Skip to main content

​
US State Privacy Posture: The 2026 Map Beyond California

California’s CCPA/CPRA has its own guide — CCPA/CPRA Posture. This page covers the rest of the map: the eighteen other state privacy statutes in force as of 2026, from the Virginia VCDPA and Colorado CPA to the newest entrants, and how the rights they grant map onto the same tenant-owned Orbit controls you already use for California and GDPR. The pattern is the same everywhere: the statute defines the right and the clock; you decide it applies; Orbit carries the request, records the consent, and enforces the opt-out.
This page describes Orbit’s platform controls. It is not legal advice. Whether any state statute applies to you — the revenue and volume thresholds, the carve-outs, what counts as “sale” or “targeted advertising” in each statute — depends on your business and on the current text of each law, which changes session by session. Confirm applicability with qualified counsel before you assemble a posture on this page.

​
The tenant-owned framing

Same model as every other posture on Orbit (posture overview):
  • Orbit never decides a statute applies to you. There is no platform-side state gate and no per-state toggle that flips obligations on or off. You determine applicability with counsel, then assemble the controls below; the platform enforces exactly what you set, and everything defaults open.
  • The controls are shared with California and GDPR. State statutes converged on a common rights core — know, delete, correct, opt out of sale and targeted advertising, limit use of sensitive data — and Orbit’s DSAR verbs, consent records, suppression ledger, and residency codes already implement that core. This page is the mapping table, not a new pipeline.
  • One intake field, one annotation field. The DSAR applicable_jurisdiction enum carries the statutory clocks Orbit tracks (gdpr, ccpa, cpra, lgpd, pdpa, pipeda, dpdp); there is no per-state code. For a request filed under a statute the enum does not name, file the nearest verb and carry the statute in requester_statement — the same pattern the DSAR page documents for GDPR Art 18.

​
Section 1 — The 2026 US state privacy map

Eighteen states beyond California operate a comprehensive privacy statute as of 2026. They fall into three families, and the family tells you most of what the statute demands: The Virginia model — the template most states copied. Full rights core (know, delete, correct), opt-out rights for sale and targeted advertising, and opt-in consent for sensitive data: The Utah model — narrower statutes: no right to correct, and sensitive data handled by notice plus opt-out rather than opt-in: No-volume-threshold statutes — a full Virginia-style rights core, but applicability turns on “doing business in the state” with little or no consumer-volume threshold, so they reach smaller tenants than the others: Citation signposts, not determinations: the effective dates and family assignments above are the posture view at the time of writing, and states amend these statutes every legislative session. Your counsel’s current-text read governs.

​
Section 2 — The common obligations matrix

Despite the different names, the statutes share one rights core. Each row maps a right to the states that grant it and to the Orbit control that fulfils it: States whose rules require honouring a universal opt-out signal such as the Global Privacy Control at the time of writing: Colorado, Connecticut, Delaware, Kentucky, Maryland, Minnesota, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, and Texas. Virginia, Utah, Iowa, Indiana, Montana, and Tennessee do not mandate it in statute. Several states add a universal-opt-out mandate by rule after their effective date, so treat this column as the starting question for counsel, not the answer.

​
Section 3 — Tenant-owned Orbit controls for each obligation

Every obligation in the matrix resolves onto a control that ships today. The endpoints below are rooted at https://api.orbit.devotel.io/api/v1/compliance. Filing a request under a statute the enum does not name: use the nearest jurisdiction code so the right SLA window applies, and put the statute in requester_statement. The CPA’s 45-day response window matches the cpra clock, so a Colorado access request files as:
The same rule the DSAR page states for Art 18 holds here: the clock and the verbs are the platform’s; the judgement that the statute applies, and which one, is yours.

​
Section 4 — GPC and universal opt-out handling

A Global Privacy Control signal arrives with the consumer’s browser traffic; interpreting it is tenant-owned. Orbit does not ingest GPC on your behalf and does not decide what an honoured signal means for your use cases — the consent page is where the decision lands:
  1. Your web property reads the Sec-GPC header or the JS signal and maps it to the opt-outs the applicable state rules require — typically sale and targeted advertising.
  2. Record the outcome with POST /compliance/consent: opt_in: false, the affected channels, a source such as gpc_signal, and a metadata object carrying the state and statute the signal was honoured for (e.g. "metadata": {"state": "US-CO", "statute": "CPA"}). The write updates the consent audit table, the contact’s channel preferences, and the suppression list in one call.
  3. Verify with GET /compliance/consent/lookup that the pair reads as opted-out before the next send.
Because an opt-out write also lands on the suppression list, an honoured GPC signal is enforced at dispatch, not merely recorded — the same guarantee a California opt_out_sale fulfilment gets.

