Furniture store customer privacy laws

Open the shared drive. There’s a spreadsheet called “delivery list FINAL v3” with 2,400 customers’ names, phone numbers, home addresses, and gate codes. Six people can open it, and one left in March. In this illustrative store, the delivery list has survived longer than several floor displays.

Customer privacy starts with knowing where those records go and who can still reach them. State-law coverage depends on more than showroom size, but the practical baseline is useful everywhere: collect deliberately, limit access, answer requests through a clear process, and keep records for a reason.

General information, not legal advice.

Does one showroom with 8,000 customers fall under a privacy law?

One showroom and 8,000 customers are not enough information to decide coverage. Those are example figures, not a legal exemption. The answer also depends on the states where you do business, the people whose data you handle, your revenue, your advertising arrangements, and the exemptions in each statute.

Start with people rather than completed orders. Your store may hold information about quote requesters, delivery contacts, newsletter subscribers, and website visitors who never bought a chair. A customer database is a useful starting point for the count; it is not necessarily the whole population a statute measures.

Then identify what the store does with that information. Keeping an address to deliver a sofa is different from disclosing data for advertising across unrelated websites. “We never sell our mailing list” does not answer every question about selling or sharing data under state law. California, for example, separately defines sharing for cross-context behavioral advertising. California Civil Code Section 1798.140.

Treat the coverage review as a short written decision. Record the states considered, the test used, the business facts supporting the result, and what would trigger another review. A website redesign, an acquired store, or a different advertising service can change the facts without adding a single showroom.

Which coverage tests should a furniture owner recognize?

Privacy laws do not share one national threshold. The following examples show why a blanket “we’re too small” answer is unreliable. They are a screening aid, not a complete state survey.

Jurisdiction	Coverage point to examine	Why it matters to a showroom
California	A covered for-profit business doing business in California can qualify through revenue, buying/selling/sharing data, or revenue from selling/sharing data	A low customer count does not settle the separate revenue test
Texas	The law generally excludes a business that meets the federal Small Business Administration definition, with a sensitive-data-sale exception	“Independent” and “SBA-defined small” are different descriptions
A state with a data-volume test	Read the count, time period, resident definition, and any lower data-sale threshold together	Orders, people, households, and website activity cannot be treated as interchangeable counts
Canada	Commercial handling of personal information can bring federal or provincial privacy law into scope	The US state-threshold approach is not a Canadian exemption

California’s main business definition has three alternative tests: annual gross revenue above the stated threshold; annually buying, selling, or sharing personal information of at least 100,000 customers or households; or deriving at least 50% of annual revenue from selling or sharing personal information. The precise statutory term is “consumers,” meaning California residents. A store does not have to satisfy all three. Civil Code Section 1798.140(d).

The California revenue threshold changes from $25 million to $26,625,000 on January 1, 2025. The California Privacy Protection Agency announced that adjustment on December 17, 2024. Use the amount for the period being assessed, and keep the revenue test separate from the data-volume test. CPPA’s monetary-threshold notice.

Texas’s Data Privacy and Security Act took effect July 1, 2024. Its general coverage includes businesses serving Texas residents that process or sell personal data and are not small businesses under the federal definition. Even a qualifying small business must obtain prior consent before selling sensitive personal data. Texas Business & Commerce Code, Sections 541.002 and 541.107.

Which announced laws belong on the planning calendar?

An enacted law with a future start date belongs on your preparation calendar, rather than in a list of duties already in force. The dates below come from laws enacted before this post’s publication. They help a store planning its next year of online selling.

State	Scheduled start	Main screening point
New Hampshire	January 1, 2025	At least 35,000 people’s data, excluding processing solely to complete a payment; alternatively 10,000 plus more than 25% of gross revenue from data sales
Nebraska	January 1, 2025	SBA-defined small-business exemption, with a separate consent rule for selling sensitive data
New Jersey	January 15, 2025	At least 100,000 people, excluding payment-only processing; alternatively 25,000 plus revenue or a discount from data sales
Tennessee	July 1, 2025	Revenue above $25 million and either 175,000 people or 25,000 plus more than 50% of gross revenue from data sales
Minnesota	July 31, 2025	A 100,000-person test or 25,000 plus more than 25% of gross revenue from data sales, subject to exclusions including its small-business provision
Kentucky	January 1, 2026	At least 100,000 people or 25,000 plus more than 50% of gross revenue from data sales

Sources: New Hampshire RSA 507-H, Nebraska LB1074, New Jersey Chapter 266, Tennessee Public Chapter 408, Minnesota Chapter 121, Article 5, and Kentucky Chapter 72.

