Short answer. Most founders check the California rule. They see a limit in the tens of millions. They decide they are too small to care. That logic does not travel. Colorado, Connecticut and Virginia set no revenue limit at all. They count rows. Hold data on 100,000 people in one of those states in a year and you are in scope. It does not matter if you have earned a dollar.
This is the companion to our guide to the CCPA and Global Privacy Control. That one covers California on its own. This one covers what changes when you cross a state line. We stick to the parts that live in code, not in a policy file.
The revenue test is a California habit, not a rule
Put the four laws side by side. The question changes shape.
| State | Revenue test? | Head-count test | Data-selling test |
|---|---|---|---|
| California | Yes. Tens of millions, raised for inflation | 100,000 people or homes | Half or more of income from selling or sharing data |
| Colorado | None | 100,000 people in the state, in one year | Any income or discount from selling data, plus 25,000 people |
| Connecticut | None | 100,000 people, not counting payment-only data | More than a quarter of gross income from selling data, plus 25,000 people |
| Virginia | None | 100,000 people in one year | Over half of gross income from selling data, plus 25,000 people |
Virginia's text is short. It is worth reading as written. Section 59.1-576(A) covers anyone who does business in the state. It also covers anyone who aims a product or service at people who live there. Then it asks one of two things. Do you hold data on at least 100,000 people in a year? Or do you hold data on at least 25,000 and make over half your gross income from selling data? That is the whole test. There is no clause about company size. There is no floor to fall under.
Colorado works the same way. Its bar is 100,000 people. Or 25,000, plus any income or discount tied to selling data. Look at how low that second bar sits. It does not ask what share of your money comes from data. Any amount counts. So does a discount.
The trap in one line. A product with no sales and a big free tier can sit outside California's reach and inside Colorado's at the same time. Being small protects you in one state. It does nothing in the other three.
What a user counts as, and why your number is bigger than you think
Three details drive the count. All three cut against small teams.
It means people in that one state. Colorado answers this in its own guidance. When the law says 100,000 consumers, it means 100,000 Colorado residents. Not 100,000 people across the country. That sounds like relief. It is, right up until you run the same test again in the next state.
Paying has nothing to do with it. The test asks whose data you hold or handle. A signup makes a row. So does a waitlist entry. So does a dead trial. So does a support ticket. So does a cookie ID your front end sets on a first visit. None of those people paid you.
One state carves out payments. The others do not. Connecticut leaves out data you hold only to complete a payment. The other two have no such carve-out. Copy your Connecticut answer into a Colorado memo and the number will be wrong.
Have you ever written down what you hold and where it goes? If not, that is the real blocker. It is the same gap that sinks EU filings. Our guide to the Article 30 record of processing shows how to build that list once and reuse it. The list is what turns "we think we are small" into a number you can defend.
Who is let off is different too, and it reverses
Founders assume California is the strict one. They assume the rest are softer copies. On exemptions, that flips more than once.
Virginia lets nonprofits off. Section 59.1-576(B) puts them in the same list as state agencies and banks. Colorado does not. Its own guidance says the law covers groups including nonprofits. Same product. Same data. Two answers. Which one binds you turns on where your users live.
Staff data runs the other way. The other three all leave out data about staff and job applicants. California does not. So one product can owe staff-data duties there and none in the rest.
Virginia and Colorado both let off data covered by the federal health law. That is narrower than it sounds. The carve-out follows the data, not the company. A wellness feature that logs mood or weight sits outside the federal rule. It sits inside the state ones.
"Sale" does not mean the same thing in two states
Here one line of front-end code gets two legal answers.
Virginia calls it a sale when you trade personal data for monetary consideration. Money has to move. California's wording is wider. It reaches deals done for money or other value. It says so in words that cover deals where no money changes hands at all.
So the free tag your AI tool dropped into the page may be a sale or share in California. Over the line, it is not. Founders read that and relax. They should not. Both states carry a second opt-out, and it catches the same tag.
Virginia's own text defines targeted advertising. It means showing ads picked from data about what someone did over time, on sites you do not own. That is what an outside ad pixel does. It does not matter that nobody paid anybody. The user can opt out of it. You have to let them.
The same text names its own exceptions. They are easy to check. Ads based only on what happens inside your own product are out. Ads based on the current page or search are out. So is plain measurement and reporting. Those four carve-outs decide whether a script creates a duty. You can answer that with the network tab, not a lawyer.
