Each US state with a comprehensive privacy law sets its own rules on who the law applies to, which rights consumers get, and what happens in case of a violation. Today, 20 state privacy laws are in force (counting Florida’s narrower Digital Bill of Rights), and 4 more take effect in 2027 and 2028.
This table compares them side by side: when each law takes effect, who it applies to and protects, the rights it grants, privacy notice, tracker and opt-out rules, consent for sensitive data, and penalties. Use the checkboxes to show only the states you need.
Disclaimer
This table doesn’t provide exhaustive guidance on each law and how it applies. For more information, check the official texts linked in the sources below.
This table gives an overview of the state privacy laws in the United States that have been recently adopted or are expected to pass soon.
The effective date of the bills that have not been passed yet and the content thereof may be subject to changes. The rights granted to users indicated in the table are identified through standard denominations. Although such denominations can overlap, the name attributed in each legislation, the content and the details relating to their exercise may differ.
Laws already in force (highlighted in green)
Laws adopted but not yet in force (highlighted in yellow)
No comprehensive privacy law yet (highlighted in light red)
US state privacy laws compared
Questions
Nevada
California
Colorado
Virginia
Connecticut
Utah
Oregon
Texas
Montana
Iowa
Kentucky
New Jersey
Delaware
New Hampshire
Nebraska
Florida
Tennessee
Maryland
Illinois
Minnesota
Alabama
Oklahoma
Louisiana
Vermont
Washington
New York
Massachussetts
Arizona
Maine
Indiana
Rhode Island
Date of entry into force
First enacted in 2017 and subsequently amended in 2019 and 2021
California Privacy Rights Act (CPRA)
Effective January 1, 2023
Colorado Privacy Act
Effective July 1, 2023
Virginia Consumer Data Protection Act (VCDPA)
Effective January 1, 2023
An Act Concerning Personal Data Privacy and Online Monitoring
Effective July 1, 2023
Utah Consumer Privacy Act
Effective December 31, 2023
Oregon Consumer Privacy Act
Effective July 1, 2024
Texas Data Privacy and Security Act
Effective July 1, 2024
Consumer Data Privacy Act
Effective October 1, 2024
An Act Relating to Consumer Data Protection
Effective January 1, 2025
Kentucky Consumer Data Protection Act
Effective January 1, 2026
Effective Date: January 15, 2025
Effective Date: January 1, 2025
Effective Date: January 1, 2025
Effective Date: January 1, 2025
Florida Digital Bill of Rights
Effective July 1, 2024
Tennessee Information Protection Act (TIPA)
Effective July 1, 2025
Maryland Online Data Privacy Act (MODPA)
Effective October 1, 2025 (applies to processing from April 1, 2026)
No comprehensive privacy legislation currently available
Minnesota Consumer Data Privacy Act (MCDPA)
Effective July 31, 2025 (July 31, 2029 for certain postsecondary institutions)
Alabama Personal Data Protection Act
Effective May 1, 2027
Oklahoma Consumer Data Privacy Act (SB 546)
Effective January 1, 2027
Louisiana Data Privacy Act (SB 386)
Effective January 1, 2027
Vermont Data Privacy and Online Surveillance Act (S.71)
Effective January 1, 2028
No comprehensive privacy legislation currently available
No comprehensive privacy legislation currently available
No comprehensive privacy legislation currently available
No comprehensive privacy legislation currently available
No comprehensive privacy legislation currently available
Indiana Consumer Data Protection Act
Effective January 1, 2026
Data Transparency and Privacy Protection Act
Effective January 1, 2026
Does it apply to me?
The Nevada Privacy Law applies, among others, to operators, generally persons who own or operate websites or online services for commercial purposes, collect and maintain personally identifiable information from Nevada consumers, and direct their activities toward Nevada.
