For each US state with a comprehensive consumer data privacy law, the thresholds a business must meet for the law to apply: consumer volume (number of state residents whose data is processed), revenue from data sales (percentage of gross revenue derived from selling personal data), revenue floor (minimum annual revenue), and whether these conditions are combined with AND or OR logic — sourced from the state's own statute. Answers 'does [state]'s privacy law apply to my business', 'what are the CCPA thresholds for 2026', 'which state privacy laws have no revenue threshold', 'how many consumers triggers the Virginia privacy law', 'which states changed their privacy law thresholds in 2026' (Connecticut lowers from 100k to 35k consumers on July 1, 2026, and adds a sensitive-data trigger with no volume floor; Indiana, Kentucky, and Rhode Island took effect January 1, 2026), 'which state has the lowest privacy law threshold' (Montana: 25k consumers), and 'does Utah require both a revenue AND consumer threshold' (yes — the only state using AND logic). As of mid-2026, 20 states have comprehensive consumer privacy laws in effect. No single authority publishes the thresholds for all states — each state's statute defines its own — which is why assembled versions come from compliance-software vendors (Feroot, IAPP, MultiState, PrivacyLawMap). The thresholds spread is wide: consumer volume from 25k (Montana) to 175k (Tennessee); revenue percentage from 0% (Texas, no numeric threshold) to 50% (Virginia model); revenue floor from $0 to $26.6M (California, inflation-adjusted). The AND/OR distinction matters: most states use OR (any threshold triggers the law), while Utah requires both revenue AND consumer volume, and Connecticut (CA) requires meeting one of three distinct paths.

Facts and short attributed quotes taken from each state's own statute, linking back to the official code. Facts are not copyrightable (Feist, 1991); no source statute is reproduced wholesale.

US state consumer data privacy laws: applicability thresholds by state


**State:** California

**Law name and abbreviation:** California Consumer Privacy Act of 2018 / California Privacy Rights Act (CCPA/CPRA)

**Effective date:** January 1, 2020 (CCPA); January 1, 2023 (CPRA amendments)

**Consumer volume threshold:** annually buys, sells, or shares the personal information of 100,000 or more consumers or households

**Revenue-from-data-sales threshold:** Derives 50 percent or more of its annual revenues from selling or sharing consumers' personal information

**Revenue floor:** annual gross revenues in excess of twenty-five million dollars ($25,000,000), as adjusted pursuant to subdivision (d) of Section 1798.199.95

**Threshold combination logic:** OR — satisfies one or more of the following thresholds

**Key exemptions:** Nonprofits; government agencies; HIPAA-covered entities; GLBA-regulated financial institutions; FCRA consumer reporting agencies; entities complying with Driver's Privacy Protection Act

**Enforcement mechanism:** State Attorney General and California Privacy Protection Agency (CPPA); limited private right of action for data breaches under Cal. Civ. Code § 1798.150

**Statute citation:** Cal. Civ. Code §§ 1798.100–1798.199.100

**Notes:** California is the only state with a standalone revenue threshold (no consumer volume required). The $25M threshold is inflation-adjusted annually per subdivision (d) of Section 1798.199.95. Definition of 'sale' is broad: includes renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating personal information for monetary or other valuable consideration. CPRA added 'sharing' as a separate trigger covering cross-context behavioral advertising.

> California, and that satisfies one or more of the following thresholds: (A) As of January 1 of the calendar year, had annual gross revenues in excess of twenty-five million dollars ($25,000,000) in the preceding calendar year, as adjusted pursuant to subdivision (d) of Section 1798.199.95. (B) Alone or in combination, annually buys, sells, or shares the personal information of 100,000 or more consumers or households.

