US state privacy laws

A state-by-state patchwork. In the US, individual states have passed their own comprehensive consumer privacy laws, which the IAPP describes as the "state privacy patchwork". Counts differ by who is counting: the IAPP tracks 19 enacted comprehensive state laws, while MultiState counts twenty states, including Florida, whose law is narrower in scope than the others.

The Virginia template. Virginia's Consumer Data Protection Act (2021 H.B. 2307 / S.B. 1392) took effect on January 1, 2023. It applies to businesses that control or process personal data of at least 100,000 consumers, or that derive over 50 percent of gross revenue from selling personal data and control or process data of at least 25,000 consumers. It gives consumers rights to access, correct, delete and get a copy of their data, and to opt out of processing for targeted advertising. The Attorney General has exclusive authority to enforce it.

New laws keep arriving. Comprehensive laws in Indiana, Kentucky and Rhode Island took effect on January 1, 2026; MultiState says all three largely mirror the template set in Virginia. Indiana's and Kentucky's laws include opt-outs for targeted advertising and data sales, while Rhode Island's does not include recognition of universal opt-out mechanisms.

Why it matters in advertising. The Global Privacy Control (GPC) browser signal is intended to communicate a "Do Not Sell or Share" request under the California Consumer Privacy Act and similar state privacy laws that let people opt out of data sales or the use of their data for cross-context targeted advertising.