The law applies to you if you’re a legal entity doing business in California for profit, that collect consumers’ personal information, or on behalf of which such information is collected and alone, or jointly with others, determine the purposes and means of the processing of consumers’ personal information and that meet one or more of the following:
annual gross revenues in excess of $26,625,000;
annually buy, sell, or share the personal information of 100,000 or more consumers or households; and/or
derive 50% or more of their annual revenues from selling, or
sharing consumers’ personal information.
The law applies to you if you’re a legal entity that does business in Coloradoorproduces commercial products or services that intentionally targets Colorado residents and
controls or processes personal data of at least 100K consumers per year, or
control or process the personal data of at least 25,000 consumers and derive revenue (or receive a discount on the price of goods or services) from the sale of personal data.
The law applies to you if you’re a person that does business in Virginiaorwho targets Virginia residents and:
controls or processes personal data of at least 100K consumers per year, or
controls or processes personal data of at least 25K consumers and with over 50% of the gross revenue coming from the sale of personal data.
The law applies to you if you’re a Business (whether based in Connecticut or not) that targets Connecticut residents and that:
during a calendar year, control or process personal data of at least 35,000 consumers (since July 1, 2026; previously 100,000); or
control or process consumers’ sensitive data, or offer consumers’ personal data for sale (no volume threshold).
The law applies to any controller or processor who conducts business in Utah or produces a product or service that is targeted to residents of Utah, has annual revenue of $25,000,000 minimum, and satisfies one or more of the following:
during a calendar year, controls or processes personal data of 100,000 or more consumers; or
derives over 50% of the entity’s gross revenue from the sale of personal data and controls or processes personal data of 25,000 or more consumers.
The law applies to any person that conducts business in Oregon, or that provides products or services to residents of Oregon, and that during a calendar year, controls or processes the personal data of:
100,000 or more consumers, other than personal data controlled or processed solely for the purpose of completing a payment transaction; or
25,000 or more consumers, while deriving 25 percent or more of its annual gross revenue from selling personal data.
The law applies to any person conducting business in Texas or producing a product or service consumed by Texas residents and that:
processes or engages in the sale of personal data; and
is not a small business under the Small Business Administration (SBA).
However, even small businesses are required to obtain consumers’ consent for the sale of sensitive data.
The law applies to persons that conduct business in Montana, or that produce products or services that are targeted to Montana residents, and:
control or process the personal data of at least 25,000 consumers (since October 1, 2025; previously 50,000), excluding personal data controlled or processed for completing a payment transaction; or
control or process the personal data of at least 15,000 consumers and derive more than 25% of gross revenue from the sale of personal data.
The ICDPA applies to persons that conduct business in Iowa or offer products or services targeted at Iowa residents andDuring a calendar year, either:
Control or process the personal data of at least 100,000 consumers; or
Control or process the personal data of at least 25,000 consumers and derive over 50% of gross revenue from the sale of personal data.
Applies to for-profit businesses conducting business in Kentucky or targeting Kentucky residents that control or process personal data of 100,000 consumers, or 25,000 consumers if more than 50% of revenue is derived from selling personal data; nonprofits are excluded.
The NJDPA applies to businesses that Conduct business in New Jersey or offer products or services targeting New Jersey residents andDuring a calendar year, either:
Control or process personal data of at least 100,000 consumers (excluding data processed solely for payment transactions), or
Control or process the personal data of at least 25,000 consumers and derive revenue, or receive discounts on goods or services, from the sale of personal data.
This law applies to businesses that operate in Delaware or offer products or services to Delaware residents and:
process the personal data of at least 35,000 consumers (excluding data solely related to payment transactions)
process the personal data of at least 10,000 consumers and derive more than 20% of gross revenue from selling personal data.
The NHDPA applies to businesses that Conduct business in New Hampshire or offer products or services targeted to New Hampshire residents andDuring a calendar year, either:
Control or process the personal data of at least 35,000 consumers (excluding data processed solely for payment transactions), or
Control or process the personal data of at least 10,000 consumers and derive more than 25% of their revenue from the sale of personal data.
