Skip to content
NewNeed a law or country we don't cover yet? Tell us, and see what's coming next.What's coming →
GlanceDesk™Jurisdiction

Home › Law library › US state privacy laws

US

US state privacy laws

Comprehensive consumer privacy laws outside California, with thresholds and deadlines.

Sourced · 79/116 facts confirmed by two sources. Last verified 11 October 2026

23 states, plus California's CCPA. Several laws take effect in 2027 and 2028; check each state's “In force from” date.

StateLawIn force fromWho is coveredRevenue thresholdRequest deadlineMust honour opt-out signalsCure periodEnforced by
AlabamaAlabama Personal Data Protection Act (HB 351, 2026)✓
Ala. HB 351 (2026), enrolled ↗		2027-05-01✓More than 25,000 Alabama consumers (excluding payment-only data), or over 25% of gross revenue from selling personal data. Businesses with fewer than 500 employees (nonprofits fewer than 100) exempt if they do not sell personal data.None (no dollar threshold)Being verifiedBeing verified45 days (mandatory)Alabama Attorney General (exclusive)
ColoradoColorado Privacy Act (CPA)✓
C.R.S. § 6-1-1301 et seq. (SB21-190) ↗		2023-07-01✓100,000+ Colorado consumers per year, or 25,000+ consumers and any revenue or discount from selling personal data.✓None (no dollar threshold)45 days (extendable by 45)Yes, since 2024-07-01None; general 60-day cure ended 2025-01-01✓Colorado Attorney General and district attorneys✓
ConnecticutConnecticut Data Privacy Act (CTDPA), as amended by SB 1295✓
Conn. Gen. Stat. ch. 743jj, § 42-515 et seq. (as amended by PA 25-113) ↗		2023-07-01 (major amendments 2026-07-01)✓From 2026-07-01: 35,000+ Connecticut consumers, OR any processing of sensitive data, OR any sale of personal data (previously 100,000 / 25,000 + 25% revenue).✓None (no dollar threshold)45 days (extendable by 45)Yes, since 2025-01-01No mandatory cure since 2024-12-31; AG may offer one at its discretionConnecticut Attorney General (exclusive)✓
DelawareDelaware Personal Data Privacy Act (DPDPA); amendments effective 2027-01-01 (85 Del. Laws c. 463)✓
6 Del. C. ch. 12D ↗		2025-01-0135,000+ Delaware consumers, or 10,000+ consumers with over 20% of gross revenue from selling personal data.None (no dollar threshold)45 days (extendable by 45)Yes, since 2026-01-01Discretionary since 2026-01-01 (DOJ may offer a chance to cure); the mandatory 60-day cure expired 2025-12-31.✓Delaware Department of Justice✓
FloridaFlorida Digital Bill of Rights (FDBR) - narrow scope, excluded from some trackers (e.g., IAPP)✓
Fla. Stat. §§ 501.701 to 501.722 ↗		2024-07-01Full obligations only for for-profits with $1B+ global revenue meeting a tech-platform criterion (e.g., ad revenue, smart speaker, app store). Sensitive-data sale rules apply to any for-profit doing business in Florida.$1,000,000,000 global annual revenueBeing verifiedNo (statute silent)45 days, at AG discretion; not available for children's-data violations✓Florida Attorney General (Department of Legal Affairs)✓
IndianaIndiana Consumer Data Protection Act (INCDPA)
Ind. Code art. 24-15 ↗		2026-01-01100,000+ Indiana consumers, or 25,000+ consumers with over 50% of gross revenue from selling personal data.None (no dollar threshold)45 days (extendable by 45)No30 days; no sunsetIndiana Attorney General (exclusive)
IowaIowa Consumer Data Protection Act (ICDPA)
Iowa Code ch. 715D ↗		2025-01-01100,000+ Iowa consumers, or more than 25,000 consumers with over 50% of gross revenue from selling personal data.✓None (no dollar threshold)90 days (extendable once by 45)No90 days after AG notice; no sunset✓Iowa Attorney General (exclusive)✓
KentuckyKentucky Consumer Data Protection Act (KCDPA); amended by 2026 HB 692 (smart-TV/ACR data consent), effective 2027-07-01✓