Source: <https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=1798.140.&lawCode=CIV>

California — US state consumer data privacy laws: applicability thresholds by state

data_sales_revenue_threshold, effective_date, enforcement, key_exemptions, law_name, notes, statute_citation


**State:** Colorado

**Law name and abbreviation:** Colorado Privacy Act (CPA)

**Effective date:** July 1, 2023

**Consumer volume threshold:** Controls or processes the personal data of one hundred thousand consumers or more during a calendar year

**Revenue-from-data-sales threshold:** Derives revenue or receives a discount on the price of goods or services from the sale of personal data and processes or controls the personal data of twenty-five thousand consumers or more

**Threshold combination logic:** OR — satisfies one or both of the following thresholds

**Key exemptions:** State and local government entities; financial institutions subject to GLBA; HIPAA-covered entities and business associates; nonprofit organizations; institutions of higher education; air carriers

**Enforcement mechanism:** Attorney General and district attorneys; civil penalty of up to $20,000 per violation; no private right of action

**Statute citation:** C.R.S. §§ 6-1-1301 to 6-1-1313

**Notes:** Colorado does not specify a minimum percentage of revenue from data sales — any revenue or discount from selling data combined with 25,000+ consumers triggers the law. As of October 1, 2025, the law also applies to any controller processing biometric identifiers or biometric data regardless of volume.

> (I) Controls or processes the personal data of one hundred thousand consumers or more during a calendar year; or Colorado Revised Statutes 2024 Page 142 of 320 Uncertified Printout (II) Derives revenue or receives a discount on the price of goods or services from the sale of personal data and processes or controls the personal data of twenty-five thousand consumers or more.

Source: <https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf>

Colorado — US state consumer data privacy laws: applicability thresholds by state

effective_date, enforcement, key_exemptions, law_name, notes, statute_citation


**State:** Connecticut

**Law name and abbreviation:** Connecticut Data Privacy Act (CTDPA)

**Effective date:** July 1, 2023

**Consumer volume threshold:** Controlled or processed the personal data of not less than one hundred thousand consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction

**Revenue-from-data-sales threshold:** controlled or processed the personal data of not less than twenty-five thousand consumers and derived more than twenty-five per cent of their gross revenue from the sale of personal data

**Threshold combination logic:** OR — during the preceding calendar year met either threshold

**Key exemptions:** State and local government bodies; HIPAA-covered entities and business associates; GLBA-regulated financial institutions; nonprofit organizations; institutions of higher education; data processed solely for payment transactions excluded from consumer count

**Enforcement mechanism:** Attorney General; cure period (expires December 31, 2024); civil penalty of up to $5,000 per violation under CUTPA; no private right of action

**Statute citation:** Conn. Gen. Stat. §§ 42-515 to 42-525

**Notes:** Connecticut SB 1295 (effective July 1, 2026) will lower the consumer threshold from 100,000 to 35,000, add a sensitive-data trigger with no volume floor, and add a trigger for selling consumer data at any scale regardless of volume or revenue percentage. Connecticut originally set the data sales revenue threshold at 25% (vs Virginia's 50%), making it easier for mid-sized data businesses to fall into scope.

> apply to persons that conduct business in this state or persons that produce products or services that are targeted to residents of this state and that during the preceding calendar year: (1) Controlled or processed the personal data of not less than one hundred thousand consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or (2) controlled or processed the personal data of not less than twenty-five thousand consumers and derived more than twenty-five per cent of their gross revenue from the sale of personal data.

Source: <https://web.archive.org/web/2024/https://www.cga.ct.gov/current/pub/chap_743jj.htm>

Connecticut — US state consumer data privacy laws: applicability thresholds by state


**State:** Delaware

**Law name and abbreviation:** Delaware Personal Data Privacy Act (DPDPA)

**Effective date:** January 1, 2025

**Consumer volume threshold:** Controlled or processed the personal data of not less than 35,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction

**Revenue-from-data-sales threshold:** Controlled or processed the personal data of not less than 10,000 consumers and derived more than 20% of their gross revenue from the sale of personal data

**Threshold combination logic:** OR — during the preceding calendar year did any of the following

**Key exemptions:** State and political subdivision bodies (excluding institutions of higher education); GLBA-regulated financial institutions; national securities associations; nonprofit organizations dedicated to preventing insurance crime

**Enforcement mechanism:** Attorney General (Department of Justice); 60-day cure period (expires December 31, 2025); no private right of action

**Statute citation:** Del. Code Ann. tit. 6, ch. 12D

**Notes:** Delaware has relatively low thresholds: 35,000 consumers (excl. payment data) or 10,000 consumers with 20% revenue from data sales. Unlike many states, Delaware does not broadly exempt all nonprofits — only nonprofits dedicated to preventing insurance crime are exempt. Institutions of higher education are NOT exempt.