The NDPA applies to businesses that:
Conduct business in Nebraska or produce products or services consumed by Nebraska residents;
Process or engage in the sale of personal data; and
Are not classified as small businesses under the federal Small Business Act. Small businesses must still obtain consent before selling sensitive data. Non-profits are exempt.
For-profit businesses doing business in Florida with global gross annual revenue over $1 billion that also derive at least 50% of revenue from online ad sales, operate a consumer smart speaker and voice command service, or operate an app store with at least 250,000 apps. The ban on selling sensitive data without consent applies to all for-profit businesses.
Persons doing business in Tennessee or targeting Tennessee residents with annual revenue over $25 million that, in a calendar year, control or process personal data of at least 175,000 consumers, or at least 25,000 consumers while deriving more than 50% of gross revenue from the sale of personal data.
Persons that conduct business in Maryland or target Maryland residents and, in a calendar year, control or process the personal data of at least 35,000 consumers (excluding payment-only data), or at least 10,000 consumers while deriving more than 20% of gross revenue from the sale of personal data. Most non-profits are covered.
Persons doing business in Minnesota or targeting Minnesota residents that, in a calendar year, control or process personal data of at least 100,000 consumers (excluding payment-only data), or at least 25,000 consumers while deriving more than 25% of gross revenue from the sale of personal data. Small businesses must still obtain consent before selling sensitive data. Most non-profits are covered.
Persons doing business in Alabama or targeting Alabama residents that process personal data of more than 25,000 consumers (excluding payment-only data), or derive more than 25% of gross revenue from the sale of personal data. Businesses with fewer than 500 employees, and non-profits with fewer than 100 employees, are exempt if they don’t sell personal data.
Persons doing business in Oklahoma or targeting Oklahoma residents that, in a calendar year, control or process personal data of at least 100,000 consumers, or at least 25,000 consumers while deriving more than 50% of gross revenue from the sale of personal data. Non-profits are exempt.
Persons doing business in Louisiana that have annual gross revenue over $25 million, or buy, receive, sell or share personal information of 75,000+ consumers, households or devices, or derive 50% or more of annual revenue from selling personal information. Non-profits are exempt.
Persons doing business in Vermont or targeting Vermont residents that control or process personal data of at least 35,000 consumers (excluding payment-only data), or sensitive data of at least 3,000 consumers, or sell personal data of at least 3,000 consumers. Consumer health data provisions apply regardless of thresholds.
Applies to for-profit businesses conducting business in Indiana or targeting Indiana residents that process data of 100,000 Indiana consumers, or 25,000 consumers if more than 50% of revenue comes from selling personal data; nonprofits are excluded.
Applies to for-profit entities conducting business in Rhode Island or targeting Rhode Island residents that process personal data of at least 35,000 customers (excluding data processed solely for payment transactions), or 10,000 customers if more than 20% of gross revenue is derived from the sale of personal data; nonprofits are excluded.
Who does it protect?
Nevada consumers
Consumers. Natural persons who reside in the state of California.
Consumers. An individual who is a Colorado resident acting only in an individual or household context.
Consumers. Natural persons who reside in the state of Virginia.
Consumers. A natural person who is a resident of Connecticut
Consumer. An individual who is a resident of the state acting in an individual or household context.
Consumers. Individuals who reside in the state of Oregon.
Consumers. Individuals who reside in the state of Texas.
Consumers. Individuals who reside in the state of Montana.
This legislation aims to safeguard the personal data of Iowa consumers
Kentucky residents/consumers
New Jersey consumers
Delaware consumers
New Hampshire consumers
Nebraska consumers
Consumers. Florida residents acting in an individual or household context.
Consumers. Tennessee residents acting in an individual or household context.
Consumers. Maryland residents acting in an individual or household context.
Consumers. Minnesota residents acting in an individual or household context.
Consumers. Alabama residents acting in an individual or household context.
Consumers. Oklahoma residents acting in an individual or household context.
Consumers. Louisiana residents acting in an individual or household context.
Consumers. Vermont residents acting in an individual or household context.
