Data privacy is no longer just a concern for Fortune 500 companies. As of 2026, 20 US states have enacted comprehensive consumer privacy laws, and the Federal Trade Commission has stepped up enforcement against businesses of all sizes. If your small or midsize business collects customer data — and virtually every business does — you need to understand which regulations apply to you and what compliance actually looks like in practice.
This guide breaks down the privacy landscape for SMBs in plain language, covering the laws that matter most, the penalties for non-compliance, and the concrete steps you can take to protect your business and your customers.
Which Data Privacy Laws Apply to Small Businesses?
The short answer: it depends on where your customers are located, what industry you operate in, and how much data you collect. Unlike the EU’s single GDPR framework, the United States has a patchwork of federal and state regulations that can overlap.
Federal regulations that commonly affect SMBs include:
- FTC Act (Section 5) — The FTC can take enforcement action against any business engaging in unfair or deceptive data practices, regardless of size. This is the baseline that applies to every US business.
- HIPAA — If you handle protected health information (healthcare providers, insurance, business associates), HIPAA’s Privacy and Security Rules apply.
- GLBA (Gramm-Leach-Bliley Act) — Financial institutions and businesses offering financial products must protect consumer financial data.
- FTC Safeguards Rule — Updated in 2023, this rule requires financial institutions under GLBA to implement specific security controls including encryption, access controls, and incident response plans.
- COPPA — If your website or app collects data from children under 13, the Children’s Online Privacy Protection Act applies.
State privacy laws have expanded dramatically since California led the way with the CCPA in 2020. As of early 2026, comprehensive state privacy laws are active in California, Virginia, Colorado, Connecticut, Utah, Iowa, Indiana, Tennessee, Montana, Texas, Oregon, Delaware, New Hampshire, New Jersey, Nebraska, Maryland, Minnesota, Rhode Island, Kentucky, and Vermont.
What Is the CCPA and Does It Apply to My Business?
The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), is the most well-known state privacy law in the US. It applies to for-profit businesses that meet any one of these thresholds:
- Annual gross revenue exceeding $25 million
- Buying, selling, or sharing personal information of 100,000 or more California consumers or households annually
- Deriving 50% or more of annual revenue from selling or sharing personal information
Even if your business is based in Georgia or Texas, the CCPA applies if you serve California residents and meet a threshold. The law gives consumers the right to know what data you collect, request deletion, opt out of data sales, and take legal action after certain data breaches.
Penalties under CCPA/CPRA can reach $2,500 per unintentional violation and $7,500 per intentional violation. With thousands of affected consumers, fines add up quickly.
How Do State Privacy Laws Differ From Each Other?
While state privacy laws share common themes, key differences in thresholds, consumer rights, and enforcement mechanisms can catch businesses off guard.
Applicability thresholds vary significantly. Virginia’s VCDPA applies to businesses that control or process data of 100,000 consumers, or 25,000 consumers if you derive more than 50% of revenue from data sales. Texas’s TDPSA has no revenue or data volume threshold — it applies to any business operating in Texas that isn’t classified as a small business under the SBA definition.
Consumer rights are broadly similar but not identical. Most state laws include the right to access, correct, delete, and port personal data, plus the right to opt out of targeted advertising. However, some states like Maryland and Minnesota have added stronger protections around sensitive data and data minimization requirements.
Enforcement is another divergence point. Most state laws are enforced exclusively by the state attorney general, but California’s CCPA includes a private right of action for certain data breaches. This means consumers in California can sue your business directly after a breach — a significant liability.
The practical takeaway for SMBs: if you serve customers across multiple states, you generally need to comply with the strictest applicable standard rather than trying to maintain separate compliance programs for each state.
What Are the Real Penalties for Non-Compliance?
The penalties for data privacy violations are substantial and growing. Non-compliance isn’t just a theoretical risk — enforcement is active and accelerating.
FTC enforcement has resulted in settlements ranging from tens of thousands to hundreds of millions of dollars. In 2024 and 2025, the FTC brought actions against multiple small and midsize businesses for data security failures, not just large corporations. Common triggers include data breaches caused by inadequate security, deceptive privacy policies, and failure to honor opt-out requests.
State-level fines under CCPA/CPRA and other state laws typically range from $2,500 to $7,500 per violation. The California Privacy Protection Agency (CPPA) began formal enforcement in 2024 and has issued fines to businesses of various sizes.
Beyond fines, the real cost of non-compliance often includes:
- Legal defense costs (averaging $150,000–$500,000 for SMBs facing regulatory action)
- Mandatory remediation and monitoring
- Reputational damage and lost customer trust
- Business interruption during investigations
- Potential class action lawsuits in states with private rights of action
For a small business, even a minor enforcement action can be existential. The cost of proactive compliance is almost always a fraction of the cost of a violation.
What Steps Should Small Businesses Take to Comply With Privacy Laws?
Compliance doesn’t require hiring a team of lawyers or buying enterprise software. Most SMBs can achieve a solid privacy posture with these practical steps:
1. Conduct a Data Inventory
You can’t protect data you don’t know you have. Map out what personal information your business collects, where it’s stored, who has access, and how long you retain it. Include employee data, customer records, website analytics, email lists, and any third-party services that process data on your behalf.
2. Update Your Privacy Policy
Your privacy policy must accurately describe your data practices. Under most state laws, it needs to disclose the categories of personal information collected, the purposes for collection, consumer rights, and how to submit requests. Generic templates from 2019 likely don’t meet current requirements.
