Rule 15 of 33

CCPA/CPRA + 19 other state privacy laws

Which US state privacy laws apply to my Canadian website?

Roughly twenty states now have comprehensive privacy laws, led by California's CCPA and CPRA. They apply by where your visitors live, not where you are. Common duties are a privacy notice, an opt-out of sale or sharing, honouring Global Privacy Control, and responding to deletion requests.

What the rule requires

20 US states by 2026. $17.1M in CCPA fines in 2026.

Who it catches

Any business with US customers. GM fined $12.75M (selling driver data); Disney $2.75M.

What this looks like in practice. A California visitor clicks 'Do not sell my data' and your site ignores it - or you share data with no notice. GM paid $12.75M, Sephora $1.2M, Honda $632,500.

How to check whether you comply

The checkMap where your customers actually live. Each state’s law triggers on its own threshold - it is a data-map question, not “does California apply”.

Read it yourself

We would rather you checked us than took our word for it. This links to the law as published, not to our summary of it.

Primary source CPPA ↗ Real case GM $12.75M; Sephora $1.2M; Honda $632,500 (CCPA) ↗

Questions people ask

Which US state privacy laws apply to my Canadian website?

Roughly twenty states now have comprehensive privacy laws, led by California's CCPA and CPRA. They apply by where your visitors live, not where you are. Common duties are a privacy notice, an opt-out of sale or sharing, honouring Global Privacy Control, and responding to deletion requests.

Who does CCPA/CPRA + 19 other state privacy laws apply to?

Any business with US customers. GM fined $12.75M (selling driver data); Disney $2.75M.

How do I check whether we comply with CCPA/CPRA + 19 other state privacy laws?

Map where your customers actually live. Each state’s law triggers on its own threshold - it is a data-map question, not “does California apply”. You can also run our free website check, which tests 25 technical items in about twenty seconds, or book a review if this rule needs a documented answer.

Other rules that catch the same businesses

Rule 16Manitoba accessibility standards Rule 17Nova Scotia Built Environment Standard Rule 18New Brunswick Pay Transparency Act Rule 19S-211 (forced-labour supply chain) All of themThe full 33-rule table, searchable

Find out which of the 33 apply to you

The fine risk check asks a few questions about your business and tells you which rules catch you, with the deadlines. Nothing you tick leaves your browser.

Check my fine risk

This page summarises a legal obligation in plain language so you can work out whether it applies to you. It is not legal advice, and the primary source linked above governs. Last reviewed 2026-10-03.