does. All of them require that advertising and analytics can be switched off on request. 2. Leave "Honour Global Privacy Control" on. 0 of the twenty require it. The signal does not tell you which state the visitor is in, so honouring it everywhere is both simpler and safer than deciding per request. 3. Publish the opt-out link. Several states expect it under a particular name — "Do Not Sell or Share My Personal Information" in California, "Your Privacy Choices" in Colorado. The policy generator writes the right one into your privacy policy. 4. Ask before processing sensitive data — race, health, precise location, biometrics, a known child's data. 0 of the twenty require consent first.

That configuration satisfies every state in the table. Nothing below changes it; it only explains where the differences are.

The twenty laws

| State | Law | Must honour GPC | Sensitive data | |---|---|---|---| | California | CCPA/CPRA | No | Notice and opt-out | | Colorado | CPA | No | Notice and opt-out | | Connecticut | CTDPA | No | Notice and opt-out | | Delaware | DPDPA | No | Notice and opt-out | | Florida | FDBR | No | Notice and opt-out | | Indiana | INCDPA | No | Notice and opt-out | | Iowa | ICDPA | No | Notice and opt-out | | Kentucky | KCDPA | No | Notice and opt-out | | Maryland | MODPA | No | Notice and opt-out | | Minnesota | MNCDPA | No | Notice and opt-out | | Montana | MCDPA | No | Notice and opt-out | | Nebraska | NDPA | No | Notice and opt-out | | New Hampshire | NHPPA | No | Notice and opt-out | | New Jersey | NJDPA | No | Notice and opt-out | | Oregon | OCPA | No | Notice and opt-out | | Rhode Island | RIDPA | No | Notice and opt-out | | Tennessee | TIPA | No | Notice and opt-out | | Texas | TDPSA | No | Notice and opt-out | | Utah | UCPA | No | Notice and opt-out | | Virginia | VCDPA | No | Notice and opt-out |

Where the differences bite

Browser opt-out signals. require you to treat a Global Privacy Control signal as the opt-out itself — not as a reason to show someone a banner. The remaining 20 do not require it. Sensitive data. California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia take the lighter approach: notice and a chance to opt out, rather than consent before you process. Everywhere else, consent comes first. Targeted advertising. Every state in the table gives consumers a way out of targeted advertising except Iowa, whose law grants an opt-out of sale only. Who is covered at all. Thresholds vary widely — Florida's are built around very large companies, while Connecticut now reaches any business that sells personal data or processes sensitive data at any volume. Each state page states the threshold in force.

What LegalBanner does about it

The banner blocks non-essential tags until the visitor chooses, in every

mode. An opt-out mode still blocks on request; it just does not block first.

GPC is read on every page load and applied to that browser without any

further action from the visitor.

Consent records are stored for every decision, with a hashed IP and user

agent rather than the raw values, which is what you need if you are ever asked to show that consent was given.

The policy generator writes the state-rights sections and the correctly

named opt-out links into your privacy policy.

Preference centre — visitors can change or withdraw a choice at any time

from your site, which every one of these laws expects.

Keeping up

These laws change. Seven of the twenty were amended in the last year, and Connecticut changes again on 1 October 2026. Each state page shows when we last checked it against the statute and what is coming.

---

*This article explains how to configure the product. It is a summary, not legal advice, and it does not account for your industry, your data practices or any sector rules that apply to you.*