[sheet: Cover]

[sheet: Cover]
Field | Value
Document Title | Multi-State Privacy Law Applicability Matrix
Client | Cascade Retail Holdings Inc. (Nasdaq: CSRD)
Client EIN | 84-3192057
Client Address | 4100 Elliott Avenue West, Suite 1200, Seattle, WA 98119
Prepared By | Sara Hendricks, Associate, Privacy & Data Security; Alan Burke, Senior Associate, Privacy & Data Security
Law Firm | Calderwood & Harkness LLP, 600 Lexington Avenue, 28th Floor, New York, NY 10022
Reviewed By | Kevin Ostrowski, Partner, Privacy & Data Security
Matter Number | 1038-00010
Date | June 30, 2025
Status | PRIVILEGED & CONFIDENTIAL — Attorney Work Product
Purpose | Map each of the 19 applicable US state comprehensive privacy statutes against Cascade's operations, data-processing profile, and compliance obligations to support the gap-analysis phase of the privacy compliance program engagement
Key Cascade Operational Data Points | 186 retail locations in 31 US states; ~41.2 million Cascade Rewards loyalty members across all 50 states; ~94 million annual online e-commerce transactions (FY2024); ~22,500 employees; FY2024 revenue $3.87 billion; ~3,800 third-party marketplace sellers (Cascade Digital Marketplace LLC); Peakview Analytics Inc. processes ~2.1 billion consumer-event data records/month; 47 third-party advertising/analytics partners (per Fieldhaven Consulting Group LLC data-mapping report dated May 19, 2025); 12 categories of cookies/tracking technologies on cascade.com
Subsidiaries in Scope | Cascade Digital Marketplace LLC (EIN 85-4107638); Ridgeline Fulfillment Services Inc. (EIN 91-1647823); Peakview Analytics Inc. (EIN 87-2250194); Cascade Rewards Corp. (EIN 86-3381729)
Data Source — Data Mapping | Fieldhaven Consulting Group LLC data-mapping report dated May 19, 2025 (Marcus Ellerby, Engagement Lead)
Related Engagement Milestone | Gap-Analysis Report delivery target: August 15, 2025
[sheet: Applicability Matrix]
Row # | State | Statute Name | Statute abbreviation | Citation | Effective Date | Applicability Threshold — Revenue | Applicability Threshold — Consumer Records | Applicability Threshold — Other | Cascade Meets Threshold? | Cascade Threshold Analysis Notes | Consumer Rights — Right to Know/Access | Consumer Rights — Right to Delete | Consumer Rights — Right to Correct | Consumer Rights — Right to Data Portability | Consumer Rights — Right to Opt Out of Sale | Consumer Rights — Right to Opt Out of Targeted Advertising | Consumer Rights — Right to Opt Out of Profiling | Consumer Rights — Right to Limit Use of Sensitive PI | Consumer Rights — Right to Appeal | Consumer Rights — Other / Notes | Opt-Out Requirements — Do Not Sell Link | Opt-Out Requirements — Universal Opt-Out Mechanism / GPC | Opt-Out Requirements — Opt-Out Preference Signal Details | Sensitive Data Provisions — Definition of Sensitive Data | Sensitive Data Provisions — Consent Model | Sensitive Data Provisions — Cascade Implication Notes | Data Processing Agreement Mandate — Controller-Processor Contract Required | Data Processing Agreement Mandate — Required Contract Terms Summary | Private Right of Action | Private Right of Action — Scope / Notes | Enforcement Authority | Cure Period | Data Protection Assessment Required | Children / Minor-Specific Provisions | Cascade-Specific Applicability Determination | Cascade Applicability Rationale | Cascade Retail Presence in State | Cascade Loyalty Members in State | Priority Level
1 | California | California Consumer Privacy Act / California Privacy Rights Act | CCPA/CPRA | Cal. Civ. Code §§ 1798.100–1798.199.100 | 2020-01-01 (CCPA); 2023-01-01 (CPRA amendments) | Annual gross revenue > $25 million | Buy, sell, or share PI of ≥ 100,000 consumers or households | Derive ≥ 50% of revenue from selling/sharing PI | Yes | Cascade FY2024 revenue $3.87B far exceeds $25M threshold; ~41.2M loyalty members; ~94M annual online transactions. All three thresholds met independently. | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | No (no general appeal right; AG enforcement process) | Right to know categories and specific pieces; right to opt out of sale and sharing; financial incentive notice required (Cascade Rewards); annual DSR metrics disclosure required (FY2024: ~38,400 DSRs — access ~12,800, deletion ~19,100, opt-out ~6,500) | Yes | Required | Must honor Global Privacy Control (GPC) signals; currently NOT honored by Cascade — identified gap | Precise geolocation; financial data; SSN; racial/ethnic origin; religious beliefs; health data; sex life/orientation; genetic/biometric data; account login credentials with password/security questions; mail/email/text message contents; children's PI | Opt-In (right to limit use/disclosure of sensitive PI; separate consent required for processing sensitive PI beyond specified purposes) | Cascade collects precise geolocation via mobile app and payment-card data — both qualify as sensitive PI. No separate opt-in consent currently obtained. Gap identified. | Yes | Service provider and contractor agreements must include: limitations on use/retention/disclosure; compliance assistance; sub-processor requirements; certification of understanding. 23 of 47 ad/analytics partners lack DPAs — gap identified. | Limited | Private right of action limited to data breaches involving unencrypted/unredacted PI due to failure to maintain reasonable security (§ 1798.150). No general private right of action for other CCPA violations. | California Attorney General; California Privacy Protection Agency (CPPA) | None (CPRA eliminated 30-day cure period for CPPA enforcement; AG retains discretion) | Yes (risk assessments for processing presenting significant risk) | Opt-in consent required for sale/sharing of PI of consumers < 16 (parental consent for < 13); California AADC imposes additional requirements for users < 18 | Applicable | Cascade operates retail locations in CA; ships to all CA addresses; ~41.2M loyalty members include substantial CA population; Peakview processes ~2.1B data events/month including CA consumers. CA AG inquiry (Feb 6, 2024) highlighted existing deficiencies in sale/sharing disclosures. | Yes — 14 locations | Estimated 5–7 million | High
