BY NEURABYTE
FRAMEWORKS/PRIVACY/US STATE PRIVACY
USDP
PRIVACY · State legislatures

US state privacy

CCPA, CPRA, and the growing set of state laws, on one requirement set.

Twenty US states have passed comprehensive privacy laws since 2018, led by California's CCPA and CPRA. They share a core: notice, access, deletion, opt-out of sale or sharing, and increasingly, rules on automated decision-making and profiling. Details differ by state. The crosswalk normalizes them onto one set of requirements with state-level notes.

AT A GLANCE
ISSUERState legislatures REGIONUnited States CATEGORYPrivacy CROSSWALKVersioned mapping onto the 15-control registry
EVIDENCE, NOT CERTIFICATION
01. WHO IT APPLIES TO

Is this one yours?

01Companies meeting revenue or data-volume thresholds in any covered state
02AI systems making or supporting decisions about consumers
03Vendors acting as service providers or processors
02. KEY REQUIREMENTS

The parts of US state privacy that touch what agents do.

Right to delete
Consumers can request deletion, and the business must honor it and instruct service providers to do the same.
Data minimization (CPRA)
Collection and retention are limited to what is reasonably necessary and proportionate.
Automated decision-making
Several states require notice, opt-out, or risk assessment for significant automated decisions.
Reasonable security
Businesses implement reasonable security procedures appropriate to the data.
03. HOW LORE MAPS TO IT

Enforcement controls, read against the requirement.

These controls exist because the platform needs them to run safely. The crosswalk reads their signed evidence against US state privacy. Where there is no evidence, the report says gap.

LORE CONTROL US STATE PRIVACY REFERENCE
Provable deletionCCPA §1798.105 and equivalents
Context disclosure recordCPRA §1798.100(c) minimization
Signed, hash-chained receiptsADMT risk assessment evidence
Blocking authorization gateReasonable security provisions
Illustrative references. The shipped crosswalk carries exact clause citations, its version, and the review date.
04. OUT OF SCOPE

What Lore will not claim.

Privacy notices, opt-out mechanisms, and consumer request portals are yours.
Applicability thresholds vary by state and are a legal determination.
05. QUESTIONS
Which states are covered?
The crosswalk tracks all enacted comprehensive laws and is versioned as new ones take effect.
Does an agent decision count as ADMT?
It can. When an agent acts on a consumer's account, the receipt and the human checker record are the evidence regulators ask for.
How is this different from GDPR?
Narrower rights, opt-out rather than opt-in, and no DPO requirement. Deletion and minimization evidence carries across both.
← PREVIOUSHIPAA ALL FRAMEWORKS NEXT →ISO 27701
US STATE PRIVACY · EARLY ACCESSEVIDENCE COLLECTED ONCE

Start building the record your auditor will read.

Every receipt Lore signs today is evidence for US state privacy tomorrow. Turn the crosswalk on when you are ready; nothing needs re-collecting.

Also from Neurabyte: Cupel
Lore's core mechanisms are patent-pending. Product names are trademarks of their respective owners; listing an integration doesn't imply a partnership.
© 2026 NEURABYTE INC.