ہوم › قوانین کی لائبریری › امریکی ریاستوں کے پرائیویسی قوانین
US
امریکی ریاستوں کے پرائیویسی قوانین
کیلیفورنیا سے باہر صارفین کی پرائیویسی کے جامع قوانین، حدوں اور آخری تاریخوں کے ساتھ۔
ذرائع کے ساتھ · 79/116 حقائق کی دو ذرائع سے تصدیق ہوئی. آخری تصدیق 11 اکتوبر، 2026
23 states, plus California's CCPA. Several laws take effect in 2027 and 2028; check each state's “In force from” date.
| ریاست | قانون | نافذ از | کون شامل ہے | آمدنی کی حد | درخواست کی آخری تاریخ | آپٹ آؤٹ سگنلز کی پابندی لازمی | اصلاح کی مہلت | نافذ کرنے والا ادارہ |
|---|---|---|---|---|---|---|---|---|
| Alabama | Alabama Personal Data Protection Act (HB 351, 2026)✓ Ala. HB 351 (2026), enrolled ↗ | 2027-05-01✓ | More than 25,000 Alabama consumers (excluding payment-only data), or over 25% of gross revenue from selling personal data. Businesses with fewer than 500 employees (nonprofits fewer than 100) exempt if they do not sell personal data. | None (no dollar threshold) | تصدیق جاری ہے | تصدیق جاری ہے | 45 days (mandatory) | Alabama Attorney General (exclusive) |
| Colorado | Colorado Privacy Act (CPA)✓ C.R.S. § 6-1-1301 et seq. (SB21-190) ↗ | 2023-07-01✓ | 100,000+ Colorado consumers per year, or 25,000+ consumers and any revenue or discount from selling personal data.✓ | None (no dollar threshold) | 45 days (extendable by 45) | Yes, since 2024-07-01 | None; general 60-day cure ended 2025-01-01✓ | Colorado Attorney General and district attorneys✓ |
| Connecticut | Connecticut Data Privacy Act (CTDPA), as amended by SB 1295✓ Conn. Gen. Stat. ch. 743jj, § 42-515 et seq. (as amended by PA 25-113) ↗ | 2023-07-01 (major amendments 2026-07-01)✓ | From 2026-07-01: 35,000+ Connecticut consumers, OR any processing of sensitive data, OR any sale of personal data (previously 100,000 / 25,000 + 25% revenue).✓ | None (no dollar threshold) | 45 days (extendable by 45) | Yes, since 2025-01-01 | No mandatory cure since 2024-12-31; AG may offer one at its discretion | Connecticut Attorney General (exclusive)✓ |
| Delaware | Delaware Personal Data Privacy Act (DPDPA); amendments effective 2027-01-01 (85 Del. Laws c. 463)✓ 6 Del. C. ch. 12D ↗ | 2025-01-01 | 35,000+ Delaware consumers, or 10,000+ consumers with over 20% of gross revenue from selling personal data. | None (no dollar threshold) | 45 days (extendable by 45) | Yes, since 2026-01-01 | Discretionary since 2026-01-01 (DOJ may offer a chance to cure); the mandatory 60-day cure expired 2025-12-31.✓ | Delaware Department of Justice✓ |
| Florida | Florida Digital Bill of Rights (FDBR) - narrow scope, excluded from some trackers (e.g., IAPP)✓ Fla. Stat. §§ 501.701 to 501.722 ↗ | 2024-07-01 | Full obligations only for for-profits with $1B+ global revenue meeting a tech-platform criterion (e.g., ad revenue, smart speaker, app store). Sensitive-data sale rules apply to any for-profit doing business in Florida. | $1,000,000,000 global annual revenue | تصدیق جاری ہے | No (statute silent) | 45 days, at AG discretion; not available for children's-data violations✓ | Florida Attorney General (Department of Legal Affairs)✓ |
| Indiana | Indiana Consumer Data Protection Act (INCDPA) Ind. Code art. 24-15 ↗ | 2026-01-01 | 100,000+ Indiana consumers, or 25,000+ consumers with over 50% of gross revenue from selling personal data. | None (no dollar threshold) | 45 days (extendable by 45) | No | 30 days; no sunset | Indiana Attorney General (exclusive) |
| Iowa | Iowa Consumer Data Protection Act (ICDPA) Iowa Code ch. 715D ↗ | 2025-01-01 | 100,000+ Iowa consumers, or more than 25,000 consumers with over 50% of gross revenue from selling personal data.✓ | None (no dollar threshold) | 90 days (extendable once by 45) | No | 90 days after AG notice; no sunset✓ | Iowa Attorney General (exclusive)✓ |
