State Privacy, Breach Notice and Data Security Laws: What Bites on a Business

Which state laws reach a business, and why

Executives often ask which state they are "subject to." That is the wrong question, because state law follows the person, not the office. A breach notice law attaches to the residents whose data you hold, wherever your servers sit. A data security statute attaches to the same residents or to your own state of operation. A consumer privacy law attaches when you cross a size or volume line. A health data or biometric law attaches to the kind of data. A monitoring-notice law attaches to where your employees work. A single company with customers in 12 states can be under all five kinds of law at once.

Federal law comes first in the order of operations. If you are a bank, a HIPAA-covered clinic or a company under the FTC Safeguards Rule, many state laws carve you out in whole or in part, and lesson 06 covers those. Read the exemption section of every state law you meet. It is usually the most important paragraph for a regulated business.

Breach notice laws: what all 50 share

The National Conference of State Legislatures (NCSL) reports that all 50 states, the District of Columbia, Guam, Puerto Rico and the Virgin Islands have laws requiring businesses, and in most cases government entities, to notify individuals of breaches involving personal information. That is the one safe sentence about breach law. Below that, the 50 laws differ in ways that matter on the worst week of your year.

The Privacy Rights Clearinghouse published a 2026 edition of its 50-state survey, covering statutes enacted as of January 1, 2026. Its headline counts, which I took from its summary page and could not cross-check against a second compilation, are these.

Compilations disagree at the edges, because "private right of action" can mean a claim written into the breach statute or a claim that a state's general consumer protection act allows. Use the survey as a map and read the actual statute of any state where your breach count is large.

The parts that are nearly universal

• Trigger. Unauthorized acquisition of computerized data that compromises the security of listed personal information. Many states add a harm test: no notice if you determine, and document, that misuse is not reasonably likely. Others, like Texas, treat acquisition as enough. A few include paper records.
• Data elements. A name plus one or more of a Social Security number, driver's license or state ID number, or a financial account or card number with its access code. Many states add medical information, health insurance numbers, biometric data, passport numbers or an online username with a password. This is a much narrower list than the personal data covered by privacy laws.
• Encryption safe harbor. Nearly all laws treat properly encrypted data as outside the trigger. The catch, which Texas states in the statute itself, is that encrypted data counts as breached if the thief also acquired the key. Check each state's wording before you call a lost laptop "encrypted."
• Owner versus maintainer. If you only store or process the data for someone else, you tell the owner immediately, and the owner notifies the individuals. Your contracts decide who pays. That belongs in the vendor lesson (lesson 09).
• Law enforcement delay. Notice can wait if a law enforcement agency says in writing or on the record that it would impede a criminal investigation.
• Substitute notice. When mailing costs too much or contact data is missing, you may post on your website, email where you can, and notify statewide media. The cost and head-count thresholds that allow this vary by state.
• Deemed compliance. Many states treat you as compliant if you follow your own notice policy that is consistent with the statute, or a federal regulator's rules (HIPAA, the banking agencies).

Four statutes read against the primary text

I read the statutes for these four jurisdictions directly. They show how far two states can sit from each other.

The practical lesson sits in the gap between the Idaho row and the other three. A business headquartered in Idaho with one customer in Albany owes New York's 30-day clock for that customer. The Idaho law does not shield you from it.

Idaho Code 28-51-104 to 107 in detail

Idaho's breach statute sits in Title 28, chapter 51, which is the identity theft chapter. Four sections do the work. I read each on legislature.idaho.gov, and the section 105 text was last amended in 2014, according to the history note on the page.

Idaho leaves out a few things. There is no day count, so the standard is reasonableness, and a regulator who sees a six-week silence after a confirmed theft is free to call it unreasonable. There is no required AG filing for businesses, though many companies send a courtesy copy anyway. And the statute itself creates no private right of action, which does not stop a plaintiff from pleading a negligence or consumer protection claim in a lawsuit. The $25,000 figure is a ceiling for intentional failure, so it caps the statutory fine. It does not cap the cost of a breach.

