Which privacy laws apply to my business

What it works out

Privacy laws decide who they cover before they say what to do. The GDPR looks at where you are and whom you reach: an establishment in the EU, or offering goods or services to people there, or monitoring their behaviour. The US state laws look at numbers: how many of the state’s residents you hold data on, how much revenue comes from selling that data and, in California and Tennessee, your total revenue.

The checker runs each law’s test against your answers and names the threshold that tripped it. It does not check the exemptions each law carves out for certain data or certain organisations, beyond whether a few states cover nonprofits. For the long answer on Article 3, read does the GDPR apply to US companies; for how the two regimes differ once both reach you, read GDPR vs CCPA.

1. Tick the Europe questions that are true of your firm today, not of a plan.
2. Enter last year’s gross revenue and the share of it that came from selling personal data.
3. Add a row for every state whose residents you sell to or serve, with a yearly count from your customer or analytics records. California counts only consumers whose data you buy, sell or share.
4. Read the result law by law; a “check” or “not covered yet” row needs a person to read the statute.

Worked example

The pre-filled firm sells skincare online from Denver: 30 staff, $12,000,000 in revenue, no data sold for money, and an SBA small business for its industry. It ships to EU countries and runs analytics and ad pixels there. Its ad pixels share the data of 140,000 California consumers for cross-context behavioural advertising, and it has customers in 6 states. As of 22 Oct 2026 the checker returns 3 laws:

Two lessons from it. The firm is based in Colorado yet misses Colorado’s thresholds (only the duties toward minors, which since 1 Oct 2025 bind any controller doing business there, reach it), while Connecticut’s law reaches it in full: since 1 Jul 2026 a firm crosses Connecticut’s line at 35,000 residents. And California is reached through the ad pixels, not through revenue; our CCPA threshold calculator takes that test apart.

Jurisdiction notes

The table holds the GDPR and 16 US state laws, each read from the statute or the regulator’s own page on 22 Oct 2026. For the whole map in one place, see US state privacy laws.

California moves its revenue line every odd year

The CCPA’s revenue test is $26,625,000, CPI-adjusted from $25,000,000 on 1 Jan 2025, and the agency adjusts it again on 1 January of every odd year, next on 1 January 2027. The CCPA covers only a for-profit entity doing business in California. What the CCPA is covers the rest.

Connecticut and Delaware change their lines on fixed dates

Since 1 Jul 2026 Connecticut reaches a firm with 35,000 residents, or any firm that processes sensitive data or offers personal data for sale; before that it was 100,000, or 25,000 plus over 25% of revenue from sales. Read the Connecticut Data Privacy Act for what that pulls in. Delaware drops from 35,000 (or 10,000 plus over 20% of revenue from sales) to 10,000 (or 5,000 plus over 20%) on 1 Jan 2027. Set the checker’s date to 2027 to see the effect.

Texas and Nebraska have no headcount

Both reach any firm that processes or sells personal data unless it is a small business under the federal SBA definition, and even a small business may not sell sensitive data without the consumer’s prior consent (Texas § 541.107). A firm with a few hundred Texans on file can be covered. See the Texas Data Privacy and Security Act.

Tennessee asks for revenue and volume

Tennessee is the only state in the table that needs both: revenue over $25,000,000 and either 175,000 residents or 25,000 plus over 50% of revenue from selling personal information.

Colorado and Oregon reach some firms below their lines

Since 1 Oct 2025 Colorado’s duties toward minors apply to any controller doing business in or targeting the state, with no volume test; the checker marks a firm under Colorado’s lines “partly” for that reason. Oregon has covered nonprofits since 1 Jul 2025 on the same thresholds, and since Sep 2025 every motor vehicle manufacturer, and affiliates holding data from a consumer’s use of a vehicle, whatever the count. Connecticut still exempts nonprofits, though not from its consumer health data rules.

Payment-only data and what we have not verified

• Connecticut, Montana, Delaware, Minnesota, Maryland and New Hampshire leave out data processed only to complete a payment when you count residents.
• Montana’s effective date is not verified here; its thresholds are the 2025 amended ones.
• Tennessee and Indiana were read from the acts as enacted in 2023; later amendments are unchecked.
• Not covered yet: Utah (UCPA), Kentucky (KRS 367.3611 ff.) and Rhode Island (RIGL 6-48.1). A row for one of these states shows “not covered yet”: read the statute itself.

Once a law reaches you

Coverage comes first; the work follows from it. Each law that reaches you asks for a notice that says what you collect and why, a way for people to ask for their data, and an answer inside a fixed number of days.

1. Put the notices in place: the privacy policy checklist lists what each law wants on the page.
2. Honour opt-out signals where a law asks for them: test your site with the Global Privacy Control checker.
3. Answer requests on time: the DSAR deadline calculator turns a received date into a due date for each law.