| name | state-law-applicability |
| title | State Privacy Law Applicability Assessment |
| description | US state privacy law applicability assessment tool. Evaluates revenue thresholds, data volume thresholds, business exemptions (GLBA, HIPAA, nonprofits), employee data carve-outs, and SBA small business determinations across all enacted state privacy laws. |
| author | mukul975 |
| author_url | https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/state-law-applicability |
| license | Apache-2.0 |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | us |
| practice | data-protection |
| language | en |
State Privacy Law Applicability Assessment
Overview
Determining which US state privacy laws apply to an organization requires evaluating multiple criteria: revenue thresholds, consumer/data volume thresholds, industry-specific exemptions, entity-type exemptions, and data-type exemptions. This skill provides a systematic assessment framework and Python automation tool for evaluating applicability across all major enacted state privacy laws.
Assessment Framework
Step 1: Geographic Nexus
For each state, determine if the organization has nexus through:
- Conducting business in the state (physical presence, employees, registered entity)
- Targeting residents of the state (marketing, advertising, or providing products/services specifically to state residents)
- Producing products/services consumed by state residents
Most state laws use "conducts business in [state] OR produces products or services targeted to [state] residents" as the nexus requirement.
Step 2: Threshold Assessment
| State | Threshold 1 | Threshold 2 | Revenue Alternative |
|---|
| California | 100,000 consumers/households | 50% revenue from sale/sharing | $25,000,000 annual gross revenue |
| Virginia | 100,000 consumers | 25,000 consumers + 50% revenue from sale | None |
| Colorado | 100,000 consumers | 25,000 consumers + revenue/discount from sale | None |
| Connecticut | 100,000 consumers (excl. payment) | 25,000 consumers + 25% revenue from sale | None |
| Texas | Non-SBA small business | N/A | None (no threshold) |
| Oregon | 100,000 consumers (excl. payment) | 25,000 consumers + 25% revenue from sale | None |
| Montana | 50,000 consumers (excl. payment) | 25,000 consumers + 25% revenue from sale | None |
| Kentucky | 100,000 consumers | 25,000 consumers + 50% revenue from sale | None |
Step 3: Entity-Level Exemptions
