Does privacy law apply to my business?
Answer in brief
In most of the 10 states read here, the number of residents in your records decides it, not your headcount. The count tests read start at 25,000 in Montana and 35,000 in Connecticut, Delaware and Maryland, and sit at 100,000 in Iowa, Minnesota and Virginia. Delaware's falls to 10,000 on January 1, 2027. Connecticut also applies at any volume if you process sensitive data or offer data for sale. Other states are marked not reviewed. This is not legal advice.
Content reviewed 8 November 2026. How this is assessed.
Tessaly and this reference are run by the same operator. Tessaly is not assessed on this page. Tessaly has no published client list.
Which state privacy laws reach a small business?
Each confirmed row below was read at the statute or at the state attorney general or agency page on the date shown. Words in quotation marks are the exact words on that page. These laws apply by where your customers live, so check every state where you hold a meaningful number of contacts, not only your home state.
A row marked not reviewed means this site has not read that state's law yet. It does not mean the state has no law. The same goes for any state missing from the table.
State privacy law thresholds. Read November 8, 2026. General information, not legal advice.
| State | Law | Consumer or record count | Revenue test | Small-business carve-out | Effective date | Source | Date read |
|---|---|---|---|---|---|---|---|
| California | California Consumer Privacy Act | "Buy, sell, or share the personal information of 100,000 or more California residents or households". Buying, selling or sharing, not holding. | Any one of: "gross annual revenue of $26.625 million or more" (agency FAQ, effective January 1, 2025), or 50% or more of annual revenue from selling or sharing. The Attorney General's page still said "over $25 million" when read. | None stated. The agency FAQ answers the small business question by pointing back to the three tests. Applies to for-profit businesses. | Amendments in effect January 1, 2023. Revenue figure effective January 1, 2025. | Attorney General, agency FAQ | 2026-11-08 |
| Connecticut | Connecticut Data Privacy Act | "at least 35,000 consumers, excluding data processed solely to complete payment transactions". Also applies at any count if you process "consumers' sensitive data" or offer personal data for sale. | None. The 2025 act removed the 25,000 consumer and 25 per cent test. | None in the text read. | Act took effect July 1, 2023. The 35,000 test is effective July 1, 2026. | Attorney General, Public Act 25-113, section 6 | 2026-11-08 |
| Delaware | Delaware Personal Data Privacy Act | Until January 1, 2027: "not less than 35,000 consumers". From January 1, 2027: "not less than 10,000 consumers". Both exclude data processed solely to complete a payment. | Until January 1, 2027: "not less than 10,000 consumers" and "more than 20%" of gross revenue from sale of personal data. From January 1, 2027: 5,000 consumers and more than 20%. | None in the chapter read. | Section headings read "Effective until Jan. 1, 2027" and "Effective Jan. 1, 2027". Original start date not stated in the text read. | Delaware Code 12D-103 | 2026-11-08 |
| Iowa | Iowa Code chapter 715D | "at least one hundred thousand consumers" | "at least twenty-five thousand consumers" and "over fifty percent of gross revenue from the sale of personal data" | None in the section read. | January 1, 2025 | Iowa Code 715D, Senate File 262 | 2026-11-08 |
| Maryland | Commercial Law, title 14, subtitle 47 | "at least 35,000 consumers", excluding data processed solely to complete a payment | "at least 10,000 consumers" and "more than 20% of its gross revenue from the sale of personal data" | None in the section read. | Not stated in the section read. | Commercial Law 14-4702 | 2026-11-08 |
| Minnesota | Minnesota Statutes 325M.10 to 325M.21 | "100,000 consumers or more", excluding data processed solely to complete a payment | "over 25 percent of gross revenue from the sale of personal data" and "25,000 consumers or more" | Yes. Small businesses as defined by the federal SBA are excluded, but under 325M.17 must not sell a consumer's sensitive data without consent. | July 31, 2025 | 325M.12, 325M.17, Laws 2024, chapter 121 | 2026-11-08 |
