Privacy and preparation
Do state privacy laws apply to my company? Thresholds explained
By SourceX Editorial · Reviewed by Noah Loul ·
Short answer
State privacy laws apply to a company when it meets a law's applicability test, usually based on annual revenue, the number of state residents whose personal data it handles, or how much revenue comes from selling personal data. Count residents per state, not customers overall, check whether employees and business contacts count, then confirm exemptions with counsel.
Key takeaways
- Most comprehensive state privacy laws use consumer-count tests; California's law can apply on revenue alone, and a few states pair a revenue figure with a count.
- Counts are per state, based on residents whose personal data you control or process, not on where your offices are.
- Several laws apply at a lower consumer count when part of a company's revenue comes from selling personal data.
- Many states exclude employees and business contacts from the definition of consumer; California's law generally does not.
- Thresholds and exemptions change through amendments, so check the current text of each law with counsel.
What tests decide whether a state privacy law applies?#
State privacy laws decide applicability with a small set of test types. Most comprehensive laws combine a requirement that you do business in the state or target its residents with one or more numeric tests; the figures differ by state and change through amendments, so read them in the current text of each law. By MultiState's count, 20 states had comprehensive privacy laws in effect at the start of 2026, counting Florida's narrower law.
California's law is the one a mid-size company should usually check first, because it can apply on any one of three tests. As reported in compliance guides, a business that does business in California is covered if its annual gross revenue exceeds an inflation-adjusted figure, set at $26,625,000 from January 2025; if it buys, sells or shares the personal information of 100,000 or more consumers or households; or if it derives 50 percent or more of its annual revenue from selling or sharing personal information. The revenue figure is adjusted in odd-numbered years, so confirm the current number.
Many companies with a few hundred employees clear that revenue figure, and once they do business in California the law can apply even if only a small share of their customers or staff live there. Revenue tests raise their own questions, such as whether the figure is one company's or a group's. Most other states rely on consumer counts, and a few use different approaches altogether, as the table shows.
| Test type | Where it appears | What to count | Common mistake |
|---|---|---|---|
| Revenue test | California on its own; Utah and Tennessee pair a revenue figure with a consumer count | Annual gross revenue as each law defines it; California's figure is inflation-adjusted | Assuming every state has one; most do not |
| Consumer-count test | Most comprehensive state laws, such as Virginia, Colorado, Connecticut and Oregon | Unique residents of that state whose personal data you control or process, across all systems | Counting customer accounts instead of people |
| Data-sale test | Many states, as a lower consumer count paired with revenue from selling personal data | Revenue or other benefit received from selling personal data | Ignoring how a data license may be classified |
| Small-business test | Texas and Nebraska, which apply unless a company is a small business under federal Small Business Administration standards | Your size status under those standards | Assuming small businesses have no duties; selling sensitive data still needs consent |
| Other approaches | Laws aimed at narrow groups, such as Florida's, whose core obligations reach only very large companies with particular business lines | Each law's applicability section | Assuming one checklist covers every state |
Who counts as a consumer?#
A consumer under most state privacy laws is a resident of that state acting in an individual or household context. Colorado's attorney general, for example, says its law does not cover people acting in a commercial or employment context, such as a job applicant, and Virginia's law generally excludes the same groups. Under laws like these, a purchasing manager at a client or your own employees fall outside the definition.
California is the main exception: the temporary carve-outs for employee and business-to-business contact data in its law expired at the start of 2023. A company whose records are mostly B2B can therefore sit outside one state's law and inside California's for the same type of record.
Count across every system, not just the CRM. Homeowners in a field service system, newsletter subscribers, website visitors identified by cookies, warranty registrations and support contacts may all count, and the same person in several systems counts once.
If your company processes personal data on behalf of customers, as many software companies do, the analysis shifts again. For that data you may be a service provider or processor, with obligations set by your contracts, and licensing it may not be your decision to make.
Exemptions that may take a company or a dataset out of scope#
Exemptions can take a whole company or only certain data out of a state privacy law, so they work at two levels. Entity-level exemptions remove certain organizations entirely, such as some financial institutions or, in some states, nonprofits. Data-level exemptions remove specific data, such as information already governed by federal laws like HIPAA, GLBA or FCRA, while the rest of the company's data stays in scope.
States differ on which exemptions they include and how broadly they apply. A company that assumes it is exempt because it is regulated under a federal law should confirm whether the exemption covers the organization or only certain data.
Take the questions below to counsel, along with the state map from the self-check.
- Does the exemption cover our type of organization, or only certain data we hold?
- Does it extend to data we handle as a vendor to an exempt organization?
