Rules
Nonprofit donor privacy laws by state: 14 state examples
Nonprofit donor privacy laws by state, shown through 14 states' privacy, charity and breach rules, plus IRS donor acknowledgment and record-keeping periods.
What to take away
- Nonprofit donor privacy laws by state come from state charity registration, state privacy statutes, state breach laws and the IRS. No federal statute governs donor lists.
- Most states require charitable solicitation registration, and many renewal forms ask how you handle donor lists.
- Five early comprehensive privacy statutes can reach a charity: California, Virginia, Colorado, Connecticut and Utah. Iowa, Indiana, Tennessee and Montana are among the states that have since joined them; this guide covers 14 states in all.
- Among the states covered here, breach notification deadlines run from 30 days in Colorado to 60 in Vermont; many other states use a "without unreasonable delay" standard.
- Keep gift substantiation for three years past the return that used it, and keep list-sharing records for the life of the agreement plus three.
The four regulators behind donor privacy
The IRS decides what you must substantiate and disclose about a gift. The FTC polices unfair or deceptive data practices and publishes security expectations that apply to donor records.
Four regulators, four jobs
IRS
- Main role
- Substantiation
- What it covers
- Gift disclosure
- Reaches you via
- Tax rules
FTC
- Main role
- Data practices
- What it covers
- Security promises
- Reaches you via
- Unfair practices
State charity offices
- Main role
- Registration
- What it covers
- Solicitation rules
- Reaches you via
- Annual filing
State attorneys general
- Main role
- Breach enforcement
- What it covers
- Privacy statutes
- Reaches you via
- State law
State charity offices run registration, annual filing and solicitation rules. State attorneys general enforce breach and privacy statutes. A state privacy law can also reach your organization directly if you cross its thresholds.
The FTC's data security guidance is the closest thing to a federal baseline for holding donor records, with or without a state privacy law.
What a compliant donor acknowledgment contains
A donor who receives goods or services in return needs an acknowledgment stating what was provided, a good-faith estimate of its value, and the fact that only the amount above that value is deductible. The IRS sets the dollar thresholds. Above the acknowledgment threshold in IRS Publication 1771, a donor cannot deduct a single contribution without a contemporaneous written acknowledgment from the charity. Where a donor pays more than $75 and receives goods or services in return, the IRS rules on quid pro quo contributions require the charity to give a written disclosure statement, even when the deductible part is $75 or less. The penalty for failing to disclose is $10 per contribution, up to $5,000 per fundraising event or mailing.
A charitable solicitation registration is a public document. Many states ask whether the charity rents, sells or exchanges its donor list, whether a donor may opt out, and how that request is honored.
- The donor's name and gift amount, recorded once
- The value of any goods or services returned to the donor
- Whether the donor opted out of list sharing
- Where the opt-out is stored and who can act on it
Where the donor file sits in your overall plan is a nonprofit marketing strategy question as much as a legal one.
Selected state examples affecting donor privacy
- California.The CCPA, as amended by the CPRA, covers for-profit businesses over revenue and data thresholds: $25 million in annual revenue, 100,000 consumers, or 50 percent of revenue from selling data. Most charities are not directly covered. The Attorney General's Registry of Charitable Trusts asks about list practices. Shine the Light lets a donor ask what personal information you shared for direct marketing.
- Virginia.The Consumer Data Protection Act covers entities that control or process data on 100,000 consumers, or 25,000 consumers while deriving over half of gross revenue from selling data. Charities that hit those numbers owe access, deletion and opt-out rights.
- Colorado.The Colorado Privacy Act reaches controllers processing 100,000 consumers, or 25,000 while earning revenue from data sales. Colorado was among the first states to require honoring universal opt-out signals, which matters if you run online donor advertising. Under the Colorado breach notice rules, affected residents must be told within 30 days after the date you determine a breach occurred, and the Attorney General must also be notified within 30 days when 500 or more Colorado residents are affected.
- Connecticut.The Connecticut Data Privacy Act applies at 100,000 consumers, or 25,000 with over 25 percent of revenue from data sales. It adds a right to appeal a refused request, and you must respond within a set window.
- Utah.The Utah Consumer Privacy Act has the highest threshold of the five: 100,000 consumers plus over $25 million in annual revenue. Few charities reach it, but the law is on the map for large national organizations.
- New York.The Charities Bureau registration covers solicitation and annual filing, and New York's SHIELD Act sets data security requirements for any entity holding private information, charity or not.