2 | Virginia | Virginia Consumer Data Protection Act | VCDPA | Va. Code Ann. §§ 59.1-575 – 59.1-585 | 2023-01-01 | N/A (no revenue threshold) | Control or process PI of ≥ 100,000 VA consumers; OR control/process PI of ≥ 25,000 VA consumers and derive > 50% gross revenue from sale of PI | See consumer-records threshold | Yes | Cascade's loyalty program and e-commerce operations easily exceed 100,000 VA consumer records given ~41.2M total loyalty members and nationwide e-commerce shipping. | Yes | Yes | Yes | Yes | Yes | Yes | Yes | No (VCDPA does not include right to limit sensitive PI; uses opt-in consent model) | Yes | Appeal process required — consumers must be able to appeal a refusal to act on a rights request; controller must respond within 60 days of appeal. Currently NOT implemented by Cascade — gap identified. | No (no specific 'Do Not Sell' link mandate; opt-out of sale and targeted advertising required) | Recognized (not expressly mandated but recommended) | VCDPA requires clear mechanism to opt out of sale, targeted advertising, and profiling | Racial/ethnic origin; religious beliefs; mental/physical health; sexual orientation; citizenship/immigration status; genetic/biometric data; PI from known child; precise geolocation | Opt-In | Cascade's precise geolocation collection from mobile app triggers opt-in consent requirement. Gap identified. | Yes | Processor contracts must include: instructions for processing; nature/purpose; type of data; duration; rights/obligations; duty of confidentiality; deletion/return; audit/inspection rights; sub-processor flow-down | No | No private right of action | Virginia Attorney General (exclusive enforcement authority) | 30-day cure period | Yes (data protection assessments for targeted advertising, sale of PI, profiling, sensitive data, heightened risk) | Opt-in consent for PI of known children under 13 (aligned with COPPA); additional protections under consideration | Applicable | Cascade operates retail locations in VA; ships e-commerce to VA; significant VA loyalty-member population. | Yes — 8 locations | Estimated 1–2 million | High
3 | Colorado | Colorado Privacy Act | CPA | Colo. Rev. Stat. §§ 6-1-1301 – 6-1-1313 | 2023-07-01 | N/A | Control or process PI of ≥ 100,000 CO consumers/year; OR control/process PI of ≥ 25,000 CO consumers and derive revenue/receive discount from sale of PI | See consumer-records threshold | Yes | Cascade meets 100,000 consumer threshold given nationwide loyalty program and e-commerce operations. | Yes | Yes | Yes | Yes | Yes | Yes | Yes | No | Yes | Appeal right required; must provide mechanism and respond within 45 days. Currently NOT implemented — gap identified. | No | Required | Must recognize universal opt-out mechanisms including GPC per CPA rules. Not currently honored by Cascade — gap. | Racial/ethnic origin; religious beliefs; mental/physical health; sexual orientation; citizenship/immigration status; genetic/biometric data; PI from known child | Opt-In | Precise geolocation from Cascade mobile app triggers opt-in requirement. | Yes | Similar to VCDPA processor contract requirements; must include purpose limitation, confidentiality, deletion/return, audit, sub-processor flow-down | No | No private right of action | Colorado Attorney General; District Attorneys | 60-day cure period (sunset January 1, 2025 — no cure period after that date) | Yes | Opt-in consent for known children under 13; additional protections for 13–17 | Applicable | Cascade has retail locations in CO; ships to CO; substantial loyalty-member base in CO. | Yes — 6 locations | Estimated 500K–1 million | High
4 | Connecticut | Connecticut Data Privacy Act | CTDPA | Conn. Gen. Stat. §§ 42-515 – 42-525 | 2023-07-01 | N/A | Control or process PI of ≥ 100,000 CT consumers; OR control/process PI of ≥ 25,000 CT consumers and derive > 25% gross revenue from sale of PI | See consumer-records threshold | Yes | Cascade exceeds 100,000 CT consumer threshold through loyalty members and e-commerce orders shipped to CT. | Yes | Yes | Yes | Yes | Yes | Yes | Yes | No (opt-in model for sensitive PI) | Yes | Appeal right required; must inform consumers of appeal mechanism and respond within 60 days. NOT implemented — gap identified. | No | Required (effective January 1, 2025) | Must recognize universal opt-out mechanisms; Cascade not currently honoring GPC — gap. | Racial/ethnic origin; religious beliefs; mental/physical health; sexual orientation; citizenship/immigration status; genetic/biometric data; PI from known child; precise geolocation | Opt-In | Precise geolocation collected via Cascade mobile app requires opt-in consent. Gap identified. | Yes | Processor contracts required with standard provisions: purpose limitation, confidentiality, deletion/return, audit, sub-processor flow-down | No | No private right of action | Connecticut Attorney General | 60-day cure period (sunset December 31, 2024 — no cure period after that date) | Yes | Opt-in consent required for processing PI of known children under 13; CTDPA amended to add protections for minors 13–17 | Applicable | Cascade has retail locations in CT; ships e-commerce to CT; CT loyalty-member base exceeds threshold. | Yes — 5 locations | Estimated 400K–700K | High
5 | Utah | Utah Consumer Privacy Act | UCPA | Utah Code Ann. §§ 13-61-101 – 13-61-404 | 2023-12-31 | Annual gross revenue ≥ $25 million | Control or process PI of ≥ 100,000 UT consumers; OR control/process PI of ≥ 25,000 UT consumers and derive > 50% gross revenue from sale of PI | Must also meet revenue threshold | Yes | Cascade FY2024 revenue $3.87B exceeds $25M; exceeds 100,000 UT consumer records through loyalty program and e-commerce. | Yes | Yes | No | Yes | Yes | Yes | No | No | No | Most business-friendly state privacy law; narrower consumer rights; no right to correct, no right to appeal, no right to opt out of profiling. | No | Silent | No specific universal opt-out mechanism requirement; standard opt-out of sale and targeted advertising required | Racial/ethnic origin; religious beliefs; sexual orientation; citizenship/immigration status; genetic/biometric data; PI from known child; precise geolocation; health data | Opt-Out (unique — consumers can opt out of sensitive PI processing rather than opt-in required) | Utah's opt-out model for sensitive PI is less restrictive; Cascade's current practices may be closer to compliance but still require documented opt-out mechanism. | Yes | Processor contracts required with similar provisions to VCDPA model | No | No private right of action | Utah Attorney General (exclusive; Division of Consumer Protection investigates) | 30-day cure period (no sunset) | No | Opt-in consent for known children under 13 (COPPA alignment) | Applicable | Cascade has retail locations in UT; ships to UT; UT loyalty members exceed threshold. | Yes — 4 locations | Estimated 300K–500K | Medium
6 | Iowa | Iowa Consumer Data Protection Act | ICDPA | Iowa Code ch. 715D | 2025-01-01 | N/A | Control or process PI of ≥ 100,000 IA consumers; OR control/process PI of ≥ 25,000 IA consumers and derive > 50% gross revenue from sale of PI | See consumer-records threshold | Yes | Cascade exceeds 100,000 IA consumer threshold through loyalty members and e-commerce operations. | Yes | Yes | No | Yes | No | No | No | No | No | Narrowest consumer rights among state privacy laws; no right to correct, no opt-out of sale/targeted advertising/profiling as separate rights; only access, delete, portability, and opt-out of sale of PI. | No | Silent | No universal opt-out mechanism requirement | Racial/ethnic origin; religious beliefs; mental/physical health; sexual orientation; citizenship/immigration status; genetic/biometric data; PI from known child | Opt-In | Precise geolocation not explicitly listed as sensitive under ICDPA; biometric and known-child data require opt-in consent. | Yes | Processor contracts required with standard provisions | No | No private right of action | Iowa Attorney General | 90-day cure period (no sunset) | No | Opt-in consent for known children under 13 | Applicable | Cascade has retail locations in IA; ships to IA; loyalty-member base in IA exceeds threshold. | Yes — 3 locations | Estimated 200K–400K | Medium
