Does this state's privacy law cover you in 2026?

A US SaaS company that holds personal data on 40,000 Connecticut residents is covered by the Connecticut Data Privacy Act as of today, has zero days of cure period left, and carries a $37,500,000 statutory maximum if one failure touches 5,000 records. Six months ago, on the same numbers, the tool returns NOT COVERED. Nothing about the company changed. Connecticut changed.

SB 1295 took effect on 2026-07-01 and lowered the Connecticut threshold from 100,000 consumers to 35,000, and removed the consumer count entirely from the sale prong: if you sell personal data, the count no longer protects you. Run the same numbers with an as-of date of 2026-06-30 and the verdict flips to NOT COVERED, because on that morning the statute still asked for 100,000. That is the whole problem with the US state privacy patchwork in 2026. The answer is not wrong or right in general. It is wrong or right on a date.

Connecticut is not the only one that moved this year. Montana now starts at 25,000 consumers, or 15,000 consumers if a quarter of gross revenue comes from selling personal data, and its right to cure ended on 2026-04-01. Oregon's cure period ended 2026-01-01, Minnesota's on 2026-01-31, New Jersey's on 2026-07-15. Indiana, Kentucky and Rhode Island switched on together on 2026-01-01, and Rhode Island surprises people: 35,000 residents, or 10,000 with 20% of revenue from data sales, and no cure period written into the law at all.

This is exactly the shape of question a chatbot answers confidently and wrongly. The training data is full of 2023 and 2024 summaries saying 100,000 consumers, 60-day cure, $7,500 everywhere. Today Colorado's maximum is $20,000 per violation, Rhode Island, New Hampshire, Maryland and New Jersey sit at $10,000, and the rest are at $7,500. A free comparison chart cannot do the arithmetic either, because the arithmetic needs your numbers: your resident count in that state, your share of revenue from data sales, whether you clear Utah's and Tennessee's $25M prong, and the date you are asking about.

So the extension asks for exactly those seven inputs and returns seven outputs: the scope verdict, the prong that caught you, the law and its effective date, the state of the right to cure, the days left on it, the statutory maximum civil penalty, and the maximum exposure for the record count you typed. Three worked examples from the same build: Connecticut with 40,000 consumers and 0% sale revenue returns COVERED, cure gone since 2025-01-01, $7,500 per violation, $37,500,000 against 5,000 records. Montana with 18,000 consumers and 30% sale revenue returns COVERED through the sale prong alone, cure gone since 2026-04-01, $9,000,000 against 1,200 records. Kentucky with 60,000 consumers and 10% sale revenue returns NOT COVERED, with the prong named and the exposure line at $0 - which is the answer a privacy owner needs in writing just as often.

All nineteen state laws, every prong, the cure countdown, the penalty and the exposure figure are free, in the popup and in the browser page, with no key, no cap and no watermark. The $60 licence sits on a different axis: it exports the whole 19-state verdict for your numbers to a .csv you keep, and sets alarms ahead of cure-period sunsets. Nothing you type leaves the browser; the only outbound call is the licence-key check.

One limit: these are statutory maximums, and whether each affected record counts as a separate violation is contested. The number is the ceiling you put in a risk register with a source next to it, not a prediction of an enforcement action. Dates checked 2026-09-17.