Developments noted in each state profile as of the last full review, plus changes to this site. Future-effective, proposed and pending measures are kept separate from current law.
Three Guide topics now answer the questions people search for, with verified deadlines and sources. Examples: COPPA’s amended rule has applied since April 22, 2026, and the HIPAA Security Rule overhaul is now targeted for July 2027.
New profiles on notice deadlines for individuals and attorneys general, from primary sources. California's fixed 30-day deadline took effect January 1, 2026.
New entry points for different readers, a side-by-side table of 19 state laws and this updates page.
The Complete Guide is organized into ten focused topic pages. Source content: Guide v0.1, July 10, 2026.
All state privacy law profiles were checked against official statutes, regulator guidance and government publications.
Reviewed August 26, 2026. Check each profile's official sources for anything newer.
2026 CCPA regulations and Delete Act/DROP rules are in force. CPPA also lists preliminary rulemaking topics separately; preliminary activity is not current law.
Colorado continues to use rulemaking to operationalize the CPA; universal opt-out requirements are already part of the live compliance framework.
The Attorney General publishes recurring CTDPA enforcement reports. Expanded minors protections are in force; additional youth measures have later effective dates.
Monitor amendments and official DOJ guidance; pending changes must not be treated as current law until effective.
The law is now in force. Any administrative rulemaking should be tracked separately from the statute.
The 2026 Iowa Code retains Chapter 715D as the operative comprehensive privacy framework.
KCDPA is in force and the Office of Data Privacy now provides consumer and business guidance.
MODPA is in force. Nonprofits are generally not categorically exempt, which increases practical reach.
Postsecondary institutions regulated by the Office of Higher Education have a later compliance date of July 31, 2029. Chapter 325M also contains separate social-media provisions.
2025 amendments changed core scope and added minors-focused sections. The current code, not the original 2023 text, should be used.
The Attorney General maintains dedicated controller, processor and consumer guidance and complaint resources.
Since January 1, 2026, the Attorney General may decide whether to offer a cure opportunity based on statutory factors.
The temporary mandatory 30-day cure period ran only through the first 18 months after effectiveness. Rulemaking must be tracked separately from the statute.
As of January 1, 2026, the AG no longer has to provide notice and an opportunity to cure. Sale of precise geolocation is prohibited and UOOM requirements are in force.
The comprehensive chapter took effect January 1, 2026. Any separate AI consumer-protection activity should be tracked as a different regulatory layer.
TIPA is in force. The Tennessee Attorney General has published business and consumer guidance.
The Attorney General provides a dedicated complaint route and compliance overview.
The current code flags future changes effective in 2027. Those provisions are not presented here as current 2026 law.
The 2026 code includes amended definitions and minors provisions. Current code should be used rather than older summaries.