Agent WranglersUS state privacy laws
About twenty US states have privacy laws that differ from the GDPR in scope, sales, sensitive data and deadlines. Keep the differences as data and checks.
- Required 6
Required
Compute which state laws apply
RequiredKeep a table of the US state privacy laws with their thresholds and start dates. Compute from your facts file which ones apply to you.
List every sale and every share
RequiredList every flow of personal data to another company that could count as a sale or targeted advertising. Offer an opt-out that stops each one.
Ask before using sensitive data
RequiredProcess sensitive data only after an opt-in where any applying state requires it, and record each consent with its time and wording.
Track request deadlines by law
RequiredCompute the due date of every privacy request from the law that applies to the person. Offer the appeal step that US state laws require.
Assess risky processing for US laws too
RequiredWrite a data protection assessment before targeted advertising, selling data, profiling with large effects or using sensitive data, in every state that asks for one.
Keep the US breach notice laws as data
RequiredKeep a table of the breach notice law of every US state where affected people live. Compute each deadline and each notice to a regulator from it.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/us-state-privacy-laws.