Consential.io / State Privacy Detection

Jurisdiction Awareness

Consent that adapts to your visitor's state

HIPAA is the floor. On top of it, roughly twenty US states now have their own consumer privacy laws — each with its own opt-out expectations. Consential recognizes which state framework applies to each visitor and shows the matching consent notice, without you managing any of it.

~20US states with a comprehensive privacy law in effect
1consent layer that covers all of them
0extra scripts for your team to install
50states default to your HIPAA baseline, deny-by-default

Coverage

One map, one system, every state

States shaded in teal have their own consumer privacy law layered on top of HIPAA. Consential detects which one applies to each visitor and shows the right notice. Everywhere else, the same widget holds to your HIPAA baseline — non-essential tracking stays blocked until a visitor agrees.

Alaska Alabama Arkansas Arizona California — state privacy law in effect. Click to read the breakdown. Colorado — state privacy law in effect. Click to read the breakdown. Connecticut — state privacy law in effect. Click to read the breakdown. Washington, DC Delaware — state privacy law in effect. Click to read the breakdown. Florida — state privacy law in effect. Click to read the breakdown. Georgia Hawaii Iowa — state privacy law in effect. Click to read the breakdown. Idaho Illinois Indiana — state privacy law in effect. Click to read the breakdown. Kansas Kentucky — state privacy law in effect. Click to read the breakdown. Louisiana Massachusetts Maryland — state privacy law in effect. Click to read the breakdown. Maine Michigan Minnesota — state privacy law in effect. Click to read the breakdown. Missouri Mississippi Montana — state privacy law in effect. Click to read the breakdown. North Carolina North Dakota Nebraska — state privacy law in effect. Click to read the breakdown. New Hampshire — state privacy law in effect. Click to read the breakdown. New Jersey — state privacy law in effect. Click to read the breakdown. New Mexico Nevada New York Ohio Oklahoma Oregon — state privacy law in effect. Click to read the breakdown. Pennsylvania Rhode Island — state privacy law in effect. Click to read the breakdown. South Carolina South Dakota Tennessee — state privacy law in effect. Click to read the breakdown. Texas — state privacy law in effect. Click to read the breakdown. Utah — state privacy law in effect. Click to read the breakdown. Virginia — state privacy law in effect. Click to read the breakdown. Vermont Washington Wisconsin West Virginia Wyoming
State privacy law in effect HIPAA baseline · deny-by-default

The states with a comprehensive consumer privacy law today:

CaliforniaCCPA/CPRA ColoradoCPA ConnecticutCTDPA DelawareDPDPA FloridaFDBR IndianaINCDPA IowaICDPA KentuckyKCDPA MarylandMODPA MinnesotaMCDPA MontanaMCDPA NebraskaNDPA New HampshireNHDPA New JerseyNJDPA OregonOCPA Rhode IslandRIDTPPA TennesseeTIPA TexasTDPSA UtahUCPA VirginiaVCDPA

Each state links to a full breakdown — thresholds, whether the HIPAA exemption is entity-level or data-level, penalties, cure periods, and the official statute. Written for practice owners.

State privacy law is a moving target — new states pass laws and existing ones take effect on a rolling basis. Consential's coverage list is maintained centrally, so a practice never has to track it. Click any state to read its full breakdown.

Your jurisdiction

What your state requires — and what your neighbors do

A comprehensive privacy law applies where your practice does business. The eavesdropping statutes behind the current wave of tracking-pixel suits do not — they follow the visitor. Every state you border is a state your paid media already reaches.

Choose your state above on the map to read its full breakdown, or browse the twenty state guides listed there.

How it works

Detected, shown, and recorded — automatically

Four steps, none of which your front desk ever touches.

01

Detected server-side

Consential resolves the visitor's US state from the connection itself — never from anything the browser claims. A visitor can't spoof their jurisdiction to weaken the record.

02

The right notice

A visitor in a state with a specific requirement sees the notice that matches it — a California visitor, for example, sees the "Do Not Sell or Share" choice. Everyone else sees the standard banner.

03

Recorded on the trail

The detected jurisdiction is written onto the same append-only consent event as every other choice, so a later review shows which framework applied to each visitor.

04

Deny-by-default

Non-essential tracking stays blocked until a visitor agrees, in every state, regardless of detection. A missed or unknown state can only add a notice — never quietly reduce protection.

Example

What a California visitor sees

California's CCPA/CPRA is the most recognized state law, with its statutory "Do Not Sell or Share My Personal Information" opt-out. When Consential detects a California visitor, that choice appears in the banner automatically — wired to deny all non-essential tracking. A visitor in a state without that requirement sees the standard banner instead.

Consent banner · California

Your Privacy Choices

We use cookies and similar technologies to run this site and, only with your permission, for analytics and marketing.

California residents may opt out of the sale or sharing of personal information. Do Not Sell or Share My Personal Information

Reject AllAccept All

Honest about the legal layer

Consential builds and operates the detection — the engine that reads the state and applies the right notice. The specific legal wording for each state is reviewed by healthcare counsel before it goes live for your practice, the same way our own policy documents are. Consential is compliance infrastructure; it is not a law firm, does not provide legal advice, and using it does not by itself guarantee compliance with any state or federal regulation. We pair the tooling with your counsel, not in place of it.

The guides

Twenty states, written out for practice owners

These are the states with a comprehensive consumer privacy law on the books. Each guide covers whether it reaches your practice, what the HIPAA carve-out does and does not exempt, what enforcement has actually cost, and what to do about your website. The other thirty-one states have no comprehensive law — your HIPAA baseline and the deny-by-default gate still apply there, and so do that state’s eavesdropping statutes, which follow the visitor rather than the practice.

See it on your site

State detection is part of the same widget that already gates your tracking scripts — there's nothing extra to install. We'll show you what fires on your site today, and what a state-aware consent layer changes.

Scan Your Site Free