The European Union's General Data Protection Regulation (GDPR), which applies to US businesses, went into effect in 2018. Since then, several US states have passed data protection laws. Some of those are already in effect, and others will go into effect within the next couple years. With so many privacy laws, you may be wondering, "Does my website need to comply with data privacy laws?"
Disclaimer: OptimWise does not provide legal counsel. You should seek necessary legal counsel for any legal issues related to your website(s), including, but not limited to, compliance with government laws and regulations and industry regulations.
Unfortunately, there isn't a quick and easy answer to the question of which data privacy laws your website must comply with. Different laws apply to different situations, based on factors such as the following:
If you offer goods or services to a US state or EU country (member state), even if you don't have an office in that state or country, then your business is considered to be doing business there. Some laws say that even if you're not earning money from those goods and services, you're still considered to be doing business. Because websites can generally be accessed from anyone in the world, it's important to keep this in mind.
The laws generally don't require as much from small businesses. For example, the GDPR has some exemptions for businesses with fewer than 250 employees, though much of the law still applies. The US state laws often have thresholds for revenue (such as $25 million) or number of consumers whose data you process (such as 100,000). But, don't assume that your business is too small to worry about these laws; in many cases, that isn't true.
Laws define the minimum you must do, but you're free to make your website more privacy-respecting than the laws require.
Rather than summarizing the many laws here, I'll provide links to 2 useful resources:
Unless you have a legal background, it's unlikely that you'll be able to read all the laws and determine how your business' website needs to comply. I highly recommend seeking legal counsel.
We can't help you determine how your website needs to comply with privacy laws, but once you know those items, we can help implement them. For example, maybe you need to show users a cookie notice, or include consent checkboxes on your forms, or use a privacy-respecting analytics solution. If you need such help, contact us.
