Every US state privacy law that reaches your website, with dates

There is no federal privacy law covering most US websites, so the rules that reach a site are the ones its visitors bring with them. 24 states now have a comprehensive consumer privacy statute and 26 do not, and 12 of the 24 require a business to honour a universal opt-out signal sent by the browser. That last group is the one that changes the build rather than the policy page.

The table below is the full set with effective dates, ordered by when each came into force. It is generated from the same data that drives our state pages, so the two cannot drift apart. Nothing here is legal advice and thresholds differ more than the rights do, which is why the threshold is the column to take to your counsel rather than the date.

Every state privacy law, by the date it took effect

Most of what these laws require is documentation: a privacy notice that describes what you actually collect, a route for someone to request their data or its deletion, and a named person who answers. Those are writing tasks. The opt-out signal is different, because the browser sends a header and your site has to read it and act before any tracking fires. That is code, it sits in the consent layer, and it is the requirement most commonly missing from sites that otherwise have a perfectly good privacy policy.

The practical consequence for reporting is the one people miss. Where the signal is honoured, a real share of visitors is absent from analytics by design, and no tool recovers them lawfully. So recorded traffic is a floor rather than a total, and a monthly report that presents sessions as people is overstating its own certainty. We cover what that does to measurement in what an AI crawler actually receives and the reporting side in the state pages themselves.

Where a state with no law still reaches you

• Your visitors travel. A business in a state with no statute still receives visitors from states that have one, and the obligation follows the person rather than the server.
• Sector rules apply everywhere. HIPAA, COPPA and the FTC Act do not care which state you are in, and for a healthcare site the sector rule is usually stricter than the state one.
• Browsers do not check your address. Tracking protection reduces what analytics sees regardless of any statute, so the measurement gap exists in all fifty states.
• The list is still growing. Several of the laws above were signed years before they took effect, so a state that is absent today has often already scheduled its entry.

If you want the version for one state rather than the whole table, every state has its own page with the threshold, what the consent layer has to do there and what it means for reporting. The Webflow agency pages and SEO agency pages both carry it.