US state website compliance — by state

Alabama does not have a comprehensive consumer privacy law as of June 2026, but federal CAN-SPAM, COPPA, ADA Title III, and FTC Act apply to every website serving Alabama residents. Alabama also has narrower state-specific rules noted below.

AL state-specific rule

Alaska does not have a comprehensive consumer privacy law as of June 2026. Federal CAN-SPAM, COPPA, ADA Title III, and FTC Act apply to websites serving Alaska residents.

American Samoa does not have a comprehensive consumer privacy law as of June 2026. Federal CAN-SPAM, COPPA, ADA Title III, and FTC Act apply to websites serving American Samoa residents.

Arizona does not have a comprehensive consumer privacy law as of June 2026. Federal CAN-SPAM, COPPA, ADA Title III, and FTC Act apply to websites serving Arizona residents.

Arkansas does not have a comprehensive consumer privacy law as of June 2026. Federal CAN-SPAM, COPPA, ADA Title III, and FTC Act apply to websites serving Arkansas residents.

California has the strictest website-privacy regime in the United States — the CCPA and its successor the CPRA — plus the CalOPPA privacy-policy requirement, court-affirmed ADA accessibility liability, and an emerging AI-transparency statute. If you collect any data from California residents, you almost certainly have website obligations here.

CCPACPRACalOPPA

Colorado has two landmark state laws affecting websites: the Colorado Privacy Act (CPA), in effect since July 2023, and the Colorado AI Act (SB 24-205), the country's first comprehensive AI regulation, effective February 1, 2026. Combined with HB 21-1110 (state accessibility law), Colorado has built one of the most comprehensive state-level digital compliance regimes outside of California.

CPAColorado AI ActHB 21-1110

Connecticut's CTDPA closely tracks the Virginia and Colorado privacy laws but adds stronger sensitive-data opt-in and explicit Global Privacy Control honouring.

CTDPA

Delaware's DPDPA has the lowest consumer threshold of any East Coast privacy law (35,000 residents), making it relevant to many SMBs with modest national reach.

DPDPA

District of Columbia does not have a comprehensive consumer privacy law as of June 2026, but federal CAN-SPAM, COPPA, ADA Title III, and FTC Act apply to every website serving District of Columbia residents. District of Columbia also has narrower state-specific rules noted below.

DC state-specific rule

Florida's primary website law is the Florida Digital Bill of Rights (FDBR), effective July 1, 2024, but its threshold is unusually high — it only applies to businesses with over $1B in global revenue that engage in specific activities. For most businesses, the more relevant Florida obligations are FIPA (data breach), Florida HB 3 (online minor protections), and federal ADA accessibility liability.

FDBRFlorida HB 3FIPA

Georgia does not have a comprehensive consumer privacy law as of June 2026. Federal CAN-SPAM, COPPA, ADA Title III, and FTC Act apply to websites serving Georgia residents.

Guam does not have a comprehensive consumer privacy law as of June 2026. Federal CAN-SPAM, COPPA, ADA Title III, and FTC Act apply to websites serving Guam residents.

Hawaii does not have a comprehensive consumer privacy law as of June 2026. Federal CAN-SPAM, COPPA, ADA Title III, and FTC Act apply to websites serving Hawaii residents.

Idaho does not have a comprehensive consumer privacy law as of June 2026. Federal CAN-SPAM, COPPA, ADA Title III, and FTC Act apply to websites serving Idaho residents.

Illinois does not have a comprehensive consumer privacy law as of June 2026, but federal CAN-SPAM, COPPA, ADA Title III, and FTC Act apply to every website serving Illinois residents. Illinois also has narrower state-specific rules noted below.

IL state-specific rule

Indiana does not have a comprehensive consumer privacy law as of June 2026, but federal CAN-SPAM, COPPA, ADA Title III, and FTC Act apply to every website serving Indiana residents. Indiana also has narrower state-specific rules noted below.

IN state-specific rule

Iowa's ICDPA is the most business-friendly comprehensive state privacy law — no opt-in requirement for sensitive data, no data protection assessment requirement, and no opt-out from profiling.

