Every US state privacy law, side by side.

states score most demanding on universal opt-out.

California. Businesses must honor opt-out preference signals such as GPC; AB 566 requires browsers to offer an opt-out signal starting January 2027.

Scale: 0 not required, 1 voluntary or future, 2 required (GPC), 3 required plus other signals or browser mandate.

states score most demanding on cure period.

California. No right to cure; the CPRA removed the former 30-day cure period.

Montana. SB 297 eliminated the guaranteed 60-day cure period.

Rhode Island. No cure period.

Scale: 0 permanent cure period, 1 cure period that has expired or is discretionary, 2 limited, 3 no cure period.

states score most demanding on data minimization.

Maryland. Collection must be limited to what is reasonably necessary and proportionate to provide or maintain a specific product or service the consumer requested.

Scale: 0 none beyond notice, 1 adequate, relevant and reasonably necessary to disclosed purposes, 2 reasonably necessary and proportionate, 3 strictly necessary to provide the requested product (Maryland style).

states score most demanding on children and teens.

Colorado. Minors under 18: duty of care and consent required for targeted ads, sale, profiling, engagement features and precise geolocation; parental consent under 13.

Montana. Minors under 18: duty of care, consent for ads, sale, profiling and engagement features, geolocation limits, and minors' assessments.

Florida. Child means under 18; under-13 data follows COPPA, and ages 13 to 17 must give affirmative authorization to process or sell sensitive data.

Maryland. Under-13 data is sensitive (COPPA). Targeted ads to, and sale of data of, consumers the controller knew or should have known are 13 to 17 are restricted.

Scale: value gives ages. Level 0 COPPA only (under 13), 1 under 13 parental consent as sensitive data, 2 extra teen protections (13 to 15 or 16, opt-in for ads or sale), 3 teen protections to 17 or a design code duty.

states score most demanding on thresholds.

Nebraska. No numeric threshold; any business processing or selling personal data except federal SBA small businesses, which still need consent to sell sensitive data.

Texas. Any business in Texas that processes or sells personal data and is not an SBA-defined small business; small businesses still need consent to sell sensitive data.

Connecticut. From July 1, 2026: 35,000+ consumers, or any controller that processes sensitive data or offers personal data for sale, regardless of volume.

Scale: value states the thresholds (consumer counts, revenue, data-sale share). Level 0 high thresholds (100k+ consumers and revenue share), 1 standard (100k, or 25k plus 50%+ revenue from sales), 2 lower thresholds (e.g. 35k or 50k, or a revenue test alone), 3 no or very low threshold (e.g. any business not a small business, or Texas-style SBA test).

states score most demanding on request deadline.

Scale: value in days. Level 2 for 45 days (the norm), 3 if shorter, 1 if longer or not set.

states score most demanding on private action.

Scale: 0 none, 1 limited (e.g. under a separate consumer protection act), 2 for data breaches only, 3 broad private right of action.

states score most demanding on rulemaking.

California. CPPA regulations in force, including 2025 rules on risk assessments, ADMT and cybersecurity audits effective Jan. 1, 2026.

Colorado. AG rules in force (Colorado Privacy Act Rules, 4 CCR 904-3), including universal opt-out specifications.

Scale: 0 none, 1 limited, 2 AG rulemaking authority, 3 rules in force.