US data privacy laws: what startup founders should know

October 13, 2026

The US has no single privacy law. Startups deal with three layers: federal laws for specific kinds of data (health, financial, children’s, marketing), comprehensive consumer privacy laws in about 20 states, and the FTC, which goes after companies that break their own privacy promises. Most seed-stage startups fall below the state laws’ size thresholds. But you still need an accurate privacy policy, you may need to honor opt-outs if you run ad pixels, and stricter rules apply as soon as you handle health, biometric, location or children’s data.

Key takeaways

Most state privacy laws apply only above a size threshold, usually data on 100,000 people a year in that state.
Your privacy policy must match what you actually do. The FTC and state attorneys general enforce that against companies of any size.
Health, biometric, precise location and children’s data trigger stricter rules, some with no size threshold.
Running advertising pixels counts as “sharing” data under many state laws.

Is there a federal privacy law?

No comprehensive one. Congress has considered several bills, but none has passed. Federal law covers specific kinds of data (see below), and the FTC treats misleading privacy practices as unfair or deceptive, which in practice means you must do what your privacy policy says.

Which state privacy laws are in force?

As of 2026, comprehensive consumer privacy laws are in force in California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia. Florida has one that applies only to very large companies. Oklahoma, Alabama and Louisiana take effect in 2027 and Vermont in 2028, and more states are considering bills. California’s law (the CCPA, as amended by the CPRA) is the most demanding and has its own enforcement agency.

Does my startup meet the thresholds?

Probably not yet, for most of them. The typical rule:

Most states: you collect data on 100,000 or more residents of that state a year, or a smaller number (often 25,000) if a large share of your revenue comes from selling data. A few states, including Connecticut, Maryland and Rhode Island, set lower numbers.
California: about $25 million or more in annual revenue (adjusted for inflation), data on 100,000 or more California residents or households, or half your revenue from selling or sharing data.
Texas: no numeric threshold, but an exemption for businesses that qualify as small businesses.

Count website visitors and app users, not just customers. A consumer app with modest revenue can cross 100,000 people quickly.

What do these laws require?

If you’re covered, the common requirements are:

A privacy policy describing what you collect, why, and who you share it with
Rights for consumers to access, correct, delete and get a copy of their data
An opt-out of sale, targeted advertising and certain profiling, including honoring browser opt-out signals like Global Privacy Control, which many states now require
Consent before processing sensitive data (health, biometrics, precise location, race, sexual orientation and similar) in most states
Contracts with vendors that process data for you
Risk assessments for high-risk processing

Ad pixels: sharing data with Meta or Google pixels is generally treated as sale or sharing for targeted advertising. If you’re covered, you need an opt-out link and opt-out signal handling. See Does My Startup Need a Privacy Policy?

Which other privacy laws might apply, regardless of size?

COPPA: if your service is aimed at children under 13 or you knowingly collect their data. Updated rules took effect in 2026.
HIPAA: if you handle health information for healthcare providers or health plans.
Washington’s My Health My Data Act: covers consumer health data, such as from wellness, fitness or period-tracking apps, with no size threshold, and lets consumers sue. Nevada and Connecticut have similar provisions.
Illinois’ biometric privacy law (BIPA): requires written consent before collecting fingerprints, face scans or voiceprints, and lets individuals sue.
GLBA: for fintech and financial services.
FCRA: if you use or provide consumer reports, such as background checks.
CAN-SPAM: commercial email.
TCPA: calls and texts, especially automated ones.
Call recording: about a dozen states, including California, Florida, Illinois, Maryland, Massachusetts, Pennsylvania and Washington, require every party’s consent. Announce recording on every call.
Video Privacy Protection Act: if you share information about what users watch.

What about users outside the US?

If you offer your product to people in the EU or UK, or monitor their behavior, GDPR can apply regardless of where your company is. Canada, Brazil and many other countries have their own laws. See GDPR Basics.

What happens if we ignore them?

Enforcement comes mainly from state attorneys general, California’s privacy agency and the FTC, with fines calculated per violation that add up quickly. Most state laws don’t let consumers sue, but California’s data breach rule, Washington’s health data law and Illinois’ biometric law do, and those drive class actions. Privacy problems also show up in enterprise sales reviews and in investor and acquirer due diligence.

See our Terms of Service & Privacy Policy service.