# State Privacy Law Applicability Assessment Report

## Organization: Liberty Commerce Inc.

| Field | Value |
|-------|-------|
| **Assessment Date** | 2026-03-14 |
| **Annual Revenue** | $48,000,000 |
| **NAICS Code** | 454110 (Electronic shopping) |
| **Entity Type** | For-profit corporation |
| **Employee Count** | 320 |
| **Revenue from Data Sale** | 12% |
| **Total States Assessed** | 8 |
| **Applicable States** | 4 |

## Applicability Matrix

| State | Law | Consumers | Threshold Met | Applicable | Employee Data |
|-------|-----|-----------|---------------|------------|---------------|
| California | CCPA/CPRA | 320,000 | Revenue >$25M + 100K consumers | YES | Fully covered |
| Virginia | VCDPA | 145,000 | 100K+ consumers | YES | Rights exempt |
| Colorado | CPA | 98,000 | 25K+ with revenue from sale | YES | Rights exempt |
| Connecticut | CTDPA | 87,000 | Below both thresholds | BORDERLINE | Rights exempt |
| Texas | TDPSA | 410,000 | Non-SBA small business | YES | Rights exempt |
| Oregon | OCPA | 72,000 | Below both thresholds | NO | Partial exempt |
| Montana | MTDPA | 28,000 | Below 50K | NO | Rights exempt |
| Kentucky | KPPA | 68,000 | Below both thresholds | NO | Rights exempt |

## Entity Exemption Analysis

| Exemption Type | Applicable to Liberty Commerce Inc.? |
|---------------|--------------------------------------|
| Government | No — for-profit corporation |
| GLBA financial institution | No — e-commerce company |
| HIPAA covered entity | No — not a healthcare entity |
| Nonprofit | No — for-profit |
| Higher education | No |
| Air carrier | No |

## SBA Small Business Determination (Texas)

| Field | Value |
|-------|-------|
| NAICS Code | 454110 |
| Industry | Electronic shopping and mail-order houses |
| SBA Revenue Threshold | $40,000,000 |
| Liberty Commerce Inc. Revenue | $48,000,000 |
| **Is Small Business** | **No** |
| **TDPSA Status** | **Full provisions apply** |

## Federal Data-Level Exemptions

| Federal Law | Data Collected | Exempt Data | Non-Exempt Data |
|-------------|---------------|-------------|-----------------|
| GLBA | No (not financial institution) | N/A | N/A |
| HIPAA | No (not covered entity) | N/A | N/A |
| FERPA | No (not educational institution) | N/A | N/A |
| FCRA | No (not consumer reporting agency) | N/A | N/A |
| COPPA | Yes (minor users) | Children's data under COPPA | N/A |

## Monitoring States

These states are below current thresholds but should be monitored:

| State | Current Consumers | Threshold | Gap | Growth Rate |
|-------|-------------------|-----------|-----|-------------|
| Connecticut | 87,000 | 100,000 | 13,000 | ~8% annually |
| Oregon | 72,000 | 100,000 | 28,000 | ~6% annually |
| Kentucky | 68,000 | 100,000 | 32,000 | ~5% annually |
| Montana | 28,000 | 50,000 | 22,000 | ~4% annually |

## Recommendations

1. **Connecticut**: Monitor consumer count closely — may reach 100,000 threshold by Q3 2027
2. **Oregon**: Implement compliance proactively given nonprofit provisions and unique third-party list right
3. **Montana**: Low growth rate; unlikely to reach 50,000 threshold before 2028
4. **Kentucky**: Effective January 1, 2026 — maintain readiness in case of threshold change

## Sign-Off

| Role | Name | Date |
|------|------|------|
| CPO | Sarah Mitchell | 2026-03-14 |
| Legal | Marcus Chen | 2026-03-14 |
| CFO | Jennifer Walsh | 2026-03-14 |