US state privacy and data security laws: the complete compliance map

California CCPA / CPRA (Nov 2022)

For-profit businesses meeting one of three thresholds: annual gross revenue over $25 million; buying, selling, or sharing personal information of 100,000 or more California consumers or households annually; or deriving 50% or more of annual revenue from selling personal information. Applies regardless of where the business is located if it serves California consumers.

Organizations build a privacy notice and a deletion request workflow and call it done. The failures we see are in the backend: no data mapping to actually locate data subject to deletion requests; service provider contracts missing required CPRA provisions; sensitive personal information -- geolocation, health data, precise identifiers -- being processed without the additional opt-out mechanism. The CPPA''s enforcement investigations have focused on opt-out signal processing (Global Privacy Control compliance) and children''s data -- two areas many compliance programmes have not operationalized.

Consumer rights to know, delete, correct, and opt out of sale or sharing. Opt-out must be accessible via a ''Do Not Sell or Share My Personal Information'' link. Data minimization and purpose limitation obligations under CPRA. Sensitive personal information carries additional opt-out rights. The California Privacy Protection Agency (CPPA) has rulemaking authority and has been issuing detailed regulations since 2022. Contracts with service providers and contractors must include specific CPRA language.

The CPPA enforces CPRA with civil penalties up to $2,500 per unintentional violation and $7,500 per intentional violation. Consumers have a private right of action for data breaches involving their unencrypted personal information -- $100 to $750 per consumer per incident, or actual damages if higher. No cure period was retained under the CPRA amendments for CPPA-initiated enforcement.

CCPA/CPRA is the most consumer-rights-oriented law in this group and the one with the most regulatory infrastructure behind it. Virginia CDPA, Colorado CPA, Oregon CPA, and Tennessee TIPA all follow CCPA''s basic architecture but with narrower scope and more business-friendly enforcement. CA SB1386 is the historical predecessor for breach notification -- California''s current breach notification obligation is now in Civil Code 1798.82, which CCPA/CPRA layered additional requirements on top of.

CA SB1386

Any business or government agency that owns or licenses computerized personal information of California residents. No revenue or size threshold.

Organizations treat it as a historical artifact superseded by CCPA. The breach notification obligation in Civil Code 1798.82 -- SB1386''s current form -- is still live, separate from CCPA, and covers a broader definition of personal information than the original 2003 law.

Notification to affected California residents when their unencrypted personal information is acquired by an unauthorized person. The original SB1386 definition of personal information was narrow (name plus SSN, financial account, or driver''s license number). Subsequent amendments expanded the definition. Current California breach notification obligations are primarily governed by Civil Code Section 1798.82, which SB1386 became.

Enforced by the California AG and local prosecutors. Civil penalties and consumer private right of action available. Historical significance: SB1386 passed in 2003 and directly triggered breach notification legislation in all 50 states over the following two decades.

The direct ancestor of every breach notification law in this group. Oregon 646A, Illinois PIPA, Alaska PIPA, NY SHIELD Act, and Texas BC521 all follow the SB1386 model of notification-upon-breach plus reasonable security baseline.

CA SB327

Manufacturers of connected devices -- IoT hardware -- sold or offered for sale in California. Device: any item capable of connecting to the internet, directly or indirectly, including via Bluetooth, Zigbee, or similar protocols.

Manufacturers who sell B2B (devices deployed in enterprise or industrial settings) assume the law applies only to consumer IoT. It does not. A connected sensor sold to a Texas manufacturer that is used in a California facility falls within scope. The ''reasonable security feature'' standard is also deliberately vague -- manufacturers tend to interpret it narrowly until they face a product liability claim where SB327 non-compliance is cited.

Each connected device must be equipped with a reasonable security feature appropriate to the nature and function of the device and the information it may collect. Critically: if the device uses a password as a means of authentication outside a local area network, it must either (a) have a unique pre-programmed password for each device, or (b) require the user to generate a new means of authentication before the device can be used.

Enforced by the California AG. No private right of action.

The only device security law in this group. It sits in a different compliance lane than all other frameworks here. Organizations building connected products face SB327 on the product side and CCPA/CPRA on the data side -- two separate legal obligations that share almost no control overlap.

CO Colorado Privacy Act

Controllers processing personal data of 100,000 or more Colorado consumers per year, or 25,000 consumers where more than 25% of gross revenue derives from selling personal data. Effective July 2023.

Confusion between ''selling'' personal data under the Colorado CPA (which requires consideration) and ''sharing'' under CCPA/CPRA (which includes no-consideration transfers for targeted advertising). An organization that has built CCPA opt-outs for ''sale or sharing'' may still be missing the Colorado definition. The mandatory universal opt-out mechanism -- specifically the technical implementation of honoring browser-level signals -- is also frequently incomplete.