| Kentucky | Kentucky Consumer Data Protection Act (KCDPA); amended by 2026 HB 692 (smart-TV/ACR data consent), effective 2027-07-01✓ KRS 367.3611 to 367.3629 ↗ | 2026-01-01✓ | 100,000+ Kentucky consumers, or 25,000+ consumers with over 50% of gross revenue from selling personal data.✓ | None (no dollar threshold) | 45 days (extendable by 45) | No | 30 days; no sunset✓ | Kentucky Attorney General (exclusive)✓ |
| Louisiana | Louisiana Data Privacy Act (SB 386, Act 502 of 2026)✓ La. R.S. 51:1780.1 to 1780.5 (SB 386, Act 502 of 2026) ↗ | 2027-01-01✓ | Any one of: annual gross revenue over $25M; buys, receives, sells or shares personal info of 75,000+ Louisiana consumers, households or devices; or 50%+ of annual revenue from selling personal info.✓ | $25,000,000 annual gross revenue (standalone trigger) | 45 days (extendable by 45); appeals within 60 days | تصدیق جاری ہے | 30 days, only from 2027-01-01 to 2027-07-31✓ | Louisiana Attorney General (exclusive)✓ |
| Maryland | Maryland Online Data Privacy Act (MODPA)✓ Md. Code, Com. Law § 14-4701 et seq. ↗ | 2025-10-01✓ | 35,000+ Maryland consumers (excluding payment-only data), or 10,000+ consumers with over 20% of gross revenue from selling personal data.✓ | None (no dollar threshold) | 45 days (extendable by 45); appeals within 60 days | Yes. | Discretionary (60 days if offered) until 2027-04-01✓ | Maryland Attorney General (Consumer Protection Division)✓ |
| Minnesota | Minnesota Consumer Data Privacy Act (MCDPA) Minn. Stat. §§ 325M.10 to 325M.21 ↗ | 2025-07-31 | 100,000+ Minnesota consumers, or 25,000+ consumers with over 25% of gross revenue from selling personal data. | None (no dollar threshold) | 45 days (extendable by 45) | Yes. | None now. | Minnesota Attorney General✓ |
| Montana | Montana Consumer Data Privacy Act (MCDPA), as amended by SB 297✓ Mont. Code Ann. § 30-14-2801 et seq.; enforcement § 30-14-2817 (as amended by SB 297, 2025) ↗ | 2024-10-01 (amendments 2025-10-01) | From 2025-10-01: 25,000+ Montana consumers, or 15,000+ consumers with over 25% of gross revenue from selling personal data (previously 50,000 / 25,000). Minors' provisions apply regardless of volume. | None (no dollar threshold) | 45 days (extendable by 45) | Yes | None. SB 297 (2025) removed the notice-and-cure right from 1 Oct 2025; the Attorney General can act without offering a cure (Mont. Code Ann. § 30-14-2817).✓ | Montana Attorney General (Office of Consumer Protection)✓ |
| Nebraska | Nebraska Data Privacy Act (LB 1074, 2024)✓ Neb. Rev. Stat. §§ 87-1101 to 87-1130 ↗ | 2025-01-01 | No consumer-count threshold: applies to anyone doing business in Nebraska who processes or sells personal data, unless an SBA-defined small business.✓ | None (SBA small-business exemption instead) | 45 days (extendable by 45) | Yes | 30 days; no sunset✓ | Nebraska Attorney General✓ |
| New Hampshire | New Hampshire Data Privacy Act (RSA ch. 507-H)✓ N.H. RSA ch. 507-H ↗ | 2025-01-01✓ | 35,000+ New Hampshire consumers, or 10,000+ consumers with over 25% of gross revenue from selling personal data. | None (no dollar threshold) | 45 days (extendable by 45) | Yes | None; 60-day cure expired 2025-12-31 | New Hampshire Attorney General (Department of Justice, Consumer Protection) |
| New Jersey | New Jersey Data Privacy Act (NJDPA) P.L.2023, c.266 (N.J.S.A. 56:8-166.4 et seq.) ↗ | 2025-01-15 | 100,000+ New Jersey consumers, or 25,000+ consumers with any revenue or price discount from selling personal data. | None (no dollar threshold) | 45 days (extendable by 45) | Yes | None; 30-day cure expired July 2026 (2026-07-15 per one source) | New Jersey Attorney General (Division of Consumer Affairs) |
