الصفحة الرئيسية › مكتبة القوانين › قوانين الخصوصية في الولايات الأمريكية
US
قوانين الخصوصية في الولايات الأمريكية
قوانين شاملة لخصوصية المستهلك خارج كاليفورنيا، مع الحدود والمهل.
موثّق المصدر · 79/116 معلومات مؤكَّدة من مصدرين. آخر تحقق 11 أكتوبر 2026
23 states, plus California's CCPA. Several laws take effect in 2027 and 2028; check each state's “In force from” date.
| الولاية | القانون | ساري المفعول منذ | من يشمله | حد الإيرادات | مهلة الرد على الطلبات | إلزامية احترام إشارات إلغاء الاشتراك | مهلة التصحيح | جهة التنفيذ |
|---|---|---|---|---|---|---|---|---|
| Alabama | Alabama Personal Data Protection Act (HB 351, 2026)✓ Ala. HB 351 (2026), enrolled ↗ | 2027-05-01✓ | More than 25,000 Alabama consumers (excluding payment-only data), or over 25% of gross revenue from selling personal data. Businesses with fewer than 500 employees (nonprofits fewer than 100) exempt if they do not sell personal data. | None (no dollar threshold) | قيد التحقق | قيد التحقق | 45 days (mandatory) | Alabama Attorney General (exclusive) |
| Colorado | Colorado Privacy Act (CPA)✓ C.R.S. § 6-1-1301 et seq. (SB21-190) ↗ | 2023-07-01✓ | 100,000+ Colorado consumers per year, or 25,000+ consumers and any revenue or discount from selling personal data.✓ | None (no dollar threshold) | 45 days (extendable by 45) | Yes, since 2024-07-01 | None; general 60-day cure ended 2025-01-01✓ | Colorado Attorney General and district attorneys✓ |
| Connecticut | Connecticut Data Privacy Act (CTDPA), as amended by SB 1295✓ Conn. Gen. Stat. ch. 743jj, § 42-515 et seq. (as amended by PA 25-113) ↗ | 2023-07-01 (major amendments 2026-07-01)✓ | From 2026-07-01: 35,000+ Connecticut consumers, OR any processing of sensitive data, OR any sale of personal data (previously 100,000 / 25,000 + 25% revenue).✓ | None (no dollar threshold) | 45 days (extendable by 45) | Yes, since 2025-01-01 | No mandatory cure since 2024-12-31; AG may offer one at its discretion | Connecticut Attorney General (exclusive)✓ |
| Delaware | Delaware Personal Data Privacy Act (DPDPA); amendments effective 2027-01-01 (85 Del. Laws c. 463)✓ 6 Del. C. ch. 12D ↗ | 2025-01-01 | 35,000+ Delaware consumers, or 10,000+ consumers with over 20% of gross revenue from selling personal data. | None (no dollar threshold) | 45 days (extendable by 45) | Yes, since 2026-01-01 | Discretionary since 2026-01-01 (DOJ may offer a chance to cure); the mandatory 60-day cure expired 2025-12-31.✓ | Delaware Department of Justice✓ |
| Florida | Florida Digital Bill of Rights (FDBR) - narrow scope, excluded from some trackers (e.g., IAPP)✓ Fla. Stat. §§ 501.701 to 501.722 ↗ | 2024-07-01 | Full obligations only for for-profits with $1B+ global revenue meeting a tech-platform criterion (e.g., ad revenue, smart speaker, app store). Sensitive-data sale rules apply to any for-profit doing business in Florida. | $1,000,000,000 global annual revenue | قيد التحقق | No (statute silent) | 45 days, at AG discretion; not available for children's-data violations✓ | Florida Attorney General (Department of Legal Affairs)✓ |
| Indiana | Indiana Consumer Data Protection Act (INCDPA) Ind. Code art. 24-15 ↗ | 2026-01-01 | 100,000+ Indiana consumers, or 25,000+ consumers with over 50% of gross revenue from selling personal data. | None (no dollar threshold) | 45 days (extendable by 45) | No | 30 days; no sunset | Indiana Attorney General (exclusive) |
| Iowa | Iowa Consumer Data Protection Act (ICDPA) Iowa Code ch. 715D ↗ | 2025-01-01 | 100,000+ Iowa consumers, or more than 25,000 consumers with over 50% of gross revenue from selling personal data.✓ | None (no dollar threshold) | 90 days (extendable once by 45) | No | 90 days after AG notice; no sunset✓ | Iowa Attorney General (exclusive)✓ |