What this means in practice. One tag, two rules. Ask two things of each outside script. Does money move? Does it follow the user off your domain? The first decides "sale" in Virginia. The second decides targeted ads almost everywhere.
Sensitive data flips to opt-in, and the lists do not match
California handles sensitive data with a link that limits its use. The other three treat it as a stop sign. You need a yes before you touch it. Not a way out after.
Colorado is blunt about what a yes is not. Agreeing to broad terms of service is not consent. Hovering is not consent. Pausing is not consent. Nor is a yes you got through a page built to mislead. Does your modal have a bright accept button and a grey link? That is the design being named.
Now the part that breaks copy-and-paste work. Each state lists its own things as sensitive.
Virginia's list has four entries. Data that reveals race or ethnic origin, faith, a mental or physical health finding, who someone is drawn to, or their citizenship status. Gene or biometric data used to tell one person from another. Data taken from a known child. And precise location data.
That last one carries a number. The number is the point. Virginia defines precise location data as data that pins a person down within a radius of 1,750 feet. Latitude and longitude at that level counts. The text says so.
Hold that against your schema. A float pair from a browser call is good to a few metres. That is far inside 1,750 feet. Store one and Virginia calls it sensitive. You needed a yes before you wrote the row.
Colorado built its list another way. Its guidance covers data about a child under 13. It covers data that reveals race, ethnic origin, faith, health conditions or findings, sex life or who someone is drawn to, or citizenship status. It covers biometric data used to tell one person from another. In 2024 the state added biological data. Their wording takes in neural data.
You do not have to take our word that the lists have drifted apart. In 2025 Connecticut's own report to lawmakers asked them to widen the state's list. The stated reason was to take in what other states have added since the law passed. The state is saying the lists differ. Build for the widest one you face.
Same header, different duty
All of these states now expect you to act on a browser opt-out. The header is the same. What it makes you do is not.
Colorado is the strictest and the clearest. It keeps a public list of opt-out tools it will honour. That list sits under Rule 5.07 of the state's privacy rules. Global Privacy Control was the first tool on it. The guidance says it is still the only one the state treats as valid. Since 1 July 2024, firms in scope must let people opt out of data sales and targeted ads through it. The cite is C.R.S. section 6-1-1306(1)(a)(IV).
There is a second duty here that gets skipped. It is trivial to fix. Your privacy notice must say how you handle requests that arrive through one of these tools. That sits at Rule 6.03(4)(e). Most notices we read do not mention the signal at all.
Connecticut turned its own duty on from 1 January 2025. There is a wrinkle worth noting. The signal has to come from a tool that lets you work out whether the person lives in Connecticut. That is a routing job in your handler. It is not a policy question.
Handling the signal is a small piece of server code. Read the header. Save the choice against the browser or device. Stop firing the tags that hang off it. Then apply the same choice to the account, if you know who the person is. Our guide to consent and tracking scripts covers the load-order bug that stops most of these fixes from working in generated front ends.
Assessments are a duty, not a nice-to-have
Colorado makes you run a data protection assessment before some work starts. Its guidance names the triggers. Before you sell personal data. Before you handle sensitive data. And before work that could lead to unfair or false treatment. Or to money or bodily harm. Or to a breach of privacy that a normal person would find offensive. Or to other real harm.
Two of those catch ordinary product work. Selling data is one. Sensitive data is the other. We have just seen how wide that box gets once location and health guesses are in it.
Have you done an EU impact assessment? Then you have most of the material. Our guide to the GDPR impact assessment sets out the method. Much of it carries over. What does not carry over is the trigger list. Read each state's own.
Enforcement is about setup, not wording
The public record is short. It is also consistent. They are finding setup faults, not drafting faults.
Connecticut reported that by the end of 2024 it had issued dozens of notices of violation under the state law. It had also sent wider requests for data. The report names where it was looking. Connected car makers. A gene and family history firm. A palm scanning service. An unnamed messaging app aimed at teens. Shops using face scanning. The report also says the office widened its work to cover bad opt-out practice and dark patterns that trick people.
Read that list again. Every item is something an outsider can see. Nobody had to read a company memo to open those files.
Two dates matter if you think there is a grace period.
