US state privacy laws for ecommerce: a 2026 compliance guide

The United States does not have a federal consumer privacy law. What it has instead is a patchwork of state laws, each with different thresholds, requirements, consumer rights and enforcement mechanisms. As of 2026, over 20 states have enacted comprehensive consumer privacy legislation, and more are on the way.

For ecommerce stores selling nationally, this creates a compliance challenge that is simultaneously urgent and tractable. Most state privacy laws share a common structure. A compliance program that addresses the core requirements across the strictest states will cover most of the others.

Why there is no federal privacy law

Congress has debated comprehensive federal privacy legislation multiple times, most recently with the American Data Privacy and Protection Act (ADPPA) in 2022. The bill passed committee but stalled over preemption: California objected to federal law overriding CCPA's stronger protections. Federal preemption of state laws remains the central political obstacle.

The result is state-by-state legislation. California moved first in 2018 with CCPA. Virginia followed in 2021. By 2026, states covering the majority of the US population by economy and consumer spending have enacted laws.

California: CCPA and CPRA

California remains the strongest US privacy framework. The California Consumer Privacy Act (CCPA) was strengthened by the California Privacy Rights Act (CPRA) in November 2020, with CPRA provisions effective January 2023.

CCPA/CPRA applies to for-profit businesses that collect personal information from California residents and meet one of these thresholds:

• Annual gross revenue over $25 million.
• Buy, sell or share personal information of 100,000 or more consumers or households annually.
• Derive 50% or more of annual revenue from selling or sharing personal information.

For a mid-market ecommerce store with $5-50M revenue and significant customer acquisition, the $25M revenue threshold or the 100,000 consumer threshold will apply to most. Any store selling meaningfully to California residents should assume CCPA/CPRA applies.

Key CCPA/CPRA requirements for ecommerce:

• Right to know what personal information is collected and how it is used.
• Right to delete personal information (with limited exceptions for order history needed for warranty or legal purposes).
• Right to opt out of the "sale" or "sharing" of personal information (sharing broadly defined to include targeted advertising).
• Right to correct inaccurate personal information (CPRA addition).
• Right to limit use of sensitive personal information (CPRA addition).
• No discrimination against consumers who exercise privacy rights.
• A privacy policy that discloses categories of data collected, purposes for collection and consumer rights.
• A "Do Not Sell or Share My Personal Information" link on the homepage.
• Honor Global Privacy Control (GPC) signals as an opt-out mechanism.

Enforcement is by the California Privacy Protection Agency (CPPA) and the California AG. Fines: $2,500 per unintentional violation, $7,500 per intentional violation. The Sephora case (2022) resulted in a $1.2M settlement for CCPA violations related to failure to honor opt-out requests and GPC signals.

Virginia: VCDPA

The Virginia Consumer Data Protection Act (VCDPA) took effect January 2023. It applies to businesses that conduct business in Virginia or produce products or services targeted to Virginia residents and that:

• Control or process personal data of 100,000 or more Virginia residents annually, or
• Control or process personal data of 25,000 or more Virginia residents and derive over 50% of gross revenue from selling personal data.

The VCDPA does not have a revenue-only threshold (unlike CCPA's $25M revenue test), so smaller stores may be outside its scope if they have fewer than 100,000 Virginia customers. But ecommerce stores with significant national sales will typically exceed the threshold.

Virginia rights are similar to CCPA: access, correction, deletion, portability, opt out of sale, opt out of targeted advertising and opt out of profiling for significant decisions. Enforcement is by the Virginia AG only (no private right of action). Fines up to $7,500 per violation.

Colorado: CPA

The Colorado Privacy Act (CPA) took effect July 2023. It applies to businesses that:

• Control or process personal data of 100,000 or more Colorado residents annually, or
• Derive revenue or receive discounts from selling personal data and process data of 25,000 or more Colorado residents.

Colorado is notable for requiring controllers to recognize the Global Privacy Control signal as a universal opt-out. This is one of the few state laws that explicitly mandates GPC recognition alongside California.

Connecticut: CTDPA

The Connecticut Data Privacy Act (CTDPA) took effect July 2023. Thresholds: 100,000 Connecticut residents annually or 25,000 residents with revenue derived from data sales. Similar rights to VCDPA. Also recognizes GPC signals as opt-out mechanism.