Indiana residents/consumers
Rhode Island residents/consumers
What rights does the law grant to users?
Right to Opt-Out of Sale: Nevada residents have the right to opt out of the sale of their personal information. Operators must establish a designated request address (e.g., an email address, toll-free number, or online form) for consumers to submit verified requests to opt out. Operators must respond within 60 days (with an optional 30-day extension, if necessary).
Right to know and access
Right to delete personal information
Right to correct inaccurate personal information
Right to opt out of the sale or sharing of personal information
Right to limit the use/disclosure of sensitive personal information
Right to non-discrimination for the exercise of consumers’ privacy rights
Rights of access and data portability
Right to correction
Right to deletion
Right to opt out of processing for purposes of targeted advertising, profiling, or the sale of personal data, and
right to appeal.
Rights of access and data portability
Right to erasure
Right to rectification
Right to opt out of processing for purposes of targeted advertising, profiling, or the sale of personal data.
Rights of access and data portability
Right to correction
Right to deletion
Right to opt out of processing for purposes of targeted advertising, profiling, or the sale of personal data, and
right to appeal.
Right of access
Right to rectification (from July 1, 2026)
Right to erasure
Right to data portability
Right to opt out of the processing of the consumer’s personal data for purposes of:
targeted advertising
the sale of personal data
Confirm whether the controller has or is processing their personal data and relevant categories of personal data;
Obtain, at the controller’s option, a list of specific third parties with whom the controller has shared their personal data;
Obtain a copy of all consumer’s personal data that the controller has processed or is processing (portable and, to the extent technically feasible, readily usable format);
Require the controller to correct inaccurate personal data;
Require the deletion of all personal data, including personal data the consumer provided to the controller, personal data the controller obtained from another source, and derived data;
Opt out of any processing activity performed for purposes of targeted advertising, sale of personal data, and profiling in furtherance of decisions that produce legal effects or effects of similar significance;
Not to be discriminated against for the exercise of rights
Confirm whether their personal data is being processed and access it;
correct inaccuracies;
deletion;
if available in digital format, obtain a copy of the personal data the consumer previously provided to the controller (portable and, to the extent technically feasible, readily usable format);
opt out of the processing for purposes of targeted advertising, sale, and profiling;
not to be discriminated against for the exercise of rights.
confirm whether a controller is processing their personal data and access it (unless confirmation/access would require the controller to reveal a trade secret);
obtain a copy of the consumer’s personal data (portable and, to the extent technically feasible, readily usable format that should allow the consumer to transmit data to another controller without hindrance when processing is performed with automated means);
request the controller to correct inaccurate personal data;
require the deletion of personal data;
opt out of processing activities performed for purposes of targeted advertising, sale of personal data, and profiling in furtherance of automated decisions that produce legal or similarly significant effects;
not to be discriminated against for the exercise of rights.
Access and Confirmation: Consumers can confirm whether a business is processing their personal data and access that data.
Data Portability: Consumers can obtain a copy of their personal data in a portable and, to the extent technically practicable, readily usable format that enables data transfer to another controller.
Deletion: Consumers can request the deletion of their personal data.
Opt-Out Rights: Consumers can opt out of the sale of their personal data. Controllers engaged in targeted advertising must disclose it and explain how to opt out (Iowa Code 715D.4(6)).
Non-Discrimination: Consumers must not be discriminated against for exercising their rights.
Grants consumers the right to access, correct, delete, and obtain a portable copy of their personal data, and to opt out of targeted advertising, data sales, and profiling that produces legal or similarly significant effects.
Access and Confirmation: Consumers can confirm whether their personal data is being processed and access that data (unless revealing the data would expose trade secrets).
Data Portability: Consumers can obtain a copy of their personal data in a portable, usable format that allows for easy transfer to another controller.
Correction: Consumers can request that inaccurate personal data be corrected.
Deletion: Consumers can request the deletion of their personal data.