​
Section 5 — Worked example: a Colorado-domiciled contact

A tenant with a marketing list that includes Colorado residents assembles the posture in four moves:
1

Determine applicability with counsel

The CPA applies past its thresholds and outside its carve-outs (Section 7). Nothing on Orbit changes until your counsel says it applies; everything below is the configuration that follows.
2

Record consent with the state attached

For each Colorado contact, record the marketing opt-in through POST /compliance/consent with metadata carrying {"state": "US-CO", "statute": "CPA"}. Record sensitive-data consents separately: Colorado is an opt-in state, so sensitive categories need their own affirmative grant, not a notice.
3

Honour GPC for Colorado traffic

Wire the Section 4 flow: your site reads the signal, and the opt-out for sale and targeted advertising is recorded with source: "gpc_signal" so the audit table shows how each opt-out arrived.
4

Stand up the request pipeline

Publish the self-service DSAR portal link in your privacy policy, and train support to file incoming requests as in Section 3 — cpra for the 45-day window, the CPA citation in requester_statement. Track the queue on GET /compliance/dsar/sla; the tiers scale to the request’s own window.
The same assembly works for any state in the map; only the metadata values, the GPC column, and the sensitive-data treatment (opt-in vs opt-out) change per family.

​
Section 6 — When state law does NOT apply

Every statute in the map carves data out that another regime already governs. The common carve-outs, all state-specific in detail:
  • HIPAA / PHI — protected health information under HIPAA is outside the state privacy statutes; Orbit’s separate HIPAA posture governs it.
  • GLBA and FCRA — financial-institution and consumer-reporting data sit under their federal regimes.
  • DPPA — motor-vehicle records stay under the federal Driver’s Privacy Protection Act.
  • Children’s data — minors’ privacy is handled federally (COPPA) and by state statutes’ heightened protections for known minors; the comprehensive statutes defer rather than duplicate.
  • Employment and B2B records — employee/beneficiary records and, in several states, business-contact data are carved out; the scope of the B2B carve-out varies state by state and has been sunset in some (California’s among them).
  • Other wanteds — nonprofits in some states, higher-education records, and public datasets variously fall outside.
The carve-out analysis is the first question for counsel, because it can remove whole datasets from the posture before any control is configured.
Each statute reaches only businesses past its own thresholds, and the thresholds differ in kind, not just in number. Confirm your position against the current text with counsel; this list is the shape of the question, not the answer.
  • Consumer-volume thresholds — the common form: personal data of 100,000+ state consumers, or 25,000 plus a share of gross revenue from selling personal data (Virginia pairs 25,000 with 50%).
  • Pure revenue thresholds — Texas reaches entities above a gross annual revenue floor regardless of volume, so a large tenant with few Texas contacts can still be in scope.
  • No volume threshold — Indiana and Montana apply on a doing-business test with little or no volume gate, so they reach smaller tenants than the rest of the map.
  • Revenue-from-sale share — several statutes’ lower-volume arm turns on what percentage of your gross revenue comes from the sale of personal data, a figure your finance team, not this page, computes.

​
Where this page sits in the posture group

This page sits in the Compliance nav group alongside the other per-jurisdiction posture guides — GDPR, CCPA/CPRA, TCPA, STIR/SHAKEN, and HIPAA — and reads the same sibling surfaces the California guide reads: the DSAR pipeline, the consent records an opt-out lands on, the suppression ledger, and the data residency codes.
  • CCPA/CPRA Posture — the California counterpart; the applicable_jurisdiction and consumer_categories subdivision in detail.
  • DSAR — intake, verification, SLA clock, proof-of-deletion certificate.
  • Consent Management — the consent write that a GPC signal resolves onto.
  • Opt-Out & Suppression Lists — the ledger that enforces opt-outs at dispatch.
  • Data Residency — the state-level jurisdiction codes on your records.
  • Posture overview — the tenant-owned framing this guide extends.