> This chapter applies to persons that conduct business in the State or persons that produce products or services that are targeted to residents of the State and that during the preceding calendar year did any of the following: (1) Controlled or processed the personal data of not less than 35,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction. (2) Controlled or processed the personal data of not less than 10,000 consumers and derived more than 20% of their gross revenue from the sale of personal data.

Source: <https://delcode.delaware.gov/title6/c012d/index.html>

Delaware — US state consumer data privacy laws: applicability thresholds by state


**State:** Florida

**Law name and abbreviation:** Florida Digital Bill of Rights (FDBR)

**Effective date:** July 1, 2024

**Revenue floor:** Makes in excess of $1 billion in global gross annual revenues

**Threshold combination logic:** AND — requires $1 billion+ in global gross annual revenues AND satisfies at least one additional criterion (50%+ revenue from online ads, operates a smart speaker with virtual assistant, or operates an app store with 250,000+ apps)

**Key exemptions:** State agencies and political subdivisions; GLBA-regulated financial institutions; HIPAA-covered entities and business associates; nonprofit organizations; postsecondary education institutions

**Enforcement mechanism:** Department of Legal Affairs (Attorney General); civil penalties of $50,000 per violation or treble damages; no private right of action

**Statute citation:** Fla. Stat. §§ 501.701 to 501.721

**Notes:** Florida has by far the highest revenue threshold of any state at $1 billion in global gross annual revenues, effectively limiting the law to large technology companies. Additionally, the business must satisfy at least one of three criteria: deriving 50%+ of global revenue from online advertising, operating a consumer smart speaker with a virtual assistant, or operating an app store with at least 250,000 apps. This narrow scope means the law applies to very few companies.

> Makes in excess of $1 billion in global gross annual revenues; and 6.  Satisfies at least one of the following: a.  Derives 50 percent or more of its global gross annual revenues from the sale of advertisements online, including providing targeted advertising or the sale of ads online; b.  Operates a consumer smart speaker and voice command component service with an integrated virtual assistant connected to a cloud computing service that uses hands-free verbal activation.

Source: <https://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&Search_String=&URL=0500-0599/0501/Sections/0501.702.html>

Florida — US state consumer data privacy laws: applicability thresholds by state

effective_date, enforcement, key_exemptions, law_name, notes, statute_citation, threshold_logic


**State:** Iowa

**Law name and abbreviation:** Iowa Consumer Data Protection Act (ICDPA)

**Effective date:** January 1, 2025

**Consumer volume threshold:** Controls or processes personal data of at least one hundred thousand consumers

**Revenue-from-data-sales threshold:** Controls or processes personal data of at least twenty-five thousand consumers and derives over fifty percent of gross revenue from the sale of personal data

**Threshold combination logic:** OR — during a calendar year does either of the following

**Key exemptions:** State and political subdivisions; GLBA-regulated financial institutions; HIPAA-covered entities and business associates; nonprofit organizations; institutions of higher education

**Enforcement mechanism:** Attorney General; 90-day cure period; no private right of action

**Statute citation:** Iowa Code ch. 715D

**Notes:** Iowa follows the Virginia model closely. Unique feature: 90-day cure period (the longest among state privacy laws). Iowa does not include a right to correction of inaccurate personal data.

> This chapter applies to a person conducting business in the state or producing products or services that are targeted to consumers who are residents of the state and that during a calendar year does either of the following: a. Controls or processes personal data of at least one hundred thousand consumers. b. Controls or processes personal data of at least twenty-five thousand consumers and derives over fifty percent of gross revenue from the sale of personal data.