The same chapter has a rule that touches ordinary retail. Section 28-51-103 bars merchants that accept payment cards from printing more than the last five digits of the card number or the expiration date on a customer's receipt, with civil penalties of up to $250 for a first violation and $1,000 for later ones. It does not apply to handwritten or imprinted records. The card brands' own rules are in lesson 05.

Idaho and a full consumer privacy law

As of October 2026, Idaho has not enacted an omnibus consumer privacy law. Three checks support that. The IAPP's state tracker chart, last updated June 29, 2026, lists 23 states with signed laws and Idaho is not among them. The Idaho Legislature's 2026 bill list shows no bill with a title about consumer data privacy or personal data. It does show H0744, "Biometric identifiers," which adds to existing law provisions on the capture or use of biometric identifiers. On the page I read, it was introduced on February 20, referred to the Environment, Energy and Technology committee on February 23, and shows no further action, and the 2026 regular session has adjourned. The page says its entries come from unofficial daily journals, so I treat the bill's final status as not confirmed against the official journal. A secondary source also reports that Idaho signed a 2026 bill (Senate Bill 1299) barring government agencies from requiring a digital ID to access services. That concerns government, not business, and I did not read the bill.

Idaho's silence does not make an Idaho business exempt. An Idaho company that sells to residents of Texas, Oregon or California is a business "doing business" there under those states' laws and must run the same threshold test as anyone else.

The 23 states with a full consumer privacy law

The count depends on who is counting. The IAPP chart, updated June 29, 2026, lists 23 states. A law firm summary counts 24 by adding Florida, whose 2023 Digital Bill of Rights applies only to companies above $1 billion in global revenue that also meet an advertising, smart-speaker or app-store test. Another firm called Alabama the 21st and Vermont the 23rd on the dates of those articles. The totals differ by date and by whether Florida is counted. I use the IAPP list, which does not count Florida. Vermont's law was signed June 16, 2026. I found no later enactment, and I did not search each statehouse, so treat the count as correct to the end of the IAPP chart.

Dates are from the IAPP chart. Several states have also amended their laws since passage. Connecticut lowered its main threshold from 100,000 to 35,000 consumers and added rules for sensitive data and minors. The sources I read disagree on whether those changes took effect on July 1 or October 1, 2026, with one placing only the ban on selling precise geolocation data on October 1, so read the amending act before you rely on a date.

Thresholds: where a mid-sized firm lands

Most of these laws apply by volume of consumers, not by headcount. I verified the figures in this table against law-firm summaries of the statutes. For the older laws I did not re-check every number, so the table sticks to the laws I could confirm.

Two patterns decide most small and mid-sized cases. First, a firm with 10 to 500 employees often falls under consumer counts that look big until you count them: 100,000 consumers means 100,000 distinct people, and a regional distributor with 15,000 accounts is nowhere near. Second, California's revenue test and the low thresholds in Rhode Island, Vermont and Connecticut catch firms that count volume in the tens of thousands. Run the arithmetic for each state rather than assuming.

Exemptions you should read first

The Oklahoma summary shows the standard pattern. Entity-level exemptions cover state agencies, financial institutions covered by the Gramm-Leach-Bliley Act (GLBA), HIPAA covered entities and business associates, nonprofits and higher education. Data-level exemptions cover GLBA and HIPAA data, data regulated by the Fair Credit Reporting Act (FCRA) and the Family Educational Rights and Privacy Act (FERPA), employee and job applicant data, and business-to-business contact information. Most of the older state laws follow a similar template, though I did not confirm each one. California departs from it on employees, covered next. Entity-level exemptions differ: some laws exempt the whole GLBA institution and others exempt only the data, so a bank's non-GLBA marketing database may still be covered.

California: the law with the longest reach

The California Consumer Privacy Act (CCPA), amended by the California Privacy Rights Act, is the one most mid-sized firms need to take seriously, for four reasons.

