> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt
> Use this file to discover all available pages before exploring further.

# US State Privacy Posture: The 2026 Map Beyond California

> Assemble a tenant-owned posture for the US state privacy statutes in force beyond California — group the Virginia-model and Utah-model laws, map the common rights onto Orbit's DSAR verbs, consent records, GPC handling, suppression, and residency pinning, and work out with counsel whether a given statute applies to you at all.

# US State Privacy Posture: The 2026 Map Beyond California

California's CCPA/CPRA has its own guide —
[CCPA/CPRA Posture](/compliance/ccpa-cpra-posture). This page covers
the rest of the map: the eighteen other state privacy statutes in
force as of 2026, from the Virginia VCDPA and Colorado CPA to the
newest entrants, and how the rights they grant map onto the same
tenant-owned Orbit controls you already use for California and
GDPR. The pattern is the same everywhere: the statute defines the
right and the clock; you decide it applies; Orbit carries the
request, records the consent, and enforces the opt-out.

<Warning>
  This page describes Orbit's platform controls. It is **not legal
  advice.** Whether any state statute applies to you — the revenue
  and volume thresholds, the carve-outs, what counts as "sale" or
  "targeted advertising" in each statute — depends on your business
  and on the current text of each law, which changes session by
  session. Confirm applicability with qualified counsel before you
  assemble a posture on this page.
</Warning>

## The tenant-owned framing

Same model as every other posture on Orbit
([posture overview](/compliance/posture-overview)):

* **Orbit never decides a statute applies to you.** There is no
  platform-side state gate and no per-state toggle that flips
  obligations on or off. You determine applicability with counsel,
  then assemble the controls below; the platform enforces exactly
  what you set, and everything defaults open.
* **The controls are shared with California and GDPR.** State
  statutes converged on a common rights core — know, delete,
  correct, opt out of sale and targeted advertising, limit use of
  sensitive data — and Orbit's DSAR verbs, consent records,
  suppression ledger, and residency codes already implement that
  core. This page is the mapping table, not a new pipeline.
* **One intake field, one annotation field.** The DSAR
  `applicable_jurisdiction` enum carries the statutory clocks Orbit
  tracks (`gdpr`, `ccpa`, `cpra`, `lgpd`, `pdpa`, `pipeda`, `dpdp`);
  there is no per-state code. For a request filed under a statute
  the enum does not name, file the nearest verb and carry the
  statute in `requester_statement` — the same pattern the
  [DSAR page documents for GDPR Art 18](/compliance/dsar).

***

## Section 1 — The 2026 US state privacy map

Eighteen states beyond California operate a comprehensive privacy
statute as of 2026. They fall into three families, and the family
tells you most of what the statute demands:

**The Virginia model** — the template most states copied. Full
rights core (know, delete, correct), opt-out rights for sale and
targeted advertising, and **opt-in consent for sensitive data**:

| State | Statute | In force since |
| - | - | - |
| Virginia | VCDPA | Jan 2023 |
| Colorado | CPA | Jul 2023 |
| Connecticut | CTDPA | Jul 2023 |
| Texas | TDPSA | Jul 2024 |
| Oregon | OCPA | Jul 2024 |
| Delaware | DPDPA | Jan 2025 |
| New Hampshire | NHPDA | Jan 2025 |
| Tennessee | TIPA | Jul 2025 |
| Maryland | MODPA | Oct 2025 |
| Minnesota | MCDPA | Jul 2025 |
| Nebraska | NDIPA | Jan 2025 |
| New Jersey | NJDPA | Jan 2025 |
| Kentucky | KCDPA | Jan 2026 |
| Rhode Island | RIDPA | Jan 2026 |

**The Utah model** — narrower statutes: no right to correct, and
sensitive data handled by notice plus opt-out rather than opt-in:

| State | Statute | In force since |
| - | - | - |
| Utah | UCPA | Dec 2023 |
| Iowa | ICDPA | Jan 2025 |

**No-volume-threshold statutes** — a full Virginia-style rights
core, but applicability turns on "doing business in the state" with
little or no consumer-volume threshold, so they reach smaller
tenants than the others:

| State | Statute | In force since |
| - | - | - |
| Indiana | ICDPA (IN) | Jan 2026 |
| Montana | MCDPA (MT) | Oct 2024 |

Citation signposts, not determinations: the effective dates and
family assignments above are the posture view at the time of
writing, and states amend these statutes every legislative
session. Your counsel's current-text read governs.