Utah: UCPA

The Utah Consumer Privacy Act (UCPA) took effect December 2023. Higher thresholds than most: $25M annual revenue AND processing data of 100,000 Utah residents or processing data of 25,000 Utah residents with 50% revenue from data sales. More business-friendly than other state laws: no data protection assessments required, no right to correction, narrower opt-out rights. Enforcement by Utah AG.

Texas: TDPSA

The Texas Data Privacy and Security Act (TDPSA) took effect July 2024. No revenue or volume thresholds for applicability to most businesses (it exempts small businesses as defined by the SBA, which for retail/ecommerce is generally under $30M revenue with fewer than 500 employees). For mid-market ecommerce stores, TDPSA likely applies.

Texas rights: access, correction, deletion, portability, opt out of sale, targeted advertising and profiling. Texas does not recognize GPC as a universal opt-out mechanism but requires opt-out mechanisms for sale and targeted advertising. Enforcement by Texas AG: up to $7,500 per violation.

Oregon: OCPA

Oregon Consumer Privacy Act took effect July 2024. Lower thresholds: 100,000 Oregon residents or 25,000 residents with revenue from data. Oregon added a specific right to know whether the controller uses automated decision-making. No private right of action. Enforcement by Oregon AG.

Montana: MCDPA

Montana Consumer Data Privacy Act effective October 2024. Thresholds: 50,000 Montana consumers (lower than most states, reflecting Montana's smaller population) or 25,000 consumers with revenue derived from data sales. Standard rights package. Enforcement by Montana AG.

Delaware, Iowa, Indiana, Tennessee and others

Several additional states enacted laws effective in 2024-2025:

• Delaware PDPA (January 2025). Lower thresholds: 35,000 Delaware residents or 10,000 with revenue from data. Includes a right for minors to delete data. Enforcement by Delaware AG.
• Iowa CDPA (January 2025). 100,000 Iowa residents or 25,000 with revenue from data. More limited rights than most: no right to correction, no right to appeal denial of requests. Enforcement by Iowa AG.
• Indiana CDPA (January 2026). 100,000 Indiana residents or 25,000 with revenue from data. Standard rights package. Enforcement by Indiana AG.
• Tennessee TIPA (July 2025). 175,000 Tennessee residents or 25,000 with revenue from data. Standard rights. Enforcement by Tennessee AG.
• New Hampshire SB 255 (January 2025). 35,000 New Hampshire residents or 10,000 with revenue from data. Standard rights. Enforcement by NH AG.
• New Jersey NJDPA (January 2025). 100,000 New Jersey residents or 25,000 with revenue from data. Standard rights. No private right of action. Enforcement by NJ AG.
• Maryland MODPA (October 2025). One of the strongest state laws: 35,000 Maryland residents, minimization requirements, targeted advertising restriction for minors under 18, data protection assessments for all targeted advertising not just high-risk processing. Enforcement by Maryland AG.
• Minnesota MNDPA (July 2025). 100,000 Minnesota residents or 25,000 with revenue from data. Standard rights. Enforcement by Minnesota AG.

Key differences between state laws that matter for ecommerce

Despite the common structure, state privacy laws differ in ways that affect ecommerce compliance strategy:

• GPC recognition. California, Colorado and Connecticut explicitly require honoring GPC signals. Texas, Virginia and most others do not. Your opt-out mechanism needs to work for GPC in at least these three states.
• Sensitive data categories. Most laws define sensitive data that requires opt-in consent rather than opt-out. Categories vary but typically include health data, precise geolocation, financial data, biometrics and data about minors. Ecommerce stores that collect health-related purchase data or precise location data need extra attention here.
• Data protection assessments (DPAs). Colorado, Connecticut, Virginia, Indiana and some others require formal impact assessments before processing data for targeted advertising, profiling or high-risk purposes. Maryland requires them broadly. California requires risk assessments via CPRA. If you run a retargeting program, you may need documented DPAs.
• Minors and age verification. Several states have heightened protections for minors, typically under 13 or under 16. If your store sells products that minors might purchase, check your age verification and data handling practices against state-specific requirements. Federal COPPA requirements add another layer for stores that collect data from children under 13.
• Private right of action. Only California CCPA provides a limited private right of action (for data breaches). Other state laws are enforced by state AGs only. This affects litigation risk but not regulatory risk.

