Home › Law library › US state privacy laws
US
US state privacy laws
Comprehensive consumer privacy laws outside California, with thresholds and deadlines.
Sourced. Last verified 9 October 2026
23 states, plus California's CCPA. Several laws take effect in 2027 and 2028; check the date column.
| State | Law | In force from | Who is covered | Revenue threshold | Request deadline | Must honour opt-out signals | Cure period | Enforced by |
|---|---|---|---|---|---|---|---|---|
| Alabama | Alabama Personal Data Protection Act (APDPA, HB 351, signed April 2026) | 2027-05-01 | More than 25,000 Alabama consumers (excluding payment-only data), or over 25% of gross revenue from selling personal data. Businesses with fewer than 500 employees (nonprofits fewer than 100) exempt if they do not sell personal data. | None (no dollar threshold) | Being verified | Being verified | 45 days (mandatory) | Alabama Attorney General (exclusive) |
| Colorado | Colorado Privacy Act (CPA) | 2023-07-01 | 100,000+ Colorado consumers per year, or 25,000+ consumers and any revenue or discount from selling personal data. | None (no dollar threshold) | 45 days (extendable by 45) | Yes, since 2024-07-01 | None; general 60-day cure ended 2025-01-01 | Colorado Attorney General and district attorneys |
| Connecticut | Connecticut Data Privacy Act (CTDPA), as amended by SB 1295 | 2023-07-01 (major amendments 2026-07-01) | From 2026-07-01: 35,000+ Connecticut consumers, OR any processing of sensitive data, OR any sale of personal data (previously 100,000 / 25,000 + 25% revenue). | None (no dollar threshold) | 45 days (extendable by 45) | Yes, since 2025-01-01 | No mandatory cure since 2024-12-31; AG may offer one at its discretion | Connecticut Attorney General (exclusive) |
| Delaware | Delaware Personal Data Privacy Act (DPDPA) | 2025-01-01 | 35,000+ Delaware consumers, or 10,000+ consumers with over 20% of gross revenue from selling personal data. | None (no dollar threshold) | 45 days (extendable by 45) | Yes, since 2026-01-01 | None; 60-day cure expired 2025-12-31 | Delaware Department of Justice |
| Florida | Florida Digital Bill of Rights (FDBR) - narrow scope, excluded from some trackers (e.g., IAPP) | 2024-07-01 | Full obligations only for for-profits with $1B+ global revenue meeting a tech-platform criterion (e.g., ad revenue, smart speaker, app store). Sensitive-data sale rules apply to any for-profit doing business in Florida. | $1,000,000,000 global annual revenue | Being verified | No (statute silent) | 45 days, at AG discretion; not available for children's-data violations | Florida Attorney General (Department of Legal Affairs) |
| Indiana | Indiana Consumer Data Protection Act (INCDPA) | 2026-01-01 | 100,000+ Indiana consumers, or 25,000+ consumers with over 50% of gross revenue from selling personal data. | None (no dollar threshold) | 45 days (extendable by 45) | No | 30 days; no sunset | Indiana Attorney General (exclusive) |
| Iowa | Iowa Consumer Data Protection Act (ICDPA) | 2025-01-01 | 100,000+ Iowa consumers, or more than 25,000 consumers with over 50% of gross revenue from selling personal data. | None (no dollar threshold) | 90 days (extendable once by 45) | No | 90 days after AG notice; no sunset | Iowa Attorney General (exclusive) |
| Kentucky | Kentucky Consumer Data Protection Act (KCDPA) | 2026-01-01 | 100,000+ Kentucky consumers, or 25,000+ consumers with over 50% of gross revenue from selling personal data. | None (no dollar threshold) | 45 days (extendable by 45) | No | 30 days; no sunset | Kentucky Attorney General (exclusive) |
| Louisiana | Louisiana Data Privacy Act (SB 386, signed 2026-05-29) | 2027-01-01 | Any one of: annual gross revenue over $25M; buys, receives, sells or shares personal info of 75,000+ Louisiana consumers, households or devices; or 50%+ of annual revenue from selling personal info. | $25,000,000 annual gross revenue (standalone trigger) | 45 days (extendable by 45); appeals within 60 days | Being verified | 30 days, only from 2027-01-01 to 2027-07-31 | Louisiana Attorney General (exclusive) |
| Maryland | Maryland Online Data Privacy Act (MODPA) | 2025-10-01 | 35,000+ Maryland consumers (excluding payment-only data), or 10,000+ consumers with over 20% of gross revenue from selling personal data. | None (no dollar threshold) | 45 days (extendable by 45); appeals within 60 days | Yes. | Discretionary (60 days if offered) until 2027-04-01 | Maryland Attorney General (Consumer Protection Division) |
| Minnesota | Minnesota Consumer Data Privacy Act (MCDPA) | 2025-07-31 | 100,000+ Minnesota consumers, or 25,000+ consumers with over 25% of gross revenue from selling personal data. | None (no dollar threshold) | 45 days (extendable by 45) | Yes. | None now. | Minnesota Attorney General |
| Montana | Montana Consumer Data Privacy Act (MCDPA), as amended by SB 297 | 2024-10-01 (amendments 2025-10-01) | From 2025-10-01: 25,000+ Montana consumers, or 15,000+ consumers with over 25% of gross revenue from selling personal data (previously 50,000 / 25,000). Minors' provisions apply regardless of volume. | None (no dollar threshold) | 45 days (extendable by 45) | Yes | None; 60-day cure eliminated 2025-10-01 by SB 297 (one source lists expiry as 2026-04-01) | Montana Attorney General (Office of Consumer Protection) |