Source: <https://www.legis.iowa.gov/docs/code/715D.pdf>

Iowa — US state consumer data privacy laws: applicability thresholds by state


**State:** Kentucky

**Law name and abbreviation:** Kentucky Consumer Data Protection Act (KCDPA)

**Effective date:** January 1, 2026

**Consumer volume threshold:** One hundred thousand (100,000) consumers

**Revenue-from-data-sales threshold:** Twenty-five thousand (25,000) consumers and derive over fifty percent (50%) of gross revenue from the sale of personal data

**Threshold combination logic:** OR — control or process personal data of at least either threshold

**Key exemptions:** City, state agency, or political subdivision; GLBA-regulated financial institutions; HIPAA-covered entities and business associates; nonprofit organizations; institutions of higher education; small telephone utilities and Tier III CMRS providers

**Enforcement mechanism:** Attorney General; 30-day cure period (non-expiring); no private right of action

**Statute citation:** KRS §§ 367.3611 to 367.3629

**Notes:** Kentucky's 30-day cure period does not expire, making it one of the most business-friendly enforcement provisions. Kentucky follows the Virginia model closely. Small telephone utilities and municipal utilities that do not sell or share data are also exempt.

> KRS 367.3611 to 367.3629 apply to persons that conduct business in the Commonwealth or produce products or services that are targeted to residents of the Commonwealth and that during a calendar year control or process personal data of at least: (a) One hundred thousand (100,000) consumers; or (b) Twenty-five thousand (25,000) consumers and derive over fifty percent (50%) of gross revenue from the sale of personal data.

Source: <https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=56648>

Kentucky — US state consumer data privacy laws: applicability thresholds by state


**State:** Maryland

**Law name and abbreviation:** Maryland Online Data Privacy Act (MODPA)

**Effective date:** October 1, 2025

**Consumer volume threshold:** CONTROLLED OR PROCESSED THE PERSONAL DATA OF AT LEAST 35,000 CONSUMERS, EXCLUDING PERSONAL DATA CONTROLLED OR PROCESSED SOLELY FOR THE PURPOSE OF COMPLETING A PAYMENT TRANSACTION

**Revenue-from-data-sales threshold:** CONTROLLED OR PROCESSED THE PERSONAL DATA OF AT LEAST 10,000 CONSUMERS AND DERIVED MORE THAN 20% OF ITS GROSS REVENUE FROM THE SALE OF PERSONAL DATA

**Threshold combination logic:** OR — during the preceding calendar year met either threshold

**Key exemptions:** State and local government bodies and instrumentalities; national securities associations; GLBA-regulated financial institutions and affiliates; nonprofit controllers assisting law enforcement with insurance crime or first responders with catastrophic events

**Enforcement mechanism:** Division of Consumer Protection (Attorney General); civil penalty; no private right of action

**Statute citation:** Md. Code Ann., Com. Law §§ 14-4601 to 14-4614

**Notes:** Maryland bans the sale of sensitive data entirely (not just requiring consent). Maryland has relatively low thresholds (35,000/10,000 at 20%), matching Delaware and Rhode Island. Unlike many states, Maryland does not broadly exempt all nonprofits — only specific nonprofit controllers assisting law enforcement or first responders are exempt.

> CONDUCTS BUSINESS IN THE STATE OR PROVIDES PRODUCTS OR SERVICES THAT ARE TARGETED TO RESIDENTS OF THE STATE, AND THAT DURING THE PRECEDING CALENDAR YEAR DID ANY OF THE FOLLOWING: (1) CONTROLLED OR PROCESSED THE PERSONAL DATA OF AT LEAST 35,000 CONSUMERS, EXCLUDING PERSONAL DATA CONTROLLED OR PROCESSED SOLELY FOR THE PURPOSE OF COMPLETING A PAYMENT TRANSACTION; OR 2. (II) (2) CONTROLLED OR PROCESSED THE PERSONAL DATA OF AT LEAST 10,000 CONSUMERS AND DERIVED MORE THAN 20% OF ITS GROSS REVENUE FROM THE SALE OF PERSONAL DATA.

Source: <https://mgaleg.maryland.gov/2024RS/chapters_noln/Ch_455_sb0541E.pdf>

Maryland — US state consumer data privacy laws: applicability thresholds by state


**State:** Minnesota

**Law name and abbreviation:** Minnesota Consumer Data Privacy Act (MCDPA)

**Effective date:** July 31, 2025

**Consumer volume threshold:** during a calendar year, controls or processes personal data of 100,000 consumers or more, excluding personal data controlled or processed solely for the purpose of completing a payment transaction

**Revenue-from-data-sales threshold:** derives over 25 percent of gross revenue from the sale of personal data and processes or controls personal data of 25,000 consumers or more

