State Privacy Law Expansion

With limited federal action, twenty states have enacted comprehensive data privacy laws as of June 2025. Although these laws share common themes, their unique requirements create a complex compliance landscape for businesses.

Pre-June 2024

The first was the California Consumer Privacy Act of 2018 (“CCPA”), effective January 1, 2020.

California expanded consumer protections with the California Privacy Rights Act of 2020 (“CPRA”). The CCPA was the first state law to establish comprehensive privacy rights and business requirements governing the collection and sale of consumers’ personal information. Other states followed suit.

Virginia passed the Consumer Data Protection Act, which became effective on January 1, 2023. This law grants consumers the ability to request data-related actions from specific businesses and imposes further restrictions on how businesses can handle “sensitive data.”

The Colorado Privacy Act, effective July 1, 2023, sets out five key rights for consumers: the right to access, the right to correction, the right to deletion, the right to data portability, and the right to opt out. The acts in both Colorado and Virginia exclude publicly available data and data that is not identifiable to an individual.

The Connecticut Data Privacy Act, effective on July 1, 2023, followed a similar framework to earlier laws but incorporated stronger protections for children.

Utah’s similar legislation went into effect on December 31, 2023.

Except for California, these states grant their respective attorneys general the authority to enforce privacy laws through civil investigative demands.

Expansion

Iowa

The Iowa Consumer Data Protection Act (“ICDPA”), considered more business-friendly because of its looser consumer protections, was signed on March 28, 2023, and became effective on January 1, 2025, giving businesses 21 months to comply.

A business falls within the scope of Iowa’s privacy law if it controls or processes personal data of at least 100,000 Iowa consumers, about 3 percent of the state’s population, during a calendar year. Alternatively, a business that derives more than 50% of its gross revenue from the sale of personal data falls within the scope of the ICDPA if it controls or processes the personal data of at least 25,000 Iowa consumers. The ICDPA differs from other state privacy laws in that it lacks a revenue threshold for covered entities.

Under the ICDPA, consumers have four main rights: the right to access, the right to delete, the right to portability, and the right to opt out of the sale of their personal data.

Those consumer rights echo those found in other state privacy laws; however, the ICDPA does not provide consumers with the right to correct personal data or the right to opt out of fully automated decisions or certain processes, such as targeted advertising and profiling. Unlike Colorado, Connecticut, and Virginia, Iowa does not require opt-in for “sensitive data” processing; instead, it requires covered entities to provide notice and an opportunity to opt out. Additionally, while the ICDPA imposes certain obligations on covered entities, as do other states’ laws, it does not require businesses to conduct data protection or privacy risk assessments. While the ICDPA provides protections similar to those of other comprehensive state privacy laws, the rights and obligations are less rigid regarding business compliance.

Indiana

Indiana’s governor signed the Indiana Consumer Data Protection Act (“INCDPA”) on May 1, 2023.

The INCDPA became effective on January 1, 2026, and has a scope and applicability similar to its predecessors. The law includes data exemptions in line with other state privacy laws. The INCDPA only applies to personal data collected from individuals who are Indiana residents. Unlike the CCPA and the CPRA, the INCDPA expressly excludes personal data collected or processed from individuals acting in a commercial context, such as business-to-business activities. Like most other comprehensive state privacy laws, the INCDPA exempts state political subdivisions and entities, nonprofit organizations, institutions of higher education, and any information or data regulated by certain other privacy laws, including the Health Insurance Portability and Accountability Act (“HIPAA”), and the Gramm-Leach-Bliley Act (“GLB Act”).

The INCDPA utilizes the regulatory framework of the European Union’s General Data Protection Regulation, which distinguishes between, and imposes different responsibilities on, “controllers” and “processors.” Indiana’s law defines a “controller” as “a person that, alone or jointly with others, determines the purpose and means of processing personal data,” while a “processor” is defined as “a person that processes personal data on behalf of a controller.”

Certain comprehensive state privacy laws, such as Indiana's, rely on this distinction to impose obligations on businesses, while other state laws do not. Under Indiana’s law, controllers and processors must enter into written contracts that govern the processor’s data processing procedures performed on behalf of the controller. The processor must comply with the controller’s instructions and assist the controller in meeting its applicable obligations under the INCDPA and other laws.

The INCDPA includes the same consumer protections as most other comprehensive state privacy laws. Consumers retain the right to access, correct, delete, port, and opt out.