| Oklahoma | Oklahoma SB 546 (2026), consumer data privacy act (Title 75A, §§ 300–320)✓ Okla. SB 546 (2026), enrolled; to be codified at 75A O.S. §§ 300–320 ↗ | 2027-01-01✓ | Businesses that operate in Oklahoma or target its residents and, in a calendar year, control or process personal data of at least 100,000 consumers, or at least 25,000 consumers while deriving over 50% of gross revenue from selling personal data.✓ | None (no dollar threshold) | 45 days, extendable once by 45 days when reasonably necessary; appeals must be decided within 60 days.✓ | No | 30 days: the Attorney General must give written notice at least 30 days before suing and cannot sue if the violation is cured; no sunset.✓ | Oklahoma Attorney General (exclusive); civil penalty up to $7,500 per violation; no private right of action.✓ |
| Oregon | Oregon Consumer Privacy Act (OCPA)✓ ORS 646A.570 to 646A.589 ↗ | 2024-07-01✓ | 100,000+ Oregon consumers, or 25,000+ consumers with 25%+ of gross revenue from selling personal data; also vehicle manufacturers processing vehicle data. | None (no dollar threshold) | 45 days (extendable by 45) | Yes, since 2026-01-01 | None; 30-day cure expired 2026-01-01 | Oregon Attorney General / Department of Justice✓ |
| Rhode Island | Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA)✓ R.I. Gen. Laws ch. 6-48.1 ↗ | 2026-01-01✓ | 35,000+ Rhode Island consumers, or 10,000+ consumers with over 20% of gross revenue from selling personal data.✓ | None (no dollar threshold) | 45 days (extendable by 45) | No | None✓ | Rhode Island Attorney General✓ |
| Tennessee | Tennessee Information Protection Act (TIPA) Tenn. Code Ann. § 47-18-3201 et seq. (2023 Pub. Ch. 408) ↗ | 2025-07-01 | Revenue over $25M AND either 175,000+ Tennessee consumers, or 25,000+ consumers with over 50% of gross revenue from selling personal info. | $25,000,000 annual revenue (required in addition to a consumer test) | 45 days (extendable by 45) | No | 60 days after AG notice; no sunset | Tennessee Attorney General and Reporter (exclusive) |
| Texas | Texas Data Privacy and Security Act (TDPSA)✓ Tex. Bus. & Com. Code ch. 541 (HB 4, 2023) ↗ | 2024-07-01✓ | No consumer-count threshold: applies to anyone doing business in Texas (or offering products/services consumed by Texans) who processes or sells personal data, unless an SBA-defined small business.✓ | None (SBA small-business exemption instead) | 45 days (extendable by 45) | Yes, since 2025-01-01 | 30 days; no sunset✓ | Texas Attorney General (Consumer Protection Division)✓ |
| Utah | Utah Consumer Privacy Act (UCPA)✓ Utah Code Title 13, ch. 61 ↗ | 2023-12-31✓ | Annual revenue of $25M+ AND either 100,000+ Utah consumers, or 25,000+ consumers with over 50% of gross revenue from selling personal data.✓ | $25,000,000 annual revenue (required in addition to a consumer test) | 45 days (extendable by 45) | No | 30 days after notice; no sunset✓ | Utah Attorney General; Division of Consumer Protection investigates and refers✓ |
| Vermont | Vermont Data Privacy and Online Surveillance Act (S.71, Act 145, signed 2026-06-16)✓ 9 V.S.A. ch. 61A (S.71, Act 145 of 2026) ↗ | 2028-01-01✓ | 35,000+ Vermont consumers (excluding payment-only data), or sensitive data of 3,000+ consumers, or offered for sale personal data of 3,000+ consumers. Consumer health data rules apply regardless of volume.✓ | None (no dollar threshold) | 45 days (extendable by 45); appeals within 60 days | Yes | 60 days, only from 2028-01-01 to 2029-06-30✓ | Vermont Attorney General (exclusive)✓ |
| Virginia | Virginia Consumer Data Protection Act (VCDPA)✓ Va. Code §§ 59.1-575 to 59.1-584 ↗ | 2023-01-01✓ | Controls or processes personal data of 100,000+ Virginia consumers per year, or 25,000+ consumers and over 50% of gross revenue from selling personal data.✓ | None (no dollar threshold) | 45 days (extendable by 45) | No | 30 days after AG notice; no sunset✓ | Virginia Attorney General (exclusive)✓ |
جن حقائق پر “تصدیق جاری ہے” لکھا ہے ان کی ابھی تصدیق ہو رہی ہے اور انہیں جواب کے طور پر نہیں دیا جاتا۔
پارٹنر
Termly
Create and maintain a privacy policy, cookie banner and request forms.
