Privacy CompliancePrivacy Notices
Does a U.S. Privacy Notice Need a Consumer Rights Section for Each State?
Many privacy notices describe consumer rights once, in general terms, for any reader who "may have rights" under a state law. Regulators in Delaware, Connecticut, and Oregon have objected to that approach, and the differences between the state laws make a single summary hard to keep accurate.
By Alex Proctor
Published September 24, 2026
Summary
Delaware's Department of Justice says that statements such as "you may have rights" or "if your state has a data privacy law" do not comply with the state's privacy law. Connecticut's Attorney General objects to notices that create a "misimpression" that rights belong only to residents of certain states. Oregon's Department of Justice has sent cure notices over consumer rights sections that name other states but not Oregon. None of the three states requires a separate consumer rights section for its own residents, but taken together, their guidance points toward state-specific content.
Why Do Privacy Notices Have Consumer Rights Sections?
California's privacy law was the first of its kind in the United States. The California Consumer Privacy Act took effect in January 2020, and it requires a business's privacy policy to explain the rights it gives consumers and how to exercise them. Many businesses responded by adding a California consumer rights section to their notice.
Other states followed, beginning with Virginia and Colorado in 2023, and 20 state privacy laws are now in force. Rather than write a consumer rights section for each new law, many businesses added states to the heading of their California section or replaced it with general language for any reader who "may have rights." Regulators in Delaware, Connecticut, and Oregon are now challenging these approaches.
What Does Delaware Say?
Delaware's Department of Justice has given the most direct guidance of the three, in the FAQ it publishes on the Delaware Personal Data Privacy Act. A notice does not need a separate Delaware section, but its description of rights must "unambiguously indicate those rights are available to Delaware residents." The guidance then names two phrases that fall short, stating that "you may have rights" and "if your state has a data privacy law" are "not sufficiently clear" and "do not comply."
Delaware accepts two ways to comply. A business can state that the rights may be exercised by all users, or by all users in the United States. Alternatively, it can "clearly describe the subset of users," which means naming Delaware among the other states whose residents hold the rights.
What Do Connecticut and Oregon Say?
Connecticut reached the same conclusion through enforcement. The Attorney General's April 2025 report says the office is "troubled by privacy notices that create a misimpression that consumer rights are exclusive to residents in only one state, or only in certain states." A company does not need a separate section for every state, but it "must avoid language that creates ambiguities over whether Connecticut residents have data rights."
The same report advises companies to consider all privacy notices and public statements to be under review. By its February 2026 report, the office had run five privacy notice sweeps.
Oregon's Department of Justice described the same defect in its six-month report. Among the notices it found confusing were those "that name one or two states in the 'your state rights' section but not Oregon, giving consumers the impression that privacy rights are only available to people who live in those named states."
Why Does the Guidance Favor State-Specific Content?
A business can write the consumer rights section of its notice in one of three ways. The first two are the options Delaware declared to be acceptable, and both use a single list of rights. The third gives each state its own consumer rights section.
| Approach | How it works | Drawback |
|---|---|---|
| One list for all users |
|
|
| One list for named states |
|
|
| A section for each state |
|
|
Based on guidance from Delaware, Connecticut, and Oregon, as of September 2026.
A single consumer rights disclosure for all users is the simplest to write, but it commits the business to honoring requests from residents of states with no privacy law at all. A list for named states only works when the list is complete and current.
Both of these approaches share a larger problem, which is that the rights are not identical. For example, Iowa provides no right to correct inaccurate data. Oregon and Minnesota give consumers a right to a list of the specific third parties that received their data, and Connecticut added a version of that right in July 2026. The availability and process for appeals also differ by state.
A single list either overstates the rights of some residents or understates the rights of others, and the regulators have objected to the latter. I recommend a consumer rights section for each state. It is more tedious, but it holds up to a regulator's reading in every state where the business is covered.
What Should a State Consumer Rights Section Look Like?
Each state's section should name the state in its heading, list the rights in the terms that state's law uses, and describe the appeal process where the law requires one. Each section should also point to the request form or other methods a resident can use, so a reader in any state can tell which methods apply to them.
The consumer rights sections also need to be maintained over time. In addition to new privacy laws taking effect, existing laws are regularly amended. The sections should be checked against current state laws as part of the regular review of the notice. Each new privacy law should get its own section before it takes effect.
Questions
Which privacy laws require a consumer rights section at all?+
Every state privacy law requires the notice to explain how consumers may exercise their rights. Most stop there. California's regulations also require the policy to explain each right under the California Consumer Privacy Act, which is why most notices already carry a California section. Minnesota also requires an explanation of the rights.
Is "you may have rights depending on where you live" enough?+
Not in Delaware, which has said in writing that the phrase does not comply. Connecticut and Oregon have both objected to notices that leave their residents unsure whether they hold rights. This phrase leaves every reader unsure. A business that uses it should expect the same objection from any regulator that reads the notice.
What happens when a new privacy law takes effect and the notice is not updated?+
Residents of the new state see a notice that names other states and not theirs, which is the defect Oregon cited in its cure notices. Three state laws took effect in January 2026. Amendments such as Connecticut's July 2026 changes can also make an existing section inaccurate. A notice reviewed once a year can be out of date for months, which is one reason I recommend a quarterly review.
Briefings are informational and do not constitute legal advice.
Is your privacy notice accurate?
I'll check what it says against what your site does.
Website Privacy Audits include a detailed video review of your live site, a written report for your team or counsel, and a remediation review call. Priority audits add 72-hour delivery and testing of demand letter claims.
Standard $449. Priority $649.
My audits are most useful when you have a consent management setup to validate, a demand letter with specific claims to assess, or a team or client that needs an external web privacy expert. If you already know you have major gaps, your budget may be better spent addressing them directly. I recommend Captain Compliance, the platform I help build, for privacy technology needs.