The INCDPA does not provide any additional guidance on how controllers must, from a technical perspective, offer and process consumer opt-out requests, but it requires that controllers provide consumers with the ability to opt out of the sale of their personal data. This opt-out right under Indiana’s law highlights an area where these state privacy laws have diverged. Enforcement authority under the INCDPA is exclusively exercised by Indiana’s Attorney General. In that regard, Indiana differs from California, which provides consumers with a private right of action and which established a dedicated privacy agency to enforce the CCPA and the CPRA.

Tennessee

 The Tennessee Information Protection Act (“TIPA”) took effect on July 1, 2025.

TIPA is similar to the more “business-friendly” state laws enacted in Virginia, Iowa, and Utah. While the TIPA extends important privacy protections, several key provisions signal weaker protections for consumers than those provided by the CCPA and CPRA. The TIPA is notably more restricted in its applicability, employing both a revenue threshold of $25 million and a data processing threshold.

Like the INCDPA, the TIPA includes a regulatory framework for controllers and processors, with required processing agreements that set forth clear instructions for processing personal information, including the nature and purpose of processing, the type of data subject to processing, the duration of processing, and the parties’ rights and obligations.

The TIPA grants Tennessee’s Attorney General the exclusive right of enforcement to seek various forms of relief, including declaratory judgment, injunctive relief, civil penalties, attorney’s fees and investigative costs. However, unlike other state privacy laws of this kind, Tennessee is the first state to provide controllers with an explicit affirmative defense. The law creates a safe harbor for any controller or processor that creates, maintains, and complies with a written privacy policy that reasonably conforms to the NIST privacy framework or other documented policies, standards, and procedures designed to safeguard consumer privacy.

Texas

 The Texas Data Privacy and Security Act (“TDPSA”), effective July 1, 2024, provides broad consumer protections that align with California’s and Virginia’s data privacy laws. The scope of the TDPSA is notably broad, with the law applying to any entity that conducts business in Texas or produces a product or service consumed by Texas residents and processes or engages in the sale of personal data, excluding, among other specified entities, any small business as defined by the U.S. Small Business Administration (“SBA”).

Oregon

The Oregon Consumer Privacy Act (“OCPA”), effective on July 1, 2024, is one of the stronger state data privacy laws.

The OCPA imposes more stringent requirements on businesses and provides broader consumer protections than other states, including protections for sensitive, biometric, and children’s data. An enforcement report from the state highlighted the law's unique features. Specifically, the OCPA was the first state law to give consumers the right to obtain a list of the specific third parties to which the controller disclosed their data; it widely defines “sensitive data” to include gender identity and crime victim status; and it expands data protections for two groups of children—those under thirteen, and those aged thirteen to fifteen. The most common deficiencies requiring cure by businesses include the following: failure to notify consumers of their rights, inadequate disclosures of third parties purchasing consumer data, use of confusing privacy notices, and inadequate or “burdensome rights mechanisms.”

Montana

The Montana Consumer Data Privacy Act (“MCDPA”), effective on October 1, 2024, is largely modeled after Connecticut’s privacy law with a right for consumers to opt out of the processing of personal data for profiling and targeted advertising. Like other recently enacted state privacy laws, the MCDPA originally provided that the Montana Attorney General notify businesses of any noncompliance with the act and allow a 60-day period to cure any such noncompliance before commencing any enforcement action; the enforcement limitation was originally scheduled to last until April 1, 2026. The Montana Attorney General retains the exclusive right to enforce the MCDPA, which does not specify a maximum civil penalty. While the MCDPA is not substantively different in its consumer protections from other state privacy laws, the uncertainty around its penalty structure sets it apart unfavorably. Amendments to the MCDPA, which took effect on October 1, 2025, expanded its scope (encompassing more businesses), increased data protections for minors, narrowed exemptions for third-party administrators, and clarified and expanded out requirements.

Florida

The Florida Digital Bill of Rights (“FDBR”) went into effect on July 1, 2024, offering similar consumer protections; however, its significantly high jurisdictional threshold subjects fewer entities to the law. The FDBR primarily targets big tech companies by imposing obligations only on a controller that has an annual global revenue of more than $1 billion and meets one of the following additional requirements:

• Derives fifty percent of its global gross annual revenue from the sale of advertisements online;

• Operates a consumer smart speaker and voice command service with an integrated virtual assistant connected to a cloud computing service that uses hands-free verbal activation; or  

• Operates an app store or digital distribution platform with at least 250,000 different software applications for consumers to download and install.

Delaware

The Delaware Personal Data Privacy Act (“DPDPA”), effective as of January 1, 2025, stands in stark contrast to Florida’s law, particularly regarding jurisdictional thresholds. The DPDPA applies to any controller or processor that either (1) controlled or processed the personal data of at least 35,000 consumers (excluding personal data controlled or processed solely for the purpose of completing a payment transaction), or (2) controlled or processed the personal data of at least 10,000 consumers and derived more than twenty percent of its gross revenue from the sale of personal data. That 35,000-consumer threshold is among the lowest among states that regulate data privacy, and the 20% revenue threshold is also relatively low. The broad applicability of the law, along with its other provisions, provides comparatively more robust consumer protections.

