Nonprofit websites and the six state privacy laws that now apply
Which state privacy laws reach nonprofits, what Oregon says about donor lists, and the 2027 accessibility deadline for HHS grantees.
Key takeaways
- Six states now apply consumer privacy laws to nonprofits; California's CCPA generally doesn't.
- HHS-funded nonprofits face a WCAG 2.1 AA deadline of May 11, 2027.
The exemption nonprofits counted on is shrinking
Colorado, Oregon, Delaware, New Jersey, Minnesota and Maryland cover nonprofits that meet their thresholds, as low as 35,000 consumers in Delaware and Maryland. All but Maryland require honoring Global Privacy Control.
What Oregon says about donor data
Oregon's nonprofit FAQ (opens in a new tab) says swapping donor lists may be a sale, and newsletter emails can't be reused for solicitations without consent.
Donation pages and trackers
Regulators check whether donation-page pixels stop when a browser sends Global Privacy Control; California, Colorado and Connecticut ran a joint sweep (opens in a new tab) in September 2025.
Accessibility for grantees and everyone else
After a May 2026 extension (opens in a new tab), HHS-funded nonprofits with 15 or more employees must meet WCAG 2.1 AA by May 11, 2027, and smaller ones by May 10, 2028. ADA Title III also covers nonprofit food banks and shelters.
What to do
Check each state where supporters live, honor GPC, and audit donation pages for labels and captions. ComplyMo honors GPC and holds pixels from one line of code, and audits your pages on Growth and up; it doesn't manage donor data or your CRM. See ComplyMo for nonprofits.
General information, not legal advice. Confirm your obligations with counsel.