Privacy By State

As of September 13, 2026, 23 states have enacted comprehensive consumer data privacy laws. Florida has a narrower, limited-scope general consumer privacy law. Other states may still impose data-breach notification, biometric, health, financial, children’s, or other sector-specific privacy requirements.

Disclaimer: This information is provided for general informational purposes only and is not legal advice. Privacy laws, regulations, thresholds, exemptions, and effective dates may change. Consult qualified legal counsel regarding specific compliance obligations.
State Legislation Effective Date Fundamental Requirement
AlabamaAlabama Personal Data Protection Act (APDPA)May 1, 2027Applies to businesses conducting business in or targeting Alabama that control/process personal data of more than 25,000 consumers, or derive more than 25% of gross revenue from sale of personal data, subject to exemptions.
AlaskaNo comprehensive consumer privacy statute enacted—No comprehensive consumer data privacy statute currently enacted. State-specific breach notification and sector-specific privacy laws may still apply.
ArizonaNo comprehensive consumer privacy statute enacted—No comprehensive consumer data privacy statute currently enacted. State-specific breach notification and sector-specific privacy laws may still apply.
ArkansasNo comprehensive consumer privacy statute enacted—No comprehensive consumer data privacy statute currently enacted. State-specific breach notification and sector-specific privacy laws may still apply.
CaliforniaCCPA / CPRACCPA: Jan. 1, 2020; CPRA amendments: Jan. 1, 2023Applies to covered for-profit businesses meeting at least one threshold, including annual gross revenue of $26,625,000 or more (effective Jan. 1, 2025), buying/selling/sharing personal information of 100,000+ consumers or households, or deriving 50%+ annual revenue from selling/sharing personal information.
ColoradoColorado Privacy Act (CPA)July 1, 2023; biometric expansion July 1, 2025Generally applies at 100,000 consumers, or 25,000 consumers plus revenue/discount from sale of personal data. Separate biometric requirements can apply more broadly.
ConnecticutConnecticut Data Privacy Act (CTDPA)July 1, 2023; scope amended July 1, 2026Applies to persons doing business in/targeting Connecticut that process 35,000+ consumers, process consumer sensitive data, or offer consumers’ personal data for sale, subject to exemptions.
DelawareDelaware Personal Data Privacy Act (DPDPA)Jan. 1, 2025; HB 380 amendments Jan. 1, 2027Current law generally covers 35,000 consumers or 10,000 consumers plus more than 20% revenue from data sales. Effective Jan. 1, 2027, HB 380 lowers thresholds to 10,000, or 5,000 plus at least 20% revenue from data sales, and expands protections.
FloridaFlorida Digital Bill of Rights (FDBR) — limited scopeJuly 1, 2024Narrow applicability: generally for-profit controllers with more than $1 billion global annual revenue that also meet specified online-advertising, smart-speaker/virtual-assistant, or large app-store/platform criteria.
GeorgiaNo comprehensive consumer privacy statute enacted—No comprehensive consumer data privacy statute currently enacted. State-specific breach notification and sector-specific privacy laws may still apply.
HawaiiNo comprehensive consumer privacy statute enacted—No comprehensive consumer data privacy statute currently enacted. State-specific breach notification and sector-specific privacy laws may still apply.
IdahoNo comprehensive consumer privacy statute enacted—No comprehensive consumer data privacy statute currently enacted. State-specific breach notification and sector-specific privacy laws may still apply.
IllinoisNo comprehensive consumer privacy statute enacted—No comprehensive consumer data privacy statute currently enacted. State-specific breach notification and sector-specific laws, including biometric privacy requirements, may still apply.
IndianaIndiana Consumer Data Protection Act (ICDPA)Jan. 1, 2026Generally applies at 100,000 consumers, or 25,000 consumers plus more than 50% gross revenue from sale of personal data, subject to exemptions.
IowaIowa Consumer Data Protection Act (ICDPA)Jan. 1, 2025Generally applies at 100,000 consumers, or 25,000 consumers plus more than 50% gross revenue from sale of personal data, subject to exemptions.
KansasNo comprehensive consumer privacy statute enacted—No comprehensive consumer data privacy statute currently enacted. State-specific breach notification and sector-specific privacy laws may still apply.
KentuckyKentucky Consumer Data Protection Act (KCDPA)Jan. 1, 2026Applies at 100,000 consumers, or 25,000 consumers plus 50% of gross revenue from sale of personal data, subject to exemptions.
LouisianaLouisiana Data Privacy Act (LDPA)Jan. 1, 2027Applies to persons doing business in Louisiana meeting at least one threshold: more than $25 million annual gross revenue; personal data of 75,000+ consumers, households, or devices; or 50%+ annual revenue from selling personal data.
MaineNo comprehensive consumer privacy statute enacted—No comprehensive consumer data privacy statute currently enacted. State-specific breach notification and sector-specific privacy laws may still apply.
MarylandMaryland Online Data Privacy Act (MODPA)Oct. 1, 2025Generally applies at 35,000 consumers, or 10,000 consumers plus more than 20% gross revenue from sale of personal data, subject to exemptions.
MassachusettsNo comprehensive consumer privacy statute enacted—No comprehensive consumer data privacy statute currently enacted. State-specific breach notification and sector-specific privacy laws may still apply.
MichiganNo comprehensive consumer privacy statute enacted—No comprehensive consumer data privacy statute currently enacted. State-specific breach notification and sector-specific privacy laws may still apply.
MinnesotaMinnesota Consumer Data Privacy Act (MCDPA)July 31, 2025Generally applies at 100,000 consumers, or 25,000 consumers plus more than 25% gross revenue from sale of personal data; certain postsecondary institutions have delayed applicability.
