Ballot Signal

Compliance center

State privacy laws: the political exemption you think you have, mostly does not exist

Only Texas and Virginia expressly exempt political organizations. Colorado and New Jersey exempt no nonprofits. Oregon, Maryland, Delaware and Minnesota have only narrow exemptions.

Last updated 2026-08-28

The assumption that gets campaigns in trouble

There is a widely held belief in political operations that state privacy laws are a commercial-sector problem — that campaigns, committees and advocacy nonprofits are exempt. That belief is wrong often enough to be dangerous, and it is wrong in different ways in different states.

What the patchwork actually looks like

As of 2025–2026:

  • Texas and Virginia expressly exempt political organizations.
  • Colorado and New Jersey exempt no nonprofits at all — the nonprofit carve-out that exists in many state laws simply is not there.
  • Oregon, Maryland, Delaware and Minnesota have only narrow exemptions — mission-specific or insurance-fraud-related — that a campaign or advocacy organization should not assume covers it.
  • The remaining states vary, and several tie the exemption to entity type in ways that a 501(c)(4) and a candidate committee will land on opposite sides of.

Confirm your own state’s current text with counsel. This page is a map of the terrain, not a legal opinion, and the terrain changes every legislative session.

You have two options for operating across a fifty-state patchwork that changes annually.

Option one: determine your obligations state by state, entity type by entity type, keep that determination current as new laws pass, and configure your systems differently per jurisdiction. This is expensive, and it fails quietly the moment somebody forgets to update it.

Option two: ask everybody, everywhere, before you do anything — and keep the record of what they said. The obligations then become largely moot, because you are already operating above the highest bar in the country.

Ballot Signal is built on option two, not because we think option one is illegitimate, but because option one does not survive contact with a campaign’s actual operating tempo.

What a data subject request looks like on our side

  • Access: every field we hold on a person is on the supporter record and is exportable.
  • Deletion: deletion removes the record and its history from our systems. It cannot remove what has already been written into your CRM — that is your controller-side obligation, and our documentation names the exact fields to filter on.
  • Opt-out of sale or sharing: we do not sell supporter data and we do not share it beyond the destinations you configure. There is no data broker relationship to opt out of.

This page is a plain-English summary written by a software company, not by lawyers, and it is not legal advice. Privacy statutes are amended constantly and applied to specific facts. Have counsel review your program.

Elsewhere in the compliance center

TCPA & texting

Prior express written consent, A2P 10DLC registration with a political authorization token, and a consent record that carries the language, the timestamp, the source URL and the version.

FEC & in-kind contributions

Under 11 CFR 100.52(d), services must be billed at the usual and normal charge — a commercially reasonable rate prevailing at the time. Discounts outside the ordinary course of business can become in-kind contributions.

CIPA & website tracking

Trackers that fire before consent are the core exposure. The Ninth Circuit held in Javier v. Assurance IQ that prior consent is required and retroactive consent is not enough.

Voter file rules

Resolution is limited to your own consented first-party data plus a commercial identity graph. Deep voter-file matching requires a data partnership we have not signed.

See what your own website already knows.

Book a 20-minute walkthrough. We will look at your site's current consent posture first — that part is useful whether or not you buy anything.

Book a demo Get started