US state laws

US state privacy laws, for small businesses.

As of October 2026, 19 US states have privacy laws in effect, each with an opt-out of the sale of personal data. Privacy Consent honors Global Privacy Control, the opt-out signal 10 of these states require.

Create your consent banner Generate Privacy Policy
VirginiaColoradoTexasGlobal Privacy Control

By law

When a state privacy law applies to your business.

Each state sets its own thresholds, and most count the consumers whose data you process in that state. No state has a general exemption for small businesses, except Texas and Nebraska.

When US state privacy laws apply to a business, and what the business needs
Your businessWhat you needWhy
Processes the personal data of many consumers in one state each year Privacy PolicyOpt-out link Virginia, Colorado, Oregon, Iowa, New Jersey, Minnesota, Indiana and Kentucky apply from 100,000 consumers. Connecticut, Delaware, New Hampshire, Maryland and Rhode Island apply from 35,000, and Montana from 25,000.
Earns revenue from selling personal data Privacy PolicyOpt-out link Most states apply at a lower count when the business sells personal data, such as 25,000 consumers in Virginia with more than 50% of revenue from sales.
Does business in Texas or Nebraska and is not a small business under the SBA definition Privacy PolicyOpt-out link Texas and Nebraska use the US Small Business Administration definition instead of a consumer count. A small business still needs consent to sell sensitive data.
Processes sensitive data, such as health data, precise location or religious beliefs Consent banner Most state laws ask for opt-in consent before processing sensitive data.

What the state laws ask, and the TermsFeed product for each part.

These duties repeat across most state laws, with details that vary by state. TermsFeed products help with all 5, and your team answers each consumer request.

Common US state privacy law requirements for a website, with the TermsFeed product for each
What the law asksWhere it comes fromHow TermsFeed helps
Publish a privacy notice with the data you process, the purposes, the sharing and the rights of consumers Every state privacy law
  • Privacy Policy Generator
Offer a clear way to opt out of the sale of personal data and of targeted advertising Every state privacy law (targeted advertising: every state except California, where the opt-out covers sharing)
  • Privacy Consent
  • CCPA Opt-out
Honor universal opt-out signals such as Global Privacy Control California, Colorado, Connecticut, Delaware, Minnesota, Montana, New Hampshire, New Jersey, Oregon and Texas
  • Privacy Consent
Get opt-in consent before tracking that uses sensitive data Most state laws, such as Colorado, Connecticut, Texas and Virginia
  • Privacy Consent
Answer consumer requests within 45 days, with a way to appeal Most state laws
  • Handled by your team

How Privacy Consent handles visitors from the US.

TermsFeed Privacy Consent gives US visitors the opt-out tools state laws ask for, and honors Global Privacy Control on every plan.

  • One setup for every state

    Privacy Consent applies the same opt-out tools to visitors from every US state, so you do not configure each law.

  • Global Privacy Control

    Privacy Consent honors the Global Privacy Control (GPC) signal, the opt-out signal California and other US states require, on every plan.

  • One Your Privacy Choices link

    Privacy Consent shows US visitors a Your Privacy Choices link with the California opt-out icon, which opens the opt-out choices in the Preferences Center.

  • Opt-out by default

    With Standard consent logic, from the Starter plan, visitors in the US get the opt-out model: vendor scripts run until the visitor opts out, as California law allows.

  • Limit the Use of sensitive data

    Mark a vendor that processes sensitive data, and the Your Privacy Choices section gets a Limit the Use toggle that turns off every marked vendor at once.

  • Stricter rules where they apply

    Privacy Consent asks for consent first in Quebec, as it does in the EU, and asks every visitor first when a vendor processes sensitive data.

What the laws ask

What privacy laws expect, and how TermsFeed covers it.

Each state attorney general enforces the state law, with penalties per violation. Each row names a state law, when it applies and the part TermsFeed handles.

