US state privacy laws digital marketing teams: overview

What to take away

State privacy law in the United States is a compliance patchwork, not a single regime, and digital marketing teams carry most of the operational work of keeping it current. Virginia's VCDPA applies according to its coverage criteria; selling to a Virginia resident alone does not establish coverage.

Which agencies enforce state privacy law

California runs two enforcers. The California Privacy Protection Agency writes rules and investigates, while the Attorney General brings civil actions. The California Attorney General CCPA page lists consumer rights and business duties, and it is the page to read before you edit a consent banner.

Virginia, Colorado and Connecticut place enforcement with their attorneys general. Utah uses the Division of Consumer Protection inside the Department of Commerce. All five states allow civil penalties, and none require a consumer to prove financial loss before a regulator acts.

The FTC can act on a false privacy notice as a deceptive practice. Its privacy and security guidance describes the standard it applies to data handling. A team that follows only one state statute can still face a federal claim.

For the workflow that decides which data you collect, see digital marketing strategy.

What a compliant notice and opt-out must contain

California adds rights to know, delete, correct and limit the use of sensitive data. Virginia and Colorado add rights to opt out of profiling and targeted advertising.

Opt-out mechanics must be easy. California requires a Do Not Sell or Share My Personal Information link and honors global opt-out preference signals. Colorado and Connecticut require a universal opt-out mechanism. Utah requires a clear method but does not mandate a universal signal.

A disclosure that lists vendors by name but hides the purpose fails the test. A consumer must be able to understand what happens to their data without reading a contract.

The same clarity standard applies across channels, which is why omnichannel marketing work should start from a single data inventory.

Records that survive an enforcement letter

Keep these for at least 24 months after collection, and longer if your own notice sets a longer period.

A written data map is the difference between a fast answer and a 45-day extension request. Regulators ask for the map, not a summary paragraph.

The NIST Privacy Framework is voluntary, but it gives a defensible structure for the same records if you want a standard to cite.

What happens when you miss the deadline

California gives a business 45 days to respond to a rights request and allows a 45-day extension with notice. Missing that deadline is itself a violation. The CPRA ended the mandatory 30-day cure period for most violations, so the Attorney General can seek civil penalties on a first offense.

The FTC can bring an action for unfair or deceptive practices, and it has done so over privacy promises that did not match practice. A consent order can bind a company for 20 years and require third-party assessments.

Your digital customer journeys map is often the exhibit that shows whether an opt-out actually stopped the data flow.

Where the state rules diverge

The USA.gov laws and regulations portal links to state statutes if you sell into a state beyond these five. Texas, Oregon and Montana also have laws of their own: the Texas Data Privacy and Security Act (TDPSA), the Oregon Consumer Privacy Act (OCPA), and the Montana Consumer Data Privacy Act (MCDPA).

When you pick vendors, ask whether their consent tools support every signal on the list. The guide to choosing digital marketing platforms covers that question.

Common questions