7 | Indiana | Indiana Consumer Data Protection Act | INCDPA | Ind. Code §§ 24-15-1 – 24-15-16 | 2026-01-01 | N/A | Control or process PI of ≥ 100,000 IN consumers; OR control/process PI of ≥ 25,000 IN consumers and derive > 50% gross revenue from sale of PI | See consumer-records threshold | Yes | Cascade exceeds 100,000 IN consumer threshold; significant retail and e-commerce presence in IN. | Yes | Yes | Yes | Yes | Yes | Yes | Yes | No (opt-in model for sensitive PI) | Yes | Appeal right required; response within 60 days. Pre-effective — Cascade has time to implement. | No | Recognized | Expected to recognize universal opt-out mechanisms; Cascade should plan for GPC compliance by effective date. | Racial/ethnic origin; religious beliefs; mental/physical health; sexual orientation; citizenship/immigration status; genetic/biometric data; PI from known child; precise geolocation | Opt-In | Precise geolocation from mobile app will require opt-in consent by effective date. | Yes | Processor contracts required with standard provisions: purpose limitation, confidentiality, deletion/return, audit, sub-processor flow-down | No | No private right of action | Indiana Attorney General | 30-day cure period | Yes | Opt-in consent for known children under 13; additional protections for 13–17 under consideration | Applicable | Cascade has retail locations in IN; ships to IN; IN loyalty-member base exceeds threshold. Not yet effective — included for planning. | Yes — 5 locations | Estimated 500K–800K | Medium
8 | Tennessee | Tennessee Information Protection Act | TIPA | Tenn. Code Ann. §§ 47-18-3201 – 47-18-3213 | 2025-07-01 | Revenue > $25 million | Control or process PI of ≥ 25,000 consumers and derive > 50% gross revenue from sale of PI; OR control or process PI of ≥ 175,000 consumers | Must meet both revenue threshold and one consumer-records threshold | Yes | Cascade FY2024 revenue $3.87B exceeds $25M; exceeds 175,000 TN consumer records through loyalty and e-commerce. | Yes | Yes | Yes | Yes | Yes | Yes | Yes | No (opt-in model) | Yes | Appeal right required; affirmative defense available for entities maintaining and complying with written privacy program conforming to NIST Privacy Framework. | No | Recognized | TIPA recognizes universal opt-out mechanisms; Cascade must implement by effective date. | Racial/ethnic origin; religious beliefs; mental/physical health; sexual orientation; citizenship/immigration status; genetic/biometric data; PI from known child; precise geolocation | Opt-In | Precise geolocation from mobile app requires opt-in. NIST Privacy Framework alignment could provide affirmative defense. | Yes | Processor contracts required with standard provisions | No | No private right of action; affirmative defense for NIST-compliant privacy programs | Tennessee Attorney General | 60-day cure period (no sunset) | Yes | Opt-in consent for known children under 13 | Applicable | Cascade has retail locations in TN; ships to TN; TN loyalty-member base exceeds threshold. Effective July 1, 2025 — imminent compliance required. | Yes — 6 locations | Estimated 600K–1 million | High
9 | Montana | Montana Consumer Data Privacy Act | MCDPA | Mont. Code Ann. §§ 30-14-2801 – 30-14-2817 | 2024-10-01 | N/A | Control or process PI of ≥ 50,000 MT consumers (lower threshold due to small state population); OR control/process PI of ≥ 25,000 MT consumers and derive > 25% gross revenue from sale of PI | See consumer-records threshold | Yes | Cascade likely exceeds 50,000 MT consumer records through loyalty program and e-commerce; lower threshold relative to MT population (~1.1M). | Yes | Yes | Yes | Yes | Yes | Yes | Yes | No (opt-in model) | Yes | Appeal right required; must provide mechanism and respond within 60 days. | No | Required | Must recognize universal opt-out mechanisms including GPC. Not currently honored by Cascade — gap. | Racial/ethnic origin; religious beliefs; mental/physical health; sexual orientation; citizenship/immigration status; genetic/biometric data; PI from known child; precise geolocation | Opt-In | Precise geolocation from mobile app requires opt-in consent. | Yes | Processor contracts required with standard provisions | No | No private right of action | Montana Attorney General | 60-day cure period (no sunset) | Yes | Opt-in consent for known children under 13 | Applicable | Cascade has limited retail presence in MT; ships e-commerce to MT; loyalty members in MT likely exceed threshold given lower 50,000 threshold. | Yes — 1 location | Estimated 50K–150K | Medium
10 | Texas | Texas Data Privacy and Security Act | TDPSA | Tex. Bus. & Com. Code ch. 541 | 2024-07-01 | N/A (no revenue threshold; however, small business exception per SBA standards) | No minimum consumer threshold — applies to any person conducting business in TX that processes PI and is not a small business under SBA definition | Small business exception (SBA definition); Cascade not a small business | Yes | Cascade is not a small business (FY2024 revenue $3.87B; ~22,500 employees); conducts business in TX; processes PI of TX consumers. Broadest applicability threshold of any state. | Yes | Yes | Yes | Yes | Yes | Yes | Yes | No (opt-in model) | Yes | Appeal right required; must provide mechanism. TDPSA has broadest applicability of any state privacy law — no consumer-record minimum. | No | Required | Must recognize universal opt-out mechanisms including GPC per TDPSA. Not currently honored — gap. | Racial/ethnic origin; religious beliefs; mental/physical health; sexual orientation; citizenship/immigration status; genetic/biometric data; PI from known child; precise geolocation | Opt-In | Precise geolocation from mobile app requires opt-in consent. TX high-volume retail state — significant consumer exposure. | Yes | Processor contracts required; must include purpose limitation, confidentiality, deletion/return, audit, sub-processor flow-down | No | No private right of action | Texas Attorney General | 30-day cure period | Yes | Opt-in consent for known children under 13; additional protections for 13–17 | Applicable | Cascade has significant retail presence in TX; major e-commerce shipping volume; large TX loyalty-member base. No minimum threshold — immediate applicability. | Yes — 18 locations | Estimated 3–5 million | High
11 | Oregon | Oregon Consumer Privacy Act | OCPA | Or. Rev. Stat. §§ 646A.570 – 646A.604 | 2024-07-01 | N/A | Control or process PI of ≥ 100,000 OR consumers; OR control/process PI of ≥ 25,000 OR consumers and derive > 25% gross revenue from sale of PI | See consumer-records threshold | Yes | Cascade exceeds 100,000 OR consumer threshold through loyalty program and e-commerce; Pacific Northwest retail hub. | Yes | Yes | Yes | Yes | Yes | Yes | Yes | No (opt-in model) | Yes | Appeal right required. OCPA notably includes nonprofit organizations (unlike most other states). Broader definition of 'derived data.' | No | Recognized | OCPA recognizes universal opt-out mechanisms; implementation recommended. | Racial/ethnic origin; religious beliefs; mental/physical health; sexual orientation; citizenship/immigration status; genetic/biometric data; PI from known child; precise geolocation; transgender/nonbinary status (unique to OR) | Opt-In | Precise geolocation from mobile app requires opt-in. OR unique inclusion of transgender/nonbinary status as sensitive — Cascade does not collect this category but should note in privacy policy. | Yes | Processor contracts required with standard provisions; OCPA requires processors to assist controllers with DPAs | No | No private right of action | Oregon Attorney General | 30-day cure period (sunset January 1, 2026) | Yes | Opt-in consent for known children under 13; additional protections for 13–15 | Applicable | Cascade has significant retail presence in OR as part of Pacific Northwest operations; major loyalty-member base in OR. | Yes — 9 locations | Estimated 400K–700K | High
