Confirm the state privacy laws applies and what it asks
Who it covers, what it asks for in plain words, and the dates that matter. The regulator has the final say; we read it with you.
Privacy · State attorneys general
US state privacy laws (20 in force in 2026)
Indiana, Kentucky and Rhode Island joined January 1, 2026. California adds cybersecurity audits and risk assessments under the CPPA rules.
Rather skip the call? Get a fixed-fee State Privacy quote in writing.
One control set, every frameworkLed by Sam Khan, CISA and CRISCPublic pricing
Who it applies to
The businesses that carry State Privacy, and the pages written for them.
Each industry page names the regulation, the obligation and the clock, tells the story of an owner in that trade, and shows what we protect for them.
Healthcare & DentalFinancial ServicesAI & Technology CompaniesArchitecture, Engineering & ConstructionRetail & Multi-Location StoresManufacturing & Machine ShopsNonprofits & AssociationsAuto Repair & Skilled TradesRestaurants, Hotels & HospitalityPrivate Schools & TutoringAgencies, Staffing & Consultancies
Which packages prepare you for it
Cyber and Data Protection Assessment
Any business of 10 to 500 people that has never had a real assessment, or has not had one in a year
There is no State Privacy package of its own yet. The Cyber and Data Protection Assessment covers the controls most of it shares with other frameworks, and the State Privacy-specific requirements are scoped with you in a 30-minute call.
What it asks for
In plain English, what State Privacy expects you to have in place.
- A data inventoryWhat personal and sensitive data you collect, why, who you share or sell it to, and how long you keep it.
- A privacy noticeA notice that says what you collect and why, and how a consumer uses each right.
- Opt-outs that workOpt-out of sale, targeted advertising and profiling, including the browser opt-out signal where the state requires it.
- Consumer requests on the clockAccess, correction, deletion and portability requests answered within the deadline, usually 45 days, with an appeal process.
- Consent for sensitive dataOpt-in consent before processing health, biometric, precise location or children’s data in most states.
- Assessments and contractsData protection assessments for high-risk processing, and processor contracts with the terms the laws require.
A note on authority: the regulator, auditor or certifying body has the final say on whether you comply. We help interpret the requirements, scope what applies, gap-assess against what is published today, and keep you compliance-ready and secure as the guidance evolves. We hold no regulatory authority and do not certify.
Where it starts
Your one-stop shop for state privacy laws
The state laws differ at the edges and agree in the middle: know what personal data you hold, tell people what you do with it, answer their requests, keep it secure, and bind your vendors. California now asks larger businesses for cybersecurity audits and documented risk assessments too.
We build one program that satisfies the common core and flags the state-specific extras.
Trace the data: tick what is true
Tick what applies and we show which state duties start for you.
The steps
Six steps from "does state privacy laws apply to us?" to evidence you can show
The whole state privacy laws journey, short version. We handle every step with you.
Scope it
Which systems, data, people and vendors are in. A clear boundary is a smaller job and a cleaner answer.
With AccuSights: we scope it with you from the intake form and put it in writing.
Run the gap assessment
What you have versus what the rule expects: tooling, configurations, policies and the records that prove each one.
With AccuSights: your engineer tells you how far each control needs to go.
Fix and document
Most gaps are in the policies and workflows nobody wrote down, not the firewall.
With AccuSights: remediation is in-house or with your IT provider, verified in your real environment.
Stay continuously compliant
Controls drift between reviews. Someone has to notice.
- Data map currentPassing
- Privacy notice updatedPassing
- Requests answered within the windowPassing
- Vendor contracts signedPassing
With AccuSights: our endpoint agent and monitoring catch the drift and flag it to your engineer.
Report, renew, reuse
The evidence that proves it, filed where the next inspector, auditor or customer can find it, and mapped to the next framework you need.
With AccuSights: evidence keeps collecting itself, so next year is a renewal and not a rerun.
Why AccuSights
Why small teams pick AccuSights for state privacy laws
Most compliance platforms assume you have a security team. We built this for the companies that do not.