| Kentucky | Kentucky Consumer Data Protection Act (KCDPA); amended by 2026 HB 692 (smart-TV/ACR data consent), effective 2027-07-01✓ KRS 367.3611 to 367.3629 ↗ | 2026-01-01✓ | 100,000+ Kentucky consumers, or 25,000+ consumers with over 50% of gross revenue from selling personal data.✓ | None (no dollar threshold) | 45 days (extendable by 45) | No | 30 days; no sunset✓ | Kentucky Attorney General (exclusive)✓ |
| Louisiana | Louisiana Data Privacy Act (SB 386, Act 502 of 2026)✓ La. R.S. 51:1780.1 to 1780.5 (SB 386, Act 502 of 2026) ↗ | 2027-01-01✓ | Any one of: annual gross revenue over $25M; buys, receives, sells or shares personal info of 75,000+ Louisiana consumers, households or devices; or 50%+ of annual revenue from selling personal info.✓ | $25,000,000 annual gross revenue (standalone trigger) | 45 days (extendable by 45); appeals within 60 days | قيد التحقق | 30 days, only from 2027-01-01 to 2027-07-31✓ | Louisiana Attorney General (exclusive)✓ |
| Maryland | Maryland Online Data Privacy Act (MODPA)✓ Md. Code, Com. Law § 14-4701 et seq. ↗ | 2025-10-01✓ | 35,000+ Maryland consumers (excluding payment-only data), or 10,000+ consumers with over 20% of gross revenue from selling personal data.✓ | None (no dollar threshold) | 45 days (extendable by 45); appeals within 60 days | Yes. | Discretionary (60 days if offered) until 2027-04-01✓ | Maryland Attorney General (Consumer Protection Division)✓ |
| Minnesota | Minnesota Consumer Data Privacy Act (MCDPA) Minn. Stat. §§ 325M.10 to 325M.21 ↗ | 2025-07-31 | 100,000+ Minnesota consumers, or 25,000+ consumers with over 25% of gross revenue from selling personal data. | None (no dollar threshold) | 45 days (extendable by 45) | Yes. | None now. | Minnesota Attorney General✓ |
| Montana | Montana Consumer Data Privacy Act (MCDPA), as amended by SB 297✓ Mont. Code Ann. § 30-14-2801 et seq.; enforcement § 30-14-2817 (as amended by SB 297, 2025) ↗ | 2024-10-01 (amendments 2025-10-01) | From 2025-10-01: 25,000+ Montana consumers, or 15,000+ consumers with over 25% of gross revenue from selling personal data (previously 50,000 / 25,000). Minors' provisions apply regardless of volume. | None (no dollar threshold) | 45 days (extendable by 45) | Yes | None. SB 297 (2025) removed the notice-and-cure right from 1 Oct 2025; the Attorney General can act without offering a cure (Mont. Code Ann. § 30-14-2817).✓ | Montana Attorney General (Office of Consumer Protection)✓ |
| Nebraska | Nebraska Data Privacy Act (LB 1074, 2024)✓ Neb. Rev. Stat. §§ 87-1101 to 87-1130 ↗ | 2025-01-01 | No consumer-count threshold: applies to anyone doing business in Nebraska who processes or sells personal data, unless an SBA-defined small business.✓ | None (SBA small-business exemption instead) | 45 days (extendable by 45) | Yes | 30 days; no sunset✓ | Nebraska Attorney General✓ |
| New Hampshire | New Hampshire Data Privacy Act (RSA ch. 507-H)✓ N.H. RSA ch. 507-H ↗ | 2025-01-01✓ | 35,000+ New Hampshire consumers, or 10,000+ consumers with over 25% of gross revenue from selling personal data. | None (no dollar threshold) | 45 days (extendable by 45) | Yes | None; 60-day cure expired 2025-12-31 | New Hampshire Attorney General (Department of Justice, Consumer Protection) |
| New Jersey | New Jersey Data Privacy Act (NJDPA) P.L.2023, c.266 (N.J.S.A. 56:8-166.4 et seq.) ↗ | 2025-01-15 | 100,000+ New Jersey consumers, or 25,000+ consumers with any revenue or price discount from selling personal data. | None (no dollar threshold) | 45 days (extendable by 45) | Yes | None; 30-day cure expired July 2026 (2026-07-15 per one source) | New Jersey Attorney General (Division of Consumer Affairs) |
