# Regulatory Standards — State Law Applicability Assessment

## Applicability Provisions by State

### California — Cal. Civ. Code §1798.140(d)
Three alternative thresholds (any one triggers applicability):
1. Annual gross revenues exceeding $25,000,000
2. Annually buys, sells, or shares PI of 100,000+ consumers or households
3. Derives 50%+ of annual revenues from selling or sharing PI
Must be a for-profit entity that "does business in California"

### Virginia — Va. Code §59.1-576
Two alternative thresholds:
1. Controls/processes PI of 100,000+ Virginia consumers
2. Controls/processes PI of 25,000+ consumers AND derives >50% gross revenue from sale

### Colorado — C.R.S. §6-1-1304
Two alternative thresholds:
1. Controls/processes PI of 100,000+ Colorado consumers
2. Controls/processes PI of 25,000+ consumers AND derives revenue or discount from sale

### Connecticut — Conn. Gen. Stat. §42-516
Two alternative thresholds (excl. payment-only):
1. Controls/processes PI of 100,000+ Connecticut consumers
2. Controls/processes PI of 25,000+ consumers AND derives >25% gross revenue from sale

### Texas — Tex. Bus. & Com. Code §541.002
No consumer count or revenue threshold. Applies to:
- Persons conducting business in Texas or targeting Texas residents
- That process or sell personal data
- That are NOT SBA-defined small businesses

### Oregon — ORS §646A.572
Two alternative thresholds (excl. payment-only):
1. Controls/processes PI of 100,000+ Oregon consumers
2. Controls/processes PI of 25,000+ consumers AND derives ≥25% gross revenue from sale

### Montana — MCA §30-14-2803
Two alternative thresholds (excl. payment-only):
1. Controls/processes PI of 50,000+ Montana consumers (lowest threshold)
2. Controls/processes PI of 25,000+ consumers AND derives >25% gross revenue from sale

### Kentucky — KRS §367.405
Two alternative thresholds:
1. Controls/processes PI of 100,000+ Kentucky consumers
2. Controls/processes PI of 25,000+ consumers AND derives >50% gross revenue from sale

## Federal Law Interactions

### GLBA Exemption Analysis

**Entity-level exemption** (VA, CO, CT, TX, OR, MT, KY): Financial institution and its affiliates are entirely exempt from the state privacy law.

**Data-level exemption** (CA): Financial institution is subject to CCPA/CPRA for personal data NOT governed by GLBA. Example: A bank's marketing department collects website browsing data from California residents who are not customers — this data is not regulated by GLBA but is regulated by CCPA.

### HIPAA Exemption Analysis

**Entity-level exemption** (VA, CO, CT, TX, OR, MT, KY): Covered entity or business associate is entirely exempt.

**Data-level exemption** (CA): Covered entity is subject to CCPA/CPRA for personal data that is NOT Protected Health Information (PHI) or subject to HIPAA. Example: A hospital's gift shop collects purchase data from California residents — this data may not qualify as PHI and would be subject to CCPA.

## SBA Size Standards Reference

### 13 CFR §121.201 — Small Business Size Standards by NAICS Code

SBA updates size standards periodically. Key standards for technology/retail:
- Manufacturing: 500-1,500 employees (varies by subsector)
- Retail trade: $8M-$47M annual receipts
- Information: $11M-$47M annual receipts
- Professional services: $8M-$47M annual receipts

Organizations must check the current SBA size standard table for their specific NAICS code.