Consumer rights: access, correction, deletion, portability, opt-out of targeted advertising, data sale, and significant profiling. Mandatory data protection assessments for high-risk processing. Opt-out via universal opt-out mechanisms (similar to Global Privacy Control) required by July 2024. Controllers must respond to rights requests within 45 days, extendable by another 45 days.

Colorado AG enforcement only, no private right of action. Civil penalties up to $20,000 per violation. No cure period after January 1, 2025.

Part of the second wave of state privacy laws, structurally similar to Virginia CDPA. The data protection assessment requirement mirrors Virginia''s. The universal opt-out mechanism requirement is more specific than Virginia''s equivalent. Oregon CPA (effective July 2024) and Tennessee TIPA (effective July 2025) follow similar architectures.

IL BIPA

Private entities -- not government agencies -- that collect, capture, purchase, receive through trade, or otherwise obtain biometric identifiers or biometric information from individuals in Illinois. Biometric identifiers: retina or iris scans, fingerprints, voiceprints, scans of hand or face geometry.

Two distinct failure modes. First: employers using fingerprint time-and-attendance systems without BIPA-compliant consent forms. This is the most common BIPA lawsuit archetype. Second: technology companies building facial recognition or voiceprint features who assume BIPA only applies to the end employer deploying the feature, not to them as the vendor collecting the biometric data on behalf of the employer. Illinois courts have found both the employer and the technology vendor can be liable.

Written policy with retention and destruction schedule, publicly available. Informed written consent before collection. Prohibition on selling, leasing, trading, or profiting from biometric data. Security standard: reasonable care consistent with the entity''s handling of other confidential and sensitive information, and at least the same standard as industry-wide norms.

Private right of action with statutory damages: $1,000 per negligent violation, $5,000 per intentional or reckless violation. Attorneys'' fees available. This has made BIPA the source of the largest class action privacy settlements in US history -- the Facebook facial recognition settlement was $650 million, the TikTok settlement was $92 million. There is no cure period, no AG-first enforcement pathway. Litigation is the mechanism.

Completely isolated from all other frameworks in this group in terms of enforcement mechanism. Every other framework here is enforced by an AG, a sector regulator, or a state agency. BIPA is enforced by class action plaintiffs and their attorneys. Virginia CDPA and Colorado CPA treat biometric data as sensitive and require consent -- but they impose no statutory damages and have no private right of action. The litigation risk profile of BIPA has no equivalent elsewhere in this group.

IL IPA

Insurance companies, agents, brokers, and all other entities licensed by the Illinois Department of Insurance. Modeled on the NAIC Insurance Data Security Model Law MDL-668.

Insurance licensees who have an enterprise-level security programme that technically satisfies the WISP requirement but lack the 72-hour notification mechanics. The 72-hour clock is a detection-and-escalation problem, not a documentation problem. Organizations with mature policies but immature monitoring have the gap in the wrong place.

A formal written information security programme (WISP) covering administrative, technical, and physical safeguards. Annual risk assessment. Oversight of third-party service providers including written contracts with security requirements. Board oversight of the cybersecurity programme. 72-hour notification to the Illinois Director of Insurance following a cybersecurity event. Annual certification of compliance.

Enforced by the Illinois Department of Insurance. Failure to notify within 72 hours or to maintain a programme can result in license action and civil penalties.

Mirrors NY DFS 23 NYCRR 500 in its overall structure -- WISP, risk assessment, third-party oversight, board governance, 72-hour notification -- but applies to Illinois-licensed insurance entities rather than NY-licensed financial institutions. Both trace back to the NAIC model law. An organization licensed in both states can achieve significant control overlap but still faces separate certification obligations.

IL PIPA

Data collectors that own or license personal information of Illinois residents. Applies regardless of business size or revenue.

Organizations scope PIPA narrowly against the original definition of personal information and miss the expanded categories added through amendments. Medical information and health insurance information are now covered -- relevant to any employer, healthcare organization, or insurer handling Illinois residents'' data.

Notification to affected Illinois residents following a qualifying breach of security involving their personal information. Illinois has progressively expanded the definition of personal information through amendments to include financial account information, medical information, health insurance information, unique biometric data, and other sensitive categories.

Enforced by the Illinois AG. Civil penalties available. No private right of action for the breach notification obligation itself (unlike BIPA).

Breach notification law structurally parallel to CA SB1386, OR 646A, AK PIPA, NY SHIELD Act, and TX BC521. The notification obligation is the primary requirement; the security baseline (reasonable security procedures) is secondary. Should not be confused with IL BIPA, which is a separate statute with separate obligations and an entirely different enforcement mechanism.

