Often, yes — more than most owners expect. Most state privacy laws set thresholds based on revenue or the number of 'consumers' whose data you hold, but 'consumer' typically includes anyone whose personal information you process — website visitors, email subscribers, and job applicants, not just paying customers. A handful of states, including Delaware, Montana, and Nevada, apply their laws with no minimum size at all. And regardless of whether a specific state law applies to you, breach notification laws and FTC enforcement against deceptive privacy or AI claims apply without a size exemption. The only reliable way to know where you stand is to check — which is exactly what our
free assessment is built to do.