Create your privacy policy with Termlyپارٹنر لنک: آپ خریدیں تو آپ پر کسی اضافی لاگت کے بغیر ہمیں کمیشن مل سکتا ہے۔ اس کا ہمارے قانونی مواد پر کبھی اثر نہیں ہوتا۔ ملحقہ (affiliate) انکشاف
ذرائع
Official texts (checked 11 October 2026)
- Alabama: Ala. HB 351 (2026), enrolled
- Colorado: C.R.S. § 6-1-1301 et seq. (SB21-190)
- Connecticut: Conn. Gen. Stat. ch. 743jj, § 42-515 et seq. (as amended by PA 25-113) (Attorney General page)
- Delaware: 6 Del. C. ch. 12D
- Florida: Fla. Stat. §§ 501.701 to 501.722
- Indiana: Ind. Code art. 24-15
- Iowa: Iowa Code ch. 715D
- Kentucky: KRS 367.3611 to 367.3629
- Louisiana: La. R.S. 51:1780.1 to 1780.5 (SB 386, Act 502 of 2026)
- Maryland: Md. Code, Com. Law § 14-4701 et seq.
- Minnesota: Minn. Stat. §§ 325M.10 to 325M.21
- Montana: Mont. Code Ann. § 30-14-2801 et seq.; enforcement § 30-14-2817 (as amended by SB 297, 2025)
- Nebraska: Neb. Rev. Stat. §§ 87-1101 to 87-1130
- New Hampshire: N.H. RSA ch. 507-H
- New Jersey: P.L.2023, c.266 (N.J.S.A. 56:8-166.4 et seq.)
- Oklahoma: Okla. SB 546 (2026), enrolled; to be codified at 75A O.S. §§ 300–320 (Enrolled bill text page)
- Oregon: ORS 646A.570 to 646A.589
- Rhode Island: R.I. Gen. Laws ch. 6-48.1
- Tennessee: Tenn. Code Ann. § 47-18-3201 et seq. (2023 Pub. Ch. 408) (Attorney General page)
- Texas: Tex. Bus. & Com. Code ch. 541 (HB 4, 2023)
- Utah: Utah Code Title 13, ch. 61
- Vermont: 9 V.S.A. ch. 61A (S.71, Act 145 of 2026)
- Virginia: Va. Code §§ 59.1-575 to 59.1-584
Attorney General guidance
- Indiana: https://www.in.gov/attorneygeneral/files/Indiana-Consumer-Data-Protection_Consumer-Bill-of-Rights_CDPCBOR.pdf
- Kentucky: https://ag.ky.gov/about/Office-Divisions/ODP/KCDPA/Pages/default.aspx
- Maryland: https://oag.maryland.gov/resources-info/Pages/data-privacy.aspx
- Minnesota: https://ag.state.mn.us/Data-Privacy/
- Nebraska: https://protectthegoodlife.nebraska.gov/data-privacy-homepage/
- New Hampshire: https://doj.nh.gov/news-and-media/attorney-general-formella-announces-creation-new-data-privacy-unit
- New Jersey: https://njconsumeraffairs.gov/ocp/Pages/NJ-Data-Privacy-Law-FAQ.aspx
- Oregon: https://www.doj.state.or.us/consumer-protection/id-theft-data-breaches/privacy/
- Texas: https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint/consumer-privacy-rights/texas-data-privacy-and-security-act
- Virginia: https://www.oag.state.va.us/consumer-protection/files/tips-and-info/Virginia-Consumer-Data-Protection-Act-Summary-7-1-26.pdf
Secondary analysis (law firms)
- https://www.afslaw.com/perspectives/privacy-counsel/new-year-new-privacy-obligations
- https://www.akingump.com/en/insights/blogs/ag-data-dive/tennessee-information-protection-act-what-businesses-need-to-know
- https://www.bassberry.com/news/big-sky-bigger-privacy-montana-broadens-its-consumer-data-privacy-act/
- https://www.dwt.com/blogs/privacy--security-law-blog/2026/06/louisiana-data-privacy-act-sb-386
- https://www.hunton.com/privacy-and-cybersecurity-law-blog/vermont-becomes-23rd-state-with-comprehensive-consumer-privacy-law
- https://www.mayerbrown.com/en/insights/publications/2026/04/alabama-enacts-comprehensive-consumer-data-privacy-law
- https://www.mayerbrown.com/zh-hans/insights/publications/2026/03/oklahoma-enacts-comprehensive-consumer-data-privacy-law
- https://www.swlaw.com/publication/connecticut-data-privacy-act-2026-amendments/
- https://www.wsgrdataadvisor.com/2023/04/the-sixth-state-iowa-enacts-comprehensive-privacy-law/
= confirmed by two independent sources, at least one official (state code or Attorney General). Unmarked figures come from law-firm analyses and are being confirmed statute by statute against the official texts listed below. Fully confirmed so far: Colorado, Kentucky, Louisiana, Maryland, Oklahoma, Rhode Island, Texas, Utah, Vermont, Virginia.