Home › State laws › Compare
STATE LAW COMPARISON
19 state privacy laws, side by side
Key applicability and enforcement features from the standardized research profiles. Select a state for the full profile and official sources. Last full review: August 26, 2026.
| State | Effective | Applicability threshold | Universal opt-out | Enforcement | Private action |
|---|---|---|---|---|---|
| CaliforniaCCPA / CPRA | January 1, 2020; major CPRA provisions January 1, 2023 | Current statutory thresholds are adjusted periodically; verify against CPPA's current monetary-threshold publication. | Yes / opt-out preference signals | California Privacy Protection Agency + Attorney General | Limited — specified security breaches |
| ColoradoCPA | July 1, 2023 | 100,000 consumers; or 25,000 consumers plus revenue/discount from sale of personal data | Yes — qualifying universal opt-out mechanisms | Colorado Attorney General / district attorneys | No |
| ConnecticutCTDPA | July 1, 2023 | 35,000 consumers; processing sensitive data; or offering personal data for sale, subject to statutory qualifications | Yes — since January 1, 2025 | Connecticut Attorney General | No general private action |
| DelawareDPDPA | January 1, 2025 | 35,000 consumers; or 10,000 consumers and >20% gross revenue from sale | Required under the Act's opt-out framework | Delaware Department of Justice / Attorney General | No |
| IndianaICDPA | January 1, 2026 | 100,000 consumers; or 25,000 consumers and >50% gross revenue from sale | No broad standalone UOOM requirement identified in this baseline | Indiana Attorney General | No |
| IowaICDPA | January 1, 2025 | 100,000 consumers; or 25,000 consumers and >50% gross revenue from sale | Not generally required in the baseline statute | Iowa Attorney General | No |
| KentuckyKCDPA | January 1, 2026 | 100,000 consumers; or 25,000 consumers and >50% gross revenue from sale | No broad standalone UOOM requirement identified in this baseline | Kentucky Attorney General — Office of Data Privacy | No |
| MarylandMODPA | October 1, 2025 | 35,000 consumers; or 10,000 consumers and >20% gross revenue from sale | Opt-out mechanisms apply; verify implementation details against current official guidance | Maryland Attorney General | No MODPA private enforcement right identified in official guidance |
| MinnesotaMCDPA | July 31, 2025 | 100,000 consumers; or 25,000 consumers plus >25% gross revenue from sale | Yes / opt-out preference mechanisms form part of the framework | Minnesota Attorney General | No general private action under MCDPA |
| MontanaMCDPA | October 1, 2024 | 25,000 consumers; or 15,000 consumers and >25% gross revenue from sale | Authorized-agent / technology-based opt-out mechanisms recognized | Montana Attorney General | No |
| NebraskaNDPA | January 1, 2025 | No classic consumer-count threshold; applies broadly to entities processing/selling personal data unless they qualify as a federal Small Business Act small business | Opt-out rights and authorized mechanisms apply under the Act | Nebraska Attorney General | No general private action |
| New HampshireNHDPA | January 1, 2025 | 35,000 consumers; or 10,000 consumers and >25% gross revenue from sale | Authorized-agent / technology opt-out mechanisms supported | New Hampshire Attorney General | No |
| New JerseyNJDPL | January 15, 2025 | 100,000 consumers; or 25,000 consumers plus revenue/discount from sale of personal data | Yes — statutory universal opt-out mechanism requirement | New Jersey Office of the Attorney General / Division of Consumer Affairs | No |
| OregonOCPA | July 1, 2024; nonprofits July 1, 2025 | 100,000 consumers; or 25,000 consumers and >25% gross revenue from sale; certain motor-vehicle manufacturers are covered regardless of threshold | Yes — required from January 1, 2026 | Oregon Attorney General | No |
| Rhode IslandRIDTPPA | January 1, 2026 | 35,000 customers; or 10,000 customers and >20% gross revenue from sale for core controller provisions | Authorized-agent opt-out supported; no Colorado-style standalone registry | Rhode Island Attorney General | No general private action |
| TennesseeTIPA | July 1, 2025 | Annual revenue >$25M and either 175,000 consumers, or 25,000 consumers plus 50% gross revenue from sale | No broad standalone UOOM requirement identified in this baseline | Tennessee Attorney General | No |
| TexasTDPSA | July 1, 2024 | No classic consumer-count threshold; small businesses under the federal SBA definition are generally exempt, except for sale of sensitive data without consent | Statutory opt-out mechanisms; verify signal implementation against current Texas guidance | Texas Attorney General | No |
| UtahUCPA | December 31, 2023 | Annual revenue ≥$25M and either 100,000 consumers, or 25,000 consumers plus >50% gross revenue from sale | Not generally required by the baseline UCPA | Utah Division of Consumer Protection / Attorney General | No |
| VirginiaVCDPA | January 1, 2023 | 100,000 consumers; or 25,000 consumers and >50% gross revenue from sale | No broad standalone UOOM mandate in the baseline framework | Virginia Attorney General | No |
Thresholds and statutory details change. Treat this table as a starting point and confirm against the official sources linked in each state profile.
Research and educational material only. Not legal advice. Time-sensitive legal requirements should be verified against current authoritative sources.