One website, a growing number of state statutes

Definition

US state privacy laws differ in coverage, exemptions, consumer rights, opt-out rules and enforcement. A website may need to support requirements from more than one state.

Does it apply to you

• Review the states relevant to your customers and the personal information you process. Check each law's current thresholds, exemptions and effective date; website traffic alone does not establish coverage.
• Some statutes exempt non-profits, or entities already regulated under sector laws such as HIPAA or the Gramm-Leach-Bliley Act. The exemptions differ state by state.

Why it matters

Enforcement is generally by the state attorney general, with civil penalties per violation. Several states offer a cure period during which a business can fix a violation before enforcement, and some of those cure periods are written to expire. Because the statutes commence on staggered dates, a website that was compliant everywhere last year may not be this year without anything about it having changed.

Requirements

• Depending on the applicable law, requirements may include a privacy notice covering categories, purposes, sharing, and how to exercise rights.
• Access, deletion, correction and portability rights, plus an opt-out of targeted advertising, sale, and certain profiling.
• Recognition of a universal opt-out signal, which several states now require.
• A data protection assessment for higher-risk processing such as targeted advertising or sensitive data.

Steadwatch's role

• The platform supports configured regional consent and opt-out behavior, request logs and response-target tracking.
• Your business identifies the applicable requirements; we document the website controls included in the agreement.

Records you receive

• A request log with dates, outcomes and deadlines.
• A consent log showing region, what was asked and what was chosen.

Your responsibilities

• Knowing which states your customers are in, and whether you cross a threshold there.
• Data protection assessments, which describe business decisions we are not party to.