| Oklahoma | Oklahoma SB 546 (2026), consumer data privacy act (Title 75A, §§ 300–320)✓ Okla. SB 546 (2026), enrolled; to be codified at 75A O.S. §§ 300–320 ↗ | 2027-01-01✓ | Businesses that operate in Oklahoma or target its residents and, in a calendar year, control or process personal data of at least 100,000 consumers, or at least 25,000 consumers while deriving over 50% of gross revenue from selling personal data.✓ | None (no dollar threshold) | 45 days, extendable once by 45 days when reasonably necessary; appeals must be decided within 60 days.✓ | No | 30 days: the Attorney General must give written notice at least 30 days before suing and cannot sue if the violation is cured; no sunset.✓ | Oklahoma Attorney General (exclusive); civil penalty up to $7,500 per violation; no private right of action.✓ |
| Oregon | Oregon Consumer Privacy Act (OCPA)✓ ORS 646A.570 to 646A.589 ↗ | 2024-07-01✓ | 100,000+ Oregon consumers, or 25,000+ consumers with 25%+ of gross revenue from selling personal data; also vehicle manufacturers processing vehicle data. | None (no dollar threshold) | 45 days (extendable by 45) | Yes, since 2026-01-01 | None; 30-day cure expired 2026-01-01 | Oregon Attorney General / Department of Justice✓ |
| Rhode Island | Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA)✓ R.I. Gen. Laws ch. 6-48.1 ↗ | 2026-01-01✓ | 35,000+ Rhode Island consumers, or 10,000+ consumers with over 20% of gross revenue from selling personal data.✓ | None (no dollar threshold) | 45 days (extendable by 45) | No | None✓ | Rhode Island Attorney General✓ |
| Tennessee | Tennessee Information Protection Act (TIPA) Tenn. Code Ann. § 47-18-3201 et seq. (2023 Pub. Ch. 408) ↗ | 2025-07-01 | Revenue over $25M AND either 175,000+ Tennessee consumers, or 25,000+ consumers with over 50% of gross revenue from selling personal info. | $25,000,000 annual revenue (required in addition to a consumer test) | 45 days (extendable by 45) | No | 60 days after AG notice; no sunset | Tennessee Attorney General and Reporter (exclusive) |
| Texas | Texas Data Privacy and Security Act (TDPSA)✓ Tex. Bus. & Com. Code ch. 541 (HB 4, 2023) ↗ | 2024-07-01✓ | No consumer-count threshold: applies to anyone doing business in Texas (or offering products/services consumed by Texans) who processes or sells personal data, unless an SBA-defined small business.✓ | None (SBA small-business exemption instead) | 45 days (extendable by 45) | Yes, since 2025-01-01 | 30 days; no sunset✓ | Texas Attorney General (Consumer Protection Division)✓ |
| Utah | Utah Consumer Privacy Act (UCPA)✓ Utah Code Title 13, ch. 61 ↗ | 2023-12-31✓ | Annual revenue of $25M+ AND either 100,000+ Utah consumers, or 25,000+ consumers with over 50% of gross revenue from selling personal data.✓ | $25,000,000 annual revenue (required in addition to a consumer test) | 45 days (extendable by 45) | No | 30 days after notice; no sunset✓ | Utah Attorney General; Division of Consumer Protection investigates and refers✓ |
| Vermont | Vermont Data Privacy and Online Surveillance Act (S.71, Act 145, signed 2026-06-16)✓ 9 V.S.A. ch. 61A (S.71, Act 145 of 2026) ↗ | 2028-01-01✓ | 35,000+ Vermont consumers (excluding payment-only data), or sensitive data of 3,000+ consumers, or offered for sale personal data of 3,000+ consumers. Consumer health data rules apply regardless of volume.✓ | None (no dollar threshold) | 45 days (extendable by 45); appeals within 60 days | Yes | 60 days, only from 2028-01-01 to 2029-06-30✓ | Vermont Attorney General (exclusive)✓ |
| Virginia | Virginia Consumer Data Protection Act (VCDPA)✓ Va. Code §§ 59.1-575 to 59.1-584 ↗ | 2023-01-01✓ | Controls or processes personal data of 100,000+ Virginia consumers per year, or 25,000+ consumers and over 50% of gross revenue from selling personal data.✓ | None (no dollar threshold) | 45 days (extendable by 45) | No | 30 days after AG notice; no sunset✓ | Virginia Attorney General (exclusive)✓ |
المعلومات الموسومة بعبارة «قيد التحقق» لا تزال قيد التأكيد ولا تُقدَّم كإجابات.
شريك
Termly
Create and maintain a privacy policy, cookie banner and request forms.
