Five State Privacy Laws Went Into Effect In 2025: Here’s What You Need to Know

Threshold variations alone present immediate compliance hurdles. Delaware casts the widest net, regulating businesses handling data of just 35,000 consumers (excluding payment data) — a standard that could ensnare regional retailers and mid-market SaaS providers. Iowa adopts a more conventional 100,000-consumer threshold, while New Jersey breaks from peer states by not providing a blanket exemption for employee or Business-to-Business (B2B) data. In contrast, Nebraska and New Hampshire exclude employee and B2B data, focusing instead on consumer data used in individual or household contexts. This lack of uniformity forces multistate operators to implement nuanced compliance matrices, as a business might be regulated in Delaware but exempt in Iowa despite identical operations. The operational implications are significant. Employers with multistate workforces must now reconcile New Jersey's inclusive approach with Nebraska and New Hampshire's B2B exemptions. Service providers face similar challenges when determining whether client engagements trigger compliance obligations. Comprehensive data mapping and tracking are legal necessities, as organizations must now track not just data categories but the precise residential jurisdictions of each data subject to properly assess their obligations.