- Washington.The My Health My Data Act reaches health-related data broadly, and some donor health information from hospital or health charity fundraising can fall inside it.
- Vermont.Vermont requires charitable solicitation registration and publishes its filings. Its breach statute requires notice within 60 days.
- Oregon.Oregon requires charitable solicitation registration and publishes its filings. Its breach statute has specific content requirements for the notice you send.
- Texas.The Texas Data Privacy and Security Act exempts nonprofit organizations, so the privacy duty that matters is breach notice. Under the Texas data breach reporting rule, an organization whose breach affects 250 or more Texans must report it to the Attorney General no later than 30 days after discovering it, and must also notify the affected donors.
- Iowa.The Iowa Consumer Data Protection Act applies to entities processing 100,000 consumers, or 25,000 while deriving over 50 percent of revenue from selling data. It takes effect January 1, 2025.
- Indiana.The Indiana Consumer Data Protection Act has the same thresholds as Iowa and takes effect January 1, 2026.
- Tennessee.The Tennessee Information Protection Act applies at 100,000 consumers, or 25,000 with over 50 percent of revenue from selling data. It takes effect July 1, 2025.
- Montana.The Montana Consumer Data Privacy Act has a lower threshold: 50,000 consumers, or 25,000 with over 50 percent of revenue from selling data. It takes effect October 1, 2024.
- Other states.For states not listed above, start with that state's charity office for registration and its attorney general for privacy and breach rules.
Records to keep, and for how long
Retention is not driven by one federal rule. Each record answers a different question.
Records and retention periods
Record
- Written acknowledgment
- Deduction substantiated
- Form 990 and Schedule B
- Public inspection, privacy
- List rental agreement
- Solicitation disclosure
- Email consent log
- Consent under email rules
- Breach investigation file
- Defensible notification decision
What it proves
- Written acknowledgment
- 3 years after return
- Form 990 and Schedule B
- 3 years minimum, 7 common
- List rental agreement
- Term plus 3 years
- Email consent log
- 2 years or longer
- Breach investigation file
- 3 years or longer
Common retention
- Written acknowledgment
- Form 990 and Schedule B
- List rental agreement
- Email consent log
- Breach investigation file
The federal tax floor comes from the IRS rule on how long to keep records: records that support an item on a tax return are kept until the period of limitations for that return runs out.
- Gift substantiation and acknowledgments.Keep for 3 years after the return they support was filed, the IRS general period of limitations.
- Records behind a claim for credit or refund.Keep for 3 years from filing the original return or 2 years from paying the tax, whichever is later.
- Employment tax records for fundraising staff.Keep for at least 4 years after the tax becomes due or is paid, whichever is later.
- Opt-out and suppression records.Keep for as long as the donor stays on any list you hold, so you can show the request was honored.
- List-sharing agreements.Keep for the life of the agreement plus three years, so you can answer a donor who asks how another charity got her name.
The periods in the figure above follow common practice. The binding number is the one in a state statute or a funder's agreement. Our notes on nonprofit email marketing cover how consent and suppression are tracked.
What happens when you do not comply
A charity that misses state registration or an annual filing can have that registration suspended or revoked. Soliciting in that state becomes unlawful until the status is restored, and the state publishes the action.
On the data side, the FTC can act when a charity's security promises do not match its practice. A lapsed donor reactivation campaign that ignores suppression lists turns a privacy problem into a complaint.
Registration is not a one-time filing. It renews, and renewal is where most enforcement begins.
Worked example: a donor asks how you got her name
A donor calls and asks how a different charity ended up with her address. Her record shows two gifts and no request to be removed from anything. If your state requires disclosure of list sharing and a way to opt out, the answer is a document, not a memory.
What the state wants is a policy, a suppression mechanism, and evidence that both were in place when the list moved. How many donors you can count decides which thresholds you cross, a habit nonprofit marketing analytics covers.
Common questions
Do nonprofits have to comply with the CCPA?
Rarely as a covered business, because that law keys on for-profit status and revenue thresholds. The duties still arrive through contracts with vendors and platforms that are covered.
Is there a federal donor privacy law?
No. Federal rules touch receipts and filings, not the list itself. The privacy laws of the United States gives the wider state-by-state picture.
How long do we keep donor records?
At least three years past the return that used them, and longer where a state registration or a donor's deduction could still be questioned.
What triggers a breach notification duty?
Unauthorized acquisition of personal information, such as a name combined with a Social Security number, driver's license number, financial account or medical data.
