No state comprehensive consumer privacy law uses employee headcount as a test. Every one of them tests on two things instead: whether you do business with enough residents of that state, measured by a consumer-record count, and in some states, whether your revenue or its reliance on selling personal data crosses a separate line. A 60-person e-commerce company with 150,000 customer accounts can be squarely covered while a 400-person company that barely touches personal data is not. “Does a state privacy law apply to us” has nothing to do with how many people you employ, and almost everything to do with how many consumer records you touch and where those consumers live.
This guide walks through the actual test each law runs, gives verified thresholds for the states where the numbers matter most, and sets out what to do this month to find out where you stand.
The three-part test, not the headcount test
Strip away the marketing language around “comprehensive state privacy laws” and nearly all of them run the same structural test, with state-specific numbers plugged in:
- A business nexus with the state. You conduct business in the state, or produce a product or service targeted at residents of that state. This is about your customers’ location, not your headquarters or incorporation state.
- A data-volume or revenue threshold. Most laws require processing personal data of some number of that state’s residents in a calendar year, commonly 100,000, or a lower figure paired with a revenue-from-data-sales condition. Some states add a flat company revenue floor on top.
- No employee-count test, anywhere. A company can be well under 500 employees and still be squarely in scope, or well over it and out of scope, depending entirely on the consumer records it touches.
That third point catches growing companies off guard. A SaaS company, a regional retailer, or a healthcare scheduling vendor can cross a 100,000-consumer threshold with a small team and a popular product, long before it has a dedicated privacy or security hire.
Verified thresholds for six states
These six illustrate the two dominant threshold patterns and are the ones we can verify with confidence. State privacy law moves fast; treat the table as a snapshot and confirm your own state’s current text before relying on it.
| State | Statute | Consumer-count threshold | Revenue condition |
|---|---|---|---|
| Virginia | Va. Code § 59.1-576 | 100,000+ VA consumers/year, or 25,000+ consumers | No flat floor; the 25,000 tier needs 50%+ of gross revenue from selling personal data |
| Colorado | Colo. Rev. Stat. § 6-1-1304 | 100,000+ CO consumers/year, or 25,000+ consumers | No flat floor; the 25,000 tier needs revenue or a discount from selling personal data |
| Utah | Utah Code § 13-61-102 | 100,000+ UT consumers, or 25,000+ with 50%+ revenue from selling data | Flat floor: annual revenue of twenty-five million dollars or more, required in addition to the data test |
| California | Cal. Civ. Code § 1798.140(d) (CCPA/CPRA) | 100,000+ consumers/households, or 50%+ of revenue from selling/sharing data | Flat floor (either prong alone qualifies): global revenue above an inflation-adjusted figure, reset every two years |
| Texas | Tex. Bus. & Com. Code § 541.002 | None | None; applies to anyone doing business in or serving Texas residents unless it meets the SBA small-business standard |
| Florida | Fla. Stat. § 501.702(9) (Digital Bill of Rights) | None | Flat floor: global revenue over one billion dollars, plus one added business-model condition (e.g., 50%+ revenue from online ad sales) |
Two patterns matter more than the exact numbers. Virginia, Colorado, and most other enacted states follow the same basic model: a 100,000-consumer test, or a lower 25,000-consumer test paired with reliance on selling data, with no separate revenue requirement. That is the model most likely to reach a growing company with a large customer base and a modest headcount. Utah, California, and Florida pair the data test with a revenue floor, which keeps the law out of scope for most mid-market companies, though California’s data-volume prong alone can still capture one with no revenue anywhere near its adjusted floor.
The remaining enacted states (among them Connecticut, Oregon, New Jersey, Iowa, Indiana, Montana, Tennessee, Delaware, Minnesota, New Hampshire, Maryland, Kentucky, and Rhode Island) mostly follow the Virginia-style model with state-specific variations, and several only took effect January 1, 2026. A few more are enacted but not yet in force: Louisiana and Oklahoma in January 2027, Alabama in May 2027, and Vermont in January 2028. Confirm the current text for any state you operate in rather than relying on a secondhand number, including this article.
Georgia does not have one, but that is not the answer you think it is
Georgia has not enacted a comprehensive consumer privacy law as of this writing, despite several legislative attempts. If your company is based in metro Atlanta or anywhere else in Georgia, that fact tells you nothing about your actual exposure. These laws apply based on where your customers live, not where your company is headquartered. A Georgia-based company with customers in Colorado, Virginia, or California is squarely subject to those states’ laws regardless of Georgia’s own position.
What a HIPAA or GLBA exemption does and does not cover
Companies that already comply with HIPAA or the Gramm-Leach-Bliley Act (GLBA) often assume they are automatically exempt from state privacy laws too. That is not safe to assume without checking the specific state. Some states exempt the regulated entity itself, so a HIPAA-covered provider is out of scope entirely; others exempt only the regulated data, such as protected health information, leaving the rest of that company’s personal data (marketing lists, employee data, website analytics) subject to the state law anyway. Treat any HIPAA or GLBA exemption claim as a question for counsel, not a blanket pass.
Finding your own exposure this month
You do not need outside help to run a first pass. This sequence works without a dedicated privacy team:
- List the states with real customer volume. Pull your billing or CRM system and count distinct consumer or household records by state for the trailing twelve months. Most companies have never run this report, and it is usually available within an hour.
- Flag any state at or near 25,000 or 100,000 records. Those are the numbers that matter across most enacted laws. A state near either threshold today is one you should expect to cross soon if the business is growing there.