• The revenue test. A for-profit business that does business in California and collects personal information is covered if its annual gross revenue exceeds $25 million as adjusted. The California Privacy Protection Agency (CPPA) posted the adjusted figure as $26,625,000, effective January 1, 2025. The other two tests are 100,000 consumers or households, and 50 percent of revenue from selling or sharing personal information.
• Employees and applicants count. The statute's employee and job-applicant exemption (section 1798.145(m)) states that it became inoperative on January 1, 2023. Staff data is now personal information with notice, access and deletion rights. Lesson 10 explains the HR side.
• Money. Administrative fines and civil penalties are up to $2,663 per violation, or $7,988 per intentional violation or one involving consumers the violator knows are under 16, as adjusted effective January 1, 2025. The private action for data breaches pays $107 to $799 per consumer per incident, or actual damages if greater, as adjusted. Those adjusted figures replaced $2,500, $7,500 and $100 to $750.
• The private action is narrow. Section 1798.150 lets a consumer sue when nonencrypted, nonredacted personal information (or an email address with a password or security answer that opens an account) is accessed, stolen or disclosed because the business failed in its duty to maintain reasonable security. This is the sharpest breach cost in state law, because it can be filed on behalf of a class.

The new audit, risk assessment and automated decision rules

The CPPA finalized regulations in September 2025 that add three duties. The CPPA's announcement says the regulations take effect January 1, 2026, with later compliance dates.

Who must do the audit? A law firm summary says a business is covered if its revenue exceeds the CCPA's inflation-adjusted threshold ($26,625,000 as of 2025) and it processes the personal information of 250,000 or more consumers or households, or the sensitive information of 50,000 or more consumers, or if it derives 50 percent or more of revenue from selling or sharing personal information. The CPPA's announcement ties the audit calendar to revenue tiers but does not define who must audit, and the regulation text was not read for this lesson, so verify those numbers in title 11 of the California Code of Regulations. Note what this means for a mid-sized firm: the audit list is an itemized security program, which is a management checklist you can build now. Lessons 02, 03 and 04 give you the layers and the framework mapping.

Health data, biometrics, AI and children

Some state laws ignore size entirely. These are the ones that turn up for small firms that do not expect it.

Washington My Health My Data Act

Washington's act (chapter 19.373 RCW) covers "consumer health data," defined to include data identifying a consumer's past, present or future physical or mental health status and health inferences drawn from non-health data. It applies to regulated entities that do business in Washington or target its consumers, which includes out-of-state firms, and to processors. According to the Washington Attorney General, the main duties began March 31, 2024 for regulated entities and June 30, 2024 for small businesses. Duties include a separate consumer health data privacy policy linked from the homepage, consent to collect or share, a valid authorization to sell (kept six years), deletion rights that reach archives and backups, and a geofencing restriction. A violation is a per se violation of the Washington Consumer Protection Act, and the AG says the act is enforceable by private action. A fitness studio, a supplement shop and a workplace wellness vendor can all hold this kind of data without being a health care provider.

Illinois Biometric Information Privacy Act

The Illinois Biometric Information Privacy Act (BIPA, 740 ILCS 14) governs fingerprints, face scans and similar identifiers. A private entity must publish a written retention and destruction policy (destroy when the purpose is met or within three years of the person's last interaction, whichever is first), give written notice and get a written release before collecting, never sell or profit from biometrics, and protect them at least as carefully as other confidential data. A person aggrieved can sue in state court for $1,000 or actual damages (negligent violation) or $5,000 or actual damages (intentional or reckless), plus attorney fees. Public Act 103-769, effective August 2, 2024, says repeated collection of the same identifier from the same person by the same method is one violation with at most one recovery. Disclosure works the same way. That amendment cut the per-scan stacking that produced the largest earlier verdicts, but a business that never got consent still faces a per-person claim, and a time clock that uses fingerprints for 300 Illinois workers is 300 potential claims. The statute text was checked through a Justia reproduction, not the official Illinois site, which blocked automated reading.

