# Multi-State Privacy Compliance Status Report

## Organization: Liberty Commerce Inc.

| Field | Value |
|-------|-------|
| **Report Date** | 2026-03-14 |
| **Annual Revenue** | $48,000,000 |
| **States Assessed** | 8 |
| **States Applicable** | 4 (CA, VA, TX, CO) |

## Applicability Summary

| State | Law | Consumers | Applicable | Basis |
|-------|-----|-----------|------------|-------|
| California | CCPA/CPRA | 320,000 | YES | Revenue >$25M + 100K consumers |
| Virginia | VCDPA | 145,000 | YES | 100K+ consumers |
| Colorado | CPA | 98,000 | YES | 25K+ with revenue from sale |
| Connecticut | CTDPA | 87,000 | Borderline | Monitoring |
| Texas | TDPSA | 410,000 | YES | Non-SBA small business |
| Oregon | OCPA | 72,000 | NO | Below thresholds |
| Montana | MTDPA | 28,000 | NO | Below 50K threshold |
| Kentucky | KPPA | 68,000 | NO | Below thresholds |

## Compliance Program Tiers

### Tier 1: Common Baseline — IMPLEMENTED
- Privacy notice with all required sections
- Consumer rights portal (access, correct, delete, portability, opt-out)
- 45-day response SLA with tracking
- Data minimization and purpose limitation
- Reasonable data security
- Non-discrimination protections

### Tier 2: High-Water Mark — IMPLEMENTED
- Opt-in consent for sensitive data (VA/CO/CT/TX standard)
- Dark pattern audit program (CT standard)
- Oregon-compliant de-identification program
- Colorado-scope profiling opt-out
- Universal opt-out (GPC) recognition

### Tier 3: State-Specific — IMPLEMENTED
- California: CPRA links, sensitive PI limit, annual metrics
- Oregon: Specific third-party list disclosure
- Texas: Data broker assessment
- Connecticut: Loyalty program exemption assessment

## Sign-Off

| Role | Name | Date |
|------|------|------|
| CPO | Sarah Mitchell | 2026-03-14 |
| Legal | Marcus Chen | 2026-03-14 |
| CTO | David Park | 2026-03-14 |