consumer-privacylisted

# Consumer privacy — product-side playbook US consumer privacy is no longer "just California". A dozen states have comprehensive privacy laws (2023-2026), and India's DPDP Act adds another regime. Each has slightly different definitions, thresholds, and user rights. The PM job is to design the consent + opt-out UX once in a way that satisfies all. ## 1. The US state-privacy landscape (mid-2026) | State | Law | In force | Key features | |---|---|---|---| | California | CCPA + CPRA | 2020 / 2023 | DNS (Do Not Sell), opt-out + opt-in for sensitive, private right of action for breaches | | Virginia | CDPA | 2023 | Similar to CPRA; no PROA | | Colorado | CPA | 2023 | Universal opt-out signal recognition (Global Privacy Control) | | Connecticut | CTDPA | 2023 | GPC + sensitive-data opt-in | | Utah | UCPA | 2023 | Weaker; B2B-friendly | | Texas | TDPSA | 2024 | Broad applicability | | Iowa, Indiana, Tennessee | Various | 2024-2026 | Generally similar to VA | | Montana, Oregon, Delaware, NH, NJ | Various | 2024-2026 | Various | | Washington | My Health My Data Act | 2024 | Health-data specific; opt-in for sensitive | **Number is growing.** 15+ states by end of 2026. ## 2. The common thread (across most) Every state law shares this skeleton: - **Consumer rights**: access, delete, correct, opt-out of sale / targeted ads. - **Sensitive data**: separate treatment (sexual orientation, immigration status, biometrics, geolocation precise, health, etc.). - **Privacy notice**: requir