MississippiNo comprehensive consumer privacy statute enacted—No comprehensive consumer data privacy statute currently enacted. State-specific breach notification and sector-specific privacy laws may still apply.
MissouriNo comprehensive consumer privacy statute enacted—No comprehensive consumer data privacy statute currently enacted. State-specific breach notification and sector-specific privacy laws may still apply.
MontanaMontana Consumer Data Privacy Act (MCDPA)Oct. 1, 2024; SB 297 amendments Oct. 1, 2025As amended, applies at 25,000 consumers, or 15,000 consumers plus more than 25% gross revenue from sale of personal data, subject to exemptions.
NebraskaNebraska Data Privacy Act (NDPA)Jan. 1, 2025Applies to persons doing business in Nebraska or providing products/services consumed by residents that process or sell personal data and are not a small business under the federal Small Business Act, subject to exemptions; small businesses have a sensitive-data sale restriction.
NevadaNo comprehensive consumer privacy statute enacted—No comprehensive consumer data privacy statute currently enacted. Nevada has other privacy and opt-out requirements that may apply.
New HampshireNew Hampshire Privacy Act (SB 255)Jan. 1, 2025Generally applies at 35,000 consumers, or 10,000 consumers plus more than 25% gross revenue from sale of personal data, subject to exemptions.
New JerseyNew Jersey Data Privacy Law (NJDPL)Jan. 15, 2025Generally applies at 100,000 consumers, or 25,000 consumers plus revenue or financial benefit from sale of personal data, subject to exemptions.
New MexicoNo comprehensive consumer privacy statute enacted—No comprehensive consumer data privacy statute currently enacted. State-specific breach notification and sector-specific privacy laws may still apply.
New YorkNo comprehensive consumer privacy statute enacted—No comprehensive consumer data privacy statute currently enacted. State-specific breach notification and sector-specific privacy laws may still apply.
North CarolinaNo comprehensive consumer privacy statute enacted—No comprehensive consumer data privacy statute currently enacted. State-specific breach notification and sector-specific privacy laws may still apply.
North DakotaNo comprehensive consumer privacy statute enacted—No comprehensive consumer data privacy statute currently enacted. State-specific breach notification and sector-specific privacy laws may still apply.
OhioNo comprehensive consumer privacy statute enacted—No comprehensive consumer data privacy statute currently enacted. State-specific breach notification and sector-specific privacy laws may still apply.
OklahomaOklahoma Consumer Data Privacy Act (SB 546)Jan. 1, 2027Applies to controllers/processors doing business in or targeting Oklahoma that annually process personal data of 100,000+ consumers, or 25,000+ consumers while deriving over 50% of gross revenue from sale of personal data.
OregonOregon Consumer Privacy Act (OCPA)July 1, 2024Applies at 100,000 consumers, or 25,000 consumers plus more than 25% annual gross revenue from sale of personal data, subject to exemptions.
PennsylvaniaNo comprehensive consumer privacy statute enacted—No comprehensive consumer data privacy statute currently enacted. State-specific breach notification and sector-specific privacy laws may still apply.
Rhode IslandRhode Island Data Transparency and Privacy Protection Act (RIDTPPA)Jan. 1, 2026Generally applies at 35,000 consumers, or 10,000 consumers plus more than 20% gross revenue from sale of personal data, subject to exemptions.
South CarolinaNo comprehensive consumer privacy statute enacted—No comprehensive consumer data privacy statute currently enacted. State-specific breach notification and sector-specific privacy laws may still apply.
South DakotaNo comprehensive consumer privacy statute enacted—No comprehensive consumer data privacy statute currently enacted. State-specific breach notification and sector-specific privacy laws may still apply.
TennesseeTennessee Information Protection Act (TIPA)July 1, 2025Applies to covered businesses with annual revenue over $25 million that process 175,000+ consumers, or 25,000+ consumers while deriving more than 50% gross revenue from sale of personal information, subject to exemptions.
TexasTexas Data Privacy and Security Act (TDPSA)July 1, 2024Broadly applies to businesses in or targeting Texas that process or sell personal data and are not small businesses under the federal Small Business Act, subject to statutory exemptions; small businesses generally may not sell sensitive personal data without consent.
UtahUtah Consumer Privacy Act (UCPA)Dec. 31, 2023Generally applies to businesses with $25 million+ annual revenue that also meet 100,000-consumer or 25,000-consumer-plus-50%-revenue thresholds, subject to exemptions.
VermontVermont Data Privacy and Online Surveillance Act (VDPOSA)Jan. 1, 2028Applies to organizations processing data of at least 35,000 consumers, sensitive data of at least 3,000 consumers, or selling personal data of at least 3,000 consumers, subject to exemptions; consumer-health provisions may apply regardless of thresholds.
VirginiaVirginia Consumer Data Protection Act (VCDPA)Jan. 1, 2023Generally applies at 100,000 consumers, or 25,000 consumers plus more than 50% gross revenue from sale of personal data, subject to exemptions.
WashingtonNo comprehensive consumer privacy statute enacted—No comprehensive consumer data privacy statute currently enacted. Washington has significant sector-specific privacy laws, including consumer-health-data requirements, that may still apply.
West VirginiaNo comprehensive consumer privacy statute enacted—No comprehensive consumer data privacy statute currently enacted. State-specific breach notification and sector-specific privacy laws may still apply.
WisconsinNo comprehensive consumer privacy statute enacted—No comprehensive consumer data privacy statute currently enacted. State-specific breach notification and sector-specific privacy laws may still apply.
WyomingNo comprehensive consumer privacy statute enacted—No comprehensive consumer data privacy statute currently enacted. State-specific breach notification and sector-specific privacy laws may still apply.