- Does it still apply once the data is licensed to a third party?
- Which laws on our state map include this exemption, and which do not?
A three-question self-check#
Three questions get most companies to a useful first answer before a call with counsel. Write the answers down even when they are uncertain; a one-page map of states, counts and exemptions is what counsel will ask for first.
- Where do the people in your records live? List states by the number of residents in your customer, contact and service records for the period each law measures, de-duplicated across systems.
- Which tests could you meet? For each state with meaningful counts, compare against its consumer-count test, any revenue test and any data-sale test, using the current text of the law.
- Whose data is it? Separate consumer records from employee and business contact records, and note which exemptions might apply to the company or to specific data.
Why licensing data can change the answer#
Licensing data can change the answer because several state laws use the share of revenue from selling personal data as a trigger. If a license includes personal data and counts as a sale under a given law, the company may cross a lower threshold it never approached before.
Licensing records with personal details removed is a different situation. Data that meets a law's definition of de-identified is generally outside that law's scope, which is one reason careful preparation matters. Whether a particular license is a sale, and whether a particular dataset is de-identified, are assessed deal by deal with counsel.
| Licensing scenario | Possible effect on applicability | What to check |
|---|---|---|
| Records licensed with personal data included | May count as a sale and trigger a lower threshold | Sale definitions and data-sale tests in each relevant state |
| Records licensed after personal details are removed | Generally outside scope if the data meets the de-identified standard | The law's de-identification conditions and contract terms |
| Only business or employee contacts included | Depends on whether the state excludes them | Consumer definitions, especially California's |
Illustrative: a three-state plumbing contractor maps its exposure#
Illustrative: a fictional plumbing and drain contractor operates in three neighboring states and runs on ServiceTitan, with HubSpot for marketing. The owner assumes privacy laws only apply to large technology companies.
The office manager pulls de-duplicated counts of homeowners by state from the job and marketing records, separates property managers and general contractors as business contacts, and lists employees by work state. Counsel reviews the map and identifies which laws may apply now and which could apply if the company licensed records containing personal data.
The owner decides that any licensing package will exclude homeowner names, addresses, phone numbers and access notes, and asks for the privacy record to show how that was done.
How SourceX approaches privacy law applicability#
SourceX treats applicability as part of the Rights step of the SourceX five-step transaction. The fit check asks where the people in the records live and which record families are involved, without collecting any files.
Preparation then removes personal details so the licensed package carries the workflow, not identities. The privacy record in the SourceX Evidence Packet documents the method, and the supplier's counsel confirms the legal position before release authorization.
Frequently asked questions
Does a state's law apply if we have no office there?
It can. Most state privacy laws reach businesses that conduct business in the state or offer products or services to its residents, and then meet the numeric test. Physical presence is not usually the trigger; the residents in your records are.
Are affiliates and subsidiaries counted together?
Laws differ on how related companies are treated, including whether data controlled by affiliates under common control or branding is combined. Groups with several operating companies should map each entity separately and ask counsel how each relevant law treats the group.
Is there a single federal privacy law instead?
At the time of writing, the US has no comprehensive federal consumer privacy law in force. Sector laws such as HIPAA, GLBA and COPPA cover particular data and businesses, and state laws fill much of the remaining space.
What if our counts drop below a threshold later?
Applicability is usually measured over a defined period, so a law that applied in one year may not apply in another. Obligations tied to data you already hold, such as contract terms or promises in your privacy notice, may continue regardless. Recheck counts each year.
Do these laws cover records from acquired or wound-down companies?
They can. Personal data in legacy archives is still personal data, and the acquiring or successor company may be the one handling it now. Promises in the original company's privacy notice may also matter, so review both the law and the history.
Sources
- The CCPA annual gross revenue threshold was adjusted to $26,625,000 effective January 2025, alongside thresholds of buying, selling or sharing personal information of 100,000 or more consumers or households, or deriving 50% or more of annual revenue from selling or sharing personal information. Source
- Indiana, Kentucky and Rhode Island laws took effect January 1, 2026, bringing states with comprehensive privacy laws in effect to 20 by MultiState's count, including Florida. Source
- The Colorado Privacy Act does not cover personal data of individuals acting in a commercial or employment context, such as a job applicant. Source
- The Virginia Consumer Data Protection Act generally does not apply to information about a person acting in a commercial or employment context. Source
- The CCPA's employee and B2B exemptions were set to expire, making California the first state to apply comprehensive restrictions to employee and B2B information, unlike Colorado, Connecticut, Utah and Virginia. Source
Related resources
See if your company qualifies
A short company assessment. No data uploads are needed.