Agent WranglersUS state privacy laws Required
Assess risky processing for US laws too
Write a data protection assessment before targeted advertising, selling data, profiling with large effects or using sensitive data, in every state that asks for one.
How to do it
Most state laws require these assessments and let the attorney general ask for them. California's regulations, in force since 1 January 2026, add more. Risk assessments start in 2026, with a summary due to the state's privacy agency by 1 April 2028. Rules on automated decisions apply from 1 January 2027. Cybersecurity audits are phased in from 2028 to 2030 by revenue. Add the US triggers to the DPIA screening, so one screening covers both.
How to check
The screening file has fields for targeted ads, sale, profiling and sensitive data. The build fails when any is true and no assessment link is filled in.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/us-state-privacy-laws/us-risk-assessments.