US state privacy laws beyond CCPA: TDPSA, VCDPA, and what indie SaaS founders need to know

There is no federal US privacy law. Instead, there are 19 state laws as of 2026, each with its own thresholds, definitions, and consumer rights. Most indie SaaS founders ignore everything outside California and Texas — and most are missing real obligations. Here's the actual map of who you need to comply with, in plain English.

The map as of May 2026

19 US states have comprehensive consumer-privacy laws in force or about to enter into force. The list as of mid-2026:

• California — CCPA / CPRA (in force, the original)
• Virginia — VCDPA (2023)
• Colorado — CPA (2023)
• Connecticut — CTDPA (2023)
• Utah — UCPA (2023)
• Iowa — ICDPA (2025)
• Indiana — INCDPA (2026)
• Tennessee — TIPA (2025)
• Montana — MCDPA (2024)
• Texas — TDPSA (2024)
• Oregon — OCPA (2024)
• Delaware — DPDPA (2025)
• New Hampshire — NHPA (2025)
• New Jersey — NJDPA (2025)
• Minnesota — MCDPA (2025)
• Maryland — MODPA (2025)
• Rhode Island — RIPA (2026)
• Nebraska — NDPA (2025)
• Kentucky — KCDPA (2026)

Do any of these apply to you?

Each law has its own applicability thresholds. The thresholds boil down to: (a) you do business in the state OR target residents there, AND (b) you process data of at least N residents per year. The N varies. Practical thresholds for indies:

What you must do if a law applies

Every state law gives consumers the same core set of rights, with minor variations. If you handle even one state, building a workflow that handles all of them is barely more work.

1. Right to know — provide a copy of personal data on request. Implement a /privacy/data-request endpoint or email channel.
2. Right to delete — delete personal data on request (with limited exceptions like billing records).
3. Right to correct — let users fix inaccurate data.
4. Right to portability — provide a machine-readable export.
5. Right to opt out of sale or targeted advertising — show a 'Do Not Sell / Share' link on every page (most states require this prominently).
6. Right to opt out of profiling for significant decisions — covers algorithmic decisioning.

What you must publish

1. Privacy policy listing categories of data collected, purposes, third parties, retention. Every state requires this; California requires the most detail.
2. Children's privacy section if you process data of users under 16 (some states) or 13 (California, federally under COPPA).
3. Sale / share / targeted-advertising disclosure if you do any of those activities, with the opt-out link prominently displayed.
4. Contact information for data subject requests — typically a privacy@ email or a form.
5. Notice at collection — at the moment you collect data, a short notice describing what you're collecting and why.

Texas TDPSA — what's different

Texas Data Privacy and Security Act took effect July 2024. Two things make it notable:

1. Lower applicability threshold than most states — covers businesses 'that produce a product or service consumed by Texas residents.' No revenue or user-count floor. This is the broadest applicability test in the US.
2. Sensitive-data consent requirement — racial, religious, health, sexual-orientation, biometric, citizenship, precise geolocation, and child data require opt-in consent before processing, not opt-out. This is closer to GDPR than to other US states.

Practical effect: if you have any Texas users and you process any sensitive data, you need explicit opt-in. Most indie SaaS does not — but anyone in health, wellness, dating, or family-related products does.

California CPRA — what's different (and important)

California is the oldest and strictest. Two specific things you can't ignore:

1. Private right of action for data breaches — California is the only state where consumers can directly sue for breaches involving statutory damages ($100–$750 per consumer per incident). For a 10K-user breach, that's $1M–$7.5M minimum exposure.
2. Sensitive personal information separate category — CA defines 'sensitive PI' broadly (precise geolocation, racial origin, religion, mail/text contents, biometric, health, financial, account credentials, sex life). Sensitive PI has separate notice and opt-out requirements ('Limit the Use of My Sensitive Personal Information').

The unified compliance program (90 minutes of work)

If you build for the strictest state's requirements, you cover all 19. The strictest baseline:

1. Publish one privacy policy that meets California's CPRA disclosure requirements (the most detailed). Tools like Iubenda and Termly generate compliant policies.
2. Implement universal data-subject requests at one address (privacy@yourdomain). Honor any of the 19 state-residents' requests from this one channel.
3. Honor GPC signals globally (treat it as opt-out for everyone, regardless of state).
4. Add 'Do Not Sell or Share My Personal Information' link in your footer.
5. If you process any data of children under 13, comply with federal COPPA — this is separate from state laws and has higher penalties.

What you can ignore (for now)

• States with very high thresholds (Utah 100K + $25M revenue) — most indies don't meet them.
• Federal privacy law — the ADPPA died in committee multiple times; nothing imminent.
• Industry-specific carve-outs (HIPAA-covered, GLBA-covered) — unless you're in those industries, irrelevant.