The European Union has one broad privacy law, the General Data Protection Regulation (GDPR). The United States doesn't. Its approach is a patchwork of federal and state laws, each covering particular types of data or industries. For a small business it can be hard to work out which ones apply, but protecting your clients' information depends on getting it right.
The rules have become much more complicated in the last few years. The California Consumer Privacy Act (CCPA), which took effect in January 2020, was the turning point. It put real compliance requirements on businesses that collect personal information about California residents, which means it can apply to your business even if you're nowhere near California.
Since then, other states have followed, and around 20 now have comprehensive privacy laws of their own. If you have customers in several states, you need to know which rules apply to you.
Key Federal Data Privacy Laws
No U.S. federal law covers privacy as broadly as the GDPR. Instead, several federal laws protect specific kinds of data.
Whether they apply to you depends on what data you collect and what industry you're in.
| Law | Focus | Key Impact on Businesses |
| Privacy Act of 1974 | Federal agency data handling | Regulates how federal agencies handle personal data |
| HIPAA (1996) | Health information | Protects privacy of health data for covered entities |
| Gramm-Leach-Bliley Act (1999) | Financial data | Requires financial institutions to safeguard sensitive data |
| COPPA (1998) | Children's online data | Limits collection of data from children under 13 |
Each has its own requirements. HIPAA, for example, sets strict privacy rules for healthcare providers and insurers, and COPPA requires parental consent before collecting information from children online. Work out which ones apply to you before a regulator does it for you.
State-Level Data Privacy Laws
With no broad federal law, states have been writing their own. By 2024, twenty states had passed comprehensive privacy laws, each a little different from the others.
New Jersey is one of them. On January 16, 2024, New Jersey Governor Phil Murphy signed into law Senate Bill 332, known as the New Jersey Data Privacy Law.
The law took effect on January 15, 2025. It gives consumers rights over their personal data and puts strict obligations on businesses that handle it.
Meanwhile, New York has focused on protecting children and teenagers online, with new child and teen online safety bills.
These bills, if passed, would require social media platforms and other online services to implement stricter safety measures and provide more transparent information about their data collection practices involving minors.
The direction is clear: more protection for consumers and more obligations for businesses. The catch is that if you operate in several states, you may face different rules that don't always agree with each other.
Keep track of the privacy laws in every state where you operate or have customers.
Compliance Challenges for Small Businesses
The first problem is just knowing what applies. Each state law has its own definitions, requirements, and thresholds. An IT audit and compliance readiness review can map which requirements actually apply to your systems and organize the evidence behind them.
For example, the California Consumer Privacy Act (CCPA) applies to businesses with annual gross revenue above $25 million (a figure now adjusted for inflation), while other states use different tests.
If you work across state lines, something that's fine in one state can be a violation in another. That's a particular headache for online businesses, which can collect data from people in every state.
Then there's time and money. Big companies have legal and compliance teams. Most small businesses don't, and new laws and amendments keep coming.
Even once you know what's required, putting it in place can be complicated and expensive. With penalties as high as they are, though, ignoring it isn't a real option.
Strategies for Compliance
Start before there's a problem. Once there's been a breach or a complaint, it's too late to protect that customer's data, or their trust.
Make one person responsible for privacy, either an employee or an outside consultant. Their job is to keep up with state and federal changes and tell you what to do about them. For most small businesses, a part-time consultant is more affordable than a full-time hire.
Review your privacy policy and data practices regularly, and again whenever a relevant law changes. Look at what you collect, where you store it, and who you share it with.
Train anyone who handles customer data. They should know why privacy matters, what the law requires, and what your own policies say. Short, regular sessions work better than one long annual one.
The sooner you start, the less it costs.
Impact of Non-Compliance
Breaking privacy laws can be expensive. Penalties add up quickly, with fines reaching $7,500 per intentional violation under the California Consumer Privacy Act (CCPA). Across hundreds or thousands of records, that can sink a small business.
There's also your reputation. Customers pay attention to how businesses treat their personal data, and one breach or violation can follow you for years.
Regulators are enforcing these laws. For instance, on February 21, 2024, California Attorney General Rob Bonta announced a settlement with DoorDash for violating the CCPA and the California Online Privacy Protection Act (CalOPPA).
Other states are stepping up too. The Texas Attorney General, for example, has become one of the most active privacy enforcers in the country. The takeaway for small businesses is to take compliance seriously in every state where they operate.
Resources and Tools for Compliance
You don't have to work all of this out alone. There's a lot of help available.
Online checklists and guides are a good place to start checking where you stand.
State Attorney General offices often publish plain guidance on their own laws. For example, the California Privacy Protection Agency (CPPA) issues enforcement advisories that offer insights into compliance expectations and potential pitfalls.
If you need more help, privacy consultants and lawyers can give advice specific to your business, run privacy impact assessments, and build a compliance plan. It costs more, but it's worth it if your situation is complicated or you operate in many states.
Future Outlook of Data Privacy
More states will probably pass privacy laws, and at some point Congress may pass a federal law that replaces the patchwork. Either way, businesses with good privacy habits already in place will have the least to change. Keep up with new laws, take data protection seriously, and you'll avoid penalties and earn customers' trust along the way.
Spot On Tech can help with the technical side of privacy compliance, from cyber insurance preparation to managing vendors and securing your systems.
