US State Privacy Laws Explained: What a VPN Doesn't Replace

The patchwork: why your state matters

The United States has long relied on laws for specific areas, such as health records, rather than one law covering everything. States have passed their own consumer privacy laws. California's CCPA came first. Its amendments by the CPRA applied from January 1, 2023, according to the California Attorney General.

How many states now count depends on who is counting. In February 2026, MultiState wrote that twenty states had comprehensive privacy laws on the books and noted that the figure includes Florida, whose law is narrower. A December 2025 Ketch article used 18. The IAPP state legislation tracker (last updated September 8, 2026) keeps its full directory behind a members login, so we give no single number as fact. Use the tracker or your attorney general for the current list.

Effective dates we confirmed as of October 2026:

• Colorado: July 1, 2023, per the Colorado Attorney General.
• Connecticut: July 1, 2023, per the Connecticut Attorney General.
• Texas: July 1, 2024, per the Texas Attorney General.
• Indiana, Kentucky and Rhode Island: January 1, 2026, per law-firm and policy-tracker write-ups dated December 2025 and February 2026.

Details differ by state: who is covered, what counts as sensitive data, how fast a company must respond, and what is exempt.

Rights you commonly get

California's Attorney General lists these CCPA rights:

• Know: what personal information a business collects, uses, shares or sells about you.
• Delete: personal information collected from you, subject to exceptions.
• Opt out: of the sale or sharing of your personal information, including through a user-enabled global privacy control.
• Non-discrimination: for exercising your rights.
• Correct: inaccurate information (added January 1, 2023).
• Limit: use and disclosure of sensitive personal information (added January 1, 2023).

Colorado and Connecticut describe a similar mix, plus a portable copy of your data and opt-outs from targeted advertising and certain profiling. The CCPA applies to for-profit businesses that do business in California and meet any one of three tests listed by the Attorney General: more than $25 million in annual gross revenue, buying, selling or sharing the data of 100,000 or more California residents or households, or earning half or more of revenue from selling personal information. Nonprofits and government agencies are generally not covered.

The Attorney General says businesses must offer at least two ways to submit a request, and must respond to requests to know, delete and correct within 45 calendar days, with a possible 45-day extension if they notify you. Opt-outs of sale or sharing are due as soon as feasible and no later than 15 business days. Other states set their own deadlines.

What a VPN covers and what it does not

If you log in to a service, give it your email address or buy something, the company already knows who you are. A VPN cannot make it forget. That is where legal rights matter. See also what we say about incognito mode and VPNs, because the same confusion shows up there.

Data brokers: the part most people miss

Data brokers build and sell profiles from records, purchases and apps. You usually never dealt with them directly. In California, the Delete Act is enforced by the California Privacy Protection Agency, which lists regulations for the Delete Request and Opt-out Platform (DROP) as adopted in November 2025. The Agency's data broker page says that starting in 2026 you may submit one request to the Agency to have your non-exempt personal information deleted from data brokers, instead of contacting each one. The page we read gave no date by which brokers must act on those requests, so check the Agency site for what is live. Elsewhere you may have to write to brokers one by one. Paid removal services exist; compare them carefully, as we discuss in VPN bundles and add-on tools.

Expect a company to verify who you are before acting, and keep a note of the date and a screenshot of the confirmation. If a business ignores a valid request, check your state attorney general's site for how to complain. Do not pay anyone who offers to "guarantee" removal without checking what they will actually do.

Opt-out signals in your browser: Global Privacy Control

Global Privacy Control (GPC) is a browser setting or extension that tells websites you opt out of the sale or sharing of your data. The GPC project site describes it as a proposed specification that the W3C Privacy Working Group took up as a work item in November 2024. It lists Brave and the DuckDuckGo browser as sending it by default, Firefox as supporting it in settings, and several extensions, including Privacy Badger and OptMeowt.

Its legal weight depends on the state. California's Attorney General says the signal must be honored by covered businesses as a valid request to stop the sale or sharing of personal information. Colorado's Attorney General says controllers must accept universal opt-out requests from July 1, 2024. Connecticut's says businesses must honor universal opt-out preference signals from January 1, 2025, and names GPC as an example. The Texas page we read did not mention a universal opt-out, so do not assume it. A signal only reaches sites that honor it, so treat GPC as a useful extra, not a guarantee.

A practical checklist

1. Find out whether your state has a comprehensive privacy law and which rights it gives you.
2. Use "Do Not Sell or Share" links and privacy portals, and turn on a browser opt-out signal.
3. Use a VPN if you want your ISP and public networks to see less. See what your ISP can see.
4. Choose a VPN that is clear about its own logging. Start with no-logs policies explained.

Where the law stops

For VPN legality itself, see Is VPN legal?. For whether a VPN is worth paying for at all, read our honest assessment.

Frequently Asked Questions