United States state privacy law, act by act

Nineteen states have a comprehensive privacy act. The table shows the application date, the threshold as the text writes it and whether the text grants a right to correction. Every row links to the statute at the state's own publisher.

Read against source 2026-08-22 · 19

• CO · Applies 2023-07-01

  Colorado Privacy Act

  Colo. Rev. Stat. §§ 6-1-1301 to 6-1-1313

  100,000 consumers, or 25,000 consumers with revenue or a discount from the sale of personal data.

  Correction: Yes

  Official text

• CT · Applies 2023-07-01

  Connecticut CTDPA

  Conn. Gen. Stat. §§ 42-515 to 42-525

  100,000 consumers, or 25,000 consumers with more than a quarter of gross revenue from the sale of personal data.

  Correction: Yes

  Official text

• DE · Applies 2025-01-01

  Delaware DPDPA

  Del. Code tit. 6, ch. 12D

  35,000 consumers, or 10,000 consumers with more than a fifth of gross revenue from the sale of personal data.

  Correction: Yes

  Official text

• FL · Applies 2024-07-01

  Florida Digital Bill of Rights

  Fla. Stat. § 501.701 et seq.

  Global gross revenue above 1,000,000,000 dollars together with one of the stated business criteria.

  Correction: Yes

  Official text

• IN · Applies 2026-01-01

  Indiana CDPA

  Ind. Code § 24-15

  100,000 consumers, or 25,000 consumers with more than half of gross revenue from the sale of personal data.

  Correction: Yes

  Official text

• IA · Applies 2025-01-01

  Iowa ICDPA

  Iowa Code ch. 715D

  100,000 consumers, or 25,000 consumers with revenue from the sale of personal data.

  Correction: Not stated

  Official text

• KY · Applies 2026-01-01

  Kentucky KCDPA

  Ky. Rev. Stat. §§ 367.3611 to 367.3639

  100,000 consumers, or 25,000 consumers with more than half of gross revenue from the sale of personal data.

  Correction: Yes

  Official text

• MD · Applies 2025-10-01

  Maryland MODPA

  Md. Code, Com. Law § 14-4601 et seq.

  35,000 consumers, or 10,000 consumers with more than a fifth of gross revenue from the sale of personal data.

  Correction: Yes

  Official text

• MN · Applies 2025-07-31

  Minnesota MCDPA

  Minn. Stat. § 325O.01 et seq.

  100,000 consumers, or 25,000 consumers with more than a quarter of gross revenue from the sale of personal data.

  Correction: Yes

  Official text

• MT · Applies 2024-10-01

  Montana MTCDPA

  Mont. Code § 30-14-2801 et seq.

  50,000 consumers, or 25,000 consumers with revenue from the sale of personal data.

  Correction: Yes

  Official text

• NE · Applies 2025-01-01

  Nebraska NDPA

  Neb. Rev. Stat. § 87-1101 et seq.

  No consumer number threshold. Applies to entities that are not small businesses under the SBA definition.

  Correction: Yes

  Official text

• NH · Applies 2025-01-01

  New Hampshire Privacy Act

  N.H. Rev. Stat. ch. 507-H

  35,000 consumers, or 10,000 consumers with more than a quarter of gross revenue from the sale of personal data.

  Correction: Yes

  Official text

• NJ · Applies 2025-01-15

  New Jersey NJDPA

  N.J.S.A. 56:8-166.4 et seq.

  100,000 consumers, or 25,000 consumers where the controller receives any benefit from the sale of personal data.

  Correction: Yes

  Official text

• OR · Applies 2024-07-01

  Oregon OCPA

  Or. Rev. Stat. §§ 646A.570 to 646A.589

  100,000 consumers, or 25,000 consumers with more than a quarter of annual revenue from the sale of personal data.

  Correction: Yes

  Official text

• RI · Applies 2026-01-01

  Rhode Island DTPPA

  R.I. Gen. Laws ch. 6-48.1

  35,000 customers, or 10,000 customers with more than a fifth of gross revenue from the sale of personal data.

  Correction: Yes

  Official text

• TN · Applies 2025-07-01

  Tennessee TIPA

  Tenn. Code § 47-18-3201 et seq.

  Revenue above 25,000,000 dollars together with a consumer volume threshold.

  Correction: Yes

  Official text

• TX · Applies 2024-07-01

  Texas TDPSA

  Tex. Bus. & Com. Code ch. 541

  No consumer number threshold. Applies to any entity doing business in Texas that is not a small business under the SBA definition.

  Correction: Yes

  Official text

• UT · Applies 2023-12-31

  Utah UCPA

  Utah Code §§ 13-61-101 to 13-61-404

  Annual revenue of 25,000,000 dollars or more, together with a consumer volume threshold.

  Correction: Not stated

  Official text

• VA · Applies 2023-01-01

  Virginia CDPA

  Va. Code §§ 59.1-575 to 59.1-585

  100,000 consumers, or 25,000 consumers with more than half of gross revenue from the sale of personal data.

  Correction: Not stated

  Official text

The table restates what the publisher writes. It is not an assessment of whether a given business is in scope, and it is not legal advice.

To the US rules