| Montana | Consumer Data Privacy Act | "not less than 25,000 consumers", excluding data processed solely to complete a payment | "not less than 15,000 consumers" and "more than 25% of gross revenue from the sale of personal data" | None in the section read. | Not stated in the section read. Section history shows amendment in 2025. | Montana Code 30-14-2803 | 2026-11-08 |
| Texas | Texas Data Privacy and Security Act | No consumer count on the Attorney General's page read. | None on the page read. | Yes. "Small businesses (as defined by the federal Small Business Administration) are generally exempt from the Act", except that a small business that sells a consumer's sensitive data must first obtain consent. | July 1, 2024 | Attorney General | 2026-11-08 |
| Utah | Utah Code title 13, chapter 61 | "100,000 or more consumers", or "25,000 or more consumers" with over 50% of gross revenue from sale of personal data. The revenue test below must also be met. | "annual revenue of $25,000,000 or more", required in addition to a count test | No separate carve-out. The revenue test does that job. | This text effective 5/1/2024. A new version effective 1/1/2027 keeps these figures and adds motor vehicle manufacturers. | Current version, 2027 version | 2026-11-08 |
| Virginia | Virginia Consumer Data Protection Act | "at least 100,000 consumers" during a calendar year | "at least 25,000 consumers" and "over 50 percent of gross revenue from the sale of personal data" | None in the section read. | Not stated in the section read. | Code of Virginia 59.1-576 | 2026-11-08 |
| Colorado | Not reviewed | Not reviewed | Not reviewed | Not reviewed | Not reviewed | Not reviewed | Not reviewed |
| Indiana | Not reviewed | Not reviewed | Not reviewed | Not reviewed | Not reviewed | Not reviewed | Not reviewed |
| Kentucky | Not reviewed | Not reviewed | Not reviewed | Not reviewed | Not reviewed | Not reviewed | Not reviewed |
| Nebraska | Not reviewed | Not reviewed | Not reviewed | Not reviewed | Not reviewed | Not reviewed | Not reviewed |
| New Hampshire | Not reviewed | Not reviewed | Not reviewed | Not reviewed | Not reviewed | Not reviewed | Not reviewed |
| New Jersey | Not reviewed | Not reviewed | Not reviewed | Not reviewed | Not reviewed | Not reviewed | Not reviewed |
| Oregon | Not reviewed | Not reviewed | Not reviewed | Not reviewed | Not reviewed | Not reviewed | Not reviewed |
| Rhode Island | Not reviewed | Not reviewed | Not reviewed | Not reviewed | Not reviewed | Not reviewed | Not reviewed |
| Tennessee | Not reviewed | Not reviewed | Not reviewed | Not reviewed | Not reviewed | Not reviewed | Not reviewed |
Worked example: a 12-person firm with 40,000 contacts in Connecticut
Connecticut's Attorney General lists a test of at least 35,000 consumers. If all 40,000 contacts are Connecticut residents who count as consumers, the firm is over the line, and having only 12 staff does not change that. The text read has no small-business exemption.
Now look closer. The Attorney General says the act does not protect someone acting in an employment context, and the statute's definition of consumer leaves out people acting in a commercial or employment context. If 30,000 of those contacts are people reached only at work, for business-to-business sales, the count could fall to 10,000, which is under the 35,000 test. But if the firm holds any sensitive data on consumers, or offers personal data for sale, Connecticut's other two tests apply at any count. A notes field that records someone's health condition can matter here.
The same 40,000 contacts, assuming all live in the one state named and all count as consumers there. Confirmed rows only. Count tests only, so a sale-of-data or revenue test may still apply.
| State | Count test read | Result at 40,000 |
|---|---|---|
| Montana | 25,000 | Over |
| Connecticut | 35,000 | Over |
| Delaware | 35,000, then 10,000 from January 1, 2027 | Over, on both |
| Maryland | 35,000 | Over |
| Iowa | 100,000 | Under |
| Minnesota | 100,000 | Under, and small businesses as the SBA defines them are excluded |
| Virginia | 100,000 | Under |
| Utah | 100,000, and $25,000,000 revenue | Under |
| California | 100,000 bought, sold or shared | Under on this test. Check the revenue tests |
| Texas | None on the page read | Depends on whether you are an SBA small business |
What should you count in a CRM export?
A row count is the wrong number. Export your contacts, and count unique people by state of residence. Use the steps below as a first estimate, and take the result to an adviser if you are near a line. The round-trip test shows how your CRM treats duplicates, which affects this count.