Colorado's AI statute

Colorado's 2024 AI law (SB 24-205) was delayed, then repealed and replaced. According to a law firm summary, Senate Bill 26-189 was signed May 14, 2026, takes effect January 1, 2027, and covers automated decision technology used in consequential decisions. Deployers must give notice, explain adverse outcomes within 30 days, and offer correction and human review. The replacement drops the earlier impact assessments and AG disclosures. Enforcement has a 60-day cure period that ends three years after the effective date. A federal lawsuit by xAI, with the Department of Justice intervening, produced a stipulated order pausing enforcement of the earlier law, and the summary expects challenges to the new one. I read only a secondary source on this, so treat the details as unconfirmed until you read the enrolled bill. Lesson 13 treats AI governance.

Children

Federal children's privacy (the Children's Online Privacy Protection Act) is in lesson 06. At the state level, the pattern is a ban on selling minors' data or targeted ads to them, such as New Hampshire's ban on selling children's data effective January 1, 2027 and Connecticut's added minors protections, and the age-appropriate design codes in some states. Those rules apply to sites and services that serve or know they have minors. If you run a kids' program, a school vendor service or a youth sports app, add these to your inventory. I did not verify each state's age cutoffs, so take them from the statute.

State data security statutes: the duty before the breach

Breach laws tell you what to do after the loss. Several states also require the program that would have prevented it. This is where a Massachusetts or New York customer list becomes a control requirement for a company elsewhere.

Together these are the written-program states. Several other states have a reasonable-security duty of their own, and I did not read each of them. The Massachusetts rule is the most specific, and many companies adopt its list as a baseline for everywhere because it is old, short and clear. If you already follow the CIS Controls IG1 safeguards or NIST CSF 2.0 from lesson 04, you probably meet every row, and a gap analysis against the Massachusetts list will tell you in an afternoon. Evidence is the issue: a WISP that exists as a policy with no training records, no access review and no vendor contracts will not survive an AG inquiry.

Employee data and monitoring

Your staff are residents of states too. In California, workers and applicants have CCPA rights, so notices at collection, access and deletion processes extend to HR systems, badge logs and monitoring tools. New York Civil Rights Law section 52-c requires an employer that monitors phone, email or internet use to give written notice at hire, get an acknowledgment, and post the notice conspicuously. Penalties are up to $500 for a first violation, $1,000 for a second and $3,000 for a third and later, and the AG enforces. Other states have narrower notice rules that I did not review. Where the rule is silent, most disputes arise from monitoring nobody told employees about, so the safe habit is one written notice that covers email, web filtering, endpoint tools, cameras and any location or keystroke tracking. See lesson 10 for the policy side and for biometrics used as time clocks, where BIPA applies.

Data broker registries

California requires data brokers to register annually with the CPPA, and the CPPA's page shows a January registration window (January 1 to 31 for 2025). Under the Delete Act, starting in 2026 consumers can ask the agency to delete their non-exempt personal information held by all registered brokers through a single platform (the Delete Request and Opt-out Platform, DROP, per a law-firm summary). The statute sets later dates for brokers to begin processing those requests, so confirm the current date on the CPPA's site. A Venable summary reports that Connecticut data broker registration begins January 1, 2027 and that New Jersey has a registration for data brokers and data collectors starting in spring 2027. Vermont, Texas and Oregon are commonly reported to run registries too, but I did not verify that in this session. Most mid-sized firms are not brokers. You are if you sell or license lists of people you have no relationship with, so check that definition before a marketing partner makes the decision for you.

Multi-state strategy: comply to the strictest, then stop

With customers in many states, the only workable plan is a single high-water mark. Build one program that meets the toughest requirement on each point, apply it everywhere, and track the places where a state demands something extra. The table below shows the usual choices.

The strategy has limits, and a manager should know where they are.