MA 201 CMR 17.00

Any business that owns, licenses, stores, or maintains personal information of Massachusetts residents -- regardless of where the business is physically located. Personal information: Massachusetts resident name combined with SSN, driver''s license or state ID number, or financial account/credit card number.

Organizations write a WISP policy document and treat it as done. The regulation''s portable device encryption requirement is the one that generates the most findings in our assessments. Laptops, USB drives, and mobile devices containing personal information must be encrypted -- not just subject to an encryption policy. We regularly find organizations that have the policy but not the enforcement. One assessment of a 90-person professional services firm found 12 unencrypted laptops with Massachusetts personal information, in direct violation of a WISP that explicitly required encryption.

A comprehensive written information security programme (WISP) that includes risk assessment; employee training; vendor contract requirements; physical access controls; a system for monitoring, detecting, and responding to unauthorized access; encryption of personal information stored on portable devices and transmitted across public networks; up-to-date firewall and malware protection; and designated responsible employee(s).

Enforced by the Massachusetts Office of Consumer Affairs and Business Regulation and the AG. Civil penalties and injunctive relief available.

Massachusetts 201 CMR 17.00 was the first US regulation to mandate a WISP, which is why the NY SHIELD Act (2019) mirrors its structure. A WISP built to Massachusetts standards satisfies the security programme requirement of the SHIELD Act simultaneously. Neither law satisfies the consumer rights workflows required by CCPA/CPRA, Virginia CDPA, or Colorado CPA.

NV SB220

Operators of websites and online services that collect covered information from Nevada consumers and sell that information to third parties for monetary consideration.

Organizations that build CCPA opt-out mechanisms assume they also cover Nevada SB220. They do not, for a specific reason: Nevada SB220 applies to the ''sale'' of information for monetary consideration -- a narrower definition than CCPA/CPRA''s ''sale or sharing,'' which covers no-consideration transfers for targeted advertising. An organization could be fully compliant with CCPA opt-out requirements while still having an unfulfilled Nevada obligation if their data practices involve paid data transfers but not targeted advertising sharing.

Operators must provide a mechanism for consumers to submit a verified request to opt out of the sale of their covered information. The operator must respond within 60 days (extendable by 30 days with notice).

Enforced by the Nevada AG. Civil penalties available. No private right of action.

Predates CCPA (Nevada SB220 passed in 2019, effective 2020). Much narrower than CCPA -- no access, correction, deletion, or portability rights. Narrower definition of ''sale'' than CCPA. Sits alongside Nevada Gaming Regulation 5.260 as a Nevada-specific obligation, but the two regulations address entirely different activities and are enforced by different bodies.

NV NOGE Regulation 5.260

All Nevada-licensed gaming establishments -- resort casinos, standalone casinos, online gaming operators, and other entities regulated by the Nevada Gaming Control Board (NGCB). Requirements scale with size and complexity.

Casino operators who have strong perimeter security but fragmented third-party risk management. The 2023 MGM Resorts and Caesars Entertainment incidents -- which directly precipitated this regulation -- both involved social engineering attacks through third-party service channels (identity verification vendors and IT support). Regulation 5.260 specifically requires operators to manage vendor risk, not just their own environment. Operators with mature internal security but a light-touch vendor assessment programme have the gap exactly where the regulation''s origin story sits.

A written cybersecurity programme approved by senior management or the board. Risk assessments. Access controls including MFA for privileged access and least-privilege principles. Encryption of patron and financial data in transit and at rest. Documented incident response plan tested regularly. Third-party vendor risk management with contractual cybersecurity requirements. 72-hour incident reporting to the NGCB.

Enforced by the Nevada Gaming Control Board. Non-compliance can result in regulatory action including fines and, in extreme cases, license suspension. The NGCB has real-time visibility into significant cyber events under the 72-hour reporting requirement.

The only gaming-sector-specific framework in this group. Nevada is the first state to mandate detailed cybersecurity requirements specifically for gaming. Its structure -- written programme, risk assessment, access controls, incident reporting, third-party oversight -- mirrors NY DFS 23 NYCRR 500 in spirit, though gaming operators are not DFS-regulated. Aligns significantly with NIST CSF, which reduces implementation effort for operators already using that framework.

NY DFS 23 NYCRR500 2023 Amd 2

Banks, insurance companies, money transmitters, and all other financial services entities licensed by the New York Department of Financial Services. Applies regardless of size, with limited exemptions for very small entities.

The board governance requirement is the most frequently incomplete control we see. Organizations have a CISO. The CISO produces a report. The report exists on paper. Whether the board actually reviewed it, understood it, and took action based on it is a different question -- and DFS examiners ask exactly that question. Another persistent gap: the penetration test scope. Organizations conduct annual penetration tests but scope them narrowly, excluding cloud environments, third-party integrations, and recently acquired systems. DFS expects the test to cover the full environment.

