[Home](/)/[Resources](/resources)/US State Consumer Privacy Laws USPrivacy # US State Consumer Privacy Laws: CCPA, VCDPA, and IoT Product Obligations The US has no federal consumer privacy law — but 19+ states do. For connected hardware companies, this means the device that collects usage data in California faces different obligations than the one shipped to Virginia or Colorado. This guide maps the landscape and identifies what hardware-specific obligations look like in practice. Copy Link[Share on WhatsApp](https://wa.me/?text=https%3A%2F%2Fkrono-labs.com%2Fguides%2Fus-state-consumer-privacy-laws-electronics) At a glance Key laws CCPA/CPRA (CA), VCDPA (VA), CPA (CO), TDPSA (TX) Focus Personal data from connected devices Key rights Access, deletion, opt-out of sale/sharing Enforcement State Attorneys General + CPPA (CA) ## Privacy obligations that apply to connected electronics ### State privacy law landscape for hardware As of 2025, 19+ US states have enacted comprehensive consumer privacy laws. Connected electronics that collect telemetry, usage data, location, or biometric data are subject to these laws whenever they process personal data of residents of covered states. Hardware companies that previously treated privacy as a software-only concern need to reassess: the device itself — and the data pipeline it creates — is the point of collection. ### California CCPA/CPRA obligations Companies meeting California's thresholds must provide a Privacy Notice at Collection at the point of data collection (which for IoT means at device setup or first use), honour consumer opt-out of sale and sharing of personal data, and enable the full suite of consumer rights: access, deletion, correction, and portability. The California Privacy Protection Agency (CPPA) enforces CPRA and has signalled active interest in IoT and connected device data practices. ### State-by-state threshold differences Many state privacy laws apply only to businesses above certain thresholds — typically annual revenue above $25M, processing data of 100,000+ consumers, or deriving 50%+ of revenue from selling personal data. Hardware companies selling into multiple states must track their own metrics against each state's threshold. A company below CCPA thresholds may still be subject to Virginia's VCDPA (which has no revenue threshold for companies processing 100,000 consumers) or Texas's TDPSA. ### IoT-specific obligations California's IoT Security Law (SB-327, codified at California Civil Code §1798.91.04) requires that any connected device sold in California have reasonable security features appropriate to the nature of the device and the information it collects. This is a distinct obligation from CCPA/CPRA, applying to any manufacturer regardless of data volume thresholds. Default passwords unique to each device (or requiring the user to generate a new password at first use) are cited as examples of reasonable security features. ## Building a state privacy compliance programme for IoT hardware 01 Map which US states have enacted comprehensive privacy laws and determine your threshold exposure for each. Focus first on California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Texas (TDPSA), and Connecticut (CTDPA) — these are the earliest enacted laws with established enforcement guidance and the most developed regulatory interpretations. 02 Inventory all personal data collected by your connected product throughout its lifecycle. Telemetry, location data, usage patterns, account registration data, crash reports, and biometric data (voice commands, facial recognition) have different sensitivity levels and may trigger different obligations. Map each data type to its collection point, storage location, and downstream recipients. 03 Update your privacy policy and privacy notice at collection to cover data collected through the hardware product. The notice must describe categories of personal data collected, purpose of collection, categories of third parties the data is shared with, and the mechanisms through which consumers can exercise their rights. For devices, this notice should be accessible during setup — not just on a website. 04 Implement consumer rights fulfilment infrastructure. Deletion requests must be honoured within specified timeframes — 45 days under most state laws, with a possible 45-day extension on notice. For connected devices, this means backend systems capable of deleting device-specific data, usage histories, and associated account data. Test the deletion flow before launch. 05 Assess whether you 'sell' or 'share' consumer data from your devices under each applicable state law's definition. If usage data, telemetry, or any other device-collected data is shared with advertising networks, analytics providers, or data brokers, this likely constitutes a sale or sharing under CCPA/CPRA and requires an opt-out mechanism and a 'Do Not Sell or Share My Personal Information' link accessible from your website and device app. ## Frequently asked questions ### Does CCPA apply to hardware companies that don't sell software? Yes, if the hardware collects personal data and the company meets California's thresholds. CCPA/CPRA applies to any business that collects personal information from California consumers and meets one of three thresholds: annual gross revenue above $25M; buying, selling, or receiving/sharing the personal information of 100,000+ consumers or households per year; or deriving 50%+ of annual revenue from selling or sharing consumers' personal information. A hardware company whose devices collect usage data and whose business otherwise meets these thresholds is a covered business. ### What is California's IoT Security Law and how does it differ from CCPA? California's IoT Security Law (SB-327) is a product security law, not a data privacy law. It requires that any connected device sold in California be equipped with reasonable security features appropriate to the device type and the information it collects. It applies to all manufacturers of connected devices sold in California — there are no threshold exemptions based on revenue or data volume. CCPA, by contrast, is a data rights law that gives consumers control over their personal information and applies only to businesses meeting specific thresholds. ### How do state privacy laws interact with GDPR for companies selling in both the EU and US? State privacy laws and GDPR share structural similarities — consent, data subject rights, data minimisation — but differ in scope, thresholds, and specific requirements. GDPR applies based on the location of data subjects, not the processing company's location; US state laws generally apply based on the residence of the consumer. A company selling connected devices globally should build its privacy architecture to the most stringent applicable standard in each area and ensure it can satisfy both GDPR's data subject rights and US state laws' consumer rights requests, which have different timelines and scope. ### What is the enforcement risk for non-compliance with state privacy laws for connected devices? State Attorneys General are the primary enforcers for most state privacy laws. California's CPPA can also initiate enforcement independently and has signalled particular interest in connected device data practices. Penalties under CCPA/CPRA reach $2,500 per unintentional violation and $7,500 per intentional violation. States like Texas (TDPSA) allow a 30-day cure period before enforcement. Private rights of action exist only for data breaches under CCPA — not for general privacy violations — but class action litigation following a breach can be financially severe. IoT device companies are a stated enforcement priority for several state AGs. **Disclaimer:** Educational resource only. Regulatory requirements change and vary by product category. Consult an accredited test laboratory or qualified compliance engineer before making certification decisions. 🇺🇸 US roadmap for your product Every standard, document, and test that applies — free, no account required. See your free roadmap[ Want an expert to take your product through 🇺🇸 US compliance for you? One consultant from Krono's compliance team takes your product from requirements to legal sale, with a fixed quote before any work starts. See compliance services](/services) Related guides * [US FTC Green GuidesUS FTC Green Guides for electronics marketing: substantiation requirements for recycled content, recyclable, carbon neutral, and energy efficiency claims on hardware products.](/guides/us-ftc-green-guides-electronics) * [US Prop 65 ElectronicsCalifornia Prop 65 for electronics: listed chemicals in PCBs, wiring, batteries and plastics, 60-day notice to discharge, safe-harbour warnings, and reformulation options.](/guides/us-prop-65-electronics) * [EU Cyber Resilience ActEU Cyber Resilience Act for hardware: default-secure requirements, vulnerability disclosure, 24-hour incident notification, and the four Annex I product classes.](/guides/eu-cyber-resilience-act) * [US ITAR/EAR ElectronicsUS ITAR vs EAR for electronics: USML vs Commerce Control List, ECCN classification, encryption controls, Consolidated Screening List obligations, and export compliance programmes.](/guides/us-itar-ear-electronics)