Start with where your data subjects are, not where you are incorporated. Then test against each state's thresholds.
Start with where your data subjects are, not where you are incorporated. Then test against each state's thresholds, which typically turn on revenue, the number of residents whose data you process, or the share of revenue derived from selling personal data.
Thresholds typically turn on revenue, the number of residents whose data you process, or the share of revenue derived from selling personal data. The genuine differences across states are in thresholds and exemptions, the treatment of sensitive data, whether universal opt-out signals must be honored, cure periods, and the specific assessment obligations.
In practice most companies build to the strictest applicable standard and apply it uniformly, because operating divergent processes by state costs more than it saves.
A defined audit or gap assessment is the typical starting point — fixed scope, fixed fee, delivered in four to twelve weeks.
A short note about your situation is plenty. Replies come from rasha.hisham@appliedprivacyconsulting.com.
We use Google Analytics 4 to understand how this site is used and to measure our advertising. These set cookies on your device. Nothing loads until you choose. How we handle your data.
Applied Privacy Consulting