3. Implement Data Subject Request Processes
Most privacy laws require you to respond to consumer requests (access, deletion, correction) within 30 to 45 days. You need a documented process for receiving, verifying, and fulfilling these requests — even if you only get a handful per year.
4. Review Vendor and Third-Party Agreements
If you share customer data with vendors, marketing platforms, cloud services, or payment processors, you need Data Processing Agreements (DPAs) in place. Under most state laws, you’re responsible for ensuring your service providers handle data appropriately.
5. Strengthen Technical Security Controls
Privacy and cybersecurity are inseparable. Regulatory compliance typically requires:
- Encryption of personal data in transit and at rest
- Multi-factor authentication for systems containing personal data
- Regular security assessments and vulnerability scanning
- Access controls based on the principle of least privilege
- An incident response plan for data breaches
- Employee security awareness training
These aren’t just regulatory checkboxes — they’re the security fundamentals that prevent breaches in the first place.
6. Train Your Team
Human error remains the leading cause of data breaches. All employees who handle personal data should receive training on your privacy policies, data handling procedures, and how to recognize phishing and social engineering attacks. Annual training is the minimum; quarterly refreshers are better.
How Does Data Privacy Connect to Cybersecurity?
Data privacy and cybersecurity are two sides of the same coin. Privacy laws define what you must protect and how consumers can control their data. Cybersecurity provides the technical and operational controls that make privacy protections enforceable.
A data breach is simultaneously a cybersecurity failure and a privacy violation. Most state privacy laws include breach notification requirements — typically requiring you to notify affected consumers within 30 to 60 days and report to the state attorney general if the breach exceeds a certain threshold.
The FTC’s updated Safeguards Rule explicitly requires businesses to implement a comprehensive security program including risk assessments, encryption, access controls, and incident response. These requirements mirror cybersecurity best practices that every business should follow regardless of regulatory obligations.
Working with an experienced IT consulting partner can help you build a security and compliance program that addresses both privacy regulations and cybersecurity threats in a unified framework.
What About Industry-Specific Privacy Requirements?
Beyond general state privacy laws, certain industries face additional obligations:
- Healthcare: HIPAA requires administrative, physical, and technical safeguards for protected health information, with breach notification requirements and penalties up to $2.1 million per violation category per year.
- Automotive dealerships: The FTC Safeguards Rule applies directly, requiring written information security programs, designated security personnel, risk assessments, and encryption. Dealerships also handle financial data subject to GLBA.
- Financial services: GLBA, the Safeguards Rule, and state insurance data security laws (many modeled on the NAIC Insurance Data Security Model Law) create layered requirements.
- Retail and e-commerce: PCI DSS applies if you process credit card payments, state privacy laws govern customer data, and the FTC Act covers deceptive practices.
At COMNEXIA, we’ve spent over 35 years helping businesses across these industries — particularly automotive dealerships and financial services firms in the Atlanta metro area — navigate the intersection of technology, security, and compliance.
What Privacy Trends Should SMBs Watch in 2026 and Beyond?
The privacy landscape continues to evolve rapidly. Key trends to monitor:
- Federal privacy legislation: Congress has introduced multiple comprehensive privacy bills. While passage timing remains uncertain, a federal standard would simplify the current state-by-state patchwork.
- AI and automated decision-making: Several state laws now include provisions around automated profiling and AI-driven decisions. If your business uses AI tools that process personal data, new disclosure and opt-out requirements may apply.
- Children’s privacy expansion: COPPA 2.0 proposals and state laws like California’s Age-Appropriate Design Code are expanding protections for minors beyond the current under-13 threshold.
- Enforcement acceleration: Both the FTC and state attorneys general are increasing enforcement resources and pursuing more cases against SMBs, not just large corporations.
Frequently Asked Questions
Q: Do privacy laws apply if my business is small and only operates in one state? A: Yes. Even single-state businesses are subject to federal regulations like the FTC Act, and if you have customers in states with privacy laws, those laws likely apply to you regardless of where your business is located. Texas’s TDPSA, for example, has no minimum size threshold.
Q: What’s the difference between CCPA and CPRA? A: The CPRA amended and expanded the CCPA, effective January 2023. Key additions include the right to correct personal information, limits on the use of sensitive personal information, and creation of the California Privacy Protection Agency (CPPA) as a dedicated enforcement body. When people reference “CCPA” today, they generally mean the law as amended by CPRA.
Q: Do I need a Data Protection Officer (DPO)? A: US privacy laws generally do not require a formal DPO for small businesses, unlike the EU’s GDPR. However, the FTC Safeguards Rule does require designating a “qualified individual” responsible for your information security program. This can be an employee or an outsourced provider.
Q: How often should I review my privacy compliance program? A: At minimum, annually — and whenever there’s a significant change to your business operations, data practices, or the regulatory landscape. Given the pace of new state laws, a quarterly review of applicable regulations is prudent.
Q: Can a managed IT provider help with privacy compliance? A: Absolutely. A qualified managed IT provider can implement the technical controls required by privacy regulations (encryption, access controls, monitoring, incident response), manage vendor security assessments, and help maintain documentation. This is especially valuable for SMBs that don’t have dedicated compliance staff. COMNEXIA’s cybersecurity services include compliance-focused security programs tailored to SMB requirements.