***

## Section 2 — The common obligations matrix

Despite the different names, the statutes share one rights core.
Each row maps a right to the states that grant it and to the Orbit
control that fulfils it:

| Right | Granted by | Orbit control |
| - | - | - |
| **Know / access** | All eighteen | `POST /compliance/dsar` with `request_type: "know"` |
| **Delete** | All eighteen | `request_type: "delete"`, with the signed proof-of-deletion certificate as your fulfilment receipt |
| **Correct** | All except Utah and Iowa | `request_type: "correct"` |
| **Opt out of sale** | All eighteen | `request_type: "opt_out_sale"`; fulfilment writes the suppression ledger every send reads |
| **Opt out of targeted advertising** | All eighteen | Consent opt-out on the advertising channel plus the suppression ledger |
| **Limit use of sensitive data** | Opt-in states and CPRA; Utah and Iowa as opt-out | `request_type: "limit_sensitive_pi"`, or a consent opt-out recorded per channel |
| **Universal opt-out signal (GPC)** | The states marked below | Honour the signal at your consent layer; interpretation is tenant-owned |

**States whose rules require honouring a universal opt-out
signal** such as the Global Privacy Control at the time of
writing: Colorado, Connecticut, Delaware, Kentucky, Maryland,
Minnesota, Nebraska, New Hampshire, New Jersey, Oregon, Rhode
Island, and Texas. Virginia, Utah, Iowa, Indiana, Montana, and
Tennessee do not mandate it in statute. Several states add a
universal-opt-out mandate by rule after their effective date, so
treat this column as the starting question for counsel, not the
answer.

***

## Section 3 — Tenant-owned Orbit controls for each obligation

Every obligation in the matrix resolves onto a control that ships
today. The endpoints below are rooted at
`https://api.orbit.devotel.io/api/v1/compliance`.

| Obligation | Surface | What it does |
| - | - | - |
| Rights requests (know / delete / correct / opt-out / limit) | [DSAR](/compliance/dsar) | One intake (`POST /compliance/dsar`), the verification gate, the SLA tracker, and the proof-of-deletion certificate. |
| Statute attribution on a request | `requester_statement` on the DSAR intake | The enum has no per-state code; the statement carries the statute, e.g. "Colorado CPA §6-1-1304 access request." |
| Opt-in and opt-out recording, incl. GPC | [Consent Management](/compliance/consent-management) | `POST /compliance/consent` per identifier and channel; an opt-out also lands on the suppression list. |
| Opt-out enforcement at send | [Opt-Out & Suppression Lists](/compliance/opt-out-suppression) | The ledger every outbound gate reads; bulk import and export for your existing lists. |
| What you process, and why | [Privacy Register](/compliance/privacy-register) | The processing-activity record several statutes' "categories of processing" disclosures mirror. |
| Where data lives | [Data Residency](/compliance/data-residency-overview) | Fine-grained jurisdiction codes (`US-CA`, `US-CO`, …) stamped at write time so fulfilment and audit reads resolve the state; [pin, lock, migrate](/guides/data-residency-pin-lock-migrate) for residency commitments. |
| Evidence for a regulator or buyer | [Evidence Binder](/compliance/evidence-binder) | Exports your request and consent history as the artefact you hand over. |

Filing a request under a statute the enum does not name: use the
nearest jurisdiction code so the right SLA window applies, and put
the statute in `requester_statement`. The CPA's 45-day response
window matches the `cpra` clock, so a Colorado access request files
as:

```bash theme={null}
curl -X POST https://api.orbit.devotel.io/api/v1/compliance/dsar \
  -H "X-API-Key: dv_live_sk_..." \
  -H "Content-Type: application/json" \
  -d '{
    "subject_email": "jordan@example.com",
    "requester_email": "jordan@example.com",
    "applicable_jurisdiction": "cpra",
    "request_type": "know",
    "requester_statement": "Colorado CPA §6-1-1304 access request; filed under cpra for the matching 45-day window."
  }'
```

The same rule the DSAR page states for Art 18 holds here: the clock
and the verbs are the platform's; the judgement that the statute
applies, and which one, is yours.

***

## Section 4 — GPC and universal opt-out handling

A Global Privacy Control signal arrives with the consumer's
browser traffic; **interpreting it is tenant-owned.** Orbit does not
ingest GPC on your behalf and does not decide what an honoured
signal means for your use cases — the consent page is where the
decision lands:

1. Your web property reads the `Sec-GPC` header or the JS signal and
   maps it to the opt-outs the applicable state rules require —
   typically sale and targeted advertising.
2. Record the outcome with `POST /compliance/consent`: `opt_in:
   false`, the affected `channels`, a `source` such as
   `gpc_signal`, and a `metadata` object carrying the state and
   statute the signal was honoured for (e.g.
   `"metadata": {"state": "US-CO", "statute": "CPA"}`). The write
   updates the consent audit table, the contact's channel
   preferences, and the suppression list in one call.
3. Verify with `GET /compliance/consent/lookup` that the pair reads
   as opted-out before the next send.

Because an opt-out write also lands on the suppression list, an
honoured GPC signal is enforced at dispatch, not merely recorded —
the same guarantee a California `opt_out_sale` fulfilment gets.