12 | Delaware | Delaware Personal Data Privacy Act | DPDPA | Del. Code Ann. tit. 6, ch. 12C | 2025-01-01 | N/A | Control or process PI of ≥ 35,000 DE consumers (lower threshold); OR control/process PI of ≥ 10,000 DE consumers and derive > 20% gross revenue from sale of PI | Lower thresholds reflect small state population | Yes | Cascade is incorporated in DE; exceeds 35,000 DE consumer threshold through loyalty and e-commerce. Low threshold easily met. | Yes | Yes | Yes | Yes | Yes | Yes | Yes | No (opt-in model) | Yes | Appeal right required; response within 60 days. Notable for lowest consumer-record thresholds. DE is Cascade's state of incorporation. | No | Recognized | Recognizes universal opt-out mechanisms; Cascade not currently honoring — gap. | Racial/ethnic origin; religious beliefs; mental/physical health; sexual orientation; citizenship/immigration status; genetic/biometric data; PI from known child; precise geolocation | Opt-In | Precise geolocation from mobile app requires opt-in consent. | Yes | Processor contracts required with standard provisions | No | No private right of action | Delaware Attorney General (Department of Justice) | 60-day cure period (sunset December 31, 2025) | Yes | Opt-in consent for known children under 13; additional protections for 13–17; DPDPA has specific minor-data provisions | Applicable | Cascade incorporated in DE; retail location present; ships to DE; DE loyalty members exceed low threshold. | Yes — 2 locations (state of incorporation) | Estimated 50K–100K | High
13 | New Jersey | New Jersey Data Privacy Act | NJDPA | N.J. Stat. Ann. §§ 56:8-166 – 56:8-188 | 2025-01-15 | N/A | Control or process PI of ≥ 100,000 NJ consumers; OR control/process PI of ≥ 25,000 NJ consumers and derive revenue from sale of PI | See consumer-records threshold | Yes | Cascade exceeds 100,000 NJ consumer threshold; significant mid-Atlantic retail and e-commerce presence. | Yes | Yes | Yes | Yes | Yes | Yes | Yes | No (opt-in model) | Yes | Appeal right required; response within 45 days. NJDPA has broader definition of financial data as sensitive PI. | No | Required | Must recognize universal opt-out mechanisms including GPC. Not currently honored — gap. | Racial/ethnic origin; religious beliefs; mental/physical health; sexual orientation; citizenship/immigration status; genetic/biometric data; PI from known child; precise geolocation; financial data (broader than most states) | Opt-In | Precise geolocation and financial data classified as sensitive; Cascade's payment-card processing and mobile app both trigger opt-in requirements. Significant gap. | Yes | Processor contracts required with standard provisions; enhanced requirements for financial data processing | No | No private right of action | New Jersey Attorney General (Division of Consumer Affairs) | 30-day cure period (sunset July 15, 2026) | Yes | Opt-in consent for known children under 13; enhanced protections for minors 13–17; online services directed to minors must conduct DPIAs | Applicable | Cascade has retail locations in NJ; ships to NJ; NJ loyalty-member base exceeds threshold. Financial data sensitivity provision is notable risk. | Yes — 7 locations | Estimated 1–2 million | High
14 | New Hampshire | New Hampshire Data Privacy Act | NHDPA | N.H. Rev. Stat. Ann. §§ 507-H:1 – 507-H:17 | 2025-01-01 | N/A | Control or process PI of ≥ 35,000 NH consumers; OR control/process PI of ≥ 10,000 NH consumers and derive > 25% gross revenue from sale of PI | Lower thresholds reflect small state population | Yes | Cascade likely exceeds 35,000 NH consumer records through loyalty program and e-commerce; lower threshold facilitates applicability. | Yes | Yes | Yes | Yes | Yes | Yes | Yes | No (opt-in model) | Yes | Appeal right required; response within 60 days. | No | Recognized | Recognizes universal opt-out mechanisms. | Racial/ethnic origin; religious beliefs; mental/physical health; sexual orientation; citizenship/immigration status; genetic/biometric data; PI from known child; precise geolocation | Opt-In | Precise geolocation from mobile app requires opt-in consent. | Yes | Processor contracts required with standard provisions | No | No private right of action | New Hampshire Attorney General | 60-day cure period | Yes | Opt-in consent for known children under 13 | Applicable | Cascade ships to NH; loyalty-member base in NH likely exceeds low threshold; limited retail presence under review. | Check — 1 location (under review) | Estimated 50K–100K | Medium
15 | Nebraska | Nebraska Data Privacy Act | NDPA | Neb. Rev. Stat. §§ 87-1101 – 87-1116 | 2025-01-01 | N/A | No minimum threshold — applies to any entity that conducts business in NE or produces products/services targeting NE consumers and processes or engages in sale of PI; small business exception | Small business exception (SBA standards); Cascade not a small business | Yes | Cascade is not a small business; conducts business in NE (retail locations); processes PI of NE consumers. Similar to TX in having no minimum consumer threshold. | Yes | Yes | Yes | Yes | Yes | Yes | Yes | No (opt-in model) | Yes | Appeal right required. No minimum threshold similar to TDPSA — broadly applicable. | No | Recognized | Recognizes universal opt-out mechanisms. | Racial/ethnic origin; religious beliefs; mental/physical health; sexual orientation; citizenship/immigration status; genetic/biometric data; PI from known child; precise geolocation | Opt-In | Precise geolocation from mobile app requires opt-in consent. | Yes | Processor contracts required with standard provisions | No | No private right of action | Nebraska Attorney General | 30-day cure period | Yes | Opt-in consent for known children under 13 | Applicable | Cascade has retail presence in NE; no minimum threshold — immediate applicability. | Yes — 2 locations | Estimated 100K–200K | Medium
