Tennessee Information Protection Act
TIPA · Normalized Research Card v2.1
IN FORCELAST VERIFIED · AUG 26 2026At a glance
Who must comply?
Applicability model: Revenue + numerical hybrid.
Core threshold: Annual revenue >$25M and either 175,000 consumers, or 25,000 consumers plus 50% gross revenue from sale
Applicability remains subject to statutory entity, data-level and activity-specific exemptions. Employment/B2B treatment and federal-law carve-outs should be read together with the official statute linked below.
Consumer rights
| Right / protection | Status |
|---|---|
| Access / confirmation | ✓ Included / qualified by statute |
| Correction | ✓ Included / qualified by statute |
| Deletion | ✓ Included / qualified by statute |
| Portability | ✓ Included / qualified by statute |
| Opt-out sale | ✓ Included / qualified by statute |
| Opt-out targeted advertising | ✓ Included / qualified by statute |
| Opt-out qualifying profiling | ✓ Included / qualified by statute |
Sensitive data & minors
Sensitive-data standard: Consent-based protections
Known-child processing interacts with COPPA and sensitive-data rules.
Business obligations
Privacy notices, minimization, security, processor contracts and assessments for heightened-risk processing.
Enforcement
Authority: Tennessee Attorney General
Private right of action: No
Penalty / remedy baseline: Up to $7,500 per violation; enhanced remedies may apply to willful/knowing violations
What makes Tennessee different?
Tennessee is distinctive for its high $25 million revenue gate and its statutory affirmative-defense concept tied to a written privacy program reasonably conforming to the NIST Privacy Framework or comparable standards.
Developments to watch
TIPA is in force. The Tennessee Attorney General has published business and consumer guidance.
Editorial rule: future-effective, proposed and pending measures are kept separate from current law.
Primary sources & verification
Last verified: August 26, 2026
Research standard: primary official sources prioritized; official guidance used to explain operational requirements.