***

## Section 5 — Worked example: a Colorado-domiciled contact

A tenant with a marketing list that includes Colorado residents
assembles the posture in four moves:

<Steps>
  <Step title="Determine applicability with counsel">
    The CPA applies past its thresholds and outside its carve-outs
    (Section 7). Nothing on Orbit changes until your counsel says it
    applies; everything below is the configuration that follows.
  </Step>

  <Step title="Record consent with the state attached">
    For each Colorado contact, record the marketing opt-in through
    `POST /compliance/consent` with `metadata` carrying
    `{"state": "US-CO", "statute": "CPA"}`. Record sensitive-data
    consents separately: Colorado is an opt-in state, so sensitive
    categories need their own affirmative grant, not a notice.
  </Step>

  <Step title="Honour GPC for Colorado traffic">
    Wire the Section 4 flow: your site reads the signal, and the
    opt-out for sale and targeted advertising is recorded with
    `source: "gpc_signal"` so the audit table shows how each opt-out
    arrived.
  </Step>

  <Step title="Stand up the request pipeline">
    Publish the [self-service DSAR portal](/guides/self-service-dsar-portal)
    link in your privacy policy, and train support to file incoming
    requests as in Section 3 — `cpra` for the 45-day window, the CPA
    citation in `requester_statement`. Track the queue on
    `GET /compliance/dsar/sla`; the tiers scale to the request's own
    window.
  </Step>
</Steps>

The same assembly works for any state in the map; only the
`metadata` values, the GPC column, and the sensitive-data treatment
(opt-in vs opt-out) change per family.

***

## Section 6 — When state law does NOT apply

Every statute in the map carves data out that another regime
already governs. The common carve-outs, all state-specific in
detail:

* **HIPAA / PHI** — protected health information under HIPAA is
  outside the state privacy statutes; Orbit's separate
  [HIPAA posture](/compliance/hipaa-posture-guide) governs it.
* **GLBA and FCRA** — financial-institution and consumer-reporting
  data sit under their federal regimes.
* **DPPA** — motor-vehicle records stay under the federal Driver's
  Privacy Protection Act.
* **Children's data** — minors' privacy is handled federally (COPPA)
  and by state statutes' heightened protections for known minors;
  the comprehensive statutes defer rather than duplicate.
* **Employment and B2B records** — employee/beneficiary records and,
  in several states, business-contact data are carved out; the
  scope of the B2B carve-out varies state by state and has been
  sunset in some (California's among them).
* **Other wanteds** — nonprofits in some states, higher-education
  records, and public datasets variously fall outside.

The carve-out analysis is the first question for counsel, because
it can remove whole datasets from the posture before any control
is configured.

***

## Section 7 — Applicability thresholds: the legal-review callout

<Warning>
  Each statute reaches only businesses past its own thresholds,
  and the thresholds differ in kind, not just in number. Confirm
  your position against the current text with counsel; this list is
  the shape of the question, not the answer.
</Warning>

* **Consumer-volume thresholds** — the common form: personal data
  of 100,000+ state consumers, or 25,000 plus a share of gross
  revenue from selling personal data (Virginia pairs 25,000 with
  50%).
* **Pure revenue thresholds** — Texas reaches entities above a
  gross annual revenue floor regardless of volume, so a large
  tenant with few Texas contacts can still be in scope.
* **No volume threshold** — Indiana and Montana apply on a
  doing-business test with little or no volume gate, so they reach
  smaller tenants than the rest of the map.
* **Revenue-from-sale share** — several statutes' lower-volume arm
  turns on what percentage of your gross revenue comes from the
  sale of personal data, a figure your finance team, not this
  page, computes.

## Where this page sits in the posture group

This page sits in the Compliance nav group alongside the other
per-jurisdiction posture guides —
[GDPR](/compliance/gdpr-posture-guide),
[CCPA/CPRA](/compliance/ccpa-cpra-posture),
[TCPA](/compliance/tcpa-posture-guide),
[STIR/SHAKEN](/compliance/stir-shaken-posture-guide), and
[HIPAA](/compliance/hipaa-posture-guide) — and reads the same
sibling surfaces the California guide reads: the
[DSAR](/compliance/dsar) pipeline, the
[consent](/compliance/consent-management) records an opt-out lands
on, the [suppression ledger](/compliance/opt-out-suppression), and
the [data residency](/compliance/data-residency-overview) codes.

## Related references

* [CCPA/CPRA Posture](/compliance/ccpa-cpra-posture) — the
  California counterpart; the `applicable_jurisdiction` and
  `consumer_categories` subdivision in detail.
* [DSAR](/compliance/dsar) — intake, verification, SLA clock,
  proof-of-deletion certificate.
* [Consent Management](/compliance/consent-management) — the consent
  write that a GPC signal resolves onto.
* [Opt-Out & Suppression Lists](/compliance/opt-out-suppression) —
  the ledger that enforces opt-outs at dispatch.
* [Data Residency](/compliance/data-residency-overview) — the
  state-level jurisdiction codes on your records.
* [Posture overview](/compliance/posture-overview) — the
  tenant-owned framing this guide extends.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.