Complete Database

U.S. State Privacy Laws

Every state privacy law — comprehensive status, consumer rights summary, and effective dates. Filter by status or search by state name.

Filter:

States with Active Privacy Laws

22
🌴
California
CCPA / CPRA
✅ Active
Effective: Jan 1, 2020 / Jan 1, 2023
The nation's most comprehensive state privacy law — grants access, deletion, correction, and opt-out of sale and sharing.
Read Full Analysis →
🏛️
Virginia
CDPA
✅ Active
Effective: Jan 1, 2023
Consumer Data Protection Act — strong rights for access, correction, deletion, portability, and opt-out of sale and targeted advertising.
Read Full Analysis →
⛰️
Colorado
CPA
✅ Active
Effective: July 1, 2023
Colorado Privacy Act — requires universal opt-out (GPC) support, data protection assessments, and broad consumer rights.
Read Full Analysis →
🏠
Connecticut
CTDPA
✅ Active
Effective: July 1, 2023
One of the strongest state laws — requires GPC support, treats data of consumers under 18 as sensitive, broad rights.
Read Full Analysis →
🏔️
Utah
UCPA
✅ Active
Effective: Dec 31, 2023
Utah Consumer Privacy Act — business-friendly dual threshold but includes opt-out rights for sale and targeted advertising.
Read Full Analysis →
⭐
Texas
TDPSA
✅ Active
Effective: July 1, 2024
Texas Data Privacy and Security Act — no minimum data volume threshold; applies to any for-profit business processing Texans' data.
Read Full Analysis →
🌊
Florida
FDBR
✅ Active
Effective: July 1, 2024
Florida Digital Bill of Rights — scoped to large tech companies ($1B+ revenue) but provides strong rights for covered services.
Read Full Analysis →
🦌
Montana
MCDPA
✅ Active
Effective: Oct 1, 2024
Montana Consumer Data Privacy Act — lower 50K consumer threshold than most states; full consumer rights suite.
Read Full Analysis →
🌲
Oregon
OCPA
✅ Active
Effective: July 1, 2024
One of the most expansive state laws — fewer exemptions, includes nonprofits (July 2025), and broader data definitions.
Read Full Analysis →
💼
Delaware
DPDPA
✅ Active
Effective: Jan 1, 2025
Very low 35K consumer threshold — one of the broadest scopes of any state law; strong consumer rights across the board.
Read Full Analysis →
🌽
Iowa
ICDPA
✅ Active
Effective: Jan 1, 2025
Iowa Consumer Data Protection Act — Virginia-model law with a 90-day cure period and opt-out rights for sale and targeted ads.
Read Full Analysis →
🌧️
Washington
My Health MY Data Act
✅ Active
Effective: Mar 31, 2024
Groundbreaking health data law extending protection beyond HIPAA — covers apps, wearables, geofencing near clinics. Private right of action.
Read Full Analysis →
🍁
New Hampshire
NHPA
✅ Active
Effective: Jan 1, 2025
New Hampshire Privacy Act — low 35K consumer threshold, full consumer rights, opt-in for sensitive data.
Read Full Analysis →
🌾
Nebraska
NDPA
✅ Active
Effective: Jan 1, 2025
No minimum data volume threshold — the broadest applicability of any state law (subject to SBA small business exemption).
Read Full Analysis →
🏙️
New Jersey
NJDPA
✅ Active
Effective: Jan 15, 2025
Escalating penalty structure — first violation $10K, subsequent $20K; full consumer rights suite with profiling opt-out.
Read Full Analysis →
🎸
Tennessee
TIPA
✅ Active
Effective: July 1, 2025
Tennessee Information Protection Act — NIST framework safe harbor; standard consumer rights and opt-in for sensitive data.
Read Full Analysis →
❄️
Minnesota
MNDPA
✅ Active
Effective: July 31, 2025
Includes data broker registration requirements; broad consumer rights and plain-language privacy notice requirements.
Read Full Analysis →
🦀
Maryland
MODPA
✅ Active
Effective: Oct 1, 2025
Strong data minimization requirements; prohibits targeted ads to minors; low 35K threshold. One of the most progressive new laws.
Read Full Analysis →
🏁
Indiana
INCDPA
✅ Active
Effective: Jan 1, 2026
Indiana Consumer Data Protection Act — Virginia-model law with full consumer rights and opt-in for sensitive data categories.
Read Full Analysis →
🏇
Kentucky
KCDPA
✅ Active
Effective: Jan 1, 2026
Kentucky Consumer Data Protection Act — close alignment with Virginia CDPA; full consumer rights suite and 30-day cure period.
Read Full Analysis →
⚓
Rhode Island
RIDPPA
✅ Active
Effective: Jan 1, 2026
Rhode Island Data Transparency and Privacy Protection Act — emphasis on plain-language notices, 35K threshold, full rights.
Read Full Analysis →
🍂
Vermont
Act 140
✅ Active
Effective: Jan 1, 2025 (partial)
First state with data broker registration (2018); Act 140 adds full consumer privacy rights — unique two-track framework.
Read Full Analysis →

States with Pending or Proposed Laws

5+

States Without a Comprehensive Privacy Law

~23
🐘
Alabama
No comprehensive law
🦅
Alaska
No comprehensive law
🍑
Georgia
No comprehensive law
🌺
Hawaii
No comprehensive law
🥔
Idaho
No comprehensive law
🎰
Louisiana
No comprehensive law
🦞
Maine
ISP data only
🚗
Michigan
No comprehensive law
🎺
Mississippi
No comprehensive law
🌉
Missouri
No comprehensive law
🎲
Nevada
Opt-out of sale only
🌶️
New Mexico
No comprehensive law
🏔️
North Carolina
No comprehensive law
🌾
North Dakota
No comprehensive law
🌻
Ohio
No comprehensive law
🔔
Pennsylvania
No comprehensive law
🌴
South Carolina
No comprehensive law
🌄
South Dakota
No comprehensive law
🏔️
West Virginia
No comprehensive law
🧀
Wisconsin
No comprehensive law
🤠
Wyoming
No comprehensive law
💎
Arkansas
No comprehensive law
🦞
Massachusetts
No comprehensive law (bills active)

No states found

Try a different search term or filter.