Selling company data by state: what each state adds

Federal law and a company's own contracts decide most of a data license. A state adds its own layer: a privacy act where there is one, rules for recordings and biometrics, and duties after a breach. Pick a state to see what applies to a company's email, tickets, calls and files. The pages are general information, dated, and not legal advice.

• California: Covers employee and business contact data, and has a data broker register
• Florida: A privacy law that reaches only very large companies, plus a sale of sensitive data rule
• Georgia: No comprehensive law, a breach statute built on defined terms and one-party recording consent
• Illinois: A biometric privacy act with a ban on profiting from biometrics and private lawsuits
• Michigan: No comprehensive law, but a Social Security Number Privacy Act and a breach statute
• New York: No comprehensive law, a strong breach and safeguards law, and an employee monitoring notice
• North Carolina: No comprehensive law, a breach act with notice to the Attorney General
• Ohio: No comprehensive law, but a cybersecurity safe harbor that rewards a written program
• Pennsylvania: No comprehensive law, an all-party consent rule for recordings, and a breach act
• Texas: Leaves business and employee contexts outside, and has a data broker register

More states follow. For the federal rules and for other countries, see the rules by region.