State-by-state breakdowns and practical explainers on US privacy law, written for business owners. Our launch series is live — start with the flagship.
The applicability hub: how thresholds and exemptions work across the states, the questions that determine whether you're covered, and the honest "most SMBs aren't" framing. Start here.
The Texas Data Privacy and Security Act exempts small businesses as defined by the SBA — which makes Texas the best worked example of why exemptions matter as much as thresholds. Who's actually covered, and who isn't.
What's in the law, who it applies to, the consumer rights you'll need to honor, and a realistic prep timeline for a small team before the effective date.
Same date as Oklahoma, different details — California-style thresholds instead of the standard model. Applicability, requirements, and what to do before January 1, in plain English.
Spring 2027 brings Alabama's law — with the lowest thresholds of the three 2027 states and a kids'-data rule worth knowing. How to use the extra four months wisely.
The honest answer: usually nothing — until it isn't. Real fines, the CIPA lawsuit wave and its 2026 defunding, and the specific situations where ignoring the law gets expensive.
E-commerce stores sell across state lines by default — which makes applicability messier for Shopify sellers than for local businesses. The thresholds that matter and the practical first steps.
The Multi-State Privacy Starter Pack ($49) covers all of this and more today, or start with the free 20-question checklist.
Get the free checklistBlog articles on Privacy Patchwork are general educational information about US state privacy laws, not legal advice. Laws change and their application depends on your specific facts — verify deadlines and requirements against official sources, and consult a licensed privacy attorney in your state if you're unsure.