Mandatory annual penetration testing. Vulnerability scanning. MFA for remote access and privileged systems (no exceptions for covered entities above limited-entity thresholds). Encryption of nonpublic information in transit and at rest. CISO reporting obligations -- the CISO must report to the board annually, and the board must have sufficient expertise or advisors to understand the report. Annual certification of compliance filed with DFS. 72-hour notification for significant cybersecurity events. Written incident response plan. Third-party service provider cybersecurity requirements with annual monitoring. Asset inventory. Access management controls.

DFS enforcement. The 2023 amendments strengthened penalties. DFS has already used NYCRR 500 to impose multi-million-dollar penalties and consent orders. Robinhood paid $30 million in 2022 for cybersecurity and anti-money-laundering failures partly under NYCRR 500.

The most operationally demanding framework in this group for organizations it applies to. IL IPA follows the same structural pattern for insurance licensees. NV Gaming Regulation 5.260 follows a similar pattern for casinos. MA 201 CMR 17.00 and NY SHIELD Act overlap on the WISP requirement but are far less technically prescriptive. Texas DIR Control Standards are similarly detailed but apply to state agencies rather than private financial institutions.

NY SHIELD Act S5575B

Any business that owns or licenses private information of New York residents, regardless of where the business operates. Small businesses (fewer than 50 employees, less than $3 million in gross revenue in each of the past three years, and less than $5 million in year-end total assets) have a scaled-down security programme requirement.

The SHIELD Act''s small business carve-down is misapplied. Organizations at the threshold (say, 48 employees, $2.8 million revenue) assume they qualify for the scaled requirements. But the statute requires meeting all three thresholds simultaneously, and many businesses in the middle of a growth phase stop qualifying partway through a year. The data security programme they built to the ''small business'' standard may no longer satisfy the full standard once they cross a threshold.

Expanded breach notification obligations: faster notification, updated definition of private information, and notification to the NY AG when breach affects more than 500 New York residents. Separately: ''reasonable safeguards'' requirement -- administrative, technical, and physical safeguards appropriate to the size and complexity of the business. The safeguards obligation is operationalized through a written data security programme.

NY AG enforcement. Civil penalties up to $5,000 per violation for failure to notify. Civil penalties up to $250,000 total for failure to implement reasonable safeguards.

A direct descendant of MA 201 CMR 17.00 in its data security programme requirement. A WISP built to Massachusetts standards satisfies NY SHIELD Act simultaneously. The breach notification component parallels CA SB1386/1798.82, OR 646A, IL PIPA, AK PIPA, and TX BC521 -- with New York-specific timelines and AG reporting thresholds.

OR 646A

Businesses that own, maintain, or otherwise possess personal information of Oregon residents. Applies regardless of where the business is located.

The AG notification threshold (250 Oregon residents) is missed. Organizations scope breach notification programmes for consumer notification but do not build the parallel workflow for AG notification when a larger population is involved. In a single assessment of a 200-person Oregon-headquartered employer, we found the incident response plan contained no step for assessing AG notification thresholds.

Reasonable security measures for personal information. Breach notification to affected Oregon residents and -- when breach affects 250 or more Oregon residents -- to the Oregon AG. Oregon has progressively expanded its definition of personal information through legislative amendments.

Oregon AG enforcement. Civil penalties available.

Breach notification parallel to CA SB1386, IL PIPA, AK PIPA, NY SHIELD Act, TX BC521. Distinct from Oregon CPA (SB 619), which is a comprehensive privacy rights law effective July 2024. Oregon has both a breach notification law (ORS 646A) and a comprehensive privacy law (CPA). They are separate obligations requiring separate compliance work.

OR CPA

Controllers processing personal data of 100,000 or more Oregon consumers annually, or 25,000 consumers where data selling accounts for 25% or more of gross revenue. Effective July 2024.

Oregon''s broader definition of ''consumer health data'' -- which includes personal data that a controller has reason to believe could be used to infer health status -- catches organizations that do not consider themselves health companies. A fitness app, a grocery retailer with purchase data, or a life insurer holding application data may be processing ''consumer health data'' under Oregon''s definition without having identified themselves as doing so.

Consumer rights: access, correction, deletion, portability, opt-out of targeted advertising, sale, and profiling for significant decisions. Data protection assessments for high-risk processing. 45-day response window for rights requests. Universal opt-out mechanism support. Sensitive data includes consumer health data -- a category that is more broadly defined under the Oregon CPA than under CCPA/CPRA.

Oregon AG enforcement. 30-day cure period during initial phase. Civil penalties up to $25,000 per violation after the cure period.