KRS 367.3611 to 367.3629 ↗		2026-01-01✓100,000+ Kentucky consumers, or 25,000+ consumers with over 50% of gross revenue from selling personal data.✓None (no dollar threshold)45 days (extendable by 45)No30 days; no sunset✓Kentucky Attorney General (exclusive)✓
LouisianaLouisiana Data Privacy Act (SB 386, Act 502 of 2026)✓
La. R.S. 51:1780.1 to 1780.5 (SB 386, Act 502 of 2026) ↗		2027-01-01✓Any one of: annual gross revenue over $25M; buys, receives, sells or shares personal info of 75,000+ Louisiana consumers, households or devices; or 50%+ of annual revenue from selling personal info.✓$25,000,000 annual gross revenue (standalone trigger)45 days (extendable by 45); appeals within 60 daysBeing verified30 days, only from 2027-01-01 to 2027-07-31✓Louisiana Attorney General (exclusive)✓
MarylandMaryland Online Data Privacy Act (MODPA)✓
Md. Code, Com. Law § 14-4701 et seq. ↗		2025-10-01✓35,000+ Maryland consumers (excluding payment-only data), or 10,000+ consumers with over 20% of gross revenue from selling personal data.✓None (no dollar threshold)45 days (extendable by 45); appeals within 60 daysYes.Discretionary (60 days if offered) until 2027-04-01✓Maryland Attorney General (Consumer Protection Division)✓
MinnesotaMinnesota Consumer Data Privacy Act (MCDPA)
Minn. Stat. §§ 325M.10 to 325M.21 ↗		2025-07-31100,000+ Minnesota consumers, or 25,000+ consumers with over 25% of gross revenue from selling personal data.None (no dollar threshold)45 days (extendable by 45)Yes.None now.Minnesota Attorney General✓
MontanaMontana Consumer Data Privacy Act (MCDPA), as amended by SB 297✓
Mont. Code Ann. § 30-14-2801 et seq.; enforcement § 30-14-2817 (as amended by SB 297, 2025) ↗		2024-10-01 (amendments 2025-10-01)From 2025-10-01: 25,000+ Montana consumers, or 15,000+ consumers with over 25% of gross revenue from selling personal data (previously 50,000 / 25,000). Minors' provisions apply regardless of volume.None (no dollar threshold)45 days (extendable by 45)YesNone. SB 297 (2025) removed the notice-and-cure right from 1 Oct 2025; the Attorney General can act without offering a cure (Mont. Code Ann. § 30-14-2817).✓Montana Attorney General (Office of Consumer Protection)✓
NebraskaNebraska Data Privacy Act (LB 1074, 2024)✓
Neb. Rev. Stat. §§ 87-1101 to 87-1130 ↗		2025-01-01No consumer-count threshold: applies to anyone doing business in Nebraska who processes or sells personal data, unless an SBA-defined small business.✓None (SBA small-business exemption instead)45 days (extendable by 45)Yes30 days; no sunset✓Nebraska Attorney General✓
New HampshireNew Hampshire Data Privacy Act (RSA ch. 507-H)✓
N.H. RSA ch. 507-H ↗		2025-01-01✓35,000+ New Hampshire consumers, or 10,000+ consumers with over 25% of gross revenue from selling personal data.None (no dollar threshold)45 days (extendable by 45)YesNone; 60-day cure expired 2025-12-31New Hampshire Attorney General (Department of Justice, Consumer Protection)
New JerseyNew Jersey Data Privacy Act (NJDPA)
P.L.2023, c.266 (N.J.S.A. 56:8-166.4 et seq.) ↗		2025-01-15100,000+ New Jersey consumers, or 25,000+ consumers with any revenue or price discount from selling personal data.None (no dollar threshold)45 days (extendable by 45)YesNone; 30-day cure expired July 2026 (2026-07-15 per one source)New Jersey Attorney General (Division of Consumer Affairs)
OklahomaOklahoma SB 546 (2026), consumer data privacy act (Title 75A, §§ 300–320)✓
Okla. SB 546 (2026), enrolled; to be codified at 75A O.S. §§ 300–320 ↗		2027-01-01✓Businesses that operate in Oklahoma or target its residents and, in a calendar year, control or process personal data of at least 100,000 consumers, or at least 25,000 consumers while deriving over 50% of gross revenue from selling personal data.✓None (no dollar threshold)45 days, extendable once by 45 days when reasonably necessary; appeals must be decided within 60 days.✓No30 days: the Attorney General must give written notice at least 30 days before suing and cannot sue if the violation is cured; no sunset.✓Oklahoma Attorney General (exclusive); civil penalty up to $7,500 per violation; no private right of action.✓