New Hampshire

New Hampshire passed the New Hampshire Privacy Act (“NHPA”), effective on January 1, 2025.

The NHPA imposes obligations on any controller that processes the data of at least 35,000 residents annually, or 10,000 residents if more than 25% of its gross revenue is derived from selling personal data. Under the law, consumers have rights consistent with those in other states’ data privacy regimes. The NHPA provides consumers with the right to confirm whether a controller is processing their data, to correct inaccuracies, to delete personal data, to obtain their data (portability), and to opt out. The NHPA specifically requires controllers to provide universal opt-out mechanisms and obtain consumer consent prior to processing sensitive data. Like most other state laws, the NHPA grants the N.H. Attorney General the “exclusive authority to enforce” compliance with the act, and the act provides no “private right of action.”

For one year after the NHPA’s effective date, controllers will have a 60-day period to cure alleged violations before any enforcement action. However, beginning January 1, 2026, the cure period will be discretionary, with the N.H. Attorney General considering several factors, such as the number of violations, the size and complexity of the controller or processor, the likelihood of harm to the public, and whether the alleged violation was likely caused by human or technical error. The N.H. Attorney General can ultimately pursue injunctive relief or civil penalties of up to $10,000 per violation.

Nebraska

The Nebraska Data Privacy Act (“NDPA”) took effect on January 1, 2025.

The NDPA applies to businesses transacting in Nebraska or targeting its residents that also process or sell personal data. Like Texas’s privacy law, the NDPA excludes any “small business,” as federally defined by the SBA. The NDPA provides consumers with the five core rights included in many other state privacy laws: the right to confirm whether a business is processing their data; the right of data portability; the right to correct inaccuracies; the right to delete; and the right to opt out of the sale of personal data, targeted advertising, and profiling in furtherance of automated decisions. The law provides for damages of up to $7,500 per violation, plus attorney's fees and expenses, and is enforced solely by the Nebraska Attorney General. Businesses are provided thirty days to cure any alleged violations.

New Jersey

The New Jersey Data Privacy Act (“NJDPA”) took effect on January 15, 2025, with a more consumer-friendly data privacy law that demands more of businesses like Connecticut and Colorado. The NJDPA applies to entities that do business in the state and handle the personal data of at least 100,000 consumers per year, or at least 25,000 consumers per year if the entity also sells personal data. The jurisdictional requirement does not include a minimum annual revenue threshold, unlike some other state laws, meaning the NJDPA's provisions could apply to comparatively small businesses. Under the law, New Jersey residents are given the same comprehensive privacy protections afforded in similar state laws; however, the NJDPA explicitly requires that entities recognize universal opt-out mechanisms.

Additionally, the NJDPA imposes several obligations on controllers and processors of personal data. Controllers are required to limit the collection of personal data to what is adequate, relevant, and reasonably necessary for the disclosed purpose for which the data is processed.

The provisions impose requirements on a controller’s data security, the processing of sensitive data, and the access to minors’ data. Controllers are also required to provide consumers with a mechanism to revoke their consent to the processing of their data. Like other state laws, controllers must have binding contracts with processors that specify the nature and purpose of the processing, provide instructions for how the processing should be carried out, and outline the rights and responsibilities of both parties. Under these agreements, processors must meet several obligations, including deleting or returning all personal data to the controller upon the controller’s request upon completion of the services. Additionally, controllers must conduct data protection assessments for certain data activities that present a “heightened risk of harm” to consumers. The NJDPA is enforced exclusively by the state’s attorney general, with a temporary cure provision that sunsets 18 months after the law takes effect.

Minnesota

The Minnesota Consumer Data Privacy Act (“MCDPA”), effective on July 31, 2025, establishes consumer protections similar to those in other states' privacy laws, but also grants consumers additional rights regarding automated profiling decisions. Specifically, the MCDPA grants consumers the right to challenge the results of a controller’s profiling. That protection includes the right to be informed of the reasons profiling led to a specific decision, the right to be informed of actions to secure a different decision in the future, the right to review the data used in profiling, and the right to correct inaccurate data for reevaluation. Like California, Connecticut, New Jersey, and Texas, Minnesota requires controllers to provide consumers with universal opt-out mechanisms to opt out of the processing of their personal data. Further, the law requires that controllers conduct a data protection impact assessment regarding certain classes of data use, including targeted advertising; processing sensitive data; selling personal data; any processing activities involving personal data with a heightened risk of consumer harm; and processing data for profiling, if the profiling presents a reasonably foreseeable risk of unfair or deceptive treatment, unlawful disparate impact on consumers, intrusion upon a consumer’s solitude or private affairs, or other substantial injury to consumers.