Third-wave state privacy law alongside Tennessee TIPA. Structurally similar to Virginia CDPA and Colorado CPA. The health data definition is broader than any other framework in this group except Washington''s My Health MY Data Act (not in this group). Oregon CPA and OR 646A are separate obligations for organizations operating in Oregon.

TN Tennessee Information Protection Act

Controllers processing personal data of 175,000 or more Tennessee consumers annually, or 25,000 consumers where data selling generates 25% or more of gross revenue. Effective July 2025. The 175,000 threshold is the highest consumer-count threshold of any state privacy law in this group.

Organizations in multi-state compliance programmes that have scoped TIPA out because they are below the 175,000-consumer threshold -- and then cross it during a period of growth without reassessing scope. TIPA became effective July 2025 and has not yet generated enforcement cases. The absence of enforcement history creates a false sense that the threshold question is theoretical.

Consumer rights: access, correction, deletion, portability, opt-out of targeted advertising, sale, and profiling. 60-day cure period -- the most business-friendly cure period of any framework in this group. Sensitive data consent required. Data protection assessments for high-risk activities.

Tennessee AG enforcement exclusively. No private right of action. Civil penalties up to $15,000 per violation.

The most business-friendly comprehensive privacy law in this group: highest consumer-count threshold, longest cure period, AG-only enforcement. Structurally similar to Virginia CDPA and Colorado CPA but with fewer teeth. Organizations already CCPA/Virginia CDPA-compliant will find TIPA incremental.

TX BC521

Individuals and organizations that conduct business in Texas and own or license personal information of Texas residents. No revenue or size threshold.

''As quickly as possible'' is interpreted as more permissive than it actually is. Texas AG enforcement has treated delays of more than 60 days as unreasonable in documented cases. Organizations using 90-day timelines calibrated against less demanding laws are exposed under TX BC521.

Breach notification to affected individuals ''as quickly as possible.'' When breach affects 250 or more Texans: notification to the Texas AG. Requires implementing reasonable security procedures and practices appropriate to the nature of personal information handled.

Texas AG enforcement. Civil penalties available.

Breach notification parallel in the Texas framework ecosystem. Distinct from -- and should not be confused with -- Texas CDPA (privacy rights) and TX DIR Control Standards (state agency IT security). Texas has three overlapping frameworks covering breach notification, consumer privacy rights, and state agency security standards, respectively.

TX CDPA

Businesses that process personal data of Texas residents and are not a small business under SBA definitions. Notably, Texas CDPA has no revenue threshold and no consumer volume threshold -- the broadest applicability trigger of any state privacy rights law in this group. Effective July 2024.

The SBA small business exclusion is misapplied. The SBA definition of small business varies by industry -- it is not a fixed headcount or revenue number. A professional services company with 500 employees may qualify as an SBA small business in its NAICS code; a manufacturing company with 100 employees may not. Organizations that assume they are excluded based on headcount alone frequently discover they are not when they check the actual SBA size standards table.

Consumer rights: access, correction, deletion, portability, opt-out of targeted advertising, sale, and profiling. Sensitive data requires consent. Data protection assessments. Privacy notice. 45-day response window for rights requests. 30-day cure period.

Texas AG enforcement exclusively. No private right of action. Civil penalties up to $7,500 per violation. 30-day cure period.

The broadest-scope state privacy rights law in this group -- no volume or revenue threshold beyond the SBA small business exclusion. Sits in the same category as CCPA/CPRA, Virginia CDPA, Colorado CPA, Oregon CPA, and Tennessee TIPA. Also coexists with TX BC521 (breach notification) in the Texas regulatory landscape.

TX DIR Control Standards 2.0

Texas state agencies and higher education institutions subject to DIR security requirements, and their technology vendors. Does not apply to private organizations unless they are contracting with a Texas state agency.

Technology vendors scoping for TX-RAMP Level 1 or Level 2 who do not realize that DIR Control Standards 2.0 defines the baseline their TX-RAMP assessment is measured against. Understanding TX-RAMP without understanding DIR Control Standards is like studying for an exam without knowing the syllabus.

A control catalogue derived from NIST SP 800-53 covering access management, configuration management, incident response, risk assessment, system and communications protection, and other control families. State agencies must implement these controls as a baseline and demonstrate compliance through DIR assessments and annual security plans.

DIR oversight. Non-compliant agencies face DIR assessment findings, escalation to agency leadership, and ultimately to the Texas Legislature. Not directly applicable to private organizations -- but indirectly relevant to any vendor seeking state agency contracts.

The foundational standard for all Texas state agency IT security. TX SB 820 and TX SB 2610 reference DIR authority and DIR-aligned controls. TX-RAMP Level 1 and Level 2 assess cloud vendors against DIR Control Standards-derived baselines.

