# US state privacy comparison
> Source: https://legalcode.md/skills/legalcode-us-state-privacy-comparison | [HTML version](https://legalcode.md/skills/legalcode-us-state-privacy-comparison)

Compare all enacted US state comprehensive privacy laws to determine applicability, map consumer rights obligations, and produce a compliance gap analysis for multi-state operations.

Compare all enacted US state comprehensive privacy laws to determine applicability, map consumer rights obligations, and produce a compliance gap analysis for multi-state operations. Use when assessing whether your organization is subject to CCPA/CPRA (California), VCDPA (Virginia), CPA (Colorado), CTDPA (Connecticut), UCPA (Utah), ICDPA (Iowa), INCDPA (Indiana), DPDPA (Delaware), TIPA (Tennessee), MCDPA (Montana), NHPA (New Hampshire), NJDPA (New Jersey), OCPA (Oregon), TDPSA (Texas), NDPA (Nebraska), MODPA (Maryland), MCDPA (Minnesota), KCDPA (Kentucky), RIDTPPA (Rhode Island), or any other enacted US state comprehensive privacy law. Produces a threshold analysis table, consumer rights compliance matrix, sensitive data obligations mapping, opt-out mechanism assessment, enforcement risk profile, cure period status, and a prioritized gap analysis with remediation roadmap. Covers all 19 enacted comprehensive state privacy laws as of 2026, including 2025-2026 amendments, new UOOM mandates, and GPC requirements.

This skill performs a comprehensive multi-state US privacy law gap analysis. It determines which enacted state comprehensive privacy laws apply to a specific organization, maps all required consumer rights and controller obligations, identifies compliance gaps, and produces a prioritized remediation roadmap. **This skill covers:** - Applicability threshold analysis across all 19 enacted US state comprehensive privacy laws - Consumer rights matrix: access, deletion, correction, portability, opt-out of sale, opt-out of targeted advertising, opt-out of profiling, appeal rights - Sensitive data classification per state — definitions, consent model, and sale prohibitions - Universal Opt-Out Mechanism (UOOM) / Global Privacy Control (GPC) mandate mapping - Cure period status — which states still offer mandatory cure rights and when they expire - Enforcement mechanism comparison — AG civil penalties, private right of action, treble damages, and AG investigatory powers - Children and minor protections across states - Data Protection Assessment (DPA / PIA) trigger analysis - Controller vs. processor obligation split and contract audit - Compliance gap analysis: COMPLIANT / PARTIAL / NON-COMPLIANT classification - Prioritized remediation roadmap with 30/60/90-day action items - Enforcement risk profile informed by actual enforcement actions (Sephora, DoorDash, Tractor Supply, Disney, Allstate/Arity, and others) **This skill does not:** ...

## Jurisdictions

Global



---
*Legalcode -- legalcode.md*