US State Privacy Laws: The 2026 Evergreen Map

Major Comprehensive State Privacy Laws

Effective/enforcement dates below are summarised carefully for programme planning. Always verify the current statute and AG/agency rules before relying on a date in production playbooks.

Additional states continue to enact or amend comprehensive laws — re-check this hub and counsel updates each quarter.

CCPA Consumer Request Clocks

Respond to verifiable consumer requests to know, delete, or correct within 45 days; one extension of an additional 45 days when reasonably necessary with notice in the first period (§1798.130). Regulations also expect acknowledgment within 10 business days.

Breach Notice vs CCPA Rights

California security breach notice to residents is under Civil Code §1798.82 (most expedient time / without unreasonable delay). That is distinct from CCPA consumer-rights clocks. See the breach deadlines matrix.

How CyberSilo Helps

CSA Privacy configures multi-state rights clocks and inventory evidence shared with GDPR/PDPL programmes.

Frequently Asked Questions

What is the current CCPA revenue threshold?

Annual gross revenues in excess of $26,625,000 (CPI-adjusted effective Jan 1, 2025), or the volume/share tests — one or more of the three statutory tests.

Is there a federal privacy law?

Not a comprehensive one as of 2026. Sector laws (HIPAA, GLBA, COPPA, etc.) still apply.

Where did the 2025 URL go?

us-state-privacy-laws-2025 redirects to this evergreen /us-state-privacy-laws hub.

Related Privacy Resources

CCPA hub · DSAR automation · CSA Privacy