• Definitions differ. What counts as a "sale" ranges from any exchange for money to any exchange for other valuable consideration. The consumer data you can share without consent in one state can require an opt-out in the next.
• Some rules cannot be averaged. BIPA's written release and retention schedule have no analog in most states, and Washington's separate health policy page is its own document. You need a state-specific item.
• Cure periods expire. Colorado's general cure period for its privacy act was repealed effective January 1, 2025 (the statute's own editor's note), and a separate 60-day cure for its newer minors provisions is repealed effective December 31, 2026. Oregon's cure period is reported to have expired January 1, 2026. A plan that assumed "we get a chance to fix it" may now be wrong in those states.
• Private lawsuits do not follow the AG rules. California's CCPA breach claim, BIPA and Washington's act can reach you without a regulator in the room. Compliance with the strictest AG rule does not reduce that exposure.
• Federal carve-outs differ by state. A GLBA bank may be exempt entity-wide in one state and data-only in another.
• Some provisions arrive on dates. California's ADMT and audit rules, Louisiana and Oklahoma on January 1, 2027, Alabama on May 1, 2027 and Vermont on January 1, 2028 mean the high-water mark moves. Re-run it at least once a year.

Decision table: which state laws am I likely under?

Questions to ask your IT provider and your compliance lead

• Which states are our customers, patients and employees in, by count, and where is that list kept?
• For each of our top five states by resident count, what is the breach clock and who files the AG form?
• Do we have a written information security program that meets the Massachusetts 201 CMR 17.00 list, and where is the evidence for each item?
• Which of our systems hold health data, biometrics or children's data, and who approved collecting it?
• Where do our vendors store resident data, and does each contract require them to tell us of a breach in a fixed number of days?
• Have we run the revenue and consumer-count tests for California and the omnibus states, and when did we last re-run them?
• Is our encryption on laptops and phones enforced by a tool we can report on, or by policy only?
• Have we given employees the written monitoring notice New York and our own policy call for?

Where this stands, and what I could not verify

Read directly from primary text this session: Idaho Code 28-51-104 and 105 (and a summary of 106 and 107 from the chapter PDF), Texas Business and Commerce Code 521.053, 521.052, 521.151, 541.107 and 541.155 on a public statute mirror, New York GBL 899-aa and 899-bb and Civil Rights Law 52-c, Massachusetts 201 CMR 17.00, Oregon ORS 646A.622, the CCPA statute PDF and the CPPA's monetary threshold page, the Washington AG's health data page, and the 2026 Idaho bill list. California Civil Code 1798.82 came from the Justia reproduction of the code, which cites SB 446, effective January 1, 2026, and Illinois BIPA also came from Justia because the Illinois site blocked my reader.

Not confirmed against primary sources: the state counts in the Privacy Rights Clearinghouse survey (36, 24 and 20 states), which match the survey's own summary page but were not cross-checked against a second compilation; thresholds for the older consumer privacy laws other than those in the table; Alabama's penalty figure; the CCPA cybersecurity audit applicability thresholds and the risk assessment dates beyond the CPPA's announcement; Connecticut's amendment dates; Colorado SB 26-189 details beyond a secondary law-firm summary dated May 27, 2026; Idaho H0744's final status and the Idaho digital ID bill; the data broker registry details for Vermont, Texas, Oregon, Connecticut and New Jersey; New York's penalty amounts under GBL 350-d for SHIELD Act violations; Oregon's cure period expiry date; and any law enacted after the IAPP chart's June 29, 2026 date. State legislatures also amend breach laws often, so recheck each statute you rely on before you put a date in a contract or an incident plan.

Questions and answers

If we have only 12 employees, do state privacy laws apply to us at all?

Breach notice and data security duties apply to any size. They attach to the data you hold, not your headcount. Consumer privacy laws usually need a volume or revenue threshold, but California's revenue test and the very low thresholds in Rhode Island and Vermont can catch small firms, and Washington's health data law and Illinois BIPA have no size floor.

Our customers are all businesses, not consumers. Are we exempt?

Often partly. Many state privacy laws exempt business-to-business contact data and employee data, and several define "consumer" as an individual acting in a personal or household context. The breach laws are different. They cover employee records and the names and numbers of individuals in a business customer's files, so a B2B firm can still owe notice.

