CMP-56Recommended US law

Compute which state laws apply

Keep a table of the US state privacy laws with their thresholds and start dates. Compute from your facts file which ones apply to you.

By Agent Wranglers. Updated 27 October 2026.

Region

United States (US). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds.

How to do it

By October 2026 about twenty states have a broad privacy law. Examples are California, Virginia, Colorado, Connecticut, Texas, Oregon, Minnesota and Maryland. Indiana, Kentucky and Rhode Island started on 1 January 2026. Most laws apply above a number of state residents per year, often 100,000, or a lower number when you sell data. California also counts revenue, and Texas and Nebraska exempt most small businesses. Store residents per state in the facts file, so the check reruns as you grow. Run the check the way Derive scope from recorded facts describes.

Examples

YAML example

- state: CA
  law: California Consumer Privacy Act as amended by the CPRA
  applies_when_any:
    - annual_revenue_usd_over: set by the state and adjusted every two years
    - residents_over: 100000
    - revenue_share_from_selling_or_sharing_over: 0.5
  universal_opt_out: required
- state: RI
  law: Rhode Island Data Transparency and Privacy Protection Act
  starts: 2026-01-01
  applies_when_any:
    - residents_over: 35000
    - { residents_over: 10000, revenue_share_from_selling_over: 0.2 }
  universal_opt_out: not required

How to check

A unit test computes the applying states from the facts file. The build fails when the result differs from the US entries in the obligations register.

Sources

CMP-2 Derive scope from recorded facts in Compliance and governance

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/compliance/us-privacy-and-ai-laws/us-state-scope">Agent Wranglers compliance and governance playbook</a>. In code you write, add a comment next to it with the same link.