Building a website feels exciting — you pick colors, write your bio, maybe add a little contact form so people can reach you. Simple enough, right? But the moment someone types their name and email into that form and hits send, you’ve taken on a real legal responsibility for protecting that information.
Here’s the deal: every U.S. state has its own data breach notification law. And according to security breach notification statutes compiled by Saxe Doernberger & Vita, every state that has one of these laws requires that any individual impacted by a breach be personally notified. So if someone hacks your site and grabs those contact form submissions, you can’t just quietly fix the problem and move on. You have to tell people.
The timelines vary by state. Illinois, for example, sets notification deadlines after discovering a breach — and that clock starts ticking as soon as you know something went wrong, not when you’ve finished cleaning it up. The exact window and who it applies to depends on the specifics of your state’s law. Other states have their own windows, their own rules, their own exceptions. The complexity across all 50 states is real, and it changes often.
So what does this mean for you practically? A few things worth knowing before you launch anything with a form on it.
First, any message submitted through your contact form is personal data. Name, email, phone number, maybe even the content of what someone wrote to you — that’s all information people trusted you with. Treat it that way. Don’t let it sit in an unsecured inbox, don’t store it somewhere you forgot about, and definitely don’t use a platform you haven’t checked for basic security settings.
Second, “I didn’t know” isn’t really a defense. The law doesn’t care if you’re a high schooler who just put up their first portfolio site or a small business owner who figured a free contact plugin was fine. If you collect data and it gets exposed, you’ve got obligations.
Third, the good news — you don’t have to be a cybersecurity expert to reduce your risk. Using reputable, well-maintained contact form tools, keeping your website platform and plugins updated, and not storing submissions longer than you need to are all practical steps that matter. The goal isn’t perfection. It’s not being the easy target.
If you’re building something serious — a freelance site, a small business, anything where real people are trusting you with their info — it’s worth at least reading up on your own state’s breach notification requirements before something goes wrong rather than after.