Which laws apply to your store

The threshold analysis for a typical mid-market ecommerce store ($5-50M revenue, selling nationally):

• California CCPA/CPRA almost certainly applies if revenue exceeds $25M or if you have more than 100,000 customer records.
• Virginia, Colorado, Connecticut, Texas, Oregon, Montana, Delaware, New Hampshire, New Jersey, Maryland and Minnesota likely apply if you have meaningful customer bases in those states and exceed the applicable thresholds (most commonly 100,000 residents or 25,000 with data revenue).
• Indiana, Iowa, Tennessee and upcoming state laws will apply based on similar thresholds as they take effect.

A national ecommerce store selling into all 50 states will typically be subject to 10-15 state privacy laws simultaneously. The compliance burden is substantial but manageable with a unified approach.

Practical compliance strategy for multi-state selling

The good news: a compliance program built around CCPA/CPRA, the strictest US framework, will satisfy most requirements under other state laws. The core elements:

• Update your privacy policy. Disclose all categories of personal information you collect (account data, order history, payment data, browsing data, device identifiers, IP addresses, cookies), your purposes for processing, who you share data with and consumer rights under applicable state laws. List each state law you comply with explicitly. Our privacy policy template for ecommerce covers the required disclosures across all major state laws.
• Add a "Do Not Sell or Share My Personal Information" link. Required by CCPA and recommended for other states. Link this to a mechanism that suppresses targeted advertising and data sharing for consumers who submit the request.
• Honor Global Privacy Control signals. Implement server-side or CMP-based GPC detection. When a browser sends the Sec-GPC: 1 header, treat it as an opt-out from sale and sharing of personal information.
• Build consumer rights fulfillment processes. You need to be able to respond to requests to access, delete, correct and port personal data within 45 days (CCPA) or the applicable state deadline (most are 30-45 days). Our guide on handling data subject access requests covers the process in detail. This means knowing where all customer data lives: your ecommerce platform, email marketing system, CRM, customer service tool and analytics platform.
• Conduct data protection assessments for targeted advertising. If you run retargeting campaigns using customer data, document a formal assessment of the risks and benefits. This satisfies requirements in Colorado, Connecticut, Virginia and other states that mandate DPAs.
• Review data sharing agreements with vendors. Every vendor that receives personal data about your customers (analytics providers, email marketing platforms, CRM vendors, ad networks) is a recipient of personal data under state laws. Ensure your data processing agreements with these vendors are compliant.
• Set up a consumer request intake process. Add a privacy request form or email address to your privacy policy. Designate someone responsible for receiving and processing requests. Track requests and response times.

Enforcement reality

State privacy enforcement has been active. California's CPPA has issued regulatory guidance and indicated enforcement priorities. The California AG has settled cases with Sephora ($1.2M), DoorDash and others. Other state AGs are beginning enforcement activities as their laws mature.

For ecommerce stores, the most actionable risk is a breach that triggers regulatory scrutiny. A breach that exposes customer data will result in AG investigations under every applicable state privacy law. Having documented compliance programs, privacy policies and consumer rights processes significantly reduces regulatory liability in breach scenarios.

Frequently asked questions

How many US states have consumer privacy laws?

As of 2026, over 20 states have enacted comprehensive consumer privacy legislation, including California, Virginia, Colorado, Connecticut, Texas, Oregon, Montana, Delaware, New Jersey, Maryland and others. More are expected each year.

Which US state privacy law is the strictest?

California's CCPA/CPRA remains the strongest US privacy framework. It has the broadest definition of personal information, requires honoring GPC signals and is enforced by a dedicated agency (CPPA) with active automated scanning.

Do I need to comply with every state privacy law?

You must comply with the laws of states where you have customers and meet the applicable thresholds. A national ecommerce store typically falls under 10-15 state laws simultaneously. Building compliance around CCPA/CPRA covers most other state requirements.

Do all state privacy laws require honoring GPC signals?

No. California, Colorado and Connecticut explicitly require honoring GPC signals. Most other states including Texas and Virginia do not mandate it, though implementing GPC support proactively is recommended as laws evolve.