Priced for a startup, not a Series D
One fixed fee, scoped from the intake form and put in writing. No seat math, no surprise add-ons at renewal.
The endpoint agent is built in
Our own agent collects device evidence from every laptop and server automatically. You do not need to buy or configure an enterprise MDM first.
A human who has done this before
A named engineer guides every step, answers the "how far do we take this control?" questions and stays through the audit.
Written once, read everywhere
One control set is mapped to every framework you carry, so evidence is produced once and reused.
What it costs
What state privacy laws costs, in plain numbers
Here is what is published, with who published it and when.
$0No state certifies privacy compliance; the attorneys general enforce. The cost is the data map, the notice, the request process and the controls.Source: California Privacy Protection Agency, regulations (2025)
A fixed feeReadiness and the fixes, in writing within 24 hours of the intake form.Source: AccuSights pricing page (2026)
From $25 a user a monthProtect: AI-powered monitoring of your computers and email day and night, with AccuSights engineers who call you. 10 users minimum.Source: AccuSights pricing page (2026)
Our part is a fixed fee. Tell us about your environment on the short intake form and you have a number in writing within 24 hours of sending it back.
Self-serve compliance software
- You get a portal and drive it yourself.
- Expert help is often a separate purchase or a partner referral.
- Device checks usually need an MDM you set up first.
- Pricing comes after a sales call.
AccuSights
- A named engineer runs it with you.
- Guidance and remediation are included, not referred out.
- The endpoint agent ships with the platform.
- A fixed fee, in writing, within 24 hours of the intake form.
Vanta alternatives compared · Drata alternatives compared · Comparing us with Vanta · Comparing us with Drata · Comparing us with Secureframe · See all AccuSights pricing
Read more
More on State Privacy, in plain words.
Questions
state privacy laws questions we get every week
What do most state privacy laws require?
A clear privacy notice; rights for residents to access, correct, delete and get a copy of their data and to opt out of sale, targeted advertising and some profiling; data protection assessments for higher-risk uses; contracts with processors; and reasonable security. The details and deadlines differ by state.Source: California Privacy Protection Agency
What changed in California in 2026?
New CPPA regulations took effect on 1 January 2026. They add cybersecurity audits and risk assessments for businesses whose processing presents significant risk, and rules on automated decision-making technology, with audit and filing deadlines phased in over several years by business size.Source: California Privacy Protection Agency
Do state privacy laws cover employee and business contact data?
In California, yes: the exemptions for employee and business-to-business data expired on 1 January 2023, so those records carry the same rights. Most other state laws still exclude people acting in a commercial or employment role. Check the states where your staff and contacts live.Source: California Privacy Protection Agency
Are HIPAA-covered practices exempt?
Partly. Most state laws exempt protected health information governed by HIPAA, and some exempt covered entities entirely. Data outside HIPAA, such as marketing lists or website tracking, can still fall under state law, and Washington's health data law reaches consumer health data that HIPAA does not.Source: HHS, HIPAA Privacy Rule
Can one program cover several states?
Yes. Build to the strictest common requirements: a data map, one notice, one rights process with state-specific timelines, processor contracts and security evidence. Then add the state-specific items, such as California's audits. We map it once and keep it current as states change.
Do you certify State Privacy compliance?
No. We do not certify, and the regulator, examiner or independent auditor for State Privacy has the final say. We interpret the requirements for your business, scope what applies, close the gaps and keep the evidence current, so you go into any audit, assessment or examination with the evidence already in hand.
Where do we start with State Privacy?
With the 3-minute Cyber Hygiene Test if you want a number today, or with the 30-minute call if you want a written scope and a fixed fee. Either way the first deliverable is a gap list ranked by what would fail and what would hurt.
We also need other frameworks. Do we do State Privacy separately?
No. We build one control set and map it to every framework you carry, so evidence is produced once and reused. Adding a framework later is a mapping exercise, not a second program.
Also in Privacy: GDPR · every framework by industry
Next step
Thirty minutes, an engineer, a written scope for State Privacy.
Book the demo and see how one control set carries State Privacy and everything else you owe. Or leave your details and an engineer replies within one business day.