**Threshold combination logic:** OR — satisfies one or more of the following thresholds

**Key exemptions:** State and local government entities; HIPAA-covered entities; GLBA-regulated financial institutions; nonprofit organizations; institutions of higher education (postsecondary institutions regulated by the Office of Higher Education not required to comply until July 31, 2029)

**Enforcement mechanism:** Attorney General; no private right of action

**Statute citation:** Minn. Stat. §§ 325M.10 to 325M.21

**Notes:** Minnesota uses a 25% revenue threshold (like Colorado and Oregon), lower than the 50% in Virginia-model states. Minnesota has stronger data minimization rules than most states. Postsecondary institutions regulated by the Office of Higher Education have a delayed compliance date of July 31, 2029.

> This section, as added by Laws 2024, chapter 121, article 5, section 3, is effective July 31, 2025, except that postsecondary institutions regulated by the Office of Higher Education are not required to comply until July 31, 2029. Laws 2024, chapter 121, article 5, section 14. 325M.12 SCOPE; EXCLUSIONS. § Subdivision 1. Scope. (a) Sections <https://www.revisor.mn.gov/statutes/cite/325M.10> 325M.10 to <https://www.revisor.mn.gov/statutes/cite/325M.21> 325M.21 apply to legal entities that conduct business in Minnesota or produce products or services that are targeted to residents of Minnesota, and that satisfy one or more of the following thresholds: (1) during a calendar year, controls or processes personal data of 100,000 consumers or more, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or (2) derives over 25 percent of gross revenue from the sale of personal data and processes or controls personal data of 25,000 consumers or more.

Source: <https://www.revisor.mn.gov/statutes/cite/325M/full>

Minnesota — US state consumer data privacy laws: applicability thresholds by state

enforcement, key_exemptions, law_name, statute_citation


**State:** Montana

**Law name and abbreviation:** Montana Consumer Data Privacy Act (MCDPA)

**Effective date:** October 1, 2024

**Consumer volume threshold:** control or process the personal data of not less than 25,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction

**Revenue-from-data-sales threshold:** control or process the personal data of not less than 15,000 consumers and derive more than 25% of gross revenue from the sale of personal data

**Threshold combination logic:** OR — applies to persons that conduct business in this state and meet either threshold

**Key exemptions:** Government bodies; HIPAA-covered entities; GLBA-regulated financial institutions; nonprofit organizations; institutions of higher education

**Enforcement mechanism:** Attorney General; 60-day cure period; no private right of action

**Statute citation:** Mont. Code Ann. §§ 30-14-2801 to 30-14-2817

**Notes:** Montana has the lowest consumer threshold in the country at 25,000 consumers, and the lowest data-sales threshold at 15,000 consumers with 25% revenue. Montana's small population (approximately 1.1 million) means these thresholds capture a proportionally larger share of businesses operating in the state.

> apply to persons that conduct business in this state or persons that produce products or services that are targeted to residents of this state and: (a) control or process the personal data of not less than 25,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or (b) control or process the personal data of not less than 15,000 consumers and derive more than 25% of gross revenue from the sale of personal data.

Source: <https://leg.mt.gov/bills/mca/title_0300/chapter_0140/part_0280/section_0030/0300-0140-0280-0030.html>

Montana — US state consumer data privacy laws: applicability thresholds by state


**State:** Nebraska

**Law name and abbreviation:** Nebraska Data Privacy Act (NDPA)

**Effective date:** January 1, 2025

**Threshold combination logic:** No numeric consumer or revenue thresholds — applies to any non-small-business that processes or sells personal data

**Key exemptions:** Small businesses as determined under the federal Small Business Act; state agencies and political subdivisions; GLBA-regulated financial institutions; HIPAA-covered entities and business associates; nonprofit organizations; institutions of higher education; electric suppliers; natural gas public utilities

**Enforcement mechanism:** Attorney General; 30-day cure period; civil penalty up to $7,500 per violation; no private right of action

**Statute citation:** Neb. Rev. Stat. §§ 87-1101 to 87-1118

**Notes:** Nebraska follows the Texas model rather than the Virginia model, using the federal Small Business Act to determine applicability rather than fixed numeric thresholds. Nebraska is the only other state besides Texas to take this approach.