- Check whether you sell or share personal data for value. “Sale” is defined broadly and can include advertising and data-partnership arrangements that do not look like a traditional data sale. Any such revenue likely puts the lower 25,000-consumer thresholds in play before the 100,000 line does.
- Confirm your actual exemptions with counsel, not assumption. If you rely on a HIPAA or GLBA exemption, get written confirmation of its scope for each state where you have volume.
- Write down the answer and the date. A one-page memo naming which states you are in scope for, and why, is the artifact an insurer, an acquirer, or a customer’s security questionnaire will eventually ask for.
Where this connects to AI systems specifically
Several of these state laws, along with the GDPR, add a separate layer of obligation once an AI system is doing the profiling or automated decision-making that touches those consumer records, not just storing them. If your scoping exercise above turns up a chatbot, a recommendation engine, or an automated underwriting tool processing data for consumers in a covered state, that system may trigger its own impact-assessment duty on top of the general applicability question answered here. That narrower, system-specific question is the scope of DSE’s DPIA and privacy risk assessment work for AI systems: a fixed-scope engagement that runs the jurisdiction trigger analysis for a specific AI system and produces a documented assessment your privacy office can finalize. It is readiness work, not legal advice.
If the broader worry is unsanctioned AI tools in use without review in the first place, see what “reasonable security” means for shadow AI at a small or mid-sized business, which covers the related California breach-law standard and a five-factor self-score.
Where DSE’s work fits, and where it does not
DSE helps organizations run the exposure check above and scope the privacy assessment or DPIA that follows once a system or activity is confirmed in scope. DSE does not provide legal advice and does not certify or guarantee compliance with any state privacy law, the GDPR, or any other framework. Whether a given law applies to your specific facts is a conclusion for your own counsel; a readiness engagement gets the record counts and data flows organized well enough that counsel’s answer is fast rather than a cold start.
Questions buyers ask
Does our company size or employee count determine whether a state privacy law applies to us?
No. None of the enacted state comprehensive privacy laws use employee headcount as a threshold. They test on the number of that state’s consumers whose data you process or sell in a calendar year, and in some states, on your revenue or reliance on selling personal data. A small company with a large customer base can be in scope; a larger company that handles little personal data may not be.
We are a Georgia company with no out-of-state customers. Are we exempt from everything?
Not automatically, and the reasoning matters more than the conclusion. Georgia itself has not enacted a comprehensive privacy law, so Georgia residency is not a trigger on its own. If you have no customers in any state with an enacted law, you may currently be out of scope, but that is a narrower position than “we’re a Georgia company so we’re exempt,” and it changes the moment you gain customers elsewhere.
If we are a HIPAA-covered entity, are we exempt from state privacy laws?
Sometimes, and only for the data or activities the exemption actually covers. Some states exempt the whole covered entity; others exempt only the protected health information itself, leaving other personal data the same company processes subject to the law. Confirm the exact scope with counsel for each state where you have consumer volume, rather than assuming it travels state to state.
How often should we recheck this?
At least annually, and sooner after any material change: entering a new state market, a product launch that changes how much personal data you collect, or a new revenue line involving selling or sharing data. Several of these laws also change their own numbers through amendment, Connecticut and Colorado both amended theirs in 2026, so the thresholds are not static even if your business does not change. A general cybersecurity risk assessment tests your security posture, not privacy-law applicability, so it does not substitute for this check.
What this guide is / What it is not
What it is: A practitioner explanation of the applicability tests used by US state comprehensive consumer privacy laws, anchored to the Virginia Consumer Data Protection Act (Va. Code § 59.1-576), the Colorado Privacy Act (Colo. Rev. Stat. § 6-1-1304), the Utah Consumer Privacy Act (Utah Code § 13-61-102), the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.140(d)), the Texas Data Privacy and Security Act (Tex. Bus. & Com. Code § 541.002), and the Florida Digital Bill of Rights (Fla. Stat. § 501.702(9)). What it is not: Legal advice, a jurisdictional determination, or a guarantee of any compliance or enforcement outcome. State privacy law thresholds, exemptions, and effective dates change through ordinary legislative amendment; confirm the current statutory text for any state before relying on a specific figure, and consult qualified counsel on whether a given law applies to your organization’s specific facts. DSE performs readiness and assessment work and does not provide legal advice or certify compliance with any state or federal privacy law.
The Bottom Line
Stop asking “are we big enough to worry about this.” Ask instead how many consumer records you process per state, and whether any part of your revenue comes from selling or sharing personal data. Those are the only two questions every enacted state comprehensive privacy law actually runs on, and a fast first pass, a record count by state, a check on data-sale arrangements, a written note of where you stand, is something most companies can finish this month without outside help. The harder part is keeping that answer current as your customer base and the laws themselves keep changing.
Metro Atlanta and Georgia companies that want this folded into an ongoing security and compliance program can start with fractional CISO leadership for Atlanta and Georgia small businesses.
Key facts
- The Colorado Privacy Act, effective July 1, 2023, applies to any controller that processes personal data of 100,000 or more Colorado consumers in a calendar year, or of 25,000 or more consumers while deriving revenue or a discount from selling personal data, with no minimum company revenue threshold at all (Colo. Rev. Stat. § 6-1-1304).
- The Texas Data Privacy and Security Act, effective July 1, 2024, sets no numeric consumer-count or revenue threshold; it applies to any entity conducting business in Texas, or offering a product or service used by Texas residents, that processes or sells personal data and does not qualify as a small business under U.S. Small Business Administration size standards (Tex. Bus. & Com. Code § 541.002).