Methodology & Sources
PrivacyLawMap publishes compliance information about 20+ US state consumer privacy laws. Because these laws change constantly and the details carry real legal and financial weight, this page documents exactly how we research, verify, and maintain that information — and how to flag anything that looks wrong.
How we research a privacy law claim
Every legal fact we publish — an applicability threshold, a consumer right, an exemption, an effective date, a cure period, or a fine amount — is traced to a controlling primary source. We read the enacted statutory text first, layer in official Attorney General and agency guidance for how it is applied, and use legal-industry analysis only to detect that something has changed. We then verify the change against the primary source before it appears on the site.
Primary sources we cite
Listed in order of authority. These are the same sources cited inline throughout our state law pages, guides, and penalties tracker.
State legislature bill text & statutes
The enacted statutory text is the controlling authority for every threshold, consumer right, exemption, and effective date we publish.
Example: leginfo.legislature.ca.gov (CCPA/CPRA, Cal. Civ. Code § 1798.100 et seq.)
State Attorney General & agency guidance
AG offices and dedicated agencies publish FAQs, rulemakings, and enforcement notices that interpret how the statute is applied in practice.
Example: oag.ca.gov/privacy/ccpa and the California Privacy Protection Agency (cppa.ca.gov)
Official enforcement actions & settlements
Settlement orders, stipulated judgments, and agency press releases are the source of every fine amount, company name, and date in our penalties tracker.
Example: CPPA newsroom (cppa.ca.gov) and state AG enforcement announcements
Secondary legal analysis (cross-check only)
Practitioner analysis helps us spot amendments and disputed interpretations, but we always trace a claim back to the primary statute or agency source before publishing it.
Example: IAPP, National Law Review, JD Supra
Our editorial standards
Primary sources first
Every legal fact — a threshold, a right, an effective date, a fine — is traced to the statute, regulation, or official agency document that controls it. Secondary commentary is used to find changes, never as the final authority.
Dated citations
Because privacy law changes constantly, we record the date a source was retrieved alongside the citation. When you see "retrieved [date]" on a page, that is the day we last confirmed the claim against the source.
Continuous review
State pages, the deadline timeline, and the penalties tracker are reviewed on a rolling basis as bills are signed, regulations are finalized, cure periods sunset, and enforcement actions are announced. Each page shows its own last-updated date.
Plain English, not legal conclusions
We translate statutory language into practical guidance for non-lawyers. We frame interpretation as "per [source]" or "commonly interpreted as" — we do not state legal conclusions as definitive advice.
Found an error?
Privacy law moves fast, and we would rather hear about a stale citation than have you rely on it. If a fact looks wrong or out of date, send us the page URL and the controlling source (statute section or official agency page). We prioritize corrections that affect a legal threshold, right, effective date, or fine amount.
Frequently asked questions
Where does PrivacyLawMap get its privacy law data?
Primarily from the enacted statutory text on state legislature websites and from official Attorney General and state-agency guidance. Fine amounts and enforcement details come from official settlement orders and agency announcements. We use legal-industry analysis (IAPP, National Law Review, JD Supra) only to detect changes, then verify each claim against the controlling primary source.
How often is the information updated?
Continuously. State law pages, the compliance deadline timeline, and the enforcement penalties tracker are reviewed on a rolling basis whenever a bill is signed, a regulation is finalized, a cure period sunsets, or an enforcement action is announced. Each page displays its own last-updated or last-reviewed date.
Is PrivacyLawMap legal advice?
No. PrivacyLawMap is a practical compliance research resource, not a law firm, and using it does not create an attorney-client relationship. We present plain-English summaries of public law and frame interpretation as "per [source]" rather than as definitive legal conclusions. For decisions about your specific situation, consult a qualified privacy attorney.
How do I report an error or outdated information?
If a citation looks wrong or out of date, email the correction with the page URL and the controlling source (statute section or agency page) and we will verify and update it. We prioritize corrections that affect a legal threshold, right, effective date, or fine amount.
Disclaimer: PrivacyLawMap provides general information about US state privacy laws for educational purposes only. This is NOT legal advice. Privacy laws are complex and frequently amended. Consult with a qualified privacy attorney for advice specific to your business. PrivacyLawMap makes no warranties about the accuracy or completeness of this information.