U.S. State Data Privacy Laws: What Your Business Needs to Know in 2025

Compliance and Regulations
Written By Helen Lavigne

By: De'Von Carter

If your business collects personal data — whether through an app, website, or customer interaction — state data privacy laws may apply to you, even if you don’t have a physical presence in those states.

While many companies scrambled to comply with Europe’s GDPR, the U.S. is now catching up with a growing number of comprehensive data privacy laws at the state level. These laws give consumers rights over their personal data and impose new obligations on businesses.

States with Comprehensive Privacy Laws (as of April 2025):

California (CCPA/CPRA)

  • Virginia (VCDPA)

  • Colorado (CPA)

  • Connecticut (CTDPA)

  • Utah (UCPA)

  • Iowa

  • Indiana

  • Tennessee

  • Montana

  • Texas

  • Oregon

  • Delaware

  • New Jersey

  • New Hampshire

  • Nebraska

  • Kentucky

These laws typically include:

The right for consumers to access, delete, or correct their data

  • Requirements to disclose data collection practices

  • Opt-out rights for data sales or targeted advertising

  • Security and data minimization obligations for businesses

  • Certain laws may require data protection assessments or third-party oversight

Even if your business is located outside these states, if you have customers, users, or site visitors from them, the law may still apply.

What This Means for You

To stay compliant, businesses should:

Map out what personal data they collect and where it goes

  • Review and update privacy policies

  • Create workflows to respond to consumer requests (access, deletion, etc.)

  • Ensure that your technology can support these workflows

  • Implement safeguards for third-party data sharing and vendors

  • Monitor legal changes regularly

Need Help Navigating Privacy Laws?

At Fourscore Law, we help businesses assess risk and build smart, scalable compliance strategies across multiple jurisdictions. Whether you're preparing for an upcoming state law or revamping your overall privacy program, our team is here to support you.

Reach out to a Fourscore attorney today to schedule a consultation and protect your business in this rapidly changing legal landscape.

Picture on the top is by Fernando Arcos and is in the public domain.

Helen Lavigne
Next

April Update: Does your business need a bank account?