Its 60-day chance to fix things was never meant to last. The guidance says that process ran until 1 January 2025. It is gone. It also confirms there is no private right to sue. Only the state can bring a case. And it reaches firms wherever they are based.
Then came September 2025. California, Colorado and Connecticut announced a joint sweep. The target was firms not acting on opt-out requests sent through Global Privacy Control. Three states. One browser signal. One shared look. That is the clearest sign yet that the checking is automatic and the sample is everybody.
A check you can run on your own code today
None of this needs a law firm to start. It needs twenty minutes and a text search.
- Count the rows, per state. Run the query. Whose data do you hold, and how many of them live in Colorado, Connecticut or Virginia? Cannot answer? That is finding one.
- List every third-party script. Open the network tab on a logged-out page. Write down each domain that is not yours. Ask the two questions above of each one.
- Search for coordinates. Grep your schema and your models for latitude, longitude, coords and geo. Any full-precision pair sits inside Virginia's 1,750-foot line.
- Search for the signal. Grep the whole repo for
Sec-GPCandglobalPrivacyControl. If neither string is there, nothing in your product reads the opt-out. - Read your own modal. Is accept as easy as reject? If reject takes more clicks, that is the dark pattern the states named.
- Open your privacy notice. Does it say how you handle universal opt-out requests? Colorado requires that it does.
Steps two, four and five are visible from outside your firm. That is why they start there. It is also why an outside scan finds them. Our Compliance Score runs a named CCPA opt-out signal detection check. It also checks for tracking pixels that fire without a yes. And for consent banners that load after the scripts they are meant to gate. You can see the same three on a live product with a free scan.
See what an outsider sees
Our free scan looks at your live product the way a watchdog would. Which third-party tags fire. In what order. And whether anything reads the opt-out header. No code access needed.
Honest limits
A scan is not legal advice. We do not pretend otherwise. Three things it cannot do.
It cannot count your rows. Scope turns on how many people in each state sit in your database. Only you can run that query. What a scan tells you is what happens once you are in scope.
It cannot read your contracts. Is a vendor working to your instructions, or doing its own thing? That turns on what you signed. Our note on processing agreements for AI coding tools covers the terms to look for.
It cannot tell you which state lines you have crossed. That is a business question about where your users live. But once you know, the technical duties look the same everywhere. That part we can measure.
One more limit worth saying out loud. That 44/100 average is not dragged down by opt-out handling. It is dragged down by missing security headers, weak database rules and exposed keys. Signal handling is usually absent rather than broken. Nobody wrote it in the first place. For the wider picture, see our overview of privacy work for AI-built products and our notes on secure AI development. Our compliance checklist puts the steps in order.
Where to start
Pick the state where most of your users live. Read that law's own words on scope, sensitive data and the opt-out signal. Build to it. Then widen.
Build to the strictest rule you face and the rest fall out free. In practice that means three things. Treat precise coords as sensitive in all of them. Honour the browser signal for each visitor, not just the ones you think live there. And make reject as easy as accept. All three cost less to build once than to argue about four times.
Do your users reach past the United States? Then transfers are a separate problem with separate paperwork. Our guide to international data transfers covers that. Our guide to deletion requests covers the right that drives the most support tickets once people know they have it.
Want a one-off read with a senior engineer's sign-off? That is our Launch Readiness Audit Report. Want to compare the options first? The pricing page lays them out. Want to start free? Run a free scan and see what a state would see. More like this sits on the blog.
Frequently asked questions
Do state privacy laws apply to my startup if we have no revenue?
They can. California has a revenue test. Colorado, Connecticut and Virginia do not. Those three ask how many people in that state you hold data on. The usual line is 100,000 in one year. A second route catches you at 25,000 if you make money from selling data. Free users count. The test is about whose data you hold, not who paid you. So a product with no revenue and a big free tier can be in scope.
Does the 100,000 figure mean people in that state or people everywhere?
People in that state. Colorado answers this in its own guidance. When the law says 100,000 consumers, it means 100,000 Colorado residents. It does not mean 100,000 people across the country. The same logic runs in the other states. Each one defines a consumer as someone who lives there and is acting for themselves or their household. Someone acting for a business, or as a job applicant, is not counted.
Is a free advertising pixel a sale of personal data?
