Consumer data request - statutory deadline

255000 dollars of statutory exposure is sitting in one Texas queue - US privacy ops managers and in-house counsel, 25 days past the deadline. This is the tool's own output for a Texas access request received 6 July, read on 14 September, with 34 open Texas requests:

Respond by: 2026-08-20 (45 calendar days) Days left: -25 Status: OVERDUE by 25 days Acknowledge receipt by: Not required in Texas Latest date if you notify of an extension: 2026-10-04 Appeal window: 60 days to answer an appeal of a denial Cure period: 30-day cure period - you can still fix it Statutory maximum: 7500 dollars per violation Exposure across your open queue: 255000 dollars across 34 open requests

Change one field - the state - to Iowa, and the same request on the same date reads ON TIME, 20 days left, respond by 2026-10-04. Same consumer, same postmark, same privacy team, a 45-day gap between the two answers. If you log consumer data requests in a spreadsheet, that gap is the whole job.

Nine US state privacy laws are live in this tool: California, Colorado, Connecticut, Indiana, Iowa, Kentucky, Texas, Utah and Virginia. Eight give 45 calendar days to respond, extendable once by 45 more when you notify the consumer. Iowa gives 90 calendar days plus the same 45-day extension - the longest response window in the country. Indiana and Kentucky took effect 1 January 2026; Iowa allows 90 days to respond where Texas allows 45.

The request type moves the clock too, and this is where a general-purpose chatbot is confidently wrong. A California opt-out of sale or targeted advertising does not run on 45 calendar days. It runs on 15 business days, so the 6 July request above was due on 27 July, not in mid-August. California is also the only one of the nine that makes you acknowledge receipt inside 10 business days. And an appeal of a denial is not a continuation of the original clock: it starts a fresh window, 45 days in Colorado and 60 days in the Virginia-model states.

The third variable is the one privacy teams lean on when they are late: the cure period. Texas, Virginia, Indiana, Kentucky and Utah keep a permanent 30-day cure period. Iowa has the longest anywhere at 90 days. But the Colorado cure period sunsetted on 1 January 2025, the Connecticut mandatory cure expired at the same time, and California has had no cure period since the CPRA removed it. In those three states the first missed deadline is directly enforceable.

Then the money. Each state carries its own statutory maximum per violation: 7500 dollars in Texas, Virginia, Indiana, Iowa, Kentucky and Utah; 20000 dollars in Colorado; 5000 dollars in Connecticut; and in California 2663 dollars, rising to 7988 dollars where the violation is intentional or involves a minor. The tool multiplies that maximum by the open requests you hold from that state. 34 open Texas requests at 7500 dollars each is the 255000 dollar ceiling in the block above - one number, from two fields you already know.

Seven inputs produce the nine outputs printed above, with no account and no upload: state, date received, request type, extension notified, today, open requests from that state, and whether the violation would be intentional or involve a minor. Nothing you type leaves the browser - the only outbound call the extension ever makes is licence key validation.

All of that is free forever - nine states, five request types, no key, no cap, no watermark, no locked answer. The $60 key sits on a different axis: it exports your calculated request log as a .csv you own, and schedules browser reminders ahead of each due date, so the clock chases you instead of you chasing it. Outside privacy counsel intake review of a single consumer rights request is commonly quoted as a four-figure engagement per matter.