Create your privacy policy with Termlyرابط شريك: قد نحصل على عمولة إذا اشتريت، دون أي تكلفة إضافية عليك. ولا يؤثر ذلك أبدًا في محتوانا القانوني. الإفصاح عن روابط الشركاء
المصادر
Official texts (checked 11 October 2026)
- Alabama: Ala. HB 351 (2026), enrolled
- Colorado: C.R.S. § 6-1-1301 et seq. (SB21-190)
- Connecticut: Conn. Gen. Stat. ch. 743jj, § 42-515 et seq. (as amended by PA 25-113) (Attorney General page)
- Delaware: 6 Del. C. ch. 12D
- Florida: Fla. Stat. §§ 501.701 to 501.722
- Indiana: Ind. Code art. 24-15
- Iowa: Iowa Code ch. 715D
- Kentucky: KRS 367.3611 to 367.3629
- Louisiana: La. R.S. 51:1780.1 to 1780.5 (SB 386, Act 502 of 2026)
- Maryland: Md. Code, Com. Law § 14-4701 et seq.
- Minnesota: Minn. Stat. §§ 325M.10 to 325M.21
- Montana: Mont. Code Ann. § 30-14-2801 et seq.; enforcement § 30-14-2817 (as amended by SB 297, 2025)
- Nebraska: Neb. Rev. Stat. §§ 87-1101 to 87-1130
- New Hampshire: N.H. RSA ch. 507-H
- New Jersey: P.L.2023, c.266 (N.J.S.A. 56:8-166.4 et seq.)
- Oklahoma: Okla. SB 546 (2026), enrolled; to be codified at 75A O.S. §§ 300–320 (Enrolled bill text page)
- Oregon: ORS 646A.570 to 646A.589
- Rhode Island: R.I. Gen. Laws ch. 6-48.1
- Tennessee: Tenn. Code Ann. § 47-18-3201 et seq. (2023 Pub. Ch. 408) (Attorney General page)
- Texas: Tex. Bus. & Com. Code ch. 541 (HB 4, 2023)
- Utah: Utah Code Title 13, ch. 61
- Vermont: 9 V.S.A. ch. 61A (S.71, Act 145 of 2026)
- Virginia: Va. Code §§ 59.1-575 to 59.1-584
Attorney General guidance
- Indiana: https://www.in.gov/attorneygeneral/files/Indiana-Consumer-Data-Protection_Consumer-Bill-of-Rights_CDPCBOR.pdf
- Kentucky: https://ag.ky.gov/about/Office-Divisions/ODP/KCDPA/Pages/default.aspx
- Maryland: https://oag.maryland.gov/resources-info/Pages/data-privacy.aspx
- Minnesota: https://ag.state.mn.us/Data-Privacy/
- Nebraska: https://protectthegoodlife.nebraska.gov/data-privacy-homepage/
- New Hampshire: https://doj.nh.gov/news-and-media/attorney-general-formella-announces-creation-new-data-privacy-unit
- New Jersey: https://njconsumeraffairs.gov/ocp/Pages/NJ-Data-Privacy-Law-FAQ.aspx
- Oregon: https://www.doj.state.or.us/consumer-protection/id-theft-data-breaches/privacy/
- Texas: https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint/consumer-privacy-rights/texas-data-privacy-and-security-act
- Virginia: https://www.oag.state.va.us/consumer-protection/files/tips-and-info/Virginia-Consumer-Data-Protection-Act-Summary-7-1-26.pdf
Secondary analysis (law firms)
- https://www.afslaw.com/perspectives/privacy-counsel/new-year-new-privacy-obligations
- https://www.akingump.com/en/insights/blogs/ag-data-dive/tennessee-information-protection-act-what-businesses-need-to-know
- https://www.bassberry.com/news/big-sky-bigger-privacy-montana-broadens-its-consumer-data-privacy-act/
- https://www.dwt.com/blogs/privacy--security-law-blog/2026/06/louisiana-data-privacy-act-sb-386
- https://www.hunton.com/privacy-and-cybersecurity-law-blog/vermont-becomes-23rd-state-with-comprehensive-consumer-privacy-law
- https://www.mayerbrown.com/en/insights/publications/2026/04/alabama-enacts-comprehensive-consumer-data-privacy-law
- https://www.mayerbrown.com/zh-hans/insights/publications/2026/03/oklahoma-enacts-comprehensive-consumer-data-privacy-law
- https://www.swlaw.com/publication/connecticut-data-privacy-act-2026-amendments/
- https://www.wsgrdataadvisor.com/2023/04/the-sixth-state-iowa-enacts-comprehensive-privacy-law/
= confirmed by two independent sources, at least one official (state code or Attorney General). Unmarked figures come from law-firm analyses and are being confirmed statute by statute against the official texts listed below. Fully confirmed so far: Colorado, Kentucky, Louisiana, Maryland, Oklahoma, Rhode Island, Texas, Utah, Vermont, Virginia.