state-law-applicability

The saved excerpt is a snapshot from review. The external source remains the complete and most current version.

---
name: state-law-applicability
description: >-
  US state privacy law applicability assessment tool. Evaluates revenue
  thresholds, data volume thresholds, business exemptions (GLBA, HIPAA,
  nonprofits), employee data carve-outs, and SBA small business
  determinations across all enacted state privacy laws.
license: Apache-2.0
metadata:
  author: mukul975
  version: "1.0"
  domain: privacy
  subdomain: us-state-privacy-laws
  tags: "applicability, thresholds, exemptions, glba, hipaa, small-business"
---

# State Privacy Law Applicability Assessment

## Overview

Determining which US state privacy laws apply to an organization requires evaluating multiple criteria: revenue thresholds, consumer/data volume thresholds, industry-specific exemptions, entity-type exemptions, and data-type exemptions. This skill provides a systematic assessment framework and Python automation tool for evaluating applicability across all major enacted state privacy laws.

## Assessment Framework

### Step 1: Geographic Nexus

For each state, determine if the organization has nexus through:
- **Conducting business** in the state (physical presence, employees, registered entity)
- **Targeting residents** of the state (marketing, advertising, or providing products/services specifically to state residents)
- **Producing products/services** consumed by state residents

Most state laws use "conducts business in [state] OR produces products or services targeted to [state] residents" as the nexus requirement.

### Step 2: Threshold Assessment

| State | Threshold 1 | Threshold 2 | Revenue Alternative |
|-------|------------|-------------|---------------------|
| California | 100,000 consumers/households | 50% revenue from sale/sharing | $25,000,000 annual gross revenue |
| Virginia | 100,000 consumers | 25,000 consumers + 50% revenue from sale | None |
| Colorado | 100,000 consumers | 25,000 consumers + revenue/discount from sale | None |
| Connecticut | 100,000 consumers (excl. payment) | 25,000 consumers + 25% revenue from sale | None |
| Texas | Non-SBA small business | N/A | None (no threshold) |
| Oregon | 100,000 consumers (excl. payment) | 25,000 consumers + 25% revenue from sale | None |
| Montana | 50,000 consumers (excl. payment) | 25,000 consumers + 25% revenue from sale | None |
| Kentucky | 100,000 consumers | 25,000 consumers + 50% revenue from sale | None |

### Step 3: Entity-Level Exemptions

| Exemption | CA | VA | CO | CT | TX | OR | MT | KY |
|-----------|----|----|----|----|----|----|----|----|
| Government | N/A (for-profit only) | Exempt | Exempt | Exempt | Exempt | Exempt | Exempt | Exempt |
| GLBA financial institutions | Data-level | Entity-level | Entity-level | Entity-level | Entity-level | Entity-level | Entity-level | Entity-level |
| HIPAA covered entities | Data-level | Entity-level | Entity-level | Entity-level | Entity-level | Entity-level | Entity-level | Entity-level |
| Nonprofits | Not exempt | Exempt | Exempt | Exempt | Exempt | **Not exempt** | Exempt | Exempt |
| Higher education | Not exempt | Exempt | Exempt | Exempt | Exempt | Not exempt | Exempt | Exempt |
| Air carriers | Not exempt | Not exempt | Not exempt | Not exempt | Not exempt | Not exempt | **Exempt** | Not exempt |

### Step 4: Data-Level Exemptions

Data that is already governed by certain federal laws may be exempt even if the organization itself is not:

| Federal Law | Full Name | Data Type |
|-------------|-----------|-----------|
| GLBA | Gramm-Leach-Bliley Act (15 U.S.C. §6801) | Financial data under GLBA privacy rules |
| HIPAA | Health Insurance Portability and Accountability Act (42 U.S.C. §1320d) | Protected health information (PHI) |
| FERPA | Family Educational Rights and Privacy Act (20 U.S.C. §1232g) | Education records |
| FCRA | Fair Credit Reporting Act (15 U.S.C. §1681) | Consumer credit reports |
| DPPA | Driver's Privacy Protection Act (18 U.S.C. §2721) | Motor vehicle records |
| COPPA | Children's Online Privacy Protection Act