OregonOregon Consumer Privacy Act (OCPA)✓
ORS 646A.570 to 646A.589 ↗		2024-07-01✓100,000+ Oregon consumers, or 25,000+ consumers with 25%+ of gross revenue from selling personal data; also vehicle manufacturers processing vehicle data.None (no dollar threshold)45 days (extendable by 45)Yes, since 2026-01-01None; 30-day cure expired 2026-01-01Oregon Attorney General / Department of Justice✓
Rhode IslandRhode Island Data Transparency and Privacy Protection Act (RIDTPPA)✓
R.I. Gen. Laws ch. 6-48.1 ↗		2026-01-01✓35,000+ Rhode Island consumers, or 10,000+ consumers with over 20% of gross revenue from selling personal data.✓None (no dollar threshold)45 days (extendable by 45)NoNone✓Rhode Island Attorney General✓
TennesseeTennessee Information Protection Act (TIPA)
Tenn. Code Ann. § 47-18-3201 et seq. (2023 Pub. Ch. 408) ↗		2025-07-01Revenue over $25M AND either 175,000+ Tennessee consumers, or 25,000+ consumers with over 50% of gross revenue from selling personal info.$25,000,000 annual revenue (required in addition to a consumer test)45 days (extendable by 45)No60 days after AG notice; no sunsetTennessee Attorney General and Reporter (exclusive)
TexasTexas Data Privacy and Security Act (TDPSA)✓
Tex. Bus. & Com. Code ch. 541 (HB 4, 2023) ↗		2024-07-01✓No consumer-count threshold: applies to anyone doing business in Texas (or offering products/services consumed by Texans) who processes or sells personal data, unless an SBA-defined small business.✓None (SBA small-business exemption instead)45 days (extendable by 45)Yes, since 2025-01-0130 days; no sunset✓Texas Attorney General (Consumer Protection Division)✓
UtahUtah Consumer Privacy Act (UCPA)✓
Utah Code Title 13, ch. 61 ↗		2023-12-31✓Annual revenue of $25M+ AND either 100,000+ Utah consumers, or 25,000+ consumers with over 50% of gross revenue from selling personal data.✓$25,000,000 annual revenue (required in addition to a consumer test)45 days (extendable by 45)No30 days after notice; no sunset✓Utah Attorney General; Division of Consumer Protection investigates and refers✓
VermontVermont Data Privacy and Online Surveillance Act (S.71, Act 145, signed 2026-06-16)✓
9 V.S.A. ch. 61A (S.71, Act 145 of 2026) ↗		2028-01-01✓35,000+ Vermont consumers (excluding payment-only data), or sensitive data of 3,000+ consumers, or offered for sale personal data of 3,000+ consumers. Consumer health data rules apply regardless of volume.✓None (no dollar threshold)45 days (extendable by 45); appeals within 60 daysYes60 days, only from 2028-01-01 to 2029-06-30✓Vermont Attorney General (exclusive)✓
VirginiaVirginia Consumer Data Protection Act (VCDPA)✓
Va. Code §§ 59.1-575 to 59.1-584 ↗		2023-01-01✓Controls or processes personal data of 100,000+ Virginia consumers per year, or 25,000+ consumers and over 50% of gross revenue from selling personal data.✓None (no dollar threshold)45 days (extendable by 45)No30 days after AG notice; no sunset✓Virginia Attorney General (exclusive)✓

Facts marked “Being verified” are still being confirmed and are not given as answers.

Sources

Official texts (checked 11 October 2026)

Attorney General guidance

Secondary analysis (law firms)

= confirmed by two independent sources, at least one official (state code or Attorney General). Unmarked figures come from law-firm analyses and are being confirmed statute by statute against the official texts listed below. Fully confirmed so far: Colorado, Kentucky, Louisiana, Maryland, Oklahoma, Rhode Island, Texas, Utah, Vermont, Virginia.