ICDPA

Kansas does not have a comprehensive consumer privacy law as of June 2026. Federal CAN-SPAM, COPPA, ADA Title III, and FTC Act apply to websites serving Kansas residents.

Kentucky does not have a comprehensive consumer privacy law as of June 2026, but federal CAN-SPAM, COPPA, ADA Title III, and FTC Act apply to every website serving Kentucky residents. Kentucky also has narrower state-specific rules noted below.

KY state-specific rule

Louisiana does not have a comprehensive consumer privacy law as of June 2026. Federal CAN-SPAM, COPPA, ADA Title III, and FTC Act apply to websites serving Louisiana residents.

Maine does not have a comprehensive consumer privacy law as of June 2026, but federal CAN-SPAM, COPPA, ADA Title III, and FTC Act apply to every website serving Maine residents. Maine also has narrower state-specific rules noted below.

ME state-specific rule

Maryland's MODPA is the most consumer-protective state privacy law in effect — it includes strict data minimization, prohibition on sale of sensitive data, and special protections for minors.

MODPA

Massachusetts does not have a comprehensive consumer privacy law as of June 2026, but federal CAN-SPAM, COPPA, ADA Title III, and FTC Act apply to every website serving Massachusetts residents. Massachusetts also has narrower state-specific rules noted below.

MA state-specific rule

Michigan does not have a comprehensive consumer privacy law as of June 2026. Federal CAN-SPAM, COPPA, ADA Title III, and FTC Act apply to websites serving Michigan residents.

Minnesota's MCDPA includes an unusual mandate that businesses maintain a written data privacy program, including data inventory and retention schedules — not just a privacy notice.

MCDPA

Mississippi does not have a comprehensive consumer privacy law as of June 2026. Federal CAN-SPAM, COPPA, ADA Title III, and FTC Act apply to websites serving Mississippi residents.

Missouri does not have a comprehensive consumer privacy law as of June 2026. Federal CAN-SPAM, COPPA, ADA Title III, and FTC Act apply to websites serving Missouri residents.

Montana's MCDPA has the lowest consumer threshold of any state privacy law (50,000 residents), making it relevant to smaller businesses with a Montana customer base.

MCDPA

Nebraska does not have a comprehensive consumer privacy law as of June 2026. Federal CAN-SPAM, COPPA, ADA Title III, and FTC Act apply to websites serving Nebraska residents.

Nevada does not have a comprehensive consumer privacy law as of June 2026, but federal CAN-SPAM, COPPA, ADA Title III, and FTC Act apply to every website serving Nevada residents. Nevada also has narrower state-specific rules noted below.

NV state-specific rule

New Hampshire's NHDPA is a standard comprehensive privacy law modeled closely on Connecticut, with a low 35,000-resident threshold that affects many SMBs.

NHDPA

New Jersey's NJDPCA classifies financial information as sensitive data — broader than most state laws — and requires opt-in consent for processing it.

NJDPCA

New Mexico does not have a comprehensive consumer privacy law as of June 2026. Federal CAN-SPAM, COPPA, ADA Title III, and FTC Act apply to websites serving New Mexico residents.

New York's website compliance landscape is shaped by the SHIELD Act (data security + breach notification), New York City's Local Law 144 governing automated hiring tools, a robust biometric privacy statute, and the highest volume of ADA web-accessibility lawsuits in the country. There is no comprehensive state privacy law yet, but proposed bills are pending.

SHIELD ActLocal Law 144 (NYC)NYC Biometric Privacy Law

North Carolina does not have a comprehensive consumer privacy law as of June 2026. Federal CAN-SPAM, COPPA, ADA Title III, and FTC Act apply to websites serving North Carolina residents.

North Dakota does not have a comprehensive consumer privacy law as of June 2026. Federal CAN-SPAM, COPPA, ADA Title III, and FTC Act apply to websites serving North Dakota residents.

