State Privacy Laws

Why do states have their own privacy laws?

Because there is no comprehensive federal privacy law. Growing public concern about online advertising, large-scale data collection and social media led states to act, and California’s consumer privacy law set the model that others adapted. Because companies operating nationally cannot ignore California, many redesigned their privacy programs around broader principles that work across states.

Each legislature still decides for itself who is covered, which data is protected, which rights apply, who enforces and what the penalties are, so compliance with one state’s law does not automatically satisfy another’s.

Which states have comprehensive privacy laws?

This site profiles 19 states whose comprehensive privacy laws are in force. Details come from our profiles, last verified August 26, 2026:

California · Colorado · Connecticut · Delaware · Indiana · Iowa · Kentucky · Maryland · Minnesota · Montana · Nebraska · New Hampshire · New Jersey · Oregon · Rhode Island · Tennessee · Texas · Utah · Virginia

Compare them side by side in the comparison table or follow new developments on the Updates page.

Does a state law apply to my business?

Usually when you do business in the state or target its residents, and meet that state’s threshold. Where your company is based does not decide it: the laws attach to the residents whose data you process, so a business in one state can be covered by another state’s law.

Thresholds follow a few models (simplified here, check each profile for the exact test):

Many laws also exempt certain organizations or data, such as data already covered by HIPAA or GLBA. Whether the exemption applies to the whole entity or only to that data differs by state. Several laws, including Delaware’s and Maryland’s, reach many nonprofits.

Do state privacy laws cover employee and business contact data?

Mostly no. Most comprehensive state laws are written for consumers acting in a personal or household context and exempt employee and business-to-business data. California is the notable exception: the CCPA also covers personal information about employees and business contacts. Check the state profile when HR or B2B data is in scope.

What rights do residents get?

The common package is access, correction, deletion, portability, and the right to opt out of the sale of personal data, targeted advertising and certain profiling. Some states add more: Oregon lets people ask for a list of specific third-party recipients, Connecticut covers access to certain inferences, and California adds a right to limit use of sensitive information plus rules on automated decision-making technology under its 2026 regulations.

Rights packages are not uniform. Iowa is narrower, with access, deletion, portability and opt-out of sale. Utah offers access, deletion of data the consumer provided, portability, and opt-out of sale and targeted advertising. See Consumer Privacy Rights for how each right works.

What counts as sensitive data, and is consent needed?

Definitions vary, but sensitive data usually includes health information, biometrics, precise geolocation, religious beliefs, genetic data, sexual orientation, citizenship status and children’s data. Most states require opt-in consent before processing it.

Iowa and Utah take a lighter approach: notice and a chance to opt out. Maryland goes the other way, prohibiting the sale of sensitive data and limiting its processing to what is strictly necessary for a product or service the consumer requested.

What is a universal opt-out signal?

A setting in a browser or device that tells every site you visit that you opt out of sale or targeted advertising, instead of making you opt out site by site. Our profiles show explicit requirements to honor these signals in California, Colorado, Connecticut (since January 1, 2025), New Jersey and Oregon (since January 1, 2026). Other states handle opt-out mechanisms differently or do not require signals, so businesses operating across states usually build to the strictest rule.

Who enforces these laws, and what are the penalties?

State attorneys general enforce most of them. California also has a dedicated regulator, the California Privacy Protection Agency, and Kentucky created an Office of Data Privacy inside its Attorney General’s office. Most laws give no general private right to sue; California allows it for certain data breaches.

Penalty levels differ. Iowa, Kentucky, Tennessee, Texas, Virginia and Oregon cite up to $7,500 per violation, Maryland up to $10,000 (and $25,000 for later violations), and New Jersey up to $10,000 for a first offense and $20,000 after that. Cure periods are shrinking: Oregon no longer requires notice and a chance to cure as of January 1, 2026, and New Hampshire’s Attorney General now decides case by case whether to offer one.

How do the laws treat children and teens?

Quickly changing. Oregon prohibits sale of under-16 data and targeted advertising or profiling of under-16s from 2026. New Jersey requires consent for targeted advertising, sale or profiling when the controller knows or willfully disregards that a consumer is 13 to 16. Connecticut’s 2026 amendments add limits on targeted advertising, sale, addictive design, precise geolocation and profiling involving minors. Virginia’s code adds duties for known children, and Montana added minors-focused provisions in 2025. Under-13 data also runs into COPPA; see federal laws.

Which state is the strictest?

It depends on the measure. Our research flags Maryland as one of the most restrictive for its strict-necessity limits on data minimization and sensitive data. California is the broadest, with its own regulator, a large regulatory code and 2026 rules on automated decision-making, risk assessments and cybersecurity audits. Colorado and Connecticut are often used as operational benchmarks outside California. Iowa and Utah are the lightest.

Do state laws replace federal laws?

No, they sit on top. A healthcare provider still follows HIPAA, a bank still follows GLBA, and both consider state privacy law where it applies, along with breach notification statutes. A federal bill that would preempt most state laws, the SECURE Data Act, has had a hearing but is not law. See Federal Data Laws.

What does compliance involve in practice?

More than a privacy notice update. Organizations typically need:

• A data inventory and records of how data is used.
• Clear privacy notices and a working request process, including identity verification.
• Opt-out handling, including signals where required.
• Vendor and processor contracts.
• Data protection assessments for higher-risk processing.
• Retention and security controls, incident response and staff training.

Larger organizations often assign a dedicated privacy office to coordinate legal, IT, security and marketing.

How fast do these laws change?

Quickly. Indiana, Kentucky and Rhode Island took effect on January 1, 2026. Montana lowered its thresholds in 2025. Virginia and Connecticut added minors provisions. Oregon and New Hampshire changed cure rules. Because summaries age fast, use current statute text and attorney general guidance, and check the “last verified” date on each profile.