16 | Minnesota | Minnesota Consumer Data Privacy Act | MN CDPA | Minn. Stat. ch. 325O | 2025-07-31 | N/A | Control or process PI of ≥ 100,000 MN consumers; OR control/process PI of ≥ 25,000 MN consumers and derive > 25% gross revenue from sale of PI | See consumer-records threshold | Yes | Cascade exceeds 100,000 MN consumer threshold through loyalty program and e-commerce. | Yes | Yes | Yes | Yes | Yes | Yes | Yes | No (opt-in model) | Yes | Appeal right required. MN CDPA includes unique data-inventory requirement and broader definition of profiling. Effective July 31, 2025 — imminent. | No | Required | Must recognize universal opt-out mechanisms including GPC. Not currently honored — gap. | Racial/ethnic origin; religious beliefs; mental/physical health; sexual orientation; citizenship/immigration status; genetic/biometric data; PI from known child; precise geolocation | Opt-In | Precise geolocation from mobile app requires opt-in consent. MN data-inventory requirement adds compliance obligation for Cascade. | Yes | Processor contracts required with enhanced provisions including data-inventory obligations | No | No private right of action | Minnesota Attorney General | 30-day cure period | Yes | Opt-in consent for known children under 13; enhanced protections for minors 13–17 | Applicable | Cascade has retail locations in MN; ships to MN; significant MN loyalty-member base. Effective July 31, 2025 — imminent compliance required. | Yes — 5 locations | Estimated 500K–800K | High
17 | Maryland | Maryland Online Data Privacy Act | MODPA | Md. Code Ann., Com. Law §§ 14-4601 – 14-4616 | 2025-10-01 | N/A | Control or process PI of ≥ 35,000 MD consumers; OR control/process PI of ≥ 10,000 MD consumers and derive > 20% gross revenue from sale of PI | Lower thresholds; MODPA is considered one of most restrictive state privacy laws | Yes | Cascade exceeds 35,000 MD consumer threshold; significant mid-Atlantic retail and e-commerce presence. | Yes | Yes | Yes | Yes | Yes | Yes | Yes | No (opt-in model) | Yes | Appeal right required. MODPA imposes data-minimization requirement (unique — most states do not). Prohibits sale of sensitive data entirely (not just opt-in). Most restrictive state privacy statute. | No | Required | Must recognize universal opt-out mechanisms. Not currently honored — gap. | Racial/ethnic origin; religious beliefs; mental/physical health; sexual orientation; citizenship/immigration status; genetic/biometric data; PI from known child; precise geolocation; financial data | Opt-In (and sale of sensitive PI prohibited entirely) | MODPA prohibits sale of sensitive PI — most restrictive. Cascade's data-sharing arrangements with ad partners involving precise geolocation or financial data may violate this prohibition. Critical gap. | Yes | Processor contracts required with enhanced provisions; must demonstrate data minimization | No | No private right of action | Maryland Attorney General (Division of Consumer Protection) | 60-day cure period (sunset April 1, 2027) | Yes | Opt-in consent for known children under 13; enhanced protections for minors 13–17; age-estimation measures may be required | Applicable | Cascade has retail locations in MD; ships to MD; MD loyalty-member base exceeds low threshold. MODPA's data-minimization and sensitive-PI-sale prohibition require significant operational changes. | Yes — 6 locations | Estimated 800K–1.5 million | High
18 | Kentucky | Kentucky Consumer Data Protection Act | KYDPA | Ky. Rev. Stat. Ann. §§ 367.500 – 367.530 | 2026-01-01 | N/A | Control or process PI of ≥ 100,000 KY consumers; OR control/process PI of ≥ 25,000 KY consumers and derive > 50% gross revenue from sale of PI | See consumer-records threshold | Yes | Cascade exceeds 100,000 KY consumer threshold through loyalty program and e-commerce. | Yes | Yes | Yes | Yes | Yes | Yes | Yes | No (opt-in model) | Yes | Appeal right required; response within 60 days. Pre-effective — Cascade has time to plan. | No | Recognized | Expected to recognize universal opt-out mechanisms. | Racial/ethnic origin; religious beliefs; mental/physical health; sexual orientation; citizenship/immigration status; genetic/biometric data; PI from known child; precise geolocation | Opt-In | Precise geolocation from mobile app will require opt-in consent by effective date. | Yes | Processor contracts required with standard provisions | No | No private right of action | Kentucky Attorney General | 30-day cure period (no sunset currently specified) | Yes | Opt-in consent for known children under 13 | Applicable | Cascade has retail locations in KY; ships to KY; KY loyalty-member base exceeds threshold. Not yet effective — included for planning. | Yes — 4 locations | Estimated 300K–500K | Medium
19 | Additional / Emerging | Other state statutes enacted or effective through 2025–2026 (e.g., Rhode Island, Wisconsin, Vermont, Pennsylvania pending) | Various | Various | Various (2025–2027 projected) | Varies | Varies | Varies | Under Review | Cascade monitors emerging state privacy legislation through Calderwood & Harkness legislative tracking service. Rhode Island enacted privacy law effective Jan 1, 2026. Multiple other states have pending bills. | Varies | Varies | Varies | Varies | Varies | Varies | Varies | Varies | Varies | Monitor for additional compliance obligations. Rhode Island Data Transparency and Privacy Protection Act likely applicable to Cascade. | Varies | Varies | Monitor for GPC/universal opt-out requirements | Varies — generally following VCDPA model | Varies | Cascade should plan for broader sensitive PI consent requirements across new statutes. | Varies | Varies | Varies | Varies | Varies | Varies | Varies | Varies | Under Review | Calderwood & Harkness maintaining legislative monitoring. Update matrix as new statutes are enacted or become effective. | Various — Cascade has retail in 31 states total | Various | Medium
[sheet: Statute Inventory]
# | State | Statute Name | Abbreviation | Statutory Citation | Original Effective Date | Amendment Effective Date (if applicable) | Current Status as of June 30, 2025 | Cascade Applicable | Cascade Retail Locations in State
1 | California | California Consumer Privacy Act / California Privacy Rights Act | CCPA/CPRA | Cal. Civ. Code §§ 1798.100–1798.199.100 | 2020-01-01 | 2023-01-01 (CPRA) | Effective; actively enforced by AG and CPPA | Yes | Yes
2 | Virginia | Virginia Consumer Data Protection Act | VCDPA | Va. Code Ann. §§ 59.1-575 – 59.1-585 | 2023-01-01 | N/A | Effective; enforced by VA AG | Yes | Yes
3 | Colorado | Colorado Privacy Act | CPA | Colo. Rev. Stat. §§ 6-1-1301 – 6-1-1313 | 2023-07-01 | N/A | Effective; enforced by CO AG | Yes | Yes
4 | Connecticut | Connecticut Data Privacy Act | CTDPA | Conn. Gen. Stat. §§ 42-515 – 42-525 | 2023-07-01 | N/A | Effective; enforced by CT AG | Yes | Yes
5 | Utah | Utah Consumer Privacy Act | UCPA | Utah Code Ann. §§ 13-61-101 – 13-61-404 | 2023-12-31 | N/A | Effective; enforced by UT AG | Yes | Yes
6 | Iowa | Iowa Consumer Data Protection Act | ICDPA | Iowa Code ch. 715D | 2025-01-01 | N/A | Effective | Yes | Yes
7 | Indiana | Indiana Consumer Data Protection Act | INCDPA | Ind. Code §§ 24-15-1 – 24-15-16 | 2026-01-01 | N/A | Enacted; not yet effective | Yes | Yes
8 | Tennessee | Tennessee Information Protection Act | TIPA | Tenn. Code Ann. §§ 47-18-3201 – 47-18-3213 | 2025-07-01 | N/A | Effective July 1, 2025 | Yes | Yes
9 | Montana | Montana Consumer Data Privacy Act | MCDPA | Mont. Code Ann. §§ 30-14-2801 – 30-14-2817 | 2024-10-01 | N/A | Effective | Yes | Yes — 1 location
10 | Texas | Texas Data Privacy and Security Act | TDPSA | Tex. Bus. & Com. Code ch. 541 | 2024-07-01 | N/A | Effective; enforced by TX AG | Yes | Yes
11 | Oregon | Oregon Consumer Privacy Act | OCPA | Or. Rev. Stat. §§ 646A.570 – 646A.604 | 2024-07-01 | N/A | Effective; enforced by OR AG | Yes | Yes