TX SB 820

Texas state agencies and their employees. Amended Texas Government Code Chapter 2054.

Annual training is completed as a checkbox. The SB 820 training requirement is tied to DIR-approved training content -- agencies that deploy generic security awareness training not vetted by DIR are technically non-compliant. In our assessments of contractors supporting Texas state agencies, we find the training requirement is often well-documented but the DIR-approval status of the training content is unverified.

Mandatory annual cybersecurity training for all state agency employees. Enhanced DIR oversight of agency cybersecurity programmes. Incident reporting obligations to DIR. Agency information security officers must report directly to agency leadership. DIR authority to conduct cybersecurity assessments of state agencies.

DIR oversight and enforcement against state agencies. Agency heads are accountable for compliance.

Operates alongside TX DIR Control Standards 2.0 as part of the Texas state agency cybersecurity infrastructure. TX SB 2610 extended similar requirements to local governments. TX-RAMP certifies the vendors serving these agencies. Together these four frameworks form a layered Texas government IT security ecosystem.

TX SB 2610

Texas local governments: counties, municipalities, special districts, and public school districts. Passed in 2025.

Small Texas municipalities and school districts with limited IT staff who do not know DIR-aligned policies exist or how to access DIR''s published policy templates. The gap is not willful non-compliance -- it is awareness. A 4,000-person school district with a two-person IT team typically has its hands full with operations; policy alignment with DIR standards is not on the radar until an incident forces the question.

Adoption of cybersecurity policies aligned with DIR standards. Annual employee cybersecurity training. Reporting of cybersecurity incidents to the Texas Department of Information Resources.

DIR oversight. Local government entities face DIR reporting requirements and potential audit.

Extends the TX SB 820 framework to local government. Complementary to TX DIR Control Standards 2.0. Local governments are not subject to TX-RAMP (which is a cloud vendor certification programme), but they would be the buyers of TX-RAMP-certified cloud services.

TX TX-RAMP Level 1

Cloud service providers seeking to sell low-impact cloud services to Texas state agencies. Specifically: cloud services that do not handle sensitive or confidential state data.

Vendors who begin a Level 1 certification expecting it to be purely administrative (because it is self-attestation) and discover mid-process that the required security documentation does not exist. Self-attestation does not mean no controls are required -- it means the controls are documented and the vendor is asserting they exist. Vendors without a mature security documentation set cannot self-attest accurately.

Self-attestation and basic security review against a NIST 800-53-derived control subset. DIR catalogue listing upon successful completion. Periodic recertification.

DIR maintains the approved catalogue. Cloud services not on the catalogue cannot be procured by state agencies. Removal from the catalogue effectively excludes a vendor from the Texas state government market for that service.

Paired with TX-RAMP Level 2 as a tiered certification programme. Level 1 covers low-impact data; Level 2 covers confidential state data. Both are derived from DIR Control Standards 2.0. TX-RAMP is modeled on FedRAMP (not in this group) but is Texas-specific and does not grant reciprocal FedRAMP authorization.

TX TX-RAMP Level 2

Cloud service providers seeking to sell higher-impact cloud services to Texas state agencies handling sensitive or confidential data.

The timeline. TX-RAMP Level 2 assessments are not fast. Organizations that begin pursuing a Texas state agency contract and realize mid-RFP that TX-RAMP Level 2 is required cannot complete the certification in time for contract award. Typical cycle is 6 to 18 months depending on the completeness of security documentation and DIR''s review queue.

Comprehensive assessment against a larger NIST 800-53 control subset. DIR review of security documentation -- not just self-attestation. Third-party assessment may be required for higher-impact services. DIR issues the certification after review.

Same market-access mechanism as Level 1. Level 2 is specifically required for services handling confidential state data. Without it, state agencies cannot procure.

Analogous to FedRAMP Moderate or High for the Texas state government context. Organizations that have FedRAMP authorization will find substantial control overlap but still need to complete a separate TX-RAMP process -- the certifications are not reciprocal.

VA CDPA 2023

Businesses controlling or processing personal data of 100,000 or more Virginia consumers per year, or 25,000 consumers where more than 50% of gross revenue comes from selling personal data. Effective January 2023. Amended in 2025.

The data protection assessment requirement is treated as a checklist rather than a documented analysis. Virginia''s law specifies that assessments must weigh benefits against privacy risks, consider available alternatives, and evaluate the safeguards in place. We have reviewed ''data protection assessments'' in client documentation that were two-page forms with no documented analysis of alternative approaches or risk mitigation rationale. Those do not satisfy the Virginia requirement -- they satisfy the appearance of it.

