What Happens If a Small Business Ignores State Privacy Laws?

Privacy vendors have a business model built on scaring you. ("Your website could cost you millions!" — from a company selling the solution.) This article does the opposite: the actual enforcement record, the actual lawsuit wave, and an honest map of when ignoring the law is fine, when it's a gamble, and when it's genuinely dangerous.

When ignoring it is fine: below the thresholds

Here's the baseline reality: every comprehensive state privacy law has applicability thresholds, and most true small businesses fall below them. A 15-person company with 4,000 customers isn't covered by California's, Virginia's, or Colorado's law. No coverage means no obligations — and no obligations means no penalties.

On top of that, enforcement of the comprehensive laws belongs exclusively to state attorneys general — consumers can't sue you directly under them. AGs have limited staff and tend to start with the biggest, most visible violators. A small business below the thresholds, with no complaints against it, is not where enforcement begins.

So if you've run the applicability test honestly and you're below every line: you're fine. Re-check yearly. That's the whole strategy.

When it stops being fine: the real risk vectors

1. The lawsuit shakedown (California's CIPA wave)

The biggest real-world danger to small businesses hasn't come from the comprehensive privacy laws at all — it's come from an old California wiretapping law being aimed at modern websites.

California's Invasion of Privacy Act (CIPA), a 1967 statute, was repurposed by plaintiffs' lawyers who argued that common website tools — Google Analytics, the Meta Pixel, session-replay software — "intercept" visitor communications. The statutory penalty: $5,000 per violation. Lawyers found California residents who'd visited small-business websites and filed putative class actions, with settlement demands from $50,000 to $200,000 per business. For a small company, settling was cheaper than fighting — which was the point.

Thousands of these lawsuits and demand letters were filed. Then, in October 2026, Governor Newsom signed SB 690, stripping the private right of action from the most-abused provision — explicitly calling out the "vexatious use of CIPA lawsuits and demand letters to extract settlement money from small businesses." The change applies retroactively to claims from the past two years.

2. Attorney-general enforcement (growing, and aimed upward)

State AGs are enforcing — and the numbers are real:

Other states' headline figures: New Jersey allows up to $10,000 for a first violation and $20,000 for subsequent ones; New Hampshire up to $10,000 per violation; Texas up to $7,500 per violation after a 30-day cure period.

The pattern: enforcement starts with large, visible companies and data brokers — not 12-person shops. But the fines establish the ceiling, and AGs have shown they'll go downmarket once the big cases are done.

3. Crossing a threshold without noticing

The quietest risk: growth. A business at 60,000 consumers isn't covered anywhere; at 110,000, it's covered in a dozen states. Nobody sends you a letter when you cross the line — the obligation just attaches. This is the strongest argument for the yearly 30-minute applicability check: the risk isn't today's size, it's not noticing you've outgrown it.

4. The things that draw attention regardless of size

Certain practices raise your profile with regulators and plaintiffs' lawyers even below thresholds:

• No privacy policy at all — the single most common red flag, and the cheapest thing to fix.
• Ignoring opt-out requests you do receive — nothing turns a small issue into a big one faster.
• Selling or sharing sensitive data (health, precise location, children's data) — the category every law treats most seriously, and the one place even Texas's small-business exemption doesn't fully protect you.
• A data breach with no security basics — breach-notification laws in nearly every state apply regardless of the privacy-law thresholds.

The cure periods: your grace, if you need it

Almost every state gives first-time violators a right to cure — notice from the AG and 30 to 60 days to fix the problem before penalties attach. (Oklahoma and Louisiana: 30 days; Alabama: 45; New Hampshire: 60 days through 2025.) Some of these sunsets are already expiring, so don't treat cure periods as permanent — but they mean an honest mistake, promptly fixed, rarely becomes a fine on the first encounter.

Watch: the privacy traps businesses are missing

Video: "Your Website Could Get You Sued — The Privacy Traps Businesses Are Missing" (The Money Path podcast, with a compliance founder) — on outdated privacy policies, cookie tools, and why small businesses get hit. We haven't watched it end-to-end; verify anything you act on.

The bottom line

Ignoring state privacy laws is safe if you're below the thresholds and doing the basics (have a privacy policy, honor opt-outs, don't sell sensitive data). It becomes a gamble as you grow past thresholds without noticing, or if you draw attention through sloppy practices. And it's dangerous if you're covered and doing nothing — the fines are real, the AGs are active, and the cure periods won't last forever.

The good news: the fix for most small businesses is an afternoon's work, not a compliance department. Our free 20-question checklist tells you which category you're in; the $49 Starter Pack covers the full readiness system if you're covered.

The penalty landscape, state by state

Two patterns to notice. First: the comprehensive privacy laws are AG-enforced with cure periods — the system is designed to bring businesses into compliance, not to ambush them. Second: the real small-business pain came from outside the comprehensive laws (CIPA's private lawsuits), which is exactly why that wave's defunding matters more than any single fine.

The enforcement pyramid: who gets hit first

It helps to think of enforcement as a pyramid, widest at the bottom:

• Top — the giants: national retailers, data brokers, Big Tech. This is where every AG starts — visible wins, big fines, precedent-setting. The $1.35M California retailer fine lives here.
• Middle — the careless mid-size: companies with real consumer counts, no privacy program, and complaints on file. Data brokers operating unregistered ($62K and $56.6K fines) live here.
• Bottom — everyone else: small businesses below thresholds, or above them but making good-faith efforts. AGs have limited staff; they don't start here.

Your goal isn't to be invisible — it's to be boring: below the lines, or above them with the basics done. Boring businesses don't generate complaints, and complaints are what start investigations.

What to do if you get a demand letter

If a letter arrives alleging privacy violations, don't panic — and don't pay on reflex:

1. Read what law it cites. CIPA-based demands sit in a very different (and now much weaker) legal position than an AG notice under a comprehensive privacy law. The October 2026 SB 690 change retroactively weakened pen-register CIPA claims from the past two years.
2. Check the sender. AG notices come from the state; demand letters from plaintiffs' firms are settlement shakedowns until proven otherwise.
3. Preserve, don't delete. Don't destroy logs, emails, or data related to the claim — spoliation makes everything worse.
4. Call a lawyer before the deadline in the letter. Not after. Many of these letters count on the recipient missing the response window.
5. Fix the underlying issue anyway. Whether or not the claim has merit, a missing privacy policy or broken opt-out is worth fixing on its own.