12 | Delaware | Delaware Personal Data Privacy Act | DPDPA | Del. Code Ann. tit. 6, ch. 12C | 2025-01-01 | N/A | Effective | Yes | Yes (state of incorporation)
13 | New Jersey | New Jersey Data Privacy Act | NJDPA | N.J. Stat. Ann. §§ 56:8-166 – 56:8-188 | 2025-01-15 | N/A | Effective | Yes | Yes
14 | New Hampshire | New Hampshire Data Privacy Act | NHDPA | N.H. Rev. Stat. Ann. §§ 507-H:1 – 507-H:17 | 2025-01-01 | N/A | Effective | Yes | Yes — 1 location (under review)
15 | Nebraska | Nebraska Data Privacy Act | NDPA | Neb. Rev. Stat. §§ 87-1101 – 87-1116 | 2025-01-01 | N/A | Effective | Yes | Yes
16 | Minnesota | Minnesota Consumer Data Privacy Act | MN CDPA | Minn. Stat. ch. 325O | 2025-07-31 | N/A | Enacted; effective July 31, 2025 | Yes | Yes
17 | Maryland | Maryland Online Data Privacy Act | MODPA | Md. Code Ann., Com. Law §§ 14-4601 – 14-4616 | 2025-10-01 | N/A | Enacted; effective October 1, 2025 | Yes | Yes
18 | Kentucky | Kentucky Consumer Data Protection Act | KYDPA | Ky. Rev. Stat. Ann. §§ 367.500 – 367.530 | 2026-01-01 | N/A | Enacted; not yet effective | Yes | Yes
19 | Additional / Emerging | Other state statutes enacted or effective through 2025–2026 | Various | Various | Various | N/A | Monitoring | Under Review | Various
[sheet: Consumer Rights Comparison]
Consumer Right | California CCPA/CPRA | Virginia VCDPA | Colorado CPA | Connecticut CTDPA | Utah UCPA | Iowa ICDPA | Indiana INCDPA | Tennessee TIPA | Montana MCDPA | Texas TDPSA | Oregon OCPA | Delaware DPDPA | New Jersey NJDPA | New Hampshire NHDPA | Nebraska NDPA | Minnesota MN CDPA | Maryland MODPA | Kentucky KYDPA | Other/Emerging
Right to Access / Know | Yes — categories and specific pieces | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Varies
Right to Delete | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Varies
Right to Correct | Yes | Yes | Yes | Yes | No | No | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Varies
Right to Data Portability | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Varies
Right to Opt Out of Sale | Yes | Yes | Yes | Yes | Yes | No | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Varies
Right to Opt Out of Targeted Advertising | Yes (sharing) | Yes | Yes | Yes | Yes | No | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Varies
Right to Opt Out of Profiling | Yes (limited) | Yes | Yes | Yes | No | No | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Varies
Right to Limit Use of Sensitive PI | Yes (CPRA § 1798.121) | No (uses opt-in model) | No (opt-in) | No (opt-in) | No | No | No (opt-in) | No (opt-in) | No (opt-in) | No (opt-in) | No (opt-in) | No (opt-in) | No (opt-in) | No (opt-in) | No (opt-in) | No (opt-in) | No (opt-in) | No (opt-in) | Varies
Right to Appeal | No (AG/CPPA process) | Yes — 60 days | Yes — 45 days | Yes — 60 days | No | No | Yes — 60 days | Yes — 60 days | Yes — 60 days | Yes — 45 days | Yes — 45 days | Yes — 60 days | Yes — 45 days | Yes — 60 days | Yes — 60 days | Yes — 45 days | Yes — 60 days | Yes — 60 days | Varies
Right to Non-Discrimination | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Varies
Financial Incentive / Loyalty Disclosure | Yes — § 1798.125 | No | No | No | No | No | No | No | No | No | No | No | No | No | No | No | No | No | Varies
Right to Know Third-Party Recipients | Yes — list of third parties | Yes (categories) | Yes (categories) | Yes (categories) | Limited | Limited | Yes (categories) | Yes (categories) | Yes (categories) | Yes (categories) | Yes (specific third parties — unique) | Yes (categories) | Yes (categories) | Yes (categories) | Yes (categories) | Yes (categories) | Yes (categories) | Yes (categories) | Varies
[sheet: Opt-Out & Sensitive Data]
State | Statute abbreviation | Do Not Sell / Share Link Required | Universal Opt-Out Mechanism (GPC) — Required / Recognized / Silent | GPC Implementation Deadline | Opt-Out of Targeted Advertising — Mechanism | Sensitive PI Categories Defined | Sensitive PI Consent Model | Precise Geolocation Classified as Sensitive | Payment / Financial Data Classified as Sensitive | Biometric Data Classified as Sensitive | Children's Data Classified as Sensitive | Cascade Impact — Precise Geolocation (mobile app) | Cascade Impact — Payment Card Data | Cascade Impact — Loyalty / Financial Incentive | Cascade Current Compliance Status | Remediation Notes
California | CCPA/CPRA | Yes | Required | Already in effect | Must provide opt-out of sharing for cross-context behavioral advertising; honor GPC | Precise geolocation; SSN; financial data; racial/ethnic origin; religious beliefs; health; sex life/orientation; genetic/biometric; login credentials with password; mail/email/text contents; children's PI | Opt-In (right to limit use/disclosure) | Yes | Yes | Yes | Yes | Gap: Precise geolocation collected via Cascade mobile app without separate opt-in consent | Gap: Payment-card data processing occurs without separate opt-in consent flow for sensitive PI | Cascade Rewards (~41.2M members) requires financial-incentive notice under § 1798.125 | Gap | Implement separate consent flow for precise geolocation and sensitive PI; deploy GPC signal recognition via OnPoint CMP; update privacy policy (last updated March 2022)
Virginia | VCDPA | No | Recognized (not mandated) | N/A | Clear mechanism for opt-out of sale, targeted advertising, profiling | Racial/ethnic origin; religious beliefs; health; sexual orientation; citizenship/immigration; genetic/biometric; known child PI; precise geolocation | Opt-In | Yes | No | Yes | Yes | Gap: Precise geolocation requires opt-in consent not currently obtained | Not classified as sensitive under VCDPA; standard processing controls apply | N/A — no financial-incentive disclosure required | Gap | Implement opt-in consent for precise geolocation; implement appeal process (not currently available — gap)
Colorado | CPA | No | Required | Already in effect (July 1, 2024 per CPA rules) | Must honor universal opt-out mechanisms; clear opt-out of sale and targeted advertising | Racial/ethnic origin; religious beliefs; health; sexual orientation; citizenship/immigration; genetic/biometric; known child PI | Opt-In | Yes (per CPA AG rules) | No | Yes | Yes | Gap: Precise geolocation requires opt-in; GPC not honored | Standard processing controls apply | N/A | Gap | Deploy GPC recognition; implement opt-in consent for precise geolocation; update privacy policy
Connecticut | CTDPA | No | Required (effective January 1, 2025) | January 1, 2025 (already in effect) | Clear mechanism for opt-out of sale, targeted advertising, profiling; must honor opt-out preference signals | Racial/ethnic origin; religious beliefs; health; sexual orientation; citizenship/immigration; genetic/biometric; known child PI; precise geolocation | Opt-In | Yes | No | Yes | Yes | Gap: Precise geolocation requires opt-in; GPC not honored | Standard processing controls apply | N/A | Gap | Deploy GPC recognition; implement opt-in consent for precise geolocation
