Episode Details

Indiana, Kentucky, and Rhode Island privacy laws, effective January 1, 2026, apply to any startup crossing each law’s consumer threshold, regardless of office or employee location. None of the three statutes conditions coverage on a physical footprint inside the state. Each measures the number of that state’s residents whose personal data a company controls or processes, or the share of revenue the company earns from selling that data, once the company conducts business in the state or directs products and services to residents there. A founder in Austin who has never shipped a single order to Fort Wayne can still owe Indiana consumers a rights notice.

A founder in San Francisco read the news that three more states had turned on comprehensive privacy statutes on New Year’s Day and did what most founders do: checked whether the company had an office, a warehouse, or a single employee in Indiana, Kentucky, or Rhode Island, found none, and moved on. That founder is looking at the wrong variable. Indiana Code section 24-15-1-1, Kentucky Revised Statutes section 367.3613, and Rhode Island General Laws section 6-48.1-3 all ask the same question, and it is not where the company’s people sit.

Each statute applies to a person that “conducts business in” the state “or produces products or services that are targeted to residents of” the state, provided the company crosses a numeric floor during the calendar year. Indiana and Kentucky share the same two triggers: control or processing of personal data belonging to at least 100,000 residents of that state, or 25,000 residents combined with more than 50 percent of gross revenue earned from selling personal data. Rhode Island set its bar lower: 35,000 residents, or 10,000 residents combined with more than 20 percent of gross revenue from data sales. Every one of those thresholds counts residents, not addresses of the company that holds their data.

This is not an accident of drafting. It is the same sentence Virginia wrote into its 2021 Consumer Data Protection Act, the template every state privacy statute since has copied with minor numeric variations. Legislators in Richmond, and every legislature that followed them, wanted the law to reach the national platforms, retailers, and application developers whose products touch their residents through a phone screen, not merely the handful of businesses that keep a lease inside the state. A rule tied to physical presence would have exempted nearly every business a consumer actually interacts with online while doing nothing to protect the data that consumer hands over daily.

The practical consequence for a startup lands on the data inventory, not the org chart. Pull the customer records and count how many unique consumers in each state list an Indiana, Kentucky, or Rhode Island address, or how many of the company’s advertising dollars or data licensing revenue trace back to selling information about people in those states. A company with 40,000 United States customers spread evenly across fifty states will likely sit under all three thresholds without difficulty. A company running a national advertising business, a data brokerage line, or a concentrated customer base in the industrial Midwest can cross Rhode Island’s 10,000 resident, 20 percent revenue trigger while still looking, by every other measure, like a small company.

Rhode Island adds a wrinkle the other two states do not share. Its Data Transparency and Privacy Protection Act sits on top of an older commercial website disclosure statute that reaches any commercial website or internet service provider conducting business in Rhode Island, or serving Rhode Island customers, that collects and sells personally identifiable information, without regard to the 35,000 or 10,000 resident thresholds at all. A startup that actually stays under the newer act’s numeric floor can still owe a disclosure obligation under the older one if its website reaches Rhode Island c