Your CRM May Already Break a State Privacy Law You Have Not Heard Of

Twenty US states now have comprehensive data privacy laws on the books. If your CRM holds customer records, email addresses, or even just contact details, you may already be covered by one, and the rule that catches people off guard is simple: the law follows the customer, not your business.

Why this catches small businesses off guard

A business based in one state does not get to apply only that state’s rules. Sell to a customer in Virginia, Virginia’s law applies. Sell to one in Texas, Texas applies. Most small businesses never check this, because they assume privacy law is a big-company problem.

Three new states, Indiana, Kentucky, and Rhode Island, added comprehensive laws this year. Connecticut lowered its threshold from 100,000 residents to 35,000 in July, pulling in far more small and mid-sized businesses than before.

What these laws actually require

The common thread across most state laws: customers can ask to see their data, correct it, or have it deleted, and businesses need an actual process to handle that request, not just a promise in a privacy policy. Twelve states now also require recognizing Global Privacy Control, a browser signal that tells you a visitor wants to opt out automatically, without them filling out a form.

If your CRM is a mess of duplicate contacts and inconsistent records, a deletion or correction request becomes a real problem fast. This connects directly to the CRM mistakes quietly costing you leads: the same messy data that hurts your sales process also makes compliance harder.

What to actually do

List every place customer data enters your business: website forms, your CRM, email signups, any tracking pixels. Update your privacy policy to reflect what you actually collect. Build a simple intake process for correction and deletion requests, even a basic form and a checklist is enough for most small businesses. Check whether your site respects Global Privacy Control if you have traffic from any of the twelve states requiring it.

FAQ

Do these laws apply if my business is small?

Usually yes. Most state laws apply based on how many residents’ data you process, not your company size or revenue, and thresholds have been dropping.

What if I only have a handful of customers in another state?

Check that state’s specific threshold. Some, like Indiana, only apply above 100,000 consumers. Others, like the newly lowered Connecticut threshold, catch businesses much smaller than that.

Getting started

Zavix Media manages CRM systems, including cleaning up the data mess that makes privacy requests harder than they need to be. Book a Free Call to check where your CRM actually stands.