Consumer rights: access, correction, deletion, portability, opt-out of targeted advertising, sale, and profiling. Data protection assessments required before engaging in high-risk processing activities -- targeted advertising, selling personal data, profiling with potential for harm, processing sensitive data. These assessments must be retained and provided to the AG on request. Processing sensitive data (health data, biometric data, precise geolocation, racial or ethnic origin, religious beliefs, sexual orientation, immigration status) requires consent. Children ages 13-17: no targeted advertising without consent.

Virginia AG exclusively. No private right of action. 30-day cure period. Civil penalties up to $7,500 per violation.

Often called the model for second-wave state privacy laws. Colorado CPA, Oregon CPA, and Tennessee TIPA all follow Virginia''s basic structure. Virginia was the second state (after California) to pass a comprehensive privacy law, and its business-friendly design was deliberate -- no private right of action, AG-only enforcement, cure period. That design influenced every state privacy law that followed it.

VT Act 171 of 2018

Data brokers: companies that collect and sell or license personal information of Vermont residents where they do not have a direct relationship with those individuals. Annual registration required with the Vermont Secretary of State.

Organizations that aggregate and resell personal data but define themselves as ''analytics companies'' or ''marketing technology companies'' rather than ''data brokers.'' Vermont''s definition is functional, not self-reported -- if you collect and sell personal information of Vermont residents without a direct relationship with those individuals, you are a data broker under Vermont law regardless of what your website says you do. One Vulnox assessment of a 60-person marketing analytics firm found the company met Vermont''s definition and had never registered, despite five years of processing Vermont resident data.

Annual registration and a $100 filing fee. Disclosure of data collection practices, opt-out mechanisms offered, and security programme. Implementation of a comprehensive information security programme. Opt-out rights for certain uses. Prohibited from facilitating certain harmful uses of data (stalking, harassment, discriminatory practices).

Vermont AG enforcement for failure to register. Civil penalties available.

Unique in this group: the only framework focused specifically on data brokers rather than direct-relationship businesses. California''s CPPA has a data broker registry under CCPA/CPRA -- a separate mechanism from Vermont''s but addressing the same actor category. No other framework in this group directly regulates data brokers as a distinct entity type.

AK PIPA

Businesses of all sizes that collect or maintain personal information of Alaska residents, regardless of where the business is located.

Alaska is frequently missing from multi-state breach notification matrices. The state''s population is small enough that incident response teams sometimes conclude Alaska residents are not ''materially affected'' by a breach without actually counting affected Alaska residents. The obligation triggers regardless of how many Alaska residents are affected -- there is no minimum threshold in Alaska PIPA.

Breach notification to affected Alaska residents when their personal information is acquired without authorization. Notification to the Alaska AG. Reasonable security procedures appropriate to the nature of the personal information.

Alaska AG enforcement. Civil penalties available.

Breach notification law parallel to CA SB1386, IL PIPA, OR 646A, NY SHIELD Act, and TX BC521. No consumer rights framework equivalent in Alaska -- this is notification-only with a security baseline, not a comprehensive privacy law.

Massachusetts 201 CMR 17.00 specifies technical controls in more detail -- portable device encryption, firewall requirements. NY DFS 23 NYCRR 500 goes much further with mandatory annual penetration testing, board reporting, and 72-hour incident notification. IL IPA requires 72-hour notification to the insurance regulator specifically. The WISP is the shared foundation, but the NY DFS and IL IPA frameworks require significantly more operational infrastructure on top of it.

Written information security programme (WISP): all four require a documented security programme with risk assessment, administrative, technical, and physical safeguards, vendor management provisions, and employee training. A WISP built to Massachusetts 201 CMR 17.00 standards satisfies the SHIELD Act''s data security programme requirement with minimal adaptation. IL IPA and NY DFS follow the same structural pattern with additional sector-specific requirements layered on top.

Definitions of ''sensitive data'' differ: California includes precise geolocation and specific behavioral inferences; Oregon has an unusually broad definition of consumer health data; Virginia, Colorado, and Tennessee align closely with GDPR-style sensitive categories. Thresholds differ: Texas CDPA has no volume threshold; Tennessee TIPA has a 175,000-consumer threshold. Enforcement models differ: California has a dedicated agency (CPPA) and a private right of action for data breaches; all others are AG-only. Cure periods differ: Tennessee offers 60 days, most others offer 30, California offers none.

Consumer rights infrastructure: all six require mechanisms for consumers to access, correct, delete, and port their personal data, and to opt out of certain uses. A unified rights request intake and response workflow can serve all six simultaneously. Privacy notices covering all six frameworks'' required disclosure elements can be maintained in a single document with state-specific supplements.

