Compute which state laws apply

How to do it

By October 2026 about twenty states have a broad privacy law. Examples are California, Virginia, Colorado, Connecticut, Texas, Oregon, Minnesota and Maryland. Indiana, Kentucky and Rhode Island started on 1 January 2026. Most laws apply above a number of state residents per year, often 100,000, or a lower number when you sell data. California also counts revenue, and Texas and Nebraska exempt most small businesses. Store residents per state in the facts file, so the check reruns as you grow.

Example

- state: CA
  law: California Consumer Privacy Act as amended by the CPRA
  applies_when_any:
    - annual_revenue_usd_over: set by the state and adjusted every two years
    - residents_over: 100000
    - revenue_share_from_selling_or_sharing_over: 0.5
  universal_opt_out: required
- state: RI
  law: Rhode Island Data Transparency and Privacy Protection Act
  starts: 2026-01-01
  applies_when_any:
    - residents_over: 35000
    - { residents_over: 10000, revenue_share_from_selling_over: 0.2 }
  universal_opt_out: not required

How to check

A unit test computes the applying states from the facts file. The build fails when the result differs from the US entries in the obligations register.