How each kind of threshold maps to the fields in a CRM export. States named are those where the text was read.
| Threshold wording | What to count | How to do it in the export |
|---|---|---|
| Consumers (all states with a count test) | Unique residents, not rows | Remove duplicates by email, then by name and phone, and filter on the state column. One person with three rows counts once |
| Residents of the state | People whose state field says so | Rows with a blank state are unknown. Report them separately and do not assume they are out of state |
| "Residents or households" (California) | People and households bought, sold or shared | Holding a record is not the test as worded. Count those whose data you bought, sold or shared |
| Commercial or employment context excluded (Connecticut, Delaware, Iowa, Montana, Virginia) | People who deal with you as individuals | Separate work-only contacts at companies from individual buyers. A person can be in both groups, so count them as a consumer if in doubt |
| Payment-only data excluded (Connecticut, Delaware, Maryland, Minnesota, Montana) | Records kept for more than taking a payment | Take out customers whose details you hold only to complete a payment, if that is really all you use them for |
| "Preceding calendar year" (Connecticut, Delaware, Maryland) or "during a calendar year" (Iowa, Minnesota, Utah, Virginia) | People in your records during that year | Use the created and last activity dates. Deleted contacts may still count for a year in which you held them |
| Share of gross revenue from selling personal data | Money from selling data | This comes from your accounts, not the CRM. If you never sell data, this share is zero |
| Sensitive data at any volume (Connecticut) | Whether you hold any at all | Search notes and custom fields for health, immigration, religion and similar details. Delete what you do not need |
| Small business as the SBA defines it (Minnesota, Texas) | Your size under the federal standard for your industry | This depends on your industry and is not a CRM number. Check it with the SBA or your adviser |
Change log
This is general information, not legal advice. For a decision that matters, ask a lawyer who handles privacy. Dates below are the dates this page was read or changed.
Changes to this page.
| Date | Change |
|---|---|
| 2026-11-08 | First published with 10 states read at the statute or at the attorney general or agency page. |
| 2026-11-08 | Connecticut: read Public Act 25-113, which lowers the count to 35,000 from July 1, 2026. The online chapter at the legislature still showed 100,000 and carried a note sending readers to the 2026 supplement, so this page uses the act and the Attorney General's page. |
| 2026-11-08 | California: the agency FAQ gives $26.625 million and the Attorney General's page gives over $25 million. Both are shown. |
| 2026-11-08 | Delaware and Utah: new versions effective January 1, 2027 recorded in the table. |
| 2026-11-08 | Not reviewed: official pages for Colorado, New Hampshire and Tennessee refused or returned nothing to a plain request. Those for Nebraska, New Jersey, Oregon and Rhode Island did not respond. Official pages for Indiana and Kentucky were not found. Effective dates for Maryland, Montana and Virginia were not on the sections read. |
Sources for this entry
- California Attorney General: CCPA: Page marked updated August 28, 2026. Read November 8, 2026.
- California Privacy Protection Agency: FAQ: Adjusted revenue threshold. Read November 8, 2026.
- Connecticut Attorney General: CTDPA FAQs: Current applicability tests. Read November 8, 2026.
- Connecticut Public Act 25-113: Section 6 amends section 42-516, effective July 1, 2026. Read November 8, 2026.
- Delaware Code, Title 6, Chapter 12D: Both versions of section 12D-103. Read November 8, 2026.
- Iowa Code Chapter 715D: Section 715D.2, scope. Read November 8, 2026.
- Iowa Senate File 262: Section 10, effective date. Read November 8, 2026.
- Maryland Commercial Law section 14-4702: Applicability. Read November 8, 2026.
- Minnesota Statutes 325M.12: Scope and exclusions. Read November 8, 2026.
- Minnesota Statutes 325M.17: Requirements for small businesses. Read November 8, 2026.
- Laws of Minnesota 2024, chapter 121: Article 5 effective date. Read November 8, 2026.
- Montana Code 30-14-2802: Definition of consumer. Read November 8, 2026.
- Montana Code 30-14-2803: Applicability, as amended in 2025. Read November 8, 2026.
- Texas Attorney General: Texas Data Privacy and Security Act: Scope, small business rule and effective date. Read November 8, 2026.
- Utah Code 13-61-102, version effective 5/1/2024: Applicability. Read November 8, 2026.
- Utah Code 13-61-102, version effective 1/1/2027: Applicability from 2027. Read November 8, 2026.
- Code of Virginia 59.1-576: Scope. Read November 8, 2026.
- Code of Virginia 59.1-575: Definition of consumer. Read November 8, 2026.
Continue this reading path
- The Best CRM for Small Business category guide
- How to choose a CRM for a small business
- Resource directory
Cite this entry
The Best CRM for Small Business. "Does privacy law apply to my business?." Content reviewed 8 November 2026. https://thebestcrmforsmallbusiness.com/does-privacy-law-apply-to-my-business/