TX-RAMP is a vendor certification programme; DIR Control Standards are agency requirements. TX SB 820 adds a mandatory employee training obligation with DIR-approved content. TX SB 2610 extends the framework to local governments with less prescriptive implementation requirements. The obligations apply to different actors -- state agencies, local governments, and cloud vendors -- and the documentation and assessment processes for each are run through different DIR workflows.

NIST 800-53-derived control families: access control, incident response, configuration management, risk assessment, system protection. Building a security programme against NIST 800-53 (or the SCF) simultaneously addresses the foundational requirements of all five Texas government frameworks.

Notification timelines: Oregon requires notification without unreasonable delay; New York requires notification in the most expedient time possible; Texas requires notification ''as quickly as possible.'' AG notification thresholds differ: Oregon and Texas both trigger at 250 affected residents; New York triggers at 500. Alaska has no minimum threshold. The personal information definitions have diverged over time as each state has amended its law independently -- Illinois now covers medical information and health insurance data, for example, while the original CA SB1386 definition was narrower.

Breach notification obligation: all six require notifying affected individuals when their personal information is acquired without authorization. All six also impose a ''reasonable security'' baseline. A unified breach response programme with a single notification workflow can be adapted to all six with jurisdiction-specific overlays for notification content and timeline.

Treating CCPA compliance as a proxy for multi-state US compliance

CCPA was the first major state privacy law, received the most media coverage, and triggered the most compliance investment. Organizations that completed CCPA compliance in 2020 or 2021 often concluded they were ahead of the curve. By 2025, the curve had moved. Virginia, Colorado, Oregon, and Tennessee all passed comprehensive privacy laws. Texas CDPA -- with no volume threshold -- came into effect July 2024. Each requires consumer rights workflows. Most require data protection assessments. CCPA compliance was a starting point, not a destination, and it did not stay current with the laws that followed.

Organizations discover mid-investigation that their ''privacy programme'' is actually a California programme with a privacy policy that mentions other states. The Virginia AG''s office, the Colorado AG''s office, and the Texas AG''s office are all empowered to investigate independently. Being CCPA-compliant provides no protection against a Colorado enforcement action.

Building breach notification workflows that cover consumer notification but not regulator notification

Consumer notification is the visible obligation -- the one that generates news coverage and consumer complaints. Regulator notification is the hidden one. Oregon requires AG notification when 250 or more Oregon residents are affected. New York requires AG notification when 500 or more New York residents are affected. Texas requires AG notification when 250 or more Texans are affected. Illinois IPA requires 72-hour notification to the insurance regulator for any significant cybersecurity event. NY DFS 23 NYCRR 500 requires 72-hour notification to DFS. These are parallel obligations that trigger on different criteria than consumer notification, and they are often missing from incident response playbooks.

Organizations notify consumers within appropriate timelines and believe they have completed their breach response obligations. Regulator notification deadlines pass unmet. Several state AGs have pursued enforcement actions specifically against organizations that notified consumers but failed to notify regulators -- or notified regulators late. The consumer notification was visible; the regulator notification failure was not, until the enforcement letter arrived.

Treating consent in enterprise software deployments as the vendor''s responsibility rather than the employer''s

Enterprise software is sold with a terms of service and a data processing agreement. Buyers assume those documents transfer compliance responsibility to the vendor. For GDPR-style processing agreements, that is partially correct. For BIPA, it is not. BIPA requires consent from the individual whose biometric data is collected -- not from the organization purchasing the software. A vendor''s contract with an enterprise client does not substitute for the enterprise client''s written consent from their employees. This distinction is well-established in Illinois case law, but it is not communicated in most enterprise software contracts.

The employer -- not the software vendor -- is typically the primary defendant in BIPA class actions, because the employment relationship creates the contact point with the individuals whose consent was not obtained. Class actions against employers for BIPA violations by fingerprint time-and-attendance systems have settled for amounts ranging from hundreds of thousands to tens of millions of dollars, depending on the headcount of affected Illinois employees.

Starting TX-RAMP certification after receiving a Texas state agency RFP that requires it

TX-RAMP is less visible than FedRAMP in vendor compliance discussions, and its timeline implications are not well-publicized outside the Texas state agency procurement ecosystem. Cloud vendors whose federal compliance teams are familiar with FedRAMP often assume TX-RAMP will follow a similar timeline. FedRAMP timelines are themselves notoriously long, but the misconception that TX-RAMP is faster is compounded by the DIR review queue, which is not a self-managed process.

Lost contract opportunities. TX-RAMP Level 2 certifications that begin during active RFP cycles do not complete before award decisions. Organizations that have invested in pursuit of a Texas state contract -- sometimes including months of business development, technical demonstrations, and proposal preparation -- are disqualified on a certification timeline issue that could have been avoided with 12 to 18 months of advance planning.