Utah | UCPA | No | Silent | N/A | Standard opt-out of sale and targeted advertising | Racial/ethnic origin; religious beliefs; sexual orientation; citizenship/immigration; genetic/biometric; known child PI; precise geolocation; health data | Opt-Out (unique among state laws) | Yes | No | Yes | Yes | Partial: Opt-out model less restrictive; Cascade must provide opt-out mechanism for sensitive PI processing | Standard processing controls apply | N/A | Partial | Implement opt-out mechanism for sensitive PI processing (less burdensome than opt-in states)
Iowa | ICDPA | No | Silent | N/A | Opt-out of sale of PI and targeted advertising | Racial/ethnic origin; religious beliefs; health; sexual orientation; citizenship/immigration; genetic/biometric; known child PI | Opt-In | No (not explicitly listed) | No | Yes | Yes | Lower risk: Precise geolocation not explicitly classified as sensitive under ICDPA | Standard processing controls apply | N/A | Partial | Implement opt-in consent for biometric and known-child data; standard controls for other categories
Indiana | INCDPA | No | Recognized | By effective date (January 1, 2026) | Clear mechanism for opt-out of sale, targeted advertising, profiling | Racial/ethnic origin; religious beliefs; health; sexual orientation; citizenship/immigration; genetic/biometric; known child PI; precise geolocation | Opt-In | Yes | No | Yes | Yes | Plan: Implement opt-in consent for precise geolocation by effective date | Standard processing controls apply | N/A | Gap (pre-effective planning) | Plan opt-in consent flow and universal opt-out mechanism implementation by January 1, 2026
Tennessee | TIPA | No | Recognized | By effective date (July 1, 2025) | Clear mechanism for opt-out of sale, targeted advertising, profiling; NIST Privacy Framework affirmative defense incentivizes compliance | Racial/ethnic origin; religious beliefs; health; sexual orientation; citizenship/immigration; genetic/biometric; known child PI; precise geolocation | Opt-In | Yes | No | Yes | Yes | Gap: Precise geolocation requires opt-in consent; not currently obtained | Standard processing controls apply | N/A | Gap | Implement opt-in consent for precise geolocation; consider NIST Privacy Framework alignment for affirmative defense
Montana | MCDPA | No | Required | Already in effect | Must honor universal opt-out mechanisms; clear opt-out of sale and targeted advertising | Racial/ethnic origin; religious beliefs; health; sexual orientation; citizenship/immigration; genetic/biometric; known child PI; precise geolocation | Opt-In | Yes | No | Yes | Yes | Gap: Precise geolocation requires opt-in; GPC not honored | Standard processing controls apply | N/A | Gap | Deploy GPC recognition; implement opt-in consent for precise geolocation
Texas | TDPSA | No | Required | Already in effect | Must recognize universal opt-out mechanisms; clear opt-out of sale, targeted advertising, profiling | Racial/ethnic origin; religious beliefs; health; sexual orientation; citizenship/immigration; genetic/biometric; known child PI; precise geolocation | Opt-In | Yes | No | Yes | Yes | Gap: Precise geolocation requires opt-in; GPC not honored; high-volume TX state | Standard processing controls apply | N/A | Gap | Deploy GPC recognition; implement opt-in consent for precise geolocation; prioritize given TX consumer volume
Oregon | OCPA | No | Recognized | N/A | Clear mechanism for opt-out of sale, targeted advertising, profiling | Racial/ethnic origin; religious beliefs; health; sexual orientation; citizenship/immigration; genetic/biometric; known child PI; precise geolocation; transgender/nonbinary status | Opt-In | Yes | No | Yes | Yes | Gap: Precise geolocation requires opt-in consent | Standard processing controls apply | N/A | Gap | Implement opt-in consent for precise geolocation; note OR unique sensitive category (transgender/nonbinary status) in privacy policy
Delaware | DPDPA | No | Recognized | N/A | Clear mechanism for opt-out of sale, targeted advertising, profiling | Racial/ethnic origin; religious beliefs; health; sexual orientation; citizenship/immigration; genetic/biometric; known child PI; precise geolocation | Opt-In | Yes | No | Yes | Yes | Gap: Precise geolocation requires opt-in consent | Standard processing controls apply | N/A | Gap | Implement opt-in consent for precise geolocation; DE is state of incorporation — reputational priority
New Jersey | NJDPA | No | Required | Already in effect | Must recognize universal opt-out mechanisms; clear opt-out of sale, targeted advertising, profiling | Racial/ethnic origin; religious beliefs; health; sexual orientation; citizenship/immigration; genetic/biometric; known child PI; precise geolocation; financial data | Opt-In | Yes | Yes (broader than most states) | Yes | Yes | Gap: Precise geolocation requires opt-in; GPC not honored | Gap: Financial/payment-card data classified as sensitive PI; requires opt-in consent | N/A | Gap | Deploy GPC recognition; implement opt-in consent for precise geolocation AND financial/payment data — dual sensitive-PI gap
New Hampshire | NHDPA | No | Recognized | N/A | Clear mechanism for opt-out of sale, targeted advertising, profiling | Racial/ethnic origin; religious beliefs; health; sexual orientation; citizenship/immigration; genetic/biometric; known child PI; precise geolocation | Opt-In | Yes | No | Yes | Yes | Gap: Precise geolocation requires opt-in consent | Standard processing controls apply | N/A | Gap | Implement opt-in consent for precise geolocation
Nebraska | NDPA | No | Recognized | N/A | Clear mechanism for opt-out of sale, targeted advertising, profiling | Racial/ethnic origin; religious beliefs; health; sexual orientation; citizenship/immigration; genetic/biometric; known child PI; precise geolocation | Opt-In | Yes | No | Yes | Yes | Gap: Precise geolocation requires opt-in consent | Standard processing controls apply | N/A | Gap | Implement opt-in consent for precise geolocation
Minnesota | MN CDPA | No | Required | By effective date (July 31, 2025) | Must recognize universal opt-out mechanisms; clear opt-out of sale, targeted advertising, profiling | Racial/ethnic origin; religious beliefs; health; sexual orientation; citizenship/immigration; genetic/biometric; known child PI; precise geolocation | Opt-In | Yes | No | Yes | Yes | Gap: Precise geolocation requires opt-in; GPC not honored; imminent effective date | Standard processing controls apply | MN unique data-inventory requirement impacts Cascade compliance planning | Gap | Deploy GPC recognition; implement opt-in consent for precise geolocation; prepare data inventory per MN requirements
Maryland | MODPA | No | Required | By effective date (October 1, 2025) | Must recognize universal opt-out mechanisms; clear opt-out of sale, targeted advertising, profiling; sale of sensitive PI prohibited entirely | Racial/ethnic origin; religious beliefs; health; sexual orientation; citizenship/immigration; genetic/biometric; known child PI; precise geolocation; financial data | Opt-In (sale of sensitive PI prohibited entirely) | Yes | Yes | Yes | Yes | Critical Gap: MODPA prohibits sale of sensitive PI entirely — Cascade's data-sharing with ad partners involving geolocation data may violate this | Critical Gap: Financial/payment data classified as sensitive; sale prohibited entirely | N/A — but data-minimization requirement impacts loyalty program data collection | Gap | Immediate review of all data-sharing arrangements involving MD consumer geolocation and financial data; MODPA sale prohibition requires restructuring of Thornbridge and other ad-partner arrangements for MD consumers
