US Privacy Laws for Websites: CCPA/CPRA and the State Patchwork

The United States still has no single federal privacy law for websites. Instead, you face a growing patchwork of state laws, led by California's CCPA as amended by the CPRA and followed by roughly twenty other states with their own comprehensive privacy statutes. If your website collects emails, runs analytics or shows targeted ads, some of these US privacy laws may apply to you, even if you are not based in those states.

This guide explains who the CCPA/CPRA covers, how the other state laws differ and what your website actually needs: notices, opt-out links, care with sensitive data and a working process for consumer requests.

This article is general information, not legal advice.

Which US privacy laws apply to your website?

Most state privacy laws apply based on where your customers live, not where your company is registered.

The main pieces to know:

• California: the California Consumer Privacy Act (CCPA), significantly amended by the California Privacy Rights Act (CPRA), which voters approved as Proposition 24 in November 2020. Most CPRA changes became operative on January 1, 2023, and the law created a dedicated regulator, the California Privacy Protection Agency (CPPA).
• The "Virginia model" states: Virginia's Consumer Data Protection Act took effect on January 1, 2023, followed by Colorado and Connecticut on July 1, 2023. Many later laws, including Indiana, Kentucky and Rhode Island (all effective January 1, 2026), follow a similar structure.
• Texas: the Texas Data Privacy and Security Act has no revenue threshold. It generally exempts businesses that qualify as small businesses under the US Small Business Administration definition, but even those may not sell sensitive personal data without consent.
• Sector laws: health, financial and children's data have their own federal rules (such as COPPA for children under 13), which sit on top of the state laws.

New states keep passing laws and existing ones keep being amended, so check the current status for the states where most of your customers live.

Does the CCPA apply to your business?

The CCPA applies to for-profit businesses that do business in California and meet at least one of three tests:

1. Annual gross revenue above a threshold that started at $25 million and is adjusted for inflation every two years. The CPPA publishes the current figure on its monetary thresholds page.
2. Buying, selling or sharing the personal information of 100,000 or more California consumers or households per year.
3. Earning 50% or more of annual revenue from selling or sharing consumers' personal information.

The second test catches more small businesses than people expect. "Sharing" in the CPRA sense includes disclosing personal information for cross-context behavioral advertising, which is exactly what many ad pixels do. A high-traffic site with ad tracking can reach that test without ever "selling" data in the everyday sense.

Other states use different thresholds, usually based on how many residents' data you process each year, and some are much lower than California's. Rhode Island, for example, applies at 35,000 consumers.

What rights do consumers have under the CCPA/CPRA?

California residents have the right to:

• Know what personal information you collect, why, and who you disclose it to.
• Delete personal information you collected from them, subject to exceptions.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of their personal information.
• Limit the use and disclosure of sensitive personal information, such as precise location or health data.
• Not be discriminated against for exercising these rights.

Most other state laws give similar rights, including access, deletion, correction, portability and opting out of targeted advertising, sale and certain profiling. A key difference: many of them require opt-in consent before you process sensitive data, while California uses a "right to limit" model. If you collect health, biometric or precise location data, check each state's rules carefully.

What your website needs: the practical checklist

If your business falls under the CCPA or similar laws, a typical small business site should have:

1. A clear privacy policy listing the categories of personal information you collect, the sources, the purposes, who you disclose it to, how long you keep it and how people can exercise their rights. Update it at least once a year.
2. A notice at collection. Wherever you collect data, such as a contact form, checkout or newsletter signup, say what you collect and why, with a link to the full policy.
3. A "Do Not Sell or Share My Personal Information" link if you sell or share data, including for targeted ads, usually in the footer.
4. A "Limit the Use of My Sensitive Personal Information" link if you use sensitive data beyond what is needed to provide your service.
5. Global Privacy Control (GPC) support. California's regulations require businesses to treat a browser opt-out preference signal like GPC as a valid opt-out request. Colorado and several other states also require honoring universal opt-out signals.
6. At least two ways to submit requests, such as a web form plus an email address or toll-free number, with a process to verify identity and respond within the legal time limits.
7. Vendor contracts that limit how your analytics, email, CRM and ad tools use the data you send them.
8. Reasonable security: encryption in transit, access controls and patched software.

Start by mapping what you collect, where it is stored and which vendors receive it, then remove what you do not need.

Cookies, pixels and the "sharing" trap

Unlike Europe, most US states do not require a consent banner before all cookies. They focus on opting out of sale, sharing and targeted advertising. That does not mean you can ignore tracking scripts.

Start with an inventory of every third-party script on your site: analytics, ad pixels, chat widgets, embedded videos, heatmaps. For each one, ask what data it sends and whether the vendor uses it for its own purposes. Then make sure that when a visitor opts out, through your link or a GPC signal, the advertising tags actually stop firing. An opt-out link that does nothing technically is a common gap.

If you also serve European visitors, one consent platform that handles both regimes is often simpler. Our guide to cookie consent and analytics under GDPR covers the European side, and the GDPR website checklist shows how the two overlap.

Enforcement, penalties and what is changing

The CCPA is enforced by the CPPA and the California Attorney General. Fines are set per violation, with higher amounts for intentional violations and violations involving minors, and they are adjusted for inflation. Consumers can also sue over certain data breaches caused by a failure to maintain reasonable security.

Other states generally leave enforcement to their attorneys general. Several originally gave businesses a "right to cure" period before penalties, but some of those periods have already expired, so do not count on a warning first.

California's rules keep evolving. The CPPA has adopted regulations covering risk assessments and automated decision-making technology, with obligations phasing in over the next few years. If you use AI to make significant decisions about people, such as hiring or lending, check the current status of those rules on the California Privacy Protection Agency website.

Privacy work often happens alongside a site rebuild, so it is a good moment to review accessibility and security too. See our ADA website accessibility guide and our small business cyber security checklist.

How HEXACODES can help

We build and update websites with privacy built into the code: clean data flows, opt-out tools that actually block tracking, GPC support, secure forms and a minimal set of third-party scripts. We also handle cyber security, from hardening hosting to cleaning up compromised sites; we moved our own website off WordPress to a static site after dealing with a spam-injection compromise ourselves.

If you need a new, privacy-conscious site, we offer a full business website starting at $30/month. For a review of an existing site, contact us on WhatsApp or by email. For the legal wording of your policies, work with a privacy lawyer alongside us.

Frequently asked questions

Does the CCPA apply to small businesses outside California?

It can. The CCPA applies to for-profit businesses that do business in California and meet at least one threshold, regardless of where they are located. Many small businesses fall below all three, but high-traffic sites that use ad tracking can reach the 100,000-consumer test faster than expected.

Do US websites need a cookie banner?

Most US state laws do not require consent before every cookie the way EU rules do. They require you to let people opt out of the sale or sharing of their data and targeted advertising, including by honoring signals like Global Privacy Control. Some states require opt-in consent for sensitive data, so a preference tool is still a good idea.

What is the difference between the CCPA and the CPRA?

The CPRA is not a separate law; it amended and expanded the CCPA. It added rights such as correction and limiting the use of sensitive personal information, introduced "sharing" for cross-context behavioral advertising and created the California Privacy Protection Agency. Today the combined law is usually called the CCPA, or the "CCPA as amended by the CPRA."