Minnesota’s law applies to entities that handle the personal data of at least 100,000 consumers annually, or 25,000 consumers annually if the entity derives more than 25% of its revenue from the sale of data.

An exemption applies to any “small business,” as defined by the SBA. Like other state laws, the MCDPA exempts certain data governed by other regimes, including financial data regulated by the GLB Act; protected health information governed by HIPAA; consumer credit-reporting data; and data covered by the Drivers’ Privacy Protection Act, the Family Educational Rights and Privacy Act, the Fair Credit Reporting Act, and the Farm Credit Act.

Maryland

The Maryland Online Data Privacy Act (“MODPA”) took effect on October 1, 2025, imposes more stringent privacy standards on businesses compared to other states’ laws. Although the law shares some similarities with other states’ laws regarding exemptions and defined roles, several key aspects of the MODPA set it apart. The MODPA sets a broader scope with its jurisdictional threshold. The law applies to any business that handles the personal data of at least 35,000 residents annually, or 10,000 residents annually if the business derives more than 20% of its revenue from the sale of data. The 35,000-resident threshold is less than 1% of the state’s population, suggesting the law will apply to a larger share of businesses transacting in the state.

The MODPA imposes additional obligations on controllers than other state privacy laws. Controllers are restricted from collecting, processing, and sharing sensitive data, except where it is “reasonably necessary and proportionate” to provide or maintain a specific product or service requested by the consumer.

Further, controllers are prohibited from selling sensitive data, defined as data that reveals a consumer’s racial/ethnic origin, religious beliefs, consumer health, sex life, sexual orientation, status as a transgender or nonbinary person, national origin, or citizenship/immigration status. Under the law, sensitive data also includes genetic data or biometric data, personal data of a consumer the controller knows to be a child, and precise geolocation data. In addition to requiring this data minimization from the outset, the MODPA also requires controllers to conduct “data protection assessments” on a “regular basis.” Finally, Maryland’s law imposes steeper penalties for violations, as they are considered unfair, abusive, or deceptive trade practices under the Maryland Consumer Protection Act (“MCPA”). The state attorney general enforces the MCPA, which carries penalties of $10,000 per violation or $25,000 for each repeat of the same violation.

Kentucky

The Kentucky Consumer Data Protection Act (“KCDPA”), effective on January 1, 2026, applies to businesses that handle the personal data of at least 100,000 residents annually, or 25,000 residents annually if the business makes more than half of its gross revenue from the sale of personal data. The KCDPA contains data and entity exemptions similar to those in other state privacy laws; however, Kentucky’s law more narrowly defines sensitive data under the KCDPA, “sensitive data” includes data indicating racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, processing genetic or biometric data for the purpose of identifying a specific person, personal data of a known child, and precise geolocation data. The KCDPA provides consumer rights and controller obligations that are largely similar to other comprehensive state privacy laws. The state’s attorney general retains the exclusive right of enforcement and may seek penalties of $7,500 per violation. Businesses are granted the opportunity to remedy violations within thirty days without penalty, and unlike with other state privacy laws, this cure provision will not sunset.

Rhode Island

The Rhode Island Data Transparency and Privacy Protection Act (“RIDPA”), took effect on January 1, 2026.

The RIDPA generally applies to any business that handles the personal data of at least 35,000 residents annually, or 10,000 residents annually if the business derives more than 20% of its revenue from the sale of data. However, certain RIDPA provisions apply to any commercial website or internet service provider that conducts business in the state, has customers in the state, or is otherwise subject to the state’s jurisdiction. Under the law, consumers have the right to confirm what data a business collects, the right to correct their data, the right to data portability, and the right to opt out of certain uses. As with most state privacy laws, the attorney general retains the exclusive authority to enforce the RIDPA, and individual consumers lack a private right of action. The penalties under the law are notably different from those in other states. The attorney general may seek fines between $100 and $500 for each intentional disclosure of personal data in violation of the law or to a shell company or entity formed to circumvent the law’s intent.

Conclusion

States are enacting privacy laws, increasing protections nationwide. This highlights regulatory scrutiny on data-collecting businesses, stressing the need for compliance. While this blog focused on comprehensive state laws, others are passing narrower ones, which businesses should also consider. Several states have considered their own privacy laws too. As the legal landscape evolves, businesses must carefully monitor their data responsibilities.