Consent laws, what is at stake and how Privacy Consent covers each one
Law Applies when What it can cost How TermsFeed covers it
CCPA+CPRA California A for-profit business above the CCPA thresholds collects personal information from California residents. Up to $2,500 per violation, or $7,500 per intentional violation or violation involving the data of a minor, as set in Cal. Civ. Code §1798.155, adjusted for inflation.
  • A Privacy Policy that lists the data, the purposes and the rights of consumers
  • Your Privacy Choices link and Preferences Center
  • Honors Global Privacy Control signals
VCDPA Virginia A business processes the data of 100,000 or more Virginia consumers, or 25,000 with more than 50% of revenue from selling data. Up to $7,500 per violation, enforced by the Attorney General after a 30-day cure period.
  • A Privacy Policy that lists the data, the purposes and the rights of consumers
  • Your Privacy Choices link and Preferences Center
  • Honors Global Privacy Control signals
CPA Colorado A business processes the data of 100,000 or more Colorado consumers, or 25,000 and earns revenue from selling data. Up to $20,000 per violation, enforced by the Attorney General and the district attorneys.
  • A Privacy Policy that lists the data, the purposes and the rights of consumers
  • Your Privacy Choices link and Preferences Center
  • Honors Global Privacy Control signals
TDPSA Texas A business does business in Texas, processes or sells personal data, and is not a small business under the SBA definition. Up to $7,500 per violation, enforced by the Attorney General after a 30-day cure period.
  • A Privacy Policy that lists the data, the purposes and the rights of consumers
  • Your Privacy Choices link and Preferences Center
  • Honors Global Privacy Control signals

A summary for orientation, not legal advice.

How Privacy Consent compares.

Free cookie plugins cover the basics, and doing it yourself means adding every script block and consent rule by hand. Privacy Consent keeps the rules for each region current, with a free plan to start.

Free cookie plugins, doing it yourself and TermsFeed Privacy Consent compared
Feature Free cookie plugins Doing it yourselfBanner and scripts coded by hand TermsFeed Privacy Consent
Price Free No fee, only your time Free plan. Paid plans from $9 a month
Global Privacy Control Rarely Manual Yes, on every plan
Rules by visitor location Rarely Rarely Yes, from the Starter plan
Consent log Varies Rarely Yes, with export on every plan

Privacy Consent plans.

Every plan includes the consent banner, Google Consent Mode v2 and the Preferences Center. Paid plans add rules by visitor location managed by TermsFeed, more banner loads and more domains. On the Free plan, a banner that keeps using up its banner loads pauses until the next month or an upgrade.

Billing period

Switch to yearly to pay less.

Billed once a year.

Free

One small website that needs a consent banner.

$0 / month / year

Start for free
  • Included: 1 domain
  • Included: 15,000 banner loads a month
  • Included: 10 vendors
  • Included: Consent log kept 180 days
  • Included: Ongoing regulation monitoring
  • Included: Strict consent logic: the consent banner asks every visitor
  • Included: Google Consent Mode v2 and Microsoft Consent Mode
  • Included: Global Privacy Control (GPC)
  • Included: Preferences Center
  • Included: Consent log export
  • Included: JavaScript callbacks when a visitor accepts or declines
Standard consent logic starts here

Starter

A business website with visitors from several countries.

$9 / month

$89 / year

Or $89 a year with yearly billing.

About $7.42 a month. Saves $19 a year against monthly billing.

Choose Starter Choose Starter
  • Included: 1 domain
  • Higher than the plan before: 125,000 banner loads a monthThen $0.30 per extra 1,000
  • Higher than the plan before: 25 vendors
  • Higher than the plan before: Consent log kept 730 days (24 months)
  • Included: Ongoing regulation monitoring
  • Included: Strict consent logic: the consent banner asks every visitor
  • Included: Google Consent Mode v2 and Microsoft Consent Mode
  • Included: Global Privacy Control (GPC)
  • Included: Preferences Center
  • Included: Consent log export
  • Included: JavaScript callbacks when a visitor accepts or declines
  • Plus
  • Higher than the plan before: 125,000 banner loads a monthThen $0.30 per extra 1,000
  • Higher than the plan before: 25 vendors
  • Higher than the plan before: Consent log kept 730 days (24 months)
  • Included: Standard consent logic: banner rules by visitor location
  • Included: Geolocation rules managed by TermsFeed
  • Included: Multi-language banner
  • Included: Custom banner colors beyond the light and dark palettes
  • Included: Remove TermsFeed branding
  • Included: Basic consent analytics

Pro

A growing business with several websites.