It depends on the state. The answer matters less than founders hope. Virginia calls it a sale only when money changes hands. So a free tag is not a sale there. California's wording is wider and covers deals where no money moves. But both let people opt out of targeted ads. A third-party pixel that follows a user across sites you do not own is exactly that. So the tag creates a duty either way. Only the label changes.
Is storing a user's location sensitive data?
In Virginia, yes, if it is precise. The law lists precise location data as sensitive. It defines that as data which fixes where a person is within a radius of 1,750 feet. A latitude and longitude pair from a browser is good to a few metres. That is far inside the line. Sensitive data needs the person's consent before you handle it. So the yes has to come before you write the row, not after. Check your schema for coordinate columns.
If I honour Global Privacy Control in California, am I covered elsewhere?
Not on its own. The signal is the same. The duty behind it is set by each state. It has made firms in scope accept it since 1 July 2024, and it lists the tools it will honour. Connecticut turned its duty on from 1 January 2025, and its wording expects the signal to let you tell whether the person lives there. Colorado adds one more step. Your privacy notice must say how you handle these requests. Read each state's rule.
Is there still a grace period to fix problems before enforcement?
Not in Colorado. Its guidance says the 60-day notice and cure process ran until 1 January 2025. It has ended. It also has no private right to sue, so only the state brings cases, and the law reaches firms wherever they are based. Connecticut reported issuing dozens of notices of violation by the end of 2024. In September 2025 California, Colorado and Connecticut announced a joint sweep of firms ignoring opt-out signals.
Research sources
- Colorado Attorney General: Universal Opt-Out and the Colorado Privacy Act, reference for the public list of recognised universal opt-out mechanisms under 4 CCR 904-3 Rule 5.07, for Global Privacy Control being the first and currently the only mechanism the Department treats as valid, for the duty beginning 1 July 2024 under C.R.S. section 6-1-1306(1)(a)(IV), and for the privacy-notice requirement at Rule 6.03(4)(e).
- Colorado Attorney General: Colorado Privacy Act (CPA), reference for the applicability thresholds in C.R.S. section 6-1-1304, for the confirmation that 100,000 consumers means 100,000 Colorado residents, for the law applying to entities including nonprofits, for the sensitive data categories and the consent definition excluding broad terms of service and deceptive page design, for the data protection assessment triggers, for the 60-day cure process ending 1 January 2025, and for the absence of a private right of action.
- Code of Virginia section 59.1-576: Scope; exemptions, reference for the two applicability tests of at least 100,000 consumers, or 25,000 consumers plus over 50 percent of gross revenue from the sale of personal data, for the exemption of nonprofit organisations, and for the exemption of data processed in the course of employment.
- Code of Virginia section 59.1-575: Definitions, reference for the definition of precise geolocation data as accurate within a radius of 1,750 feet, for precise geolocation data being listed as sensitive data, for the definition of sale of personal data as an exchange for monetary consideration, for the definition of targeted advertising and its four exclusions, and for the definition of consent as a clear affirmative act.
- Connecticut Attorney General: Attorney General Tong Releases Updated Report on Connecticut Data Privacy Act, reference for the dozens of notices of violation issued by the end of 2024, for the named investigations into connected vehicle makers, a genetic and family history company, a palm recognition service, an anonymous messaging app aimed at teenagers and retailers using facial recognition, for the broadened focus on problematic opt-out practices and dark patterns, and for the recommendation to expand the definition of sensitive data to incorporate elements added by other states.
- Connecticut Attorney General: The Connecticut Data Privacy Act, reference for the applicability threshold of 100,000 consumers excluding data processed solely to complete a payment transaction, for the alternative threshold tied to gross revenue from the sale of personal data, and for the duty to honour opt-out preference signals from 1 January 2025.
- California Privacy Protection Agency: Joint Investigative Privacy Sweep, reference for the September 2025 joint sweep by the Agency and the Attorneys General of California, Colorado and Connecticut of businesses not acting on opt-out requests sent through the Global Privacy Control.
- Colorado General Assembly: HB24-1058 Protect Privacy of Biological Data, reference for the 2024 addition of biological data, defined to include neural data, to the categories of sensitive data under the Colorado Privacy Act.
- Jai Mittal, Founder & CTO, Launch Ready Code — Proprietary data from 700+ AI-built app security audits, 2025–2026. Average Launch Readiness Score: 44/100.