Quick answer
OptiTech's US Data Privacy framework is a single requirement catalog covering the common core of the state laws, with per-state applicability: you declare where you do business and what data you process, the platform determines which states' laws bind you (thresholds included), and one set of privacy controls maps to every applicable citation. When a new state law passes, it arrives as a delta against your existing controls, which is usually a short list.
Applicability scoping per state
State laws trigger on thresholds: revenue, number of consumer records, or share of revenue from data sales. The scoping assessment captures your figures and flags which laws currently apply and which you're approaching, so crossing a threshold is a planned event, not a discovered liability. The assessment re-runs when your scope data changes.
One rights process, many statutes
Consumer rights requests (access, deletion, correction, opt-out) run as one workflow with per-state deadline and verification rules applied automatically based on the requester's state. The request log doubles as compliance evidence, since several states require records of request handling. If you already run GDPR rights handling, it's the same machinery with different clocks, and the cross-mapping means your Article 30-style records feed the state-law data inventories too.
Controls that satisfy the common core
- Privacy notices under version control, with review triggers when processing changes.
- Processor contracts tracked in the supplier register with state-law clause coverage.
- Opt-out mechanics, including Global Privacy Control handling, verified as technical controls on your web properties.
- Risk assessments for profiling and sensitive data, maintained in the risk register where states require them.
Staying ready for the next law
The framework updates as legislatures act: new laws and amendments arrive as managed catalog updates with a highlighted delta. Your team reviews a diff, not a statute, and the program's structure (centralized controls, per-state mapping) is what makes "19+ laws and counting" a maintenance task instead of a recurring crisis.
Get a personalized walkthrough of automated compliance for your team. No commitment required.