Several states now have their own privacy laws, and they apply based on where the customer is. A small business serving one state may have almost nothing to do. One selling nationally may not.
The state laws have thresholds. California, Virginia, Colorado and the rest generally require either large revenue or tens of thousands of consumer records. At $400k you are almost certainly under all of them, and it is the customer's state that matters, not yours.
Breach notification has no threshold. Every state has a law, and if you lose customer data you must notify, based on where each customer lives.
So: a clear privacy policy, secure storage, and know what you would do in the first 48 hours of a breach.
Want me to draft the breach response steps?
It told you what does not apply, which is more useful than a list of everything.
- A privacy policy on your website saying what you collect, why, and who you share it with
- Somewhere secure to keep it, not a shared spreadsheet on an open laptop
- A way to handle access and deletion requests if a state law covers you
- Sector rules that override everything: HIPAA for health, GLBA for financial, COPPA for anything aimed at children under 13
- Breach notification, which every state has in some form even where it has no general privacy law
California, the one most businesses meet first
The CCPA, as amended by the CPRA, covers a for-profit business doing business in California that has annual gross revenue over $26.625 million, or buys, sells or shares the personal information of 100,000 or more California consumers or households, or earns 50% or more of its revenue from selling or sharing it. It turns on your customers being Californian, not on you being there. A covered business that sells or shares personal information, including through ad pixels, needs a Do Not Sell or Share link and must honor Global Privacy Control signals. About 20 states now have comprehensive privacy laws, each with its own thresholds. As of Oct 2026.
Cal. Civ. Code secs. 1798.100 and 1798.140(d); Cal. Code Regs. tit. 11, sec. 7025
Texas works differently. Its Data Privacy and Security Act covers businesses that are not small businesses, but even a small business may not sell sensitive data without consent.
Email and text marketing
Email needs no consent, but CAN-SPAM requires accurate headers and subject lines, identification as an ad, a valid postal address and an opt-out honored within 10 business days. Marketing texts sent with automated systems need prior express written consent, statutory damages are $500 per text and up to $1,500 if willful, and federal rules allow marketing calls and texts only between 8 a.m. and 9 p.m. in the recipient's time zone. Some states add their own rules: Florida's Telephone Solicitation Act gives consumers their own right to sue. As of Oct 2026.
15 U.S.C. 7701 et seq.; 16 CFR Part 316; 47 U.S.C. 227; 47 CFR 64.1200(c)(1); Fla. Stat. sec. 501.059
Thresholds matter in both directions. Most state laws only bite above a revenue or record-count line, so you may be covered by none of them. Breach notification laws have no such threshold.
I hold [what data]. I operate from [state] and my customers are in [which states]. My annual revenue is roughly [amount]. Which privacy laws actually apply to me, and what do I need to do?
Every lesson ends with a question to hand to a Greymill specialist, who answers with what it knows about your business.