Do state privacy laws apply to a local HVAC or plumbing company?

The short answer for a local contractor#

State privacy laws apply to a local HVAC or plumbing company only when it meets a specific law's applicability test, and many single-market contractors do not. The comprehensive laws, such as California's CCPA and the newer laws in Oregon, New Jersey and Minnesota, were written with thresholds that leave many small businesses outside them.

The map has grown more crowded. By MultiState's count, comprehensive consumer privacy laws in Indiana, Kentucky and Rhode Island took effect on January 1, 2026, bringing the number of states with such laws in effect to 20, including Florida's narrower law. A contractor near a state line, or one that bought a shop in a neighboring market, now has more tests to run than it did a few years ago.

Falling outside a comprehensive law does not mean no rules apply. Call recording consent laws, state breach notification laws and the promises in your own website privacy policy reach companies of every size.

What thresholds trigger the CCPA?#

The CCPA covers a for-profit business doing business in California that meets at least one of three tests. Privacy compliance guides summarize them as follows, and the revenue figure is adjusted over time, so confirm the current number before relying on it.

California is also the outlier on workforce and business contacts. The CCPA's employee and business-to-business exemptions expired on January 1, 2023, so a covered contractor treats technician records and commercial customer contacts as in scope too.

How do other state laws decide who is covered?#

Most other comprehensive state privacy laws decide coverage by counting how many of the state's residents a business processes personal data about in a year, often with a lower count for businesses that earn revenue from selling personal data. The exact numbers differ by state, and a few states use different tests altogether, so read each law's own applicability section rather than assuming California's.

Many of these laws also leave out business and workforce data. The Virginia Consumer Data Protection Act generally does not apply to people acting in a commercial or employment context, with no sunset, and the Colorado Attorney General says the Colorado Privacy Act does not cover people acting in a commercial or employment context. For a contractor, homeowners count, while property managers and your own technicians may not, depending on the state.

Which of your records count toward the thresholds?#

Resident counts include more than paying customers: any homeowner whose personal data your company processes can count. In a typical shop those records sit across the field service system, the phone system and the marketing stack.

Count per state, by person, and de-duplicate across systems. One homeowner can appear as a lead, a customer, a caller and a review contact; counting every row overstates exposure, while forgetting leads and callers understates it.

• 1Customer and location records in ServiceTitan, Housecall Pro, Jobber or FieldEdge, including past customers you no longer serve.
• 2Leads from web forms, online booking, lead marketplaces and call tracking numbers, even when no job was booked.
• 3Call recordings and caller ID logs from the booking line and the after-hours answering service.
• 4Maintenance agreement and membership rosters, renewal notices and review requests.
• 5Financing applications passed to a lender partner and warranty registrations sent to manufacturers.
• 6Website analytics and advertising pixels that identify devices or visitors.

A decision tree for HVAC and plumbing owners#

The decision tree below runs in order and stops at the first point where a law may apply. From there the next step is a review with counsel, not a self-diagnosis.

• 1Step 1: List every state where you serve homes or take calls, including service areas that cross a state line.
• 2Step 2: For each state, check whether a comprehensive privacy law is in effect, using a current tracker or a privacy rules checker.
• 3Step 3: If you serve California residents, test total company revenue against the CCPA revenue threshold first.
• 4Step 4: For every other state, count unique residents across customers, leads, callers and website visitors for the last full year.
• 5Step 5: Ask whether you sell or share personal data through lead resale, partner referrals, advertising pixels or, later, a data license.
• 6Step 6: Check whether your company or the data falls under an exemption, such as commercial-context or employment-context data.
• 7Step 7: Record the answer, the counts and the date, and repeat the check each year and after every acquisition.

Illustrative: an HVAC company with one shop across a state line#

Illustrative: a fictional HVAC and electrical company runs one shop in a metro area that straddles two states. Its ServiceTitan account holds customer and location records for both states, its call tracking platform logs every inbound number, and a marketing agency runs paid search with website pixels.

The office manager counts unique residents per state from ServiceTitan, the call tracking export and form leads, de-duplicating by phone number and service address. One state has no comprehensive law. In the other, the combined count of customers, leads and callers sits closer to the threshold than the owner expected, and counsel flags the agency's pixels for review under the sale and sharing definitions.

The owner decides to operate as if the law may apply: the privacy policy is rewritten, a deletion request process is set up in the CRM, and pixel settings are reviewed with the agency. When the company later weighs licensing its job histories, that groundwork shortens the rights review.

Why licensing data can change the answer#

Licensing customer-linked records to an AI developer may count as selling personal information under some state laws, which can bring a company into scope or add duties it did not have before. De-identification is the usual route, but the term has a legal meaning, not just a technical one.

Under California's definition, information is deidentified only if the business takes reasonable measures to ensure it cannot be associated with a consumer or household, publicly commits to keep and use it only in deidentified form and not to reidentify it, and contractually obligates recipients to follow the same rules. Other states use similar but not identical definitions, so the standard is checked state by state.

SourceX handles this inside the Rights and Preparation steps of the SourceX five-step transaction. Which state laws may apply is assessed deal by deal with the supplier's counsel, personal and confidential details are removed before anything is shared, and the SourceX Evidence Packet records the privacy steps taken and who authorized release. The initial fit check collects metadata only.