Omnichannel digital planning under five state privacy laws

What to take away

Start with where your audiences live

The United States has no single federal privacy statute covering commercial advertising data. Instead, a growing set of state laws applies to businesses based on their activities and ties to residents of those states, with requirements that vary by jurisdiction.

For planning purposes, a national campaign is really a bundle of state campaigns sharing creative and budget but not data rules. The same email, the same retargeting pixel, and the same loyalty offer can be lawful in one state and exposed in another.

Some state statutes use business or data-processing thresholds to define their scope. Where a law applies, a business can have duties for that state's residents even if it is headquartered elsewhere. A retailer in Ohio selling into Colorado, for example, should assess Colorado law's scope rather than rely on its location.

List the states where the brand meets a threshold, then list the states where it merely has customers. The second list is the risk list. The coverage tests for five statutes follow below; for any other state, read that statute's own applicability section.

This is why US state privacy laws deserve a standing slot in the planning calendar rather than a one-off legal review. Statutes are amended, thresholds shift, and new states come online, so the map is a moving target.

Budget follows the map. Consent management, preference centers, data mapping, and suppression logic all cost money, so the list of states decides where that spend goes first.

Five statutes side by side

The California Consumer Privacy Act (CCPA) is the model most other states have borrowed from, and the California Privacy Rights Act (CPRA) amended and expanded it. The single-state mechanics sit in the California planning guide.

The Attorney General says California voters approved Proposition 24, the CPRA, in November 2020, and its added protections began on January 1, 2023. The core consumer rights are access, deletion, correction, portability, and the right to opt out of sale or sharing.

Other states have adopted their own privacy statutes. Examples include Virginia's Consumer Data Protection Act (VCDPA), the Colorado Privacy Act (CPA), the Connecticut Data Privacy Act (CTDPA), the Utah Consumer Privacy Act (UCPA), and the Texas Data Privacy and Security Act (TDPSA). Their scope and requirements differ, so California's framework should not be treated as a national rulebook.

The table is a planning aid, not legal advice. It shows where a single national consent string can fail: a list that is out of scope in Virginia can be in scope in Connecticut, and the cure step differs from Virginia to Colorado.

Revenue tests sit beside the consumer counts. California's CCPA applies to for-profit businesses that meet a gross annual revenue test or the 100,000-resident test, among others. Virginia also covers businesses that process data of at least 25,000 consumers and derive more than half of gross revenue from the sale of personal data.

Penalty ceilings differ as much as coverage. In Virginia, the Attorney General may seek civil penalties of up to $7,500 for each violation. Colorado's statute sits inside its Consumer Protection Act.

Connecticut entities that violate the CTDPA face civil penalties under the Connecticut Unfair Trade Practices Act, and the Attorney General can also seek injunctive relief. California's agency lists fines of not more than $2,663 for each violation or $7,988 for each intentional violation, amounts in effect from January 1, 2025.

Which states require opt-out signals to be honored

Universal opt-out signals show why the differences matter. California's Attorney General says a user-enabled global privacy control, like the GPC, must be honored by covered businesses as a valid request to stop the sale or sharing of personal information.

Colorado's Attorney General says controllers must accept opt-out requests through universal opt-out mechanisms starting on July 1, 2024. Connecticut's Attorney General says that as of January 1, 2025, businesses covered under the CTDPA must honor universal opt out preference signals sent by Connecticut residents.

The three offices act together. California's attorney general and the California Privacy Protection Agency, alongside the attorneys general of Colorado and Connecticut, announced a joint investigative sweep involving potential noncompliance with the Global Privacy Control.

Treat frameworks as transport and statutes as the rulebook

The Interactive Advertising Bureau (IAB) and the Digital Advertising Alliance (DAA) each publish self-regulatory frameworks that many US advertisers rely on. Neither is a statute, and neither overrides state law, but both provide operational scaffolding.

The IAB framework consent approach centers on standardized transparency and consent strings that travel with an ad request. In practice this is how a publisher tells a downstream buyer what a consumer agreed to, in a machine-readable form.

The DAA advertising principles focus on notice, choice, and accountability, including the AdChoices icon and the DAA's own opt-out tools. They are widely used for interest-based advertising and are familiar to brand and agency teams.

State law and these frameworks overlap but do not align. A DAA opt-out may satisfy a self-regulatory commitment without satisfying a state opt-out right, and an IAB consent string may carry a signal that a state statute does not recognize.

The gap is widest for sensitive data, for universal opt-out signals, and for the treatment of data that is inferred rather than collected. Frameworks were built for a national market. Statutes were built for state residents.

The consent string is the envelope. The state statute decides what may lawfully go inside it and who may open it.

Plan consent as a set of permissions

Consent is not a single switch. In practice it is a set of permissions, and each state grants a different set. Check four of them for every campaign before any data moves.

Opt-out of sale and sharing comes first. California treats sharing for cross-context behavioral advertising as something a consumer can switch off. Some states cover only sale in the narrow sense, which leaves certain audience transfers outside the opt-out.

Sensitive data comes next. Precise location, health signals, and data about known children attract extra limits in some states and none in others. A campaign that relies on store-visit attribution is exposed here.

