Unlike the EU's single GDPR framework, the US has taken a state-by-state approach to data privacy — and the patchwork is only growing. Here's a practical, non-legal-advice overview of what a business website needs to consider.
The Foundational Law: CCPA/CPRA (California)
California's Consumer Privacy Act, later expanded by the CPRA, gives California residents rights to know what data is collected about them, request deletion, and opt out of the sale or sharing of their personal information. Because California is large enough that many businesses can't practically exclude it, CCPA compliance has become a de facto national baseline for many US companies.
"Most businesses don't need fifty different privacy policies — they need one solid framework built to the strictest applicable state law, applied consistently."
The Growing List of State Laws
Virginia, Colorado, Connecticut, Utah, and a steadily increasing number of other states have since passed their own comprehensive privacy laws, each with subtle differences in thresholds, consumer rights, and enforcement. A business with any meaningful US traffic footprint is likely subject to more than one.
What This Actually Requires on a Website
1. A clear, accurate privacy policy — not a generic template, but one reflecting what data your specific site and tools actually collect.
2. A functioning cookie/tracking consent mechanism for applicable states, distinguishing essential from non-essential tracking.
3. A "Do Not Sell or Share My Personal Information" mechanism if you use third-party advertising pixels or sell data — many businesses don't realize standard ad retargeting can count as a "sale" under these laws.
4. A functioning process to actually honor deletion and access requests when they come in, not just a policy promising to.
The Compliance Gap Most Businesses Have
The most common gap we find isn't a missing privacy policy — it's a privacy policy that doesn't match what the site's actual tracking scripts and third-party tools are doing. An accurate technical audit of what data actually flows off your site should come before rewriting the policy that describes it.
The Bottom Line
This is a genuinely evolving legal area, and this overview isn't legal advice — a qualified attorney should review your specific situation. What a development team can do is make sure the technical infrastructure (consent management, data mapping, deletion workflows) is actually capable of matching whatever the policy promises.
Compliance lives in how the site is built — consent, forms, where data flows — and that is part of every build in our Web Development service. The free website diagnostic is a sensible first pass, and our ADA compliance guide covers the accessibility side of the same risk.