State privacy laws: opt-out and policy gaps

The rule

California is not the only state with a privacy statute. Several states have passed comprehensive laws on a shared pattern: a business that decides why and how personal data is processed, called a controller, owes consumers a privacy notice and a way to opt out of targeted advertising and the sale of their data. California is covered in US-04 and US-05. This article reads four others: Virginia, Colorado, Connecticut and Texas.

Connecticut’s text follows the same pattern. Connecticut applies from 1 July 2026 to businesses that process the personal data of 35,000 or more consumers, process sensitive data, or offer personal data for sale (§42-516 as amended by P.A. 25-113). Under §42-520(b)(1) the notice must be “reasonably accessible, clear and meaningful,” with “a clear and conspicuous disclosure” of any processing for targeted advertising or any sale for targeted advertising. Section 42-520(c)(1)(A) also asks for a clear and conspicuous hyperlink to a page where a consumer can opt out of targeted advertising or sale and for the ability to opt out through “an opt-out preference signal sent, with such consumer’s consent, by a platform, technology or mechanism.”

Virginia defines a sale as an exchange of personal data “for monetary consideration,” while Connecticut and Texas add “other valuable consideration,” which is the wording California uses. Thresholds differ: Virginia applies at 100,000 consumers, or 25,000 together with more than half of gross revenue from selling data (§59.1-576). The Connecticut text read here is the General Assembly’s 2026 supplement, with amended text effective 1 July 2026, and the Attorney General has announced further Connecticut privacy laws that take effect on 1 October 2026, so check the current text before relying on a threshold.

Enforcement is by the Attorney General in Virginia, Texas and Connecticut, with a cure period of 30 days in Virginia and Texas before an action can be brought. Both allow civil penalties of up to $7,500 “for each violation” (Va. Code §59.1-584; Tex. Bus. & Com. Code §541.155). In Connecticut the statute treats a failure to follow the Act as an unfair trade practice enforced solely by the Attorney General (§42-525).

What PeekWell checks and how

US-11 asks whether a visitor from a state with its own privacy law can opt out of targeted advertising and whether the policy describes how. Unlike the California checks, it isn’t limited to sites that name California.

The scan is automated. It looks on your public pages for a way to opt out of targeted advertising, such as a link to a page where a visitor can switch it off. It reads the policy for what the state laws ask for: statements on sensitive data, targeted advertising and sale, and an explanation of the opt-out. And it checks whether a browser opt-out signal changes what the page does, as in US-03. Advertising trackers that still start with the signal on are what the report records.

The limits are the usual ones for a visit from outside. It sees the public pages it visited, and the members area when you give it a sign-in. It doesn’t submit forms, and it can’t see data sent from your servers. It does not know a visitor’s state, check your threshold, or tell whether an opt-out request is honoured after the page closes. A Passed means the expected mechanisms were observed on the pages scanned. It does not say the business complies with any state’s law.

Why it matters for a company

The enforcement record under these statutes is shorter than California’s, and the cases that exist differ in kind. In the Texas matter filed on 13 January 2025, the Attorney General sued Allstate and its subsidiary Arity under the Texas Data Privacy and Security Act. The allegation was that they collected and sold location and movement data from phones through software embedded in third-party apps, without the notice and consent the Act requires for sensitive data such as precise geolocation. The Attorney General called it the first enforcement action filed by a state attorney general to enforce a comprehensive data privacy law. The page read reports no outcome.

Connecticut’s TicketNetwork settlement of 8 July 2025 is closer to what a site scan sees. The Attorney General sent a cure notice on 9 November 2023 saying the privacy notice was “largely unreadable, missing key data rights, and contained rights mechanisms that were misconfigured or inoperable.” The company had 60 days, until 8 January 2024, to fix each problem, and the Attorney General says it did not resolve them well beyond that period. It agreed to pay $85,000 and to report metrics on consumer requests. The release does not state the company’s size.

By the end of 2025 the Connecticut Attorney General’s February 2026 report counts dozens of notices of violation and warning letters, including over hidden consumer rights. Connecticut’s mandatory cure period expired on 1 January 2025, so a notice there may now lead to an action sooner.

For a company the lessons are practical. Cure periods, where they exist, are short: 30 days in Virginia and Texas, and 60 days in the notice Connecticut sent TicketNetwork. A warning letter has a deadline. A notice that is hard to read, or a rights link that does not work, is the kind of problem a visitor or a regulator can see without any inside information. And the statutes name opt-out signals and browser settings, so a mechanism that works only when someone finds a link may fall short in states that list the signal.

Smaller companies and larger companies

Size works differently in each state. Texas excludes small businesses as the SBA defines them, but not for selling sensitive data. Virginia sets its threshold on the number of consumers whose data is processed. Connecticut’s test counts consumers too, and since 1 July 2026 it also reaches any business that sells personal data or processes sensitive data. Colorado’s thresholds are in C.R.S. §6-1-1304: as passed in 2021, 100,000 consumers in a calendar year, or 25,000 for a business that earns revenue or a discount from selling personal data. The Act has been amended since, so check the current text.

In a smaller company the site usually reaches several states without anyone choosing that. An online shop ships nationwide, and its policy was set up with one state’s law in mind or none. The opt-out link may be missing, or go to a page that does nothing. TicketNetwork shows that a notice can exist and still be unreadable or point to rights that do not function.

In a larger company the problem is spread. Different brands and apps run different policies, a legal team tracks a few states, and a signal that one team’s page honours is ignored by another’s. Large companies also hold sensitive data such as location, as in the Texas matter.

How to fix it

Start by working out which states you serve, then make one opt-out experience that meets the strictest common ground.

1. Decide where you have visitors. Check your analytics and shipping addresses for the states you reach. Then check each state’s threshold in its statute.
2. Offer an opt-out of targeted advertising and sale. Add a clear link, in the footer or header, to a page where a visitor can switch both off, and make the switch stop the tags it names. If you also serve California, the same link can carry the “Do Not Sell or Share” title that US-02 covers.
3. Honour the browser signal. Make your consent or tag setup read the opt-out signal and stop advertising tags for that visitor. US-03 covers the signal in more detail.
4. Update the policy. State what you process, whether you sell or use targeted advertising, which categories go to third parties, how to opt out and appeal, and how signal requests are handled. Include the Texas sentence about selling sensitive data if you do that.
5. Check sensitive data. If you collect precise location, health or similar data, ask your legal adviser which of the states you serve require consent before you collect or sell it.
6. Test the notice as a visitor would. Read the policy on a phone and click each rights link. Unreadable notices and broken links are what Connecticut’s Attorney General pointed to.
7. Re-scan. Run a scan after the changes. The finding should clear once the opt-out exists, the policy explains it and the signal changes what the page does.