Universal opt-out signals are the third variable. California, Colorado and Connecticut require them to be honored, so confirm that the preference reaches every activation system. Do not treat browser or device signals as a national on/off switch.

Federal rules sit underneath all of this. The Children's Online Privacy Protection Act (COPPA) applies nationwide, so youth-facing channels need parental consent handling that no state patchwork can replace. The CAN-SPAM Act governs commercial email nationwide, while Federal Communications Commission (FCC) rules under the Telephone Consumer Protection Act (TCPA) cover texts and calls. State rules can be stricter, not looser.

Data flows follow the same logic. Collection, enrichment, activation, and measurement each need a state-aware permission check, and the check must run before the data moves, not after.

Build four owned layers

A workable model has four layers, and each layer has an owner. The layers are lawful basis, consent record, suppression path, and enforcement contact.

The lawful basis layer states, per state, why the brand may process the data. Consent, legitimate interest style balancing, and contractual necessity are not interchangeable across statutes, and some states simply do not recognize a category the brand relies on elsewhere.

The consent record layer stores what each person agreed to, when, under which state rule, and through which interface. Without a timestamped record tied to a state, an opt-out becomes impossible to prove.

The suppression path layer carries that record into every activation system: ad platforms, email, SMS, CRM, and retail media. A consent state that lives only in the consent platform is a compliance gap waiting to surface.

The enforcement contact layer names a person and an escalation route per state. When a complaint arrives, the clock starts immediately, and a generic inbox is not a plan.

The same planning logic can inform other regulated campaigns; see cannabis digital marketing compliance in the US.

For smaller teams, sequencing matters more than tooling. A documented manual process beats an undocumented automated one, and the small-team omnichannel media planning workflow can absorb the state layer without a rebuild.

Route complaints to the right enforcer

Enforcement is where the patchwork becomes operational. Different bodies have different powers, different priorities, and different appetites for penalties, so the contact layer needs one route per body.

Keep one page per market that lists the attorney general contact, the consumer protection office, the agency where one exists, and the person who answers. State attorneys general are the primary enforcers in most states. They receive complaints, issue investigative demands, and negotiate settlements. USAGov maintains a directory of state attorneys general that planners should keep alongside their market list.

State consumer protection offices handle adjacent complaints, and their intake routes often differ from the attorney general's. The state consumer protection offices directory is the practical starting point for a complaint response plan.

California is the outlier. The California Privacy Protection Agency has dedicated rulemaking and enforcement authority, and the attorney general also brings actions. That dual structure means two escalation paths in one state.

At the federal level, the Federal Trade Commission (FTC) polices unfair and deceptive practices under Section 5 of the Federal Trade Commission Act. The Commission also enforces other consumer protection statutes that prohibit specifically defined practices.

The FCC covers communications privacy, including texts and calls. The Securities and Exchange Commission (SEC) enters the picture when privacy failures become material disclosures for public companies.

Self-regulatory bodies matter too. The Better Business Bureau (BBB) administers the DAA's accountability program, so a consumer complaint can reach a brand through a non-governmental route with its own deadlines.

Reconcile a national campaign

Reconciliation is the work of making one national campaign lawful in every state it touches. It is a planning task, not a legal footnote.

Work through four passes in order, because each feeds the next: the data map decides which interfaces change, the interfaces decide what consent state reaches vendors, and the vendors decide what measurement can still see.

Start with a data map that names every field, its source, its destination, and the states where it is restricted. Then reconcile the consent interfaces. A single national banner that shows the same choices everywhere will either over-collect in strict states or under-inform in permissive ones.

Next, reconcile the vendor stack. Contracts must reflect state-specific limits on service providers and contractors, and downstream partners must accept the consent state you pass them.

Finally, reconcile measurement. Attribution models that rely on identifiers restricted in one state will quietly undercount there, which distorts the national picture and the budget that follows it.

Strong digital customer journeys already assume one promise across channels. In the US, that promise has to be kept under several different state rulebooks at once, and the planning model is what holds them together.

Common questions

Does a federal privacy law override state rules in the US?

No. There is no comprehensive federal commercial privacy statute, so state laws apply alongside sector rules like COPPA and CAN-SPAM. The FTC acts mainly against unfair or deceptive practices rather than under a general privacy code.

Is the CCPA the same as the CPRA?

No. The CCPA created the original consumer rights, and the CPRA amended and expanded it, adding elements such as the right to limit sensitive personal information. Most teams now treat the two as one California framework.

Do IAB framework consent strings satisfy state opt-out requirements?

Not by themselves. A consent string is a transport mechanism, and whether it satisfies a state depends on what it records and whether that state recognizes the signal. The state statute is the rulebook.

Which states require universal opt-out signals to be honored?

California treats a user-enabled global privacy control such as the GPC as a valid opt-out request. Colorado requires universal opt-out mechanisms from July 1, 2024, and Connecticut requires preference signals to be honored from January 1, 2025.

Which body enforces privacy complaints in most states?

The state attorney general in most cases, sometimes alongside a dedicated agency as in California. State consumer protection offices also take complaints, and the FTC handles federal unfairness and deception matters.

How often should a multi-state data plan be reviewed?

At least twice a year, and immediately after any new state statute takes effect or any threshold changes. Statutes are amended and new states come online, so a static plan ages badly.