Read each test with its definitions and exclusions. Tennessee’s revenue condition is easy to lose when someone repeats only the 175,000 figure. Nebraska’s small-business approach is easy to miss in a chart built around customer counts. A useful review keeps those conditions attached to the number.

Does selling across state lines change the answer?

Online selling can bring other states’ residents into your privacy review even if all the furniture leaves one warehouse. The statutes above use tests involving doing business in a state or offering products or services to its residents. A shop address alone does not describe that reach.

Map the states you serve, then examine the information you collect about residents there. Keep a record of the method behind any count. Where a law excludes information processed solely to complete a payment, a broader customer profile used for marketing or service may require a different analysis from the payment record alone.

Ask whoever manages your website to identify the advertising and analytics services installed on it. Include agencies and applications, not just the store’s direct contracts. A tracking tool can be active even when nobody on the showroom floor recognizes its name. Your privacy notice and any required choices should reflect what the site actually does.

The same cross-border discipline helps with other customer commitments. Our overview of furniture delivery laws explains why the delivery destination deserves attention beyond freight pricing.

What does a covered store generally need to do?

A covered store needs a working process behind its privacy notice. State laws differ, but recurring subjects include explaining data practices, handling customer rights requests, limiting collection and use, protecting information, and defining service-provider responsibilities. Texas Chapter 541 provides a concrete example of that structure. Texas’s enacted requirements.

Put the notice where the customer encounters the collection. An online quote request should not promise one use of information while the team follows another practice. When a new field is added, ask why the store needs it, who sees it, and whether the published explanation still fits.

Give staff a named contact for requests. An associate should recognize “please delete my information” or “what do you hold about me?” as something to route and record. The customer should not have to know the statute’s vocabulary to reach the right person.

Set the response process around the law governing the request. Record receipt, identity checks, the decision, any explanation, and completion. Keep marketing preferences separate from broader access or deletion requests: stopping promotional email does not, by itself, answer a request about the order file.

Where should the data map start?

Start the map with one ordinary sofa order and follow every copy of its information. That is more revealing than asking each department whether it uses “customer data.” Sales may think of the quote, while delivery thinks of access instructions and service thinks of photographs.

Record	Why the store needs it	Who ordinarily needs access	What to reconsider after the job
Customer profile	Contact and order history	Authorized sales and service staff	Duplicate profiles and unused fields
Signed order	Evidence of the agreement	Staff handling the sale, records, or disputes	Retention period and any hold
Delivery instructions	Carrying out the scheduled delivery	Assigned delivery staff and coordinator	Gate codes and temporary access details
Service photographs	Assessing the reported problem	Staff and vendors handling that claim	Unnecessary views of the customer’s home
Marketing list	Agreed promotional contact	Authorized marketing staff	Opt-outs and redundant exports

Add the actual storage locations alongside that table: Shopify, the order system, email, shared drives, delivery software, and paper. Include personal phones and downloaded files where staff use them for work. A record does not become harmless because it has left the main application.

The FTC recommends taking inventory, keeping only needed information, protecting it, disposing of it safely, and planning for incidents. Use that as a practical baseline while your legal coverage review is being completed. FTC’s guide to protecting personal information.

Who should see delivery access details?

Delivery access details belong with the people carrying out the delivery for the period they need them. Avoid permanent gate-code columns in a general customer export. A sales associate helping with fabric choices does not ordinarily need the entry instructions for every household the store has ever served.

Give staff their own accounts and review access when their job or location changes. Departures need an explicit offboarding step covering the order system, email, shared drives, and delivery tools. Revoking one login does not remove a downloaded spreadsheet from a laptop.

Keep card details out of ordinary order notes and messages. Use the payment service designed to handle them. The showroom PCI guide explains the separate payment-security responsibilities; it should sit beside the privacy process rather than replace it.

Customer records also need a boundary around AI tools. A useful small-store AI policy tells staff which tools are approved and what information can be entered. An address or service photograph does not become suitable for an outside tool merely because the prompt is asking for a polite reply.

Do delivery partners need a data agreement?

A delivery partner’s access to customer information should be covered by a suitable written arrangement. For a covered business using a processor, a privacy statute may require specific contract terms. Texas, for example, requires a controller–processor contract addressing the processing instructions, purpose, data, duration, and parties’ responsibilities. Section 541.104.

Begin with what the partner actually needs. A crew taking a sideboard upstairs needs the delivery address, contact arrangement, and necessary access information. It does not need the customer’s full purchasing history, other quotes, or unrelated service correspondence.