Opt-Out Rights: Consumers can opt out of targeted advertising, the sale of their personal data, and certain profiling activities.
Non-Discrimination: Consumers cannot be discriminated against for exercising their rights.
Access and Confirmation: Consumers can ask if a business is processing their data and can access it, unless this would reveal trade secrets.
Data Copy in a Usable Format: individuals have the right to request a copy of their personal data in a format they can easily use or transfer to another entity.
Correction of Inaccurate Data: Consumers may request corrections to inaccurate personal data.
Deletion: Consumers can request the deletion of their personal data.
Opt-Out Options: Consumers can opt out of having their data used for targeted advertising, being sold, or profiling.
Non-Discrimination: Businesses are not allowed to treat consumers unfairly if they choose to exercise their DPDPA rights.
List of Third-Party Data Sharing: Consumers can request a list of the categories of third parties to which the business has disclosed their data (from January 1, 2027, a list of the specific third parties).
Access and Confirmation: Consumers can confirm whether their personal data is being processed and access it (unless revealing the data would expose trade secrets).
Data Portability: Consumers can obtain a copy of their personal data in a portable format, allowing easy transfer to another service provider.
Correction of Inaccurate Data: Consumers can request that inaccurate or incomplete data be corrected.
Deletion: Consumers can request the deletion of their personal data.
Opt-Out Rights: Consumers can opt out of the sale of their personal data, targeted advertising, and certain profiling activities.
Non-Discrimination: Consumers cannot be discriminated against for exercising their rights under the NHDPA.
Access and Confirmation: Consumers can confirm whether a controller is processing their personal data and access that data.
Correction: Consumers can request the correction of inaccurate personal data.
Deletion: Consumers can request the deletion of personal data they have provided or that has been obtained about them.
Data Portability: If the data is processed via automated means and in a digital format, consumers can request a copy of their personal data in a portable and usable format.
Opt-Out Rights: Consumers can opt out of the processing of personal data for purposes of targeted advertising, the sale of personal data, and profiling that leads to decisions with legal or similarly significant effects.
Non-Discrimination: Consumers cannot be discriminated against for exercising their rights under the NDPA.
Access, correction, deletion, portability, and opt-out of targeted advertising, sale, profiling, collection or processing of sensitive data (including precise geolocation), and collection through voice or facial recognition.
Access, correction, deletion, portability, and opt-out of targeted advertising, sale and profiling with legal or similarly significant effects.
Access, correction, deletion, portability, a list of categories of third parties to which data was disclosed, and opt-out of targeted advertising, sale and profiling with legal or similarly significant effects.
Access, correction, deletion, portability, a list of specific third parties to which data was disclosed, opt-out of targeted advertising, sale and profiling, and the right to question the result of profiling-based decisions.
Access, correction, deletion, portability, and opt-out of targeted advertising, sale and profiling for solely automated significant decisions.
Access, correction, deletion, portability, and opt-out of targeted advertising, sale (monetary consideration only) and profiling with legal or similarly significant effects.
Access, correction, deletion, portability, and opt-out of targeted advertising, sale and profiling for solely automated significant decisions.
Access, correction, deletion, portability, a list of third parties to which data was sold, opt-out of targeted advertising, sale and profiling, and the right to question profiling-based decisions.
Grants consumers the right to access, correct, delete, and obtain a portable copy of their personal data, and to opt out of targeted advertising, data sales, and certain profiling.
Grants consumers the right to access, correct, delete, and obtain a portable copy of their personal data, and to opt out of targeted advertising, sale of personal data, and profiling that produces legal or similarly significant effects.
Do I need to provide a privacy notice?
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES(including ‘NOTICE: We may sell your sensitive/biometric personal data’ statements where applicable)
YES(including whether personal data is used to train large language models)
Since July 15, 2025, businesses must provide consumers with an option to opt out of the sale of personal data, targeted advertising, and profiling through universal opt-out signals.
Starting January 1, 2026, businesses must honor consumers’ universal opt-out signals to opt out of targeted advertising and data sales.
