CCPA and Beyond: State-by-State Data Privacy Rules US Software Teams Can't Ignore

The California Consumer Privacy Act (CCPA), strengthened by the California Privacy Rights Act (CPRA), was the law that forced most US software companies to build their first real consumer privacy controls. But CCPA is no longer the only law in the room. A growing number of states have passed comprehensive privacy legislation, and software teams building for a national US customer base now face a genuine patchwork problem: broadly similar principles, meaningfully different requirements, enforced by different regulators with different penalty structures.

The Common Core Across State Privacy Laws

Despite the patchwork, most state laws share a recognisable structural core, which is good news for software teams — it means a well-architected privacy layer can satisfy the majority of requirements across states with configuration differences, not a rebuild per state.

• Right to know / access — consumers can request what personal data has been collected about them.
• Right to delete — consumers can request deletion of their personal data, with defined exceptions.
• Right to opt out of sale/sharing — particularly of data used for targeted advertising or shared with third parties.
• Right to correct — increasingly common in newer state laws, allowing consumers to fix inaccurate data.
• Sensitive data protections — additional consent or opt-out requirements for categories like health, biometric, or precise geolocation data.

Where the Real Differences Bite

The differences that actually change your architecture and process aren't philosophical — they're operational: response timelines, applicability thresholds, and enforcement mechanisms differ enough that a single, rigid 'CCPA-only' implementation will miss obligations in other states.

• Applicability thresholds: some state laws apply based on revenue, others on the number of state residents' data processed — meaning a smaller company can be in scope in one state and out of scope in another.
• Response timelines: consumer request response windows vary (commonly 45 days, sometimes with extensions), and tracking the correct deadline per state adds real operational complexity.
• Private right of action: most states rely solely on Attorney General enforcement, but a subset of provisions (data breach related, in some states) allow individual consumers to sue directly — a materially different risk profile.
• Universal opt-out signals: some states require honouring browser-level opt-out signals (like Global Privacy Control) automatically, which has direct implications for consent management tooling.

Architecting for a Multi-State Compliance Strategy

• Build a single, configurable consumer rights request (DSAR) workflow that can be parameterised per state's specific timeline and scope, rather than separate systems per state.
• Implement Global Privacy Control and similar opt-out signal handling at the platform level, not per-campaign or per-team.
• Maintain a structured data inventory mapping what personal data is collected, why, and which state-level sensitive-data categories it falls under.
• Centralise consent and preference management so opt-out status is enforced consistently across every system that uses consumer data, not just the marketing stack.
• Track applicability thresholds per state as your user base and revenue grow — a company can cross into scope for a new state's law without anyone noticing until an audit.

“The software teams handling the state privacy patchwork well aren't maintaining fifty different compliance implementations. They've built one configurable privacy layer and treat each state's law as a parameter set, not a separate project.”

— Arjun Mehta, CEO & Co-Founder, Alliance Corporation

A Practical Compliance Checklist

• Map which state privacy laws currently apply to your business based on revenue, data volume, and residency of your users.
• Build or audit a single DSAR workflow configurable to each applicable state's timeline and rights.
• Implement universal opt-out signal handling (e.g. Global Privacy Control) if you serve users in states that require it.
• Review data broker and 'sale/sharing' definitions carefully — many states define these more broadly than plain-language use of the word 'sale.'
• Reassess applicability thresholds annually as your business grows into new states or revenue tiers.