One website, a growing number of state statutes

What it is

Beyond California, a substantial and growing number of US states have enacted comprehensive consumer privacy laws. They share a common core, drawn largely from the Virginia model, and differ on thresholds, definitions, cure periods and enforcement.

Does it apply to you

• You process personal data about residents of a state with such a law, above that state’s processing threshold. Thresholds are usually expressed as a number of consumers per year, with a lower number where data is sold.
• Note that most of these statutes have no revenue threshold at all, unlike California. A modest business with a lot of website visitors can be in scope in several states while being out of scope in California.
• Some statutes exempt non-profits, or entities already regulated under sector laws such as HIPAA or the Gramm-Leach-Bliley Act. The exemptions differ state by state.

What being wrong costs

Enforcement is generally by the state attorney general, with civil penalties per violation. Several states offer a cure period during which a business can fix a violation before enforcement, and some of those cure periods are written to expire. Because the statutes commence on staggered dates, a website that was compliant everywhere last year may not be this year without anything about it having changed.

What it demands

• A privacy notice covering categories, purposes, sharing, and how to exercise rights.
• Access, deletion, correction and portability rights, plus an opt-out of targeted advertising, sale, and certain profiling.
• Recognition of a universal opt-out signal, which several states now require.
• A data protection assessment for higher-risk processing such as targeted advertising or sensitive data.

What WebSpark does

• One consent and preference mechanism that reads region from the request and applies the appropriate rule, rather than a banner that behaves identically everywhere.
• Universal opt-out signals are honored.
• Requests are logged with their date and the governing policy version, and tracked against the shortest applicable deadline.

What you can show

• A request log with dates, outcomes and deadlines.
• A consent log showing region, what was asked and what was chosen.

What stays yours

• Knowing which states your customers are in, and whether you cross a threshold there.
• Data protection assessments, which describe business decisions we are not party to.