Since January 1, 2025, businesses must allow consumers to opt out of the sale of their personal data and targeted advertising through universal opt-out signals.
NO
NO
NO
YES
YES
YES(controllers must follow a consumer’s opt-out preference signal where it conflicts with other settings; no technical standard is specified)
NO
YESwith limits (opt-out of targeted advertising and sale through an authorized agent, including a browser setting or extension or a global device setting; controllers may decline in limited cases, e.g. if they cannot verify Louisiana residency)
YES
NO
NO
Do I need to allow consumers to opt out of the processing of personal data with regard to certain purposes?
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
YES
Do I need to obtain consumers’ prior consent (opt-in) before processing sensitive data?
Not Applicable
NO
YES
YES
YES
NO
YES
YES
YES
Businesses can only process sensitive data if they offer consumers with a clear notice the opportunity to opt out. Please note that the processing of children’s sensitive data must align with the Children’s Online Privacy Protection Act (COPPA) (verifiable parental consent).
YES
YES
YES
YES
YES
YES
YES
Stricter than consent: sensitive data may be collected or processed only where strictly necessary to provide a requested product or service, and selling sensitive data is prohibited. Targeted advertising to, and sale of data of, consumers the controller knows or should know are under 18 is also prohibited.
YES(consent is also required for targeted advertising or sale where the controller knows the consumer is 13 to 16)
YES(consent is also required for targeted advertising or sale involving known 13-15 year olds)
YES
YES
YES(selling sensitive data or consumer health data also requires consent; targeted advertising to, and sale of data of, known 13-17 year olds is prohibited)
YES
YES
What are the consequences in case of violation?
Civil penalty for violation or injunction. Civil penalties up to $5,000 per violation.
Administrative fines or civil penalties of up to $2,663 per violation, or $7,988 per intentional violation or violation involving consumers under 16 (amounts adjusted from January 1, 2025). Enforced by the California Privacy Protection Agency and the Attorney General. Consumers have a private right of action for certain data breaches (statutory damages of $107 to $799 per consumer per incident).
Civil penalty of not more than $20,000 per violation.
Civil penalty of up to $7,500 for each violation.
Civil penalty of not more than $5,000 for each willful violation, plus expenses incurred by the Attorney General in investigating and preparing the case, including attorney fees.
By initiating an action, Attorney General may recover (i) actual damages to the consumer; and (ii) an amount not to exceed $7,500 for each violation.
The Attorney General may bring an action to seek a civil penalty of not more than $7,500 for each violation or to enjoin a violation or obtain other equitable relief.
A person who violates the obligations imposed under the law following the cure period or who breaches a written statement provided to the attorney general is liable for a civil penalty in an amount not to exceed $7,500 for each violation
The Attorney General may bring an action to seek a civil penalty. Since October 1, 2025, civil penalties of up to $7,500 per violation apply, and the 60-day cure period has been removed.
Non-compliance can result in civil penalties of up to $7,500 per violation, payable to the consumer education and litigation fund. The Attorney General must first give 90 days’ written notice to cure; this cure period does not expire.
Violations are enforced exclusively by the Kentucky Attorney General. Businesses receive a 30-day cure period after written notice. If violations are not cured or recur, the Attorney General may seek civil penalties of up to $7,500 per violation, plus investigation costs, court costs, and attorney’s fees. There is no private right of action for consumers.
Businesses that fail to comply with the law may be subject to civil penalties, which could result in significant financial consequences. The 30-day cure period expired on July 1, 2026. Violations are enforced by the Attorney General under the New Jersey Consumer Fraud Act (up to $10,000 for a first violation and $20,000 for subsequent ones).
Enforced by the Delaware Department of Justice; willful violations can lead to civil penalties of up to $10,000 per violation (6 Del. C. 2522). The mandatory 60-day cure period ended on December 31, 2025; since then, any cure opportunity is at the Department of Justice’s discretion.
The New Hampshire Attorney General’s