How U.S. Privacy Laws Impact Website Owners 

Online privacy is no longer a “nice-to-have” — it’s a must.  

With data privacy laws rolling out across the U.S., website owners must understand their legal obligations and how to meet them.  

Whether you run a small business website or manage client websites, here’s what you need to know about how U.S. privacy laws affect your online presence — and how you can simplify compliance with tools like Termly. 

What Do Privacy Laws Mean for Website Owners 

If your website collects data — even something as simple as a name or email address — it may be subject to state-level privacy laws. These laws regulate how businesses collect, use, share, and store personal information, and they often come with requirements like: 

• Providing a clear privacy policy 
• Offering opt-out options for data sharing or sale 
• Responding to data access or deletion requests 
• Displaying cookie consent banners 

Let’s break down the most relevant U.S. privacy laws and how they affect your website.  

1. California Consumer Privacy Act (CCPA) 

The CCPA is a major modern U.S. data privacy law, passed in 2018 and enforced starting in 2020. It applies to for-profit businesses that collect personal information from California residents and meet the following thresholds 

• Make over $25 million in gross annual revenue 
• Buy, sell, or share data from 100,000 or more California residents or households 
• Earn at least 50% of annual revenue from selling personal information 

Website requirements under the CCPA include: 

• A clear and accessible privacy policy 
• A “Do Not Sell or Share My Personal Information” link or setting 
• Options for users to access, correct, or delete their data. 
• Timely responses to all consumer data requests 
• Disclose to users when you collect their personal information and explain how you will use it.  
• Treat users who opt out the same as those who don’t. 

The California Privacy Rights Act (CPRA), which went into effect in 2023, expanded on the CCPA by introducing new consumer rights. This included the ability to limit the use of sensitive information and the creation of a regulatory agency for stricter enforcement.  

Businesses must now ensure they meet both the CCPA and CPRA requirements to avoid penalties and protect consumer privacy.  

2. Virginia Consumer Data Protection Act (VCDPA) 

The VCDPA went into effect in 2023 and applies to businesses that collect personal data from Virginia residents and meet one of the following thresholds: 

• Process data from at least 100,000 Virginia residents annually 
• Process data from 25,000 residents and make 50% or more of revenue from selling that data 

Website Requirements Under the VCDPA Include: 

• A privacy policy that clearly explains what data you collect and why. 
• Options for users to access, correct, or delete their data. 
• Timely responses to all consumer data requests 
• Opt-out options for targeted advertising and data sales 
• Consent before collecting sensitive data 
• Contracts with service providers to ensure data protection 

3. Connecticut Data Privacy Act (CTDPA) 

Connecticut’s law took effect in July 2023 and applies to businesses that collect personal data from its residents. You must follow the CTDPA if you meet one of the following thresholds: 

• Process data from at least 100,000 Connecticut residents annually 
• Handle data from 25,000 or more consumers and make over 25% of revenue from selling that data 

Website requirements under the CTDPA include: 

• A privacy policy that clearly explains what data you collect and why. 
• Options for users to access, correct, delete or download their data. 
• Timely responses to all consumer data requests 
• Opt-out options for targeted advertising and data sales 
• Consent before collecting sensitive data 
• Data protection assessments for certain processing activities. 

4.  Utah Consumer Privacy Act (UCPA) 

The UCPA went into effect at the end of 2023 and applies to businesses that: 

• Make at least $25 million in annual revenue, and either: 
• Handle personal data from 100,000 or more Utah residents per year 
• Handle data from 25,000 or more residents and make over 50% of revenue from selling personal data 

Website requirements under the UCPA include: 

• A privacy policy that clearly explains what data you collect and why, and it must be updated every 12 months.  
• Options for users to access, correct, or delete their data 
• Timely responses to all consumer data requests 
• Opt-out options for targeted advertising and data sales 
• Contracts with service providers to ensure data protection 
• Security measures to protect user data 

5. Texas Data Privacy and Security Act (TDPSA) 

Texas passed one of the broadest privacy laws in the U.S., which went into effect in January 2025. 

The TDPSA applies to all businesses operating in Texas or elsewhere that collect or process personal data from its residents, apart from those classified as a “small business” by the U.S. Small Business Administration (SBA). 

Website requirements under the TDPSA include: 

• A privacy policy that clearly explains what data you collect and why 
• Options for users to access, correct, or delete their data 
• Timely responses to all consumer data requests 
• Data collection limits to only what’s needed 
• Security measures to protect user data 

6. Oregon Consumer Privacy Act (OCPA) 

Oregon’s privacy law took effect in July 2024, and it applies to businesses that meet one of the following thresholds: 

• Handle personal data from 100,000 or more Oregon consumers in a year 
• Handle data from 25,000 or more Oregon consumers and make at least 25% of annual revenue from selling that data 

Website requirements under the OCPA include: 

• A privacy policy that clearly explains what data you collect and why 
• Options for users to access, correct, or delete their data 
• Opt-out options for targeted advertising and data sales 
• Consent before processing sensitive data 
• Data collection limits to only what’s needed 

Staying Ahead With a Privacy Solution 

While many U.S. privacy laws share common requirements — like transparent privacy policies, opt-out options, and user rights management — the details can vary from state to state. 

Each law has its own definitions, thresholds, and specific requirements, so reviewing them individually is essential to understand how they apply to your business.  

To help you stay informed and prepared, Termly offers a suite of tools that make privacy easier to manage. Their Consent Management Platform (CMP) helps you align with cookie-related requirements across jurisdictions. 

For a state-by-state overview, their U.S. Privacy Law Tracker breaks down key legislation by state so you can monitor what’s in effect — and what’s coming next. 

Tags: Our Favorites