FreePublished on GitHub

state-law-applicability

US state privacy law applicability assessment tool. Evaluates revenue thresholds, data volume thresholds, business exemptions (GLBA, HIPAA, nonprofits), employee data carve-outs, and SBA small business determinations across all enacted state privacy laws.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills

See how to install

Files included (5)

SKILL.md6.8 KB
assets/template.md3.3 KB
references/standards.md3.4 KB
references/workflows.md4.3 KB
scripts/process.py17.0 KB

SKILL.md (original)

Review the instructions the agent will receive before you install.

State Privacy Law Applicability Assessment

Overview

Determining which US state privacy laws apply to an organization requires evaluating multiple criteria: revenue thresholds, consumer/data volume thresholds, industry-specific exemptions, entity-type exemptions, and data-type exemptions. This skill provides a systematic assessment framework and Python automation tool for evaluating applicability across all major enacted state privacy laws.

Assessment Framework

Step 1: Geographic Nexus

For each state, determine if the organization has nexus through:

Conducting business in the state (physical presence, employees, registered entity)
Targeting residents of the state (marketing, advertising, or providing products/services specifically to state residents)
Producing products/services consumed by state residents

Most state laws use "conducts business in [state] OR produces products or services targeted to [state] residents" as the nexus requirement.

Step 2: Threshold Assessment

State	Threshold 1	Threshold 2	Revenue Alternative
California	100,000 consumers/households	50% revenue from sale/sharing	$25,000,000 annual gross revenue
Virginia	100,000 consumers	25,000 consumers + 50% revenue from sale	None
Colorado	100,000 consumers	25,000 consumers + revenue/discount from sale	None
Connecticut	100,000 consumers (excl. payment)	25,000 consumers + 25% revenue from sale	None
Texas	Non-SBA small business	N/A	None (no threshold)
Oregon	100,000 consumers (excl. payment)	25,000 consumers + 25% revenue from sale	None
Montana	50,000 consumers (excl. payment)	25,000 consumers + 25% revenue from sale	None
Kentucky	100,000 consumers	25,000 consumers + 50% revenue from sale	None

Step 3: Entity-Level Exemptions

Exemption	CA	VA	CO	CT	TX	OR	MT	KY
Government	N/A (for-profit only)	Exempt	Exempt	Exempt	Exempt	Exempt	Exempt	Exempt
GLBA financial institutions	Data-level	Entity-level	Entity-level	Entity-level	Entity-level	Entity-level	Entity-level	Entity-level
HIPAA covered entities	Data-level	Entity-level	Entity-level	Entity-level	Entity-level	Entity-level	Entity-level	Entity-level
Nonprofits	Not exempt	Exempt	Exempt	Exempt	Exempt	Not exempt	Exempt	Exempt
Higher education	Not exempt	Exempt	Exempt	Exempt	Exempt	Not exempt	Exempt	Exempt
Air carriers	Not exempt	Not exempt	Not exempt	Not exempt	Not exempt	Not exempt	Exempt	Not exempt

Step 4: Data-Level Exemptions

Data that is already governed by certain federal laws may be exempt even if the organization itself is not:

Federal Law	Full Name	Data Type
GLBA	Gramm-Leach-Bliley Act (15 U.S.C. §6801)	Financial data under GLBA privacy rules
HIPAA	Health Insurance Portability and Accountability Act (42 U.S.C. §1320d)	Protected health information (PHI)
FERPA	Family Educational Rights and Privacy Act (20 U.S.C. §1232g)	Education records
FCRA	Fair Credit Reporting Act (15 U.S.C. §1681)	Consumer credit reports
DPPA	Driver's Privacy Protection Act (18 U.S.C. §2721)	Motor vehicle records
COPPA	Children's Online Privacy Protection Act (15 U.S.C. §6501)	Children's data under COPPA
Farm Credit Act	Farm Credit Act of 1971 (12 U.S.C. §2001)	Farm credit data

California distinction: CCPA/CPRA exempts the data governed by these federal laws, not the entity. A GLBA-covered bank is still subject to CCPA for personal data that falls outside GLBA's scope (e.g., marketing data not related to financial products).

Step 5: Employee Data Assessment

State	Employee Data Status
California	Fully covered (CPRA removed prior partial exemption)
Virginia	Exempt from consumer rights; controller duties apply
Colorado	Exempt from consumer rights; controller duties apply
Connecticut	Exempt from consumer rights; controller duties apply
Texas	Exempt from consumer rights; controller duties apply
Oregon	Partial exemption: Rights exempt; controller duties, DPIAs, sensitive consent apply
Montana	Exempt from consumer rights; controller duties apply
Kentucky	Exempt from consumer rights; controller duties apply

Step 6: SBA Small Business Determination (Texas TDPSA)

The TDPSA is the only state law that uses the SBA small business definition. Key steps:

Identify the organization's primary NAICS code
Look up the SBA size standard for that NAICS code in 13 CFR §121.201
Compare the organization's annual receipts or employee count to the threshold
If the organization qualifies as a small business:
- Most TDPSA provisions are exempt
- Prohibition on selling sensitive data without consent still applies (§541.107(b))

Common SBA thresholds for technology/retail companies:

NAICS	Industry	Revenue Threshold
454110	Electronic shopping	$40,000,000
519130	Internet publishing and web search portals	$47,000,000
518210	Data processing and hosting	$35,000,000
511210	Software publishers	$47,000,000
541511	Custom computer programming	$34,000,000

Liberty Commerce Inc. Assessment Summary

State	Consumers	Revenue from Sale	Applicable	Basis
California	320,000	12%	YES	Revenue >$25M + 100K consumers
Virginia	145,000	12%	YES	100K+ consumers
Colorado	98,000	12%	YES	25K+ with revenue from sale
Connecticut	87,000	12%	Borderline	Below 100K; below 25% revenue
Texas	410,000	12%	YES	Non-SBA small business
Oregon	72,000	12%	NO	Below both thresholds
Montana	28,000	12%	NO	Below both thresholds
Kentucky	68,000	12%	NO	Below both thresholds

Key Regulatory References

SBA Size Standards: 13 CFR §121.201
GLBA: 15 U.S.C. §6801-6809
HIPAA: 42 U.S.C. §1320d et seq.; 45 CFR Parts 160, 164
FERPA: 20 U.S.C. §1232g
FCRA: 15 U.S.C. §1681 et seq.
COPPA: 15 U.S.C. §6501-6506
DPPA: 18 U.S.C. §2721-2725

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

More skills from this repository

42-cfr-part-2

Free

Implements 42 CFR Part 2 protections for substance use disorder patient records. Covers written consent requirements stricter than HIPAA, re-disclosure prohibition, court order procedures, qualified service organization agreements, and 2024 amendments aligning Part 2 with HIPAA. Keywords: 42 CFR Part 2, substance use disorder, SUD records, re-disclosure, consent, Part 2 amendments.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills317Updated Mar 17, 2026

adequacy-assessment

Free

Guides assessment of third-country adequacy decisions under GDPR Article 45 for international data transfers. Covers the current EC adequacy decisions list, adequacy assessment criteria, partial adequacy handling, and monitoring of adequacy decision reviews. Keywords: adequacy decision, Article 45, third country, adequate protection, EC adequacy list.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills317Updated Mar 17, 2026

age-gating-services

Free

Implements age-gating mechanisms for online services to restrict access based on user age. Covers hard gates versus soft gates, neutral age prompts, re-verification triggers, circumvention prevention, and regulatory requirements under GDPR, COPPA, UK Online Safety Act, and DSA. Keywords: age gate, age restriction, neutral prompt, children, online services, access control.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills317Updated Mar 17, 2026

age-verification-methods

Free

Evaluates and implements age estimation and verification technologies for online services. Covers facial age estimation, digital ID verification, self-declaration with risk assessment, AI-based age estimation, and the accuracy versus privacy tradeoff. Includes ICO guidance and euCONSENT framework. Keywords: age verification, age estimation, facial analysis, digital ID, children, online safety.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills317Updated Mar 17, 2026

ai-act-high-risk-docs

Free

Preparing EU AI Act compliance documentation for high-risk AI systems. Covers Annex III classification, technical documentation under Art. 11, conformity assessment, risk management systems, and CE marking requirements. Keywords: EU AI Act, high-risk AI, Annex III, conformity assessment, CE marking.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills317Updated Mar 17, 2026

ai-automated-decisions

Free

Implements GDPR Art. 22 automated decision-making and AI Act Art. 14 human oversight requirements for AI systems. Covers identification of solely automated decisions, meaningful human intervention design, logic explanation mechanisms, and contestation procedures. Keywords: Art. 22, automated decision, human oversight, AI Act, profiling, contestation.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills317Updated Mar 17, 2026

See all skills by mukul975

Report a problem with this skill

Install

Install with a command

npx skills add https://github.com/mukul975/Privacy-Data-Protection-Skills --skill state-law-applicability

Paste it into your terminal and run it (requires Node.js). You can choose which agents to install it for, such as Claude Code or Codex.

Ask your agent

Please install the following Agent Skill.
https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/state-law-applicability

First review SKILL.md and the bundled files and confirm there is nothing suspicious (such as sending data externally or reading credentials). Then place it in ~/.claude/skills/state-law-applicability/ for Claude Code, or ~/.agents/skills/state-law-applicability/ for Codex.

Send this text to Claude Code or Codex as is. It checks the contents before installing.

View source on GitHub

Repository: mukul975/Privacy-Data-Protection-Skills
Stars: 317
Forks: 62
Category: DevOps
License: Apache-2.0
Original language: English
Last updated: Mar 17, 2026

A skill is a set of instructions and scripts for an agent. cccskills does not guarantee that skills are safe. Review the contents before you install.