Kentucky | KYDPA | No | Recognized | By effective date (January 1, 2026) | Clear mechanism for opt-out of sale, targeted advertising, profiling | Racial/ethnic origin; religious beliefs; health; sexual orientation; citizenship/immigration; genetic/biometric; known child PI; precise geolocation | Opt-In | Yes | No | Yes | Yes | Plan: Implement opt-in consent for precise geolocation by effective date | Standard processing controls apply | N/A | Gap (pre-effective planning) | Plan opt-in consent flow implementation by January 1, 2026
[sheet: DPA & Enforcement]
State | Statute abbreviation | Controller-Processor DPA Required | Required DPA Terms — Purpose Limitation | Required DPA Terms — Confidentiality | Required DPA Terms — Deletion/Return | Required DPA Terms — Audit Rights | Required DPA Terms — Sub-Processor Flow-Down | CCPA Service Provider / Contractor Distinction | Cascade DPA Gap Status | Private Right of Action | Private Right of Action Scope | Enforcement Authority | Cure Period | Cure Period Sunset Date (if applicable) | Data Protection Assessment Required | Maximum Penalty Per Violation | Cascade Risk Rating
California | CCPA/CPRA | Yes | Yes | Yes | Yes | Yes | Yes | Yes — service provider, contractor, and third-party distinctions | 23 of 47 ad/analytics partners lack DPAs; Thornbridge Media Corp. arrangement ($18.4M FY2024 spend) requires restructuring as highest priority | Limited | Data breaches only (§ 1798.150) — unencrypted/unredacted PI; no general private right of action | California AG; California Privacy Protection Agency (CPPA) | None (cure period eliminated by CPRA for CPPA enforcement) | Eliminated effective 2023 | Yes | $2,500/violation; $7,500/intentional violation or involving minors | High
Virginia | VCDPA | Yes | Yes | Yes | Yes | Yes | Yes | N/A — uses controller/processor model | Same gap — 23 of 47 partners lack DPAs applicable across statutes | No | No private right of action | Virginia Attorney General | 30 days | No sunset | Yes | $7,500/violation | High
Colorado | CPA | Yes | Yes | Yes | Yes | Yes | Yes | N/A — controller/processor model | 23 of 47 partners lack DPAs; cure period expired — higher enforcement risk | No | No private right of action | Colorado AG; District Attorneys | 60 days (expired) | Sunset January 1, 2025 — no cure period | Yes | $20,000/violation (CCPA enforcement under UCCC) | High
Connecticut | CTDPA | Yes | Yes | Yes | Yes | Yes | Yes | N/A — controller/processor model | 23 of 47 partners lack DPAs; cure period expired — higher enforcement risk | No | No private right of action | Connecticut Attorney General | 60 days (expired) | Sunset December 31, 2024 — no cure period | Yes | $5,000/violation under CUTPA | High
Utah | UCPA | Yes | Yes | Yes | Yes | Yes | Yes | N/A — controller/processor model | 23 of 47 partners lack DPAs | No | No private right of action | Utah AG (Division of Consumer Protection) | 30 days | No sunset | No | $7,500/violation | Medium
Iowa | ICDPA | Yes | Yes | Yes | Yes | Yes | Yes | N/A — controller/processor model | 23 of 47 partners lack DPAs | No | No private right of action | Iowa Attorney General | 90 days | No sunset | No | $7,500/violation | Medium
Indiana | INCDPA | Yes | Yes | Yes | Yes | Yes | Yes | N/A — controller/processor model | 23 of 47 partners lack DPAs; time to remediate before effective date | No | No private right of action | Indiana Attorney General | 30 days | No sunset | Yes | $7,500/violation | Medium
Tennessee | TIPA | Yes | Yes | Yes | Yes | Yes | Yes | N/A — controller/processor model | 23 of 47 partners lack DPAs; affirmative defense available if NIST-aligned privacy program maintained | No | No private right of action; affirmative defense for NIST-compliant programs | Tennessee Attorney General | 60 days | No sunset | Yes | $7,500/violation; $15,000/violation involving known child | High
Montana | MCDPA | Yes | Yes | Yes | Yes | Yes | Yes | N/A — controller/processor model | 23 of 47 partners lack DPAs | No | No private right of action | Montana Attorney General | 60 days | No sunset | Yes | $7,500/violation | Medium
Texas | TDPSA | Yes | Yes | Yes | Yes | Yes | Yes | N/A — controller/processor model | 23 of 47 partners lack DPAs; TX AG active enforcement posture increases risk | No | No private right of action | Texas Attorney General | 30 days | No sunset | Yes | $7,500/violation; $25,000 under DTPA | High
Oregon | OCPA | Yes | Yes | Yes | Yes | Yes | Yes | N/A — controller/processor model | 23 of 47 partners lack DPAs; cure period sunsets Jan 1, 2026 | No | No private right of action | Oregon Attorney General | 30 days | Sunset January 1, 2026 | Yes | $7,500/violation | High
Delaware | DPDPA | Yes | Yes | Yes | Yes | Yes | Yes | N/A — controller/processor model | 23 of 47 partners lack DPAs; cure period sunsets Dec 31, 2025 | No | No private right of action | Delaware AG (Department of Justice) | 60 days | Sunset December 31, 2025 | Yes | $10,000/violation | High
New Jersey | NJDPA | Yes | Yes | Yes | Yes | Yes | Yes | N/A — controller/processor model | 23 of 47 partners lack DPAs; financial data sensitivity adds DPA complexity | No | No private right of action | New Jersey AG (Division of Consumer Affairs) | 30 days | Sunset July 15, 2026 | Yes | $10,000/first violation; $20,000/subsequent | High
New Hampshire | NHDPA | Yes | Yes | Yes | Yes | Yes | Yes | N/A — controller/processor model | 23 of 47 partners lack DPAs | No | No private right of action | New Hampshire Attorney General | 60 days | No sunset | Yes | $7,500/violation | Medium
Nebraska | NDPA | Yes | Yes | Yes | Yes | Yes | Yes | N/A — controller/processor model | 23 of 47 partners lack DPAs; no minimum threshold increases scope of applicability | No | No private right of action | Nebraska Attorney General | 30 days | No sunset | Yes | $7,500/violation | Medium
Minnesota | MN CDPA | Yes | Yes | Yes | Yes | Yes | Yes | N/A — controller/processor model | 23 of 47 partners lack DPAs; data-inventory requirement adds DPA complexity | No | No private right of action | Minnesota Attorney General | 30 days | No sunset | Yes | $7,500/violation; $40,000 for knowing violations | High
Maryland | MODPA | Yes | Yes | Yes | Yes | Yes | Yes | N/A — controller/processor model | 23 of 47 partners lack DPAs; MODPA data-minimization and sensitive-PI-sale prohibition require enhanced DPA terms | No | No private right of action | Maryland AG (Division of Consumer Protection) | 60 days | Sunset April 1, 2027 | Yes | $10,000/violation; $25,000/subsequent | High
Kentucky | KYDPA | Yes | Yes | Yes | Yes | Yes | Yes | N/A — controller/processor model | 23 of 47 partners lack DPAs; time to remediate before effective date | No | No private right of action | Kentucky Attorney General | 30 days | No sunset currently specified | Yes | $7,500/violation | Medium
Additional / Emerging | Various | Varies | Varies | Varies | Varies | Varies | Varies | N/A | Monitor for additional DPA requirements as new statutes take effect | Varies | Varies | Varies | Varies | Varies | Varies | Varies | Medium