Twenty States. One Question Most Sellers Haven't Asked Yet.
Twenty U.S. states now have comprehensive consumer privacy laws in effect. Four more have already been signed into law and are simply waiting on their effective dates. For most independent Shopify sellers and the bookkeepers who work with them, this number is genuinely surprising, because the conversation about privacy compliance almost always starts and ends with California.
Why This Matters More Than It Used To
When only California had a real comprehensive law, treating it as the whole conversation made sense. That stopped being true somewhere in the last two years. Virginia, Colorado, Kentucky, Indiana, Iowa, Minnesota, Nebraska, and Tennessee, among others, now each carry their own real thresholds, their own rights, and their own enforcement bodies. None of them are optional just because they're less well known than California's.
The Pattern Worth Noticing
These laws are not copies of each other. Iowa grants only four rights and skips a correction right entirely. Nebraska doesn't use a revenue or consumer threshold at all, it applies based on federal small-business classification. Tennessee requires clearing both a revenue and a consumer threshold together, not either one alone. Assuming that being compliant in one state automatically covers you in another is one of the more common and costly assumptions a growing seller can make.
What This Means If You Sell Into Multiple States
A store shipping into ten or more states doesn't have one compliance question anymore. It potentially has ten separate ones, each with its own threshold and its own specific rights to honor. The states that actually apply to you depend entirely on where your customers are and how many of them there are, not on a general sense of how big your business feels.
The Honest Difficulty
No single spreadsheet built by hand realistically keeps up with twenty active state laws plus four more arriving over the next two years, each with different thresholds and different rights. This is precisely the kind of fragmented, frequently-changing landscape that benefits from a tool checking it systematically, rather than trying to hold all of it in memory or in a document that goes stale the moment one state amends its threshold.
Check Where You Actually Stand
All information in this article is sourced from MultiState's 2026 state privacy law tracker and Privacy World's state privacy law updates. Regulens is informational only and this article is not legal advice. Speak to a licensed privacy attorney about your specific compliance situation.
Regulens tracks comprehensive privacy law coverage across every state where a real law currently applies, and stages upcoming laws ahead of their effective dates.
Free to check, takes three minutes, no credit card needed. Not legal advice. Informational only.
Check your store's full multi-state privacy readiness at getregulens.com
Further Reading
Q4 Is Starting — Here's the Multi-State Compliance Check Most Sellers Skip Before It Does
Fourth quarter brings the highest sales volume of the year for most Shopify sellers, which means it also brings the highest chance of crossing a state threshold you haven't checked yet.
Vermont's Privacy Law Has the Lowest Bar in the Country — And You Have Until 2028
At just 3,000 consumers for sensitive data, Vermont's threshold is dramatically lower than any other state Regulens tracks. It doesn't take effect until 2028, but the gap between now and then is worth using well.