State Privacy Laws
Comprehensive state laws
California's CCPA, as amended by the CPRA, applies to for-profit businesses doing business in California that meet a revenue threshold, process data of 100,000 or more consumers or households, or derive 50 percent or more of revenue from selling or sharing personal information. Rights include know, delete, correct, opt out of sale or sharing, limit use of sensitive information, and non-discrimination. The CPPA and attorney general enforce; the private right of action is limited to data breaches. Other comprehensive laws, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and Montana, use controller and processor roles, data protection assessments, universal opt-out mechanisms, and consent for sensitive data.
Other state regimes
Every state has a breach notification law. State UDAP statutes fill gaps. Biometric laws include Illinois BIPA, which requires a written release before collecting biometric identifiers and provides statutory damages per violation and a private right of action, plus Texas CUBI and Washington's law. State constitutions in California, Florida, Washington, Montana, Alaska, and Hawaii recognize privacy rights.
Traps
Do not assume every state law has a private right of action, that the CCPA covers all businesses, that sale and sharing are identical, or that a cure period exists everywhere. BIPA requires a written release, not just notice.
Worked example
An Illinois employer scans fingerprints without a written release. That violates BIPA, exposing statutory damages per scan. Rule of thumb: check thresholds, rights, enforcement, and private rights of action for each state.