Small Business Privacy Compliance Guide — What You Actually Need to Do

If you run a small or mid-size business, the wave of state privacy laws might feel like it's only relevant to big tech companies. It's not. Depending on where your customers are and what data you collect, you could be subject to multiple state privacy laws — even with a modest customer base.

Here's what you actually need to know.

Am I Even Affected?

The short answer: probably, at least partially.

Two states — Texas and Nebraska — have privacy laws with no consumer count or revenue threshold. If you do business in either state and process personal data, the law applies to you. Period.

Beyond that, here's a quick sizing guide:

If you have fewer than 25,000 customers

You're below most state thresholds. But if you operate in Texas or Nebraska, you still need to comply. And if a meaningful portion of your customers are in states like Vermont or Tennessee (25,000 threshold), keep an eye on your numbers.

If you have 25,000–100,000 customers

You may be caught by states with lower thresholds:

• Tennessee, Vermont: 25,000 consumers
• Delaware, New Hampshire, Maryland, Rhode Island: 35,000 consumers
• California, Montana: 50,000 consumers

If you have 100,000+ customers

You're above the threshold for most states. You need a comprehensive compliance strategy.

If your annual revenue exceeds $25 million

California, Utah, and Tennessee apply based on revenue alone, regardless of how many consumers' data you process.

What Do These Laws Actually Require?

While each law has nuances, they share common requirements. Here's the essential list for small businesses:

1. Write a Privacy Policy (If You Don't Have One)

Every state privacy law requires a clear, accessible privacy policy. Yours should cover:

• What personal information you collect
• Why you collect it
• Who you share it with
• How long you keep it
• What rights consumers have and how to exercise them

Effort level: Medium. You may need a lawyer to draft it the first time, but templates and generators exist. This is a one-time task with annual updates.

2. Handle Consumer Rights Requests

Consumers in covered states can make requests like:

• "What data do you have on me?" (Right to Know)
• "Delete my data." (Right to Delete)
• "Stop selling my data." (Right to Opt-Out)

You need a process to receive, verify, and respond to these requests — typically within 45 days.

Effort level: Low to Medium. For most small businesses, these requests will be infrequent. Set up an email address (like privacy@yourcompany.com) and a simple workflow.

3. Add Opt-Out Mechanisms

If you sell data, share data with third parties for advertising, or use targeted advertising, you need to let consumers opt out.

• Add a "Do Not Sell or Share My Personal Information" link (required by California)
• Consider supporting Global Privacy Control (GPC) — required by California and Colorado

Effort level: Low. Most analytics and advertising platforms now support opt-out signals.

4. Get Consent for Sensitive Data

If you collect sensitive personal information (health data, biometrics, precise location, racial/ethnic data, children's data), most states require opt-in consent before processing it.

Effort level: Depends on your data practices. If you don't collect sensitive data, this is a non-issue.

5. Review Your Vendor Contracts

If you share customer data with third-party service providers (analytics tools, email platforms, payment processors), you need contracts that restrict how they can use that data.

Effort level: Medium. Check your existing service agreements. Many SaaS providers have updated their terms to include data processing addendums.

What You DON'T Need to Worry About (Yet)

As a small business, some advanced requirements are less likely to apply to you immediately:

• Data Protection Impact Assessments (DPIAs) — Required by many states but typically only for high-risk processing like selling data or using AI for profiling
• Dedicated Data Protection Officer — No state requires this yet
• Complex consent management platforms — Only needed if you have significant web traffic and complex data flows

The Cost of Non-Compliance

State attorneys general are the primary enforcers. Penalties range from $2,500 to $25,000 per violation depending on the state. For small businesses, the more immediate risk is:

• Reputation damage from a data breach or consumer complaint
• Being targeted as enforcement ramps up (California's CPPA has been active since 2023)
• Vermont and California allow consumers to sue directly — no AG involvement needed

The good news: many states offer a cure period (30–90 days to fix violations before penalties apply). But cure periods are expiring — California, Colorado, Connecticut, Maryland, and Vermont have already eliminated theirs.

A Simple Action Plan

Here's a realistic plan for getting compliant if you're starting from scratch:

Week 1: Assess

• Figure out which laws apply to your business
• Identify what personal data you collect and where it flows

Week 2: Privacy Policy

• Draft or update your privacy policy
• Add it to your website footer

Week 3: Consumer Rights

• Set up a process for receiving and responding to privacy requests
• Create a dedicated email address (privacy@yourcompany.com)

Week 4: Opt-Out & Vendors

• Add opt-out mechanisms if you share data
• Review vendor contracts for data processing terms

Ongoing: Monitor

• Track new state laws and threshold changes
• Review your compliance annually