> Data Privacy Act applies only to a person that: (a) Conducts business in this state or produces a product or service consumed by residents of this state; (b) Processes or engages in the sale of personal data; and (c) Is not a small business as determined under the federal Small Business Act, as such act existed on January 1, 2024, except to the extent that section

Source: <https://nebraskalegislature.gov/laws/statutes.php?statute=87-1103>

Nebraska — US state consumer data privacy laws: applicability thresholds by state


**State:** New Jersey

**Law name and abbreviation:** New Jersey Data Privacy Act (NJDPA)

**Effective date:** January 15, 2025

**Consumer volume threshold:** control or process the personal data of at least 100,000 consumers, excluding personal data processed solely for the purpose of completing a payment transaction

**Revenue-from-data-sales threshold:** control or process the personal data of at least 25,000 consumers and the controller derives revenue, or receives a discount on the price of any goods or services, from the sale of personal data

**Threshold combination logic:** OR — during a calendar year either threshold is met

**Key exemptions:** HIPAA-covered entities and business associates; GLBA-regulated financial institutions and affiliates; secondary market institutions; insurance institutions; NJ Motor Vehicle Commission data sales under DPPA

**Enforcement mechanism:** Attorney General (Division of Consumer Affairs); violations treated as unlawful practices under the Consumer Fraud Act; no private right of action for data privacy violations specifically

**Statute citation:** N.J. Stat. Ann. § 56:8-166.1 et seq.

**Notes:** New Jersey is notable for not exempting nonprofit organizations — one of the few states where nonprofits must comply. Like Colorado, NJ does not specify a minimum percentage of revenue from data sales — any revenue or discount from selling data combined with 25,000+ consumers triggers the law.

> that during a calendar 44 year either: 45 a. control or process the personal data of at least 100,000 46 consumers, excluding personal data processed solely for the 47 purpose of completing a payment transaction; or S332 [5R] SINGLETON, CODEY 12 1 b. control or process the personal data of at least 25,000 2 consumers and the controller derives revenue, or receives a discount 3 on the price of any goods or services, from the sale of personal 4 data.

Source: <https://pub.njleg.state.nj.us/Bills/2022/S0500/332_R5.PDF>

New Jersey — US state consumer data privacy laws: applicability thresholds by state


**State:** Oregon

**Law name and abbreviation:** Oregon Consumer Privacy Act (OCPA)

**Effective date:** July 1, 2024

**Consumer volume threshold:** The personal data of 100,000 or more consumers, other than personal data controlled or processed solely for the purpose of completing a payment transaction

**Revenue-from-data-sales threshold:** The personal data of 25,000 or more consumers, while deriving 25 percent or more of the person's annual gross revenue from selling personal data

**Threshold combination logic:** OR — during a calendar year, controls or processes either threshold

**Key exemptions:** Public corporations and public bodies; HIPAA-covered entities; nonprofit organizations (exempt until July 1, 2025)

**Enforcement mechanism:** Attorney General; exclusive authority; civil penalty; no private right of action

**Statute citation:** Or. Rev. Stat. §§ 646A.570 to 646A.589

**Notes:** Oregon does not exclude payment-only data processing from the data-sales threshold — only from the volume threshold. As of the 2025 amendments, the law also applies to motor vehicle manufacturers regardless of consumer volume thresholds. Oregon had the latest nonprofit exemption expiration (July 1, 2025) and includes a universal opt-out mechanism requirement effective January 1, 2026.

> ����� (20) �Third party� means a person, a public corporation, including the Oregon Health and Science University and the Oregon State Bar, or a public body, as defined in ORS 174.109, other than a consumer, a controller, a processor or an affiliate of a controller or processor. [2023 c.369 �1] ����� 646A.572 Scope and application; exclusions. (1)(a) ORS 646A.570 to 646A.589 apply to any person that conducts business in this state, or that provides products or services to residents of this state, and that during a calendar year, controls or processes: ����� (A) The personal data of 100,000 or more consumers, other than personal data controlled or processed solely for the purpose of completing a payment transaction;