$24 / month

$229 / year

Or $229 a year with yearly billing.

About $19.08 a month. Saves $59 a year against monthly billing.

Choose Pro Choose Pro
  • Higher than the plan before: 5 domains
  • Higher than the plan before: 500,000 banner loads a monthThen $0.30 per extra 1,000
  • Higher than the plan before: Unlimited vendors
  • Included: Consent log kept 730 days (24 months)
  • Included: Ongoing regulation monitoring
  • Included: Strict consent logic: the consent banner asks every visitor
  • Included: Google Consent Mode v2 and Microsoft Consent Mode
  • Included: Global Privacy Control (GPC)
  • Included: Preferences Center
  • Included: Consent log export
  • Included: JavaScript callbacks when a visitor accepts or declines
  • Included: Standard consent logic: banner rules by visitor location
  • Included: Geolocation rules managed by TermsFeed
  • Included: Multi-language banner
  • Included: Custom banner colors beyond the light and dark palettes
  • Included: Remove TermsFeed branding
  • Plus
  • Higher than the plan before: 5 domains
  • Higher than the plan before: 500,000 banner loads a monthThen $0.30 per extra 1,000
  • Higher than the plan before: Unlimited vendors
  • Included: Full consent analytics

Business

High-traffic websites and businesses with many brands.

$59 / month

$569 / year

Or $569 a year with yearly billing.

About $47.42 a month. Saves $139 a year against monthly billing.

Choose Business Choose Business
  • Higher than the plan before: 25 domains
  • Higher than the plan before: 3,000,000 banner loads a monthThen $0.21 per extra 1,000
  • Included: Unlimited vendors
  • Included: Consent log kept 730 days (24 months)
  • Included: Ongoing regulation monitoring
  • Included: Strict consent logic: the consent banner asks every visitor
  • Included: Google Consent Mode v2 and Microsoft Consent Mode
  • Included: Global Privacy Control (GPC)
  • Included: Preferences Center
  • Included: Consent log export
  • Included: JavaScript callbacks when a visitor accepts or declines
  • Included: Standard consent logic: banner rules by visitor location
  • Included: Geolocation rules managed by TermsFeed
  • Included: Multi-language banner
  • Included: Custom banner colors beyond the light and dark palettes
  • Included: Remove TermsFeed branding
  • Included: Full consent analytics
  • Plus
  • Higher than the plan before: 25 domains
  • Higher than the plan before: 3,000,000 banner loads a monthThen $0.21 per extra 1,000
  • Included: Overage 30% lower than Pro

Prices in US dollars (USD). Cancel your subscription anytime.

Helping businesses since 2012 Free plans available Monthly or yearly billing Cancel anytime

Helping businesses since 2012.

Over 1.9 million customers have created a legal agreement with TermsFeed.

It makes creation of a long Terms and Conditions easier by just putting the important details and ticking some boxes.
CEO Information Technology and Services 50-100 Employees G2 ·
Excellent. Very Happy. TermsFeed gave me everything I needed with minimal effort on my part. Their support team is great and able to troubleshoot and make any changes that are needed for your site. Even with email support, Customer Support is very responsive. I have total confidence in using this service and their support.
CEO Information Technology and Services 1-10 Employees Capterra ·
Elegant solution, reasonable cost and fantastic support.
Managing Partner Information Technology and Services 1-10 Employees Capterra ·
Great Service! 10 out of 10 experience with them. Very fast and easy to use system. Very quick turnaround times with customer support and super easy system to use.
CEO Airlines/Aviation 1-10 Employees Capterra ·
Termsfeed is really easy to use. I don't need any legal knowledge to create legal documents. It might be pricey for small companies and startups.
Application Development Analyst Information Technology and Services 50-100 Employees G2 ·
TermsFeed is very easy to use with user-friendly interface. It helps me to draw out the Terms & Conditions along with Privacy Policies for the business and stay in grounds with the regulations and compliance. The cookie content for websites is very easy to manage with TermsFeed. The technical support team is great in assisting the users. A little expensive than the other similar products available in the market. The payment interface should be updated to be more clear to the users.
Java Software Developer Information Technology and Services 50-100 Employees G2 ·
TermsFeed is easy to use and understand. TermsFeed has great customer service and offers many features.
CRA Misc 1-50 Employees G2 ·
Excellent customer support! Fully functional system at low cost. Easy to understand.
Operations Director Design 1-10 Employees Capterra ·