| Nebraska | Nebraska Data Privacy Act (NDPA) | 2025-01-01 | No consumer-count threshold: applies to anyone doing business in Nebraska who processes or sells personal data, unless an SBA-defined small business. | None (SBA small-business exemption instead) | 45 days (extendable by 45) | Yes | 30 days; no sunset | Nebraska Attorney General |
| New Hampshire | New Hampshire Privacy Act (NHPA) | 2025-01-01 | 35,000+ New Hampshire consumers, or 10,000+ consumers with over 25% of gross revenue from selling personal data. | None (no dollar threshold) | 45 days (extendable by 45) | Yes | None; 60-day cure expired 2025-12-31 | New Hampshire Attorney General (Department of Justice, Consumer Protection) |
| New Jersey | New Jersey Data Privacy Act (NJDPA) | 2025-01-15 | 100,000+ New Jersey consumers, or 25,000+ consumers with any revenue or price discount from selling personal data. | None (no dollar threshold) | 45 days (extendable by 45) | Yes | None; 30-day cure expired July 2026 (2026-07-15 per one source) | New Jersey Attorney General (Division of Consumer Affairs) |
| Oklahoma | Oklahoma Consumer Data Privacy Act (SB 546, signed 2026-03-20) | 2027-01-01 | 100,000+ Oklahoma consumers, or 25,000+ consumers with over 50% of gross revenue from selling personal data. | None (no dollar threshold) | Being verified | No | 30 days; no sunset | Oklahoma Attorney General (exclusive) |
| Oregon | Oregon Consumer Privacy Act (OCPA) | 2024-07-01 | 100,000+ Oregon consumers, or 25,000+ consumers with 25%+ of gross revenue from selling personal data; also vehicle manufacturers processing vehicle data. | None (no dollar threshold) | 45 days (extendable by 45) | Yes, since 2026-01-01 | None; 30-day cure expired 2026-01-01 | Oregon Attorney General / Department of Justice |
| Rhode Island | Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA) | 2026-01-01 | 35,000+ Rhode Island consumers, or 10,000+ consumers with over 20% of gross revenue from selling personal data. | None (no dollar threshold) | 45 days (extendable by 45) | No | None | Rhode Island Attorney General |
| Tennessee | Tennessee Information Protection Act (TIPA) | 2025-07-01 | Revenue over $25M AND either 175,000+ Tennessee consumers, or 25,000+ consumers with over 50% of gross revenue from selling personal info. | $25,000,000 annual revenue (required in addition to a consumer test) | 45 days (extendable by 45) | No | 60 days after AG notice; no sunset | Tennessee Attorney General and Reporter (exclusive) |
| Texas | Texas Data Privacy and Security Act (TDPSA) | 2024-07-01 | No consumer-count threshold: applies to anyone doing business in Texas (or offering products/services consumed by Texans) who processes or sells personal data, unless an SBA-defined small business. | None (SBA small-business exemption instead) | 45 days (extendable by 45) | Yes, since 2025-01-01 | 30 days; no sunset | Texas Attorney General (Consumer Protection Division) |
| Utah | Utah Consumer Privacy Act (UCPA) | 2023-12-31 | Annual revenue of $25M+ AND either 100,000+ Utah consumers, or 25,000+ consumers with over 50% of gross revenue from selling personal data. | $25,000,000 annual revenue (required in addition to a consumer test) | 45 days (extendable by 45) | No | 30 days after notice; no sunset | Utah Attorney General; Division of Consumer Protection investigates and refers |
| Vermont | Vermont Data Privacy and Online Surveillance Act (S.71, Act 145, signed 2026-06-16) | 2028-01-01 | 35,000+ Vermont consumers (excluding payment-only data), or sensitive data of 3,000+ consumers, or offered for sale personal data of 3,000+ consumers. Consumer health data rules apply regardless of volume. | None (no dollar threshold) | 45 days (extendable by 45); appeals within 60 days | Yes | 60 days, only from 2028-01-01 to 2029-06-30 | Vermont Attorney General (exclusive) |
| Virginia | Virginia Consumer Data Protection Act (VCDPA) | 2023-01-01 | Controls or processes personal data of 100,000+ Virginia consumers per year, or 25,000+ consumers and over 50% of gross revenue from selling personal data. | None (no dollar threshold) | 45 days (extendable by 45) | No | 30 days after AG notice; no sunset | Virginia Attorney General (exclusive) |
Facts marked “Being verified” are still being confirmed and are not given as answers.
Sources
- https://www.afslaw.com/perspectives/privacy-counsel/new-year-new-privacy-obligations
- https://www.akingump.com/en/insights/blogs/ag-data-dive/tennessee-information-protection-act-what-businesses-need-to-know
- https://www.bassberry.com/news/big-sky-bigger-privacy-montana-broadens-its-consumer-data-privacy-act/
- https://www.dwt.com/blogs/privacy--security-law-blog/2026/06/louisiana-data-privacy-act-sb-386
- https://www.enzuzo.com/blog/us-state-privacy-laws
- https://www.hunton.com/privacy-and-cybersecurity-law-blog/vermont-becomes-23rd-state-with-comprehensive-consumer-privacy-law
- https://www.mayerbrown.com/en/insights/publications/2026/04/alabama-enacts-comprehensive-consumer-data-privacy-law
- https://www.mayerbrown.com/zh-hans/insights/publications/2026/03/oklahoma-enacts-comprehensive-consumer-data-privacy-law
- https://www.swlaw.com/publication/connecticut-data-privacy-act-2026-amendments/
- https://www.wsgrdataadvisor.com/2023/04/the-sixth-state-iowa-enacts-comprehensive-privacy-law/
State figures come from law-firm and privacy-industry trackers cross-checked against each other; statute-by-statute confirmation is part of the Phase 1 verification gate.