SaaS Companies Are Building One Compliance Program for 20 Different State Privacy Laws
Twenty US states now have comprehensive consumer privacy laws on the books in 2026, and no federal law overrides any of them. Indiana, Kentucky, and Rhode Island all activated their statutes in January; Arkansas joined on July 1. Oklahoma and Alabama are set to follow in 2027. Each law has its own applicability thresholds, its own list of consumer rights, its own enforcement mechanism, and in a growing number of cases, its own flatly incompatible compliance obligations. For a SaaS company operating nationally, the live question in 2026 isn't whether to comply with state privacy law. It's whether to build one compliance program that covers all twenty states with targeted overlays, or to treat each state as its own project — and the second option is quietly becoming unworkable.
The thresholds alone don't line up
Three states — Delaware, Montana, and Nevada — apply their privacy laws to any business processing the data of their residents, with no revenue or data-volume minimum. Virginia and Connecticut set the bar at 100,000 consumers. Rhode Island sets it at 35,000. Texas exempts businesses that qualify as small under US Small Business Administration standards, a carve-out none of the other nineteen states use. A company sized to safely ignore Virginia's threshold can still be squarely inside Delaware's, simply because Delaware's law was written to apply to almost everyone.
Opt-out mechanics diverge just as much. At least ten states — including California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, New Jersey, New Hampshire, and Oregon — now legally require businesses to honor the Global Privacy Control signal, a browser-level universal opt-out. Build a consent layer that only checks for an explicit cookie-banner click and ignores the GPC header, and you're out of compliance in roughly half the states with a comprehensive law, even if your banner itself is flawless.
Where the laws actively conflict, not just differ
The harder problem isn't volume of rules — it's that some of them contradict each other by design. Colorado's privacy law requires a documented risk assessment for high-risk processing activities, including anything involving automated decision-making, with specific content requirements written into Colorado's own regulations. California's newer rules governing automated decision-making technology (ADMT) impose a separate, differently structured assessment and disclosure regime. The two states were not written to be mutually satisfiable with a single document. A company that produces one "privacy impact assessment" template and assumes it clears both states' bars is very likely wrong about at least one of them.
Geolocation data sale is a sharper example because it comes with hard effective dates. Virginia's SB 338 banned the sale of precise geolocation data as of July 1, 2026. Connecticut's Senate Bill 4, signed by Governor Ned Lamont on May 27, 2026, imposes a similar ban that takes effect October 1, 2026, and simultaneously creates a data broker registration requirement. Maryland's version has been in force since October 2025. These aren't opt-out regimes a company can satisfy with a banner — they're outright prohibitions on a specific category of data sale, arriving on three different calendars, in three different legal forms, for three different states. A company whose product or ad-tech stack touches precise location data has to know, state by state, not just whether the sale is restricted but exactly when the restriction started applying to them.
The two paths companies are actually choosing
In practice, SaaS companies operating across all fifty states are converging on one of two strategies, and the middle ground is disappearing. The first is a unified privacy program: one core set of data practices, data processing agreements, and consent flows built to the strictest common denominator across all twenty states, with narrow, well-documented overlays for the handful of requirements — like Colorado's and California's separate ADMT assessments, or the three states' different geolocation-sale effective dates — that genuinely cannot be satisfied by a single baseline. This is more engineering and legal work up front, but it scales as more states pass laws, because the baseline absorbs most of what's new and only the genuine conflicts need a state-specific carve-out.
The second strategy, more common among smaller companies without in-house privacy counsel, is reactive and narrower: comply fully only where the applicability threshold clearly bites — Delaware, Montana, Nevada, and the handful of larger states — and treat the rest as a monitoring list to revisit if a specific state's enforcement activity picks up. This works until it doesn't; a company that guessed wrong about a threshold, or that didn't notice a new effective date land on the calendar, finds out the hard way, because state attorneys general have shown they will act on cases a federal regulator never would have prioritized.
What to actually do about it
If you're running compliance for a multi-state SaaS product in 2026, the mandatory checklist has gotten specific enough to write down in order: confirm which of the twenty states' applicability thresholds your company actually crosses, rather than assuming size alone exempts you; implement GPC signal recognition at the browser level, not just a cookie banner, since roughly half the states now require it by statute; maintain separate risk-assessment documentation for Colorado and California rather than one shared template; and calendar the specific effective dates for any precise-geolocation-data practices against Virginia, Connecticut, and Maryland individually, since "we comply with CCPA" says nothing about whether you're compliant with any of the other nineteen laws, let alone the three that treat location data as a special case. The patchwork isn't going away — Oklahoma and Alabama arrive in 2027 — and every year of inaction makes the eventual unification project larger, not smaller.