Data privacy law has moved from a compliance specialty for large tech companies to a broad-based requirement affecting businesses of all sizes. California's CCPA set the template; now 17+ states have enacted comprehensive privacy laws. For SMBs that collect consumer data — which is virtually every business with a website — understanding applicable privacy obligations is essential.
CCPA and CPRA
The California Consumer Privacy Act (Cal. Civ. Code § 1798.100 et seq.), amended by Proposition 24 (CPRA, effective January 1, 2023), applies to for-profit businesses doing business in California that meet one of these thresholds: annual gross revenues exceeding $25 million; buying, selling, or sharing personal information of 100,000+ consumers per year; or deriving 50%+ of revenues from selling personal information.
Covered businesses must: provide a privacy notice at collection, respond to consumer rights requests (access, deletion, correction, opt-out) within 45 days, maintain a "Do Not Sell or Share My Personal Information" link, and implement reasonable security measures. Penalties: up to $7,500 per intentional violation.
GDPR: When It Applies to U.S. Companies
The EU General Data Protection Regulation (Regulation (EU) 2016/679) applies to any organization that processes personal data of EU/EEA residents in the context of offering goods or services to those residents or monitoring their behavior. U.S. companies with EU-accessible websites, EU customers, or EU employees are typically covered. GDPR requires lawful basis for all processing, data subject rights responses within 30 days, data processing agreements with vendors, and breach notification within 72 hours. Maximum penalties: €20 million or 4% of global annual turnover.
The State Privacy Law Landscape (2025)
Comprehensive state privacy laws are now in effect in at least 17 states including Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah, Texas, Oregon, Montana, Iowa, Indiana, Tennessee, Florida, Delaware, New Hampshire, New Jersey, Nebraska, and Kentucky. Most follow the California opt-out model with thresholds around 100,000 consumers. A company collecting data nationwide may be subject to 10+ state privacy laws simultaneously.
Privacy Notices and Cookie Consent
Most state privacy laws require a privacy notice disclosing: categories of personal data collected, purposes, categories of third parties, consumer rights, and contact information. GDPR requires additional disclosure of lawful basis, retention periods, and international transfer mechanisms. Cookie consent under GDPR requires prior opt-in for non-essential cookies; CCPA/CPRA requires an opt-out link.
How Compliance Singularity Handles Privacy Compliance
Compliance Singularity assesses your privacy obligations based on revenue, consumer data volume, states of operation, and EU presence. It generates a prioritized privacy compliance checklist identifying applicable laws, required privacy notice updates, consumer rights procedures, and vendor data processing agreement gaps. Annual privacy obligation reviews are built into the compliance calendar with updates triggered when new state laws go into effect.