Northern Mariana Islands does not have a comprehensive consumer privacy law as of June 2026. Federal CAN-SPAM, COPPA, ADA Title III, and FTC Act apply to websites serving Northern Mariana Islands residents.

Ohio does not have a comprehensive consumer privacy law as of June 2026, but federal CAN-SPAM, COPPA, ADA Title III, and FTC Act apply to every website serving Ohio residents. Ohio also has narrower state-specific rules noted below.

OH state-specific rule

Oklahoma does not have a comprehensive consumer privacy law as of June 2026. Federal CAN-SPAM, COPPA, ADA Title III, and FTC Act apply to websites serving Oklahoma residents.

Oregon's OCPA establishes comprehensive privacy rights similar to Connecticut's, with the key innovation that consumers can request a list of the SPECIFIC third parties to whom their data has been disclosed (not just categories).

OCPA

Pennsylvania does not have a comprehensive consumer privacy law as of June 2026. Federal CAN-SPAM, COPPA, ADA Title III, and FTC Act apply to websites serving Pennsylvania residents.

Puerto Rico does not have a comprehensive consumer privacy law as of June 2026, but federal CAN-SPAM, COPPA, ADA Title III, and FTC Act apply to every website serving Puerto Rico residents. Puerto Rico also has narrower state-specific rules noted below.

PR state-specific rule

Rhode Island does not have a comprehensive consumer privacy law as of June 2026, but federal CAN-SPAM, COPPA, ADA Title III, and FTC Act apply to every website serving Rhode Island residents. Rhode Island also has narrower state-specific rules noted below.

RI state-specific rule

South Carolina does not have a comprehensive consumer privacy law as of June 2026. Federal CAN-SPAM, COPPA, ADA Title III, and FTC Act apply to websites serving South Carolina residents.

South Dakota does not have a comprehensive consumer privacy law as of June 2026. Federal CAN-SPAM, COPPA, ADA Title III, and FTC Act apply to websites serving South Dakota residents.

Tennessee's TIPA introduced a NIST-CSF-based safe harbor — businesses that document compliance with a recognized privacy framework get an affirmative defence against TIPA enforcement actions.

TIPA

Texas's primary website law is the Texas Data Privacy and Security Act (TDPSA), effective July 1, 2024 — a comprehensive privacy law modeled on Virginia's VCDPA but with a notably lower applicability threshold. Texas also has one of the country's strictest biometric statutes and a 2025 AI governance law.

TDPSATexas Biometric ActTRAIGA

US Virgin Islands does not have a comprehensive consumer privacy law as of June 2026. Federal CAN-SPAM, COPPA, ADA Title III, and FTC Act apply to websites serving US Virgin Islands residents.

Utah's UCPA is the most business-friendly of the comprehensive state privacy laws — higher revenue thresholds, opt-out only (no opt-in for sensitive data), and no data protection assessment requirement.

UCPA

Vermont does not have a comprehensive consumer privacy law as of June 2026, but federal CAN-SPAM, COPPA, ADA Title III, and FTC Act apply to every website serving Vermont residents. Vermont also has narrower state-specific rules noted below.

VT state-specific rule

Virginia was the second US state (after California) to pass a comprehensive consumer privacy law. The VCDPA establishes opt-out rights for targeted advertising and data sale, plus opt-in for sensitive data. Coverage thresholds catch most national websites quickly.

VCDPA

Washington's My Health My Data Act is narrower than other state privacy laws (consumer health data only) but applies more broadly — no revenue or consumer threshold. Any business handling 'consumer health data' for Washington residents is subject.

MHMD

West Virginia does not have a comprehensive consumer privacy law as of June 2026. Federal CAN-SPAM, COPPA, ADA Title III, and FTC Act apply to websites serving West Virginia residents.

Wisconsin does not have a comprehensive consumer privacy law as of June 2026. Federal CAN-SPAM, COPPA, ADA Title III, and FTC Act apply to websites serving Wisconsin residents.

Wyoming does not have a comprehensive consumer privacy law as of June 2026. Federal CAN-SPAM, COPPA, ADA Title III, and FTC Act apply to websites serving Wyoming residents.