Source: <https://www.oregonlegislature.gov/bills_laws/ors/ors646a.html>

Oregon — US state consumer data privacy laws: applicability thresholds by state

data_sales_revenue_threshold, effective_date, enforcement, key_exemptions, law_name, notes, statute_citation, threshold_logic


**State:** Rhode Island

**Law name and abbreviation:** Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA)

**Effective date:** January 1, 2026

**Consumer volume threshold:** Controlled or processed the personal data of not less than thirty-five thousand (35,000) customers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction

**Revenue-from-data-sales threshold:** Controlled or processed the personal data of not less than ten thousand (10,000) customers and derived more than twenty percent (20%) of their gross revenue from the sale of personal data

**Threshold combination logic:** OR — during the preceding calendar year did any of the following

**Key exemptions:** State and political subdivision bodies; nonprofit organizations; institutions of higher education; GLBA-regulated financial institutions; HIPAA-covered entities and business associates; national securities associations

**Enforcement mechanism:** Attorney General; no private right of action

**Statute citation:** R.I. Gen. Laws §§ 6-48.1-1 to 6-48.1-14

**Notes:** Rhode Island uses the term 'customer' rather than 'consumer.' The thresholds (35,000 customers or 10,000 + 20% revenue) are identical to Delaware's and among the lowest in the country. The law applies only to for-profit entities.

> entities that conduct business in the state or for-profit entities that produce products or services that are targeted to residents of the state and that during the preceding calendar year did any of the following: (1) Controlled or processed the personal data of not less than thirty-five thousand (35,000) customers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction. (2) Controlled or processed the personal data of not less than ten thousand (10,000) customers and derived more than twenty percent (20%) of their gross revenue from the sale of personal data.

Source: <https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-4.htm>

Rhode Island — US state consumer data privacy laws: applicability thresholds by state


**State:** Tennessee

**Law name and abbreviation:** Tennessee Information Protection Act (TIPA)

**Effective date:** July 1, 2025

**Consumer volume threshold:** During a calendar year, control or process personal information of at least one hundred seventy-five thousand (175,000) consumers

**Revenue-from-data-sales threshold:** Control or process personal information of at least twenty-five thousand (25,000) consumers and derive more than fifty percent (50%) of gross revenue from the sale of personal information

**Revenue floor:** Exceed twenty-five million dollars ($25,000,000) in revenue

**Threshold combination logic:** AND — requires exceeding $25,000,000 in revenue AND one of the volume thresholds

**Key exemptions:** State and local government entities; HIPAA-covered entities and business associates; GLBA-regulated financial institutions; nonprofit organizations; institutions of higher education

**Enforcement mechanism:** Attorney General; 60-day cure period; no private right of action

**Statute citation:** Tenn. Code Ann. § 47-18-3201 et seq.

**Notes:** Tennessee has the highest consumer volume threshold (175,000) of any state and requires both a $25M revenue floor AND volume thresholds (like Utah). This makes Tennessee's law one of the narrowest in scope. Tennessee uses the term 'personal information' rather than 'personal data.'

> However, the Tennessee Code Commission is requested to include the headings in any compilation or publication containing this act. SECTION 6. This act takes effect July 1, 2025, the public welfare requiring it.

Source: <https://publications.tnsosfiles.com/acts/113/pub/pc0408.pdf>

Tennessee — US state consumer data privacy laws: applicability thresholds by state

consumer_volume_threshold, data_sales_revenue_threshold, enforcement, key_exemptions, law_name, notes, revenue_floor, statute_citation, threshold_logic


**State:** Texas

**Law name and abbreviation:** Texas Data Privacy and Security Act (TDPSA)

**Effective date:** July 1, 2024

**Threshold combination logic:** No numeric consumer or revenue thresholds — applies to any non-small-business that processes or sells personal data

**Key exemptions:** Small businesses as defined by the United States Small Business Administration; state agencies and political subdivisions; GLBA-regulated financial institutions; HIPAA-covered entities and business associates; nonprofit organizations; institutions of higher education

**Enforcement mechanism:** Attorney General; 30-day cure period; civil penalty up to $7,500 per violation; no private right of action

**Statute citation:** Tex. Bus. & Com. Code ch. 541

**Notes:** Texas is unique among state privacy laws in having no specific numeric consumer or revenue thresholds. Instead, it exempts small businesses as defined by the U.S. Small Business Administration. This means the SBA size standards (which vary by industry) determine applicability rather than a fixed consumer count.