Do we have to notify the Idaho Attorney General after a breach?

Section 28-51-105 does not require a business to notify the Idaho AG. It requires notice to affected Idaho residents and, if you only maintain the data, to the owner. Agencies have a 24-hour AG notice. If your breach also involves residents of Texas, New York, California or other states, those states may require a filing, and the Idaho AG is your primary regulator for enforcement if you are not federally or state licensed.

How do I know whether my data was "encrypted" for breach law purposes?

Ask whether the data was encrypted at the time of the loss with a recognized method, whether the key stayed secret, and whether the data was in the form the thief obtained. A backup drive encrypted with a key that sat on the same server is not protected. Idaho's definition turns on unencrypted data being acquired, and Texas counts encrypted data as breached if the key was also acquired.

What is the quickest way to see whether we cross a consumer privacy threshold?

Count distinct residents by state in your customer, subscriber and website data for the calendar year, then compare to each state's number. Include the share of revenue from selling or sharing data. Exclude data the law exempts, such as employee data in many states. Save the worksheet with a date, and re-run it every January.

Does a SOC 2 report or ISO 27001 certificate satisfy these laws?

Neither is named in the breach statutes. They help as evidence of reasonable security under the data security laws, and California's coming audit duty will resemble them. Neither replaces notice duties, a written program in Massachusetts, or consent rules for health data and biometrics. Lesson 04 explains what each document proves.

What do we do about employees who work remotely in another state?

Treat each state where staff live as a place where you employ people. Their data is covered by that state's breach law, and monitoring notice rules such as New York's can apply to staff working there. Add each state to your exposure sheet on the day the first person is hired there.

Will a federal privacy law replace all this?

I found no enacted federal omnibus privacy law, and the state laws are still being added to, as the 2026 enactments in Oklahoma, Alabama, Louisiana and Vermont show. Plan for the state patchwork to continue. Federal sector rules (HIPAA, GLBA, COPPA) already sit on top in lesson 06 and sometimes preempt or exempt.

Hard questions

"A single national standard would be simpler. Why should a small firm track dozens of laws?"

You do not track 50 laws. You track four things: the 30-day breach clock, the AG filings, a written program, and the volume tests that decide the consumer privacy laws. The high-water-mark program covers most of the rest. The cost of the patchwork is real, and it falls hardest on firms with no compliance staff. Until Congress acts, the answer is a single process, not 50.

"Idaho has no consumer privacy law. Isn't that a competitive advantage for Idaho businesses?"

Only for data about Idaho residents. A firm that sells beyond the state lives under the laws of its customers' states. Large buyers also pass those laws into contracts, so a vendor that cannot answer a privacy questionnaire loses the sale whatever Idaho law says. What Idaho's gap does change is the rights Idaho residents have to see or delete data about them, which is a policy choice and not an operating rule for your company.

"These per-person damages in California and Illinois are extortion for technical violations."

Critics of the private actions make that argument, and Illinois answered it in part with its 2024 amendment limiting recovery to one per person for repeated collection by the same method. Supporters point out that regulators cannot police millions of small violations and that statutory damages give individuals a remedy where actual loss is hard to prove. For a manager the point is practical: the exposure exists, the defense is documented consent and documented security, and arguing about its fairness does not reduce the number.

"We never had a breach. Why spend on a written program?"

Because the first time you are asked for it is the worst time to write it. Massachusetts requires the program whether or not you have a breach. In New York and Oregon it is the safest evidence that your safeguards were reasonable, and in California it is the main defense to the breach claim. Insurers also ask for it at renewal.

"If we comply with the strictest state, why worry about the differences?"

Because some laws are different in kind, with no stricter and looser versions to choose between. Illinois wants a written release for biometrics, Washington wants a separate health policy page, Texas gives small businesses a different rule, and cure periods that existed last year may have ended. The high-water mark gets you most of the way. The state-specific items are the ones regulators and plaintiffs find first.