Which Privacy Law Trigger Applies to Your Data?

You've determined that your organization falls below the volume and revenue thresholds for a state's comprehensive privacy law. Is that the end of the story? Not quite. States like Vermont, Maryland, Virginia, and New Jersey have introduced more specific requirements as of 2026, focusing on precise geolocation, sensitive personal data, and data brokers. These requirements often depend on the type of data or activity involved, rather than the number of consumers you serve or your earnings.

This guide helps your data governance team decide which compliance track suits your data and activities.

The Decision You Are Facing

You need to determine how much of your data inventory requires category-level controls and what kind. A threshold check answers, "Does this state's comprehensive law cover us?" A data-type check asks, "Does anything we collect or do trigger a specific rule regardless of that answer?"

Treat these as separate analyses. If you only perform the first, you might meet thresholds but still be out of compliance.

Key Factors Affecting Your Choice

Consider these questions before choosing a path.

1. Do you hold precise geolocation data? Examine mobile SDKs, app telemetry, delivery and fleet tools, and ad-tech partners that receive coordinates. Location data often comes through third-party code, not your own collection methods.

2. Do you process sensitive personal or biometric data? This includes inferred data, not just what users provide. A health-related segment built from browsing behavior can qualify.

3. Do you sell, license, or share this data? Regulators focus on use, sale, licensing, and sharing. A dataset used internally has different obligations than one you license out.

4. Do you receive personal data from sources other than the individual? This is central to data broker requirements and can be overlooked if you don't consider yourself a broker.

5. Can you trace data from source to recipient? If your team can't track where a field originated and who received it, you need to start with data mapping.

Path A: Category-Level Controls on Sensitive and Location Data

Choose this path if you handle geolocation or sensitive data and don't acquire or resell data about people with whom you have no direct relationship.

If your Consent Management Platform treats all Non-Essential Cookies and SDK-based collection as one category, then separate location and sensitive categories with their own Purpose Disclosure and Granularity. Bundled consent is inadequate when a law targets a specific data type.

If location data comes through a Tag Manager or third-party SDK, then audit what those Container Tags transmit. Teams often find coordinates or device-level signals sent to vendors without review.

If you rely on consent as your Legal Basis for Processing sensitive data, then ensure it's Valid Consent: obtained through Clear Affirmative Action, with equal choice prominence between accept and reject. Keep records of what the user saw and chose.

What drives this path: The requirement is based on data type. Your consumer count doesn't affect whether location or sensitive data rules apply.

Path B: Data Broker Obligations

Choose this path if you collect, aggregate, license, or sell personal data about individuals with whom you have no direct relationship, or if your business model resembles that.

If you're an obvious broker, then review registration, disclosure, and handling requirements in each state where you operate, and reassess how you share and license data downstream. Expanded requirements impact your operations and contracts, not just your privacy notice.

If you're not an obvious broker but run an enrichment product, audience-extension offering, or data partnership, then test whether that activity meets a broker definition in any relevant state. Broker status can stem from one product line, not your entire company.

If you're a buyer or licensee of broker data, then tighten vendor diligence. Ask about data origin and the upstream collection notice. You inherit exposure when provenance is unclear.

What drives this path: The trigger is the activity, not your business size. A small company with one data-licensing line can fall into this category.

Path C: Both Apply

Choose this path if you hold sensitive or location data and also license or sell data to third parties. This is common in ad-tech, mobility, retail analytics, and app businesses.

If both conditions are true, then implement Path A controls on collection and Path B analysis on onward transfer. Sensitive or location data that you sell or license is the highest-scrutiny combination, so prioritize it in your remediation queue.

Sequence the work this way:

1. Map sensitive and location data fields, including how each is used, sold, licensed, and shared.
2. Flag every flow where those fields leave your environment.
3. Check each flow against the consent record and Purpose Disclosure that supports it.
4. Decide, flow by flow, whether to keep, restrict, or stop.

What Happens If You Skip the Mapping

The risk of not adapting is real. If you can't identify where precise geolocation or sensitive data resides, you can't apply the right controls, honor consumer requests accurately, or defend your position when questioned. Meeting a threshold exemption doesn't protect you from a rule that never used a threshold. A data inventory focused only on cookies will miss location signals in apps, SDKs, and server-side pipelines.

Summary Matrix

A final note on timing. State laws will keep changing, so build the data map as a living infrastructure, not a one-time project. A current inventory of sensitive and location data lets your team quickly assess each new rule: does it affect anything we hold, and what do we change?

Official regulatory texts