The agreement should match the handoff. Describe permitted use, who can see the information, any subcontracting, incident reporting, and return or deletion when the work ends. Establish how your store will reach the partner when a customer makes a request. A generic confidentiality sentence may leave those operational questions unanswered.

Test the process on a canceled delivery. The job disappears from tomorrow’s schedule, but has the address disappeared from the driver’s working list? Who withdraws the file already sent? That small exercise often reveals whether the arrangement works beyond the contract.

Must a deletion request erase the signed contract?

A deletion request needs a record-by-record decision, rather than an automatic promise to destroy everything. Privacy laws contain exceptions, including certain processing needed for contracts, warranties, legal duties, or claims. Texas Section 541.201 expressly addresses several of those purposes. Texas’s limitations and exceptions.

Separate the signed agreement from temporary delivery details and marketing data. They serve different purposes and may have different retention needs. Keeping an order to establish warranty coverage does not explain keeping an obsolete gate code or an abandoned mailing-list export.

Check with your attorney when setting retention periods and legal-hold rules, including how your state’s exceptions apply. Record the reason for retained information and limit its further use. “We might need it someday” is a poor retention policy; an identified agreement, obligation, or claim is a decision someone can review.

The signed-order retention guide explains the practical separation between ordinary retention and a legal hold. Give someone responsibility for reviewing holds as well as creating them. Otherwise, a temporary preservation decision can quietly become permanent storage.

What does the cleanup look like in the opening store?

The manager begins with the delivery spreadsheet, not a company-wide deletion exercise. She identifies its working owner and removes access that no longer belongs to an active role. The delivery coordinator confirms which jobs are still open and moves necessary instructions into the approved delivery process.

Next, the team separates the old export from the source records. Completed deliveries do not need to remain on the live working list just because their signed orders are retained elsewhere. The manager records the disposal decision and checks whether emailed or downloaded copies also need attention.

Finally, the store rehearses a request involving a customer with an open service claim. The team locates the customer profile, signed agreement, delivery record, claim photographs, and marketing entry. Each has an owner and a proposed action. The customer receives a clear response that explains what happened, including any information retained for a stated reason.

That rehearsal reveals gaps without waiting for a complaint. Perhaps the delivery partner cannot locate the file by order number, or nobody knows where the signed PDF was exported. Solve the missing handoff before writing a privacy promise the team cannot carry out.

How OrderPilot supports the store’s privacy routine

OrderPilot’s roles and location rules help match access to the work. Staff can be limited to personal, location, or wider record scope, with separate rights for costs, price changes, and payment actions. Access changes and blocked actions remain traceable. The roles and permissions guide helps turn those controls into a practical staff arrangement. Customer profiles remain in Shopify. OrderPilot supports customer-data exports and supported erasure requests, while signature records have their own retention periods and legal holds. Those are separate record processes: completing a customer-data action does not mean every signed record follows the same deletion path. The controls support the store’s decisions; they do not decide legal coverage or make the business compliant by themselves. Staff still need the data map, the partner arrangements, and an owner for requests. The benefit is a manageable record structure that the team can use during a real customer conversation.

What changes for a Canadian furniture store?

Canada’s privacy framework does not use the US state-law thresholds as a general small-store exemption. PIPEDA covers private-sector handling of personal information in commercial activity. Alberta, British Columbia, and Quebec have substantially similar private-sector laws that generally apply to activity within those provinces; commercial information crossing provincial or national borders remains subject to PIPEDA. Office of the Privacy Commissioner’s overview.

The practical themes are familiar: explain the purpose, limit collection and retention, protect information, and provide a way to exercise rights. The legal basis and detailed procedures need the Canadian review. A Toronto showroom should not adopt a US threshold chart and conclude that its delivery spreadsheet is outside privacy law.

A privacy baseline you can put to work

Use this checklist to assign the work, with one owner beside each item:

Map customer information across the order, website, email, delivery, service, and marketing systems.
Record the states and countries served, the coverage tests considered, and the next review trigger.
Remove unnecessary fields and retire duplicate exports through an agreed process.
Match account access to each person’s work and location; include offboarding.
Give delivery and service partners only the information needed for their assignments.
Keep written partner responsibilities and a contact for customer-data requests.
Document request intake, verification, routing, decisions, and completion.
Set retention rules by record purpose, with a separate process for signed records and legal holds.
Review what the privacy notice promises against what the team actually does.

Start with staff access and permissions. The next useful change may be as ordinary as closing an old colleague’s access to tomorrow’s delivery list.

Customer data privacy: which state laws apply to a furniture store