Capterra reviews constitute the subjective opinions of individual end users based on their own experiences and do not represent the views of Capterra or its affiliates.

Frequently asked questions about US state privacy laws.

Answers to the questions small businesses ask about the state privacy laws, opt-outs and Global Privacy Control.

Which US states have privacy laws?

As of October 2026, 19 US states have comprehensive privacy laws in effect. The states are California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island.

Oklahoma and Louisiana have laws that take effect on January 1, 2027, Alabama on May 1, 2027, and Vermont on January 1, 2028.

Do US state privacy laws apply to small businesses?

US state privacy laws apply to a small business once it passes a state threshold, which most states set by the number of consumers. Many states start at 100,000 consumers a year, and some at 35,000 or 25,000. Most apply at a lower count when the business sells personal data. Texas and Nebraska exempt small businesses under the SBA definition, but still ask for consent before a sale of sensitive data.

Check the table on this page against the number of visitors and customers you have in each state.

Do I need a cookie banner for US state privacy laws?

Which states require Global Privacy Control?

10 states require businesses to honor universal opt-out signals such as Global Privacy Control. California applied the rule first, Colorado from July 1, 2024, and Connecticut, Texas, Montana and New Hampshire from January 1, 2025.

New Jersey followed on July 15, 2025, Minnesota on July 31, 2025, and Oregon and Delaware on January 1, 2026. Vermont joins on January 1, 2028.

Does the TermsFeed Privacy Policy cover every state law?

The Privacy Policy Generator writes a CCPA+CPRA section for California, and no section names the other state laws. The policy lists the data you collect, the purposes, the sharing and the rights of consumers, which every state law asks for.

Check the appeal process and the opt-out methods against the laws of the states where you have customers.

More solutions.

Each solution page lists what a law or a platform asks of your website, and which TermsFeed product covers each part.

GDPR Consent from visitors in the EU before cookies load, with a Privacy Policy and a record of every consent. UK GDPR Consent before cookies under PECR, the 2026 analytics exception, and a Privacy Policy for UK visitors. CCPA+CPRA A Privacy Policy, the Do Not Sell or Share link and Global Privacy Control, for California residents. Canada (PIPEDA and Law 25) PIPEDA consent and Quebec Law 25, with tracking off until Quebec visitors agree. Switzerland (FADP) The FADP privacy notice and the Swiss cookie rules, with opt-in consent for Swiss visitors. LGPD (Brazil) Visitors from Brazil get clear privacy information, a reject button and revocable consent. COPPA The privacy notice for websites and apps aimed at children under 13, and the 2025 rule changes. Shopify Privacy Consent in your theme, connected to the Shopify Customer Privacy API. WordPress Privacy Consent on any WordPress theme, the WordPress Consent API, and free legal pages with AutoTerms. Wix Privacy Consent in Wix Custom Code, with the Wix cookie banner turned off. Squarespace Privacy Consent in Squarespace Code Injection, and Squarespace Analytics in your Cookies Policy. Webflow Privacy Consent in the Webflow Head code, with embeds that wait for consent. Online stores A Privacy Policy, a Return and Refund Policy and a consent banner for stores that sell online. SaaS Terms and Conditions, a Privacy Policy and a consent banner for software sold by subscription. Mobile apps The Privacy Policy and EULA that the Apple App Store and Google Play ask for. Global Privacy Control The browser opt-out signal 10 US states require, honored by Privacy Consent on every plan. Google Consent Mode v2 Consent signals for Google Ads and Google Analytics 4, sent from Privacy Consent with code from the docs.