> APPLICABILITY OF CHAPTER. (a) This chapter 16 applies only to a person that: 17 (1)AAconducts business in this state or produces a 18 product or service consumed by residents of this state; 19 (2)AAprocesses or engages in the sale of personal data; 20 and 21 (3)AAis not a small business as defined by the United 22 States Small Business Administration, except to the extent that 23 Section 541.107 applies to a person described by this subdivision.

Source: <https://capitol.texas.gov/tlodocs/88R/billtext/pdf/HB00004F.pdf>

Texas — US state consumer data privacy laws: applicability thresholds by state


**State:** Utah

**Law name and abbreviation:** Utah Consumer Privacy Act (UCPA)

**Effective date:** December 31, 2023

**Consumer volume threshold:** during a calendar year, controls or processes personal data of 100,000 or more consumers

**Revenue-from-data-sales threshold:** derives over 50% of the entity's gross revenue from the sale of personal data and controls or processes personal data of 25,000 or more consumers

**Revenue floor:** has annual revenue of $25,000,000 or more

**Threshold combination logic:** AND — requires annual revenue of $25,000,000 or more AND one of the volume thresholds

**Key exemptions:** Governmental entities; tribes; institutions of higher education; nonprofit corporations; HIPAA-covered entities and business associates

**Enforcement mechanism:** Attorney General; 30-day cure period; no private right of action

**Statute citation:** Utah Code §§ 13-61-101 to 13-61-404

**Notes:** Utah is the only state that requires BOTH a revenue threshold AND consumer volume — using AND logic rather than OR. A business must have $25M+ in annual revenue and also meet one of the two volume thresholds. This makes Utah's law the narrowest in scope among all state privacy laws.

> This chapter applies to any controller or processor who: (a) (i) conducts business in the state; or (ii) produces a product or service that is targeted to consumers who are residents of the state; (b) has annual revenue of $25,000,000 or more; and (c) satisfies one or more of the following thresholds: (i) during a calendar year, controls or processes personal data of 100,000 or more consumers; or (ii) derives over 50% of the entity's gross revenue from the sale of personal data and controls or processes personal data of 25,000 or more consumers.

Source: <https://le.utah.gov/xcode/Title13/Chapter61/C13-61_2022050420231231.pdf>

Utah — US state consumer data privacy laws: applicability thresholds by state


**State:** Virginia

**Law name and abbreviation:** Virginia Consumer Data Protection Act (VCDPA)

**Effective date:** January 1, 2023

**Consumer volume threshold:** control or process personal data of at least 100,000 consumers

**Revenue-from-data-sales threshold:** control or process personal data of at least 25,000 consumers and derive over 50 percent of gross revenue from the sale of personal data

**Threshold combination logic:** OR — applies to persons that (i) during a calendar year, control or process personal data of at least 100,000 consumers or (ii) control or process personal data of at least 25,000 consumers and derive over 50 percent of gross revenue from the sale of personal data

**Key exemptions:** State and local government bodies; financial institutions or data subject to GLBA; HIPAA-covered entities and business associates; nonprofit organizations; institutions of higher education; employment data and emergency contact information

**Enforcement mechanism:** Attorney General has exclusive authority to enforce; 30-day cure period; civil penalties up to $7,500 per violation; no private right of action

**Statute citation:** Va. Code Ann. §§ 59.1-575 to 59.1-585

**Notes:** Virginia's law set the template for many subsequent state privacy laws (the 'Virginia model'). No independent revenue threshold — a business with over $150 million in annual revenue is not in scope unless it also meets the consumer volume thresholds. B2B contacts and employees are excluded from consumer counts per the exemption in § 59.1-576(C)(14).

> This chapter applies to persons that conduct business in the Commonwealth or produce products or services that are targeted to residents of the Commonwealth and that (i) during a calendar year, control or process personal data of at least 100,000 consumers or (ii) control or process personal data of at least 25,000 consumers and derive over 50 percent of gross revenue from the sale of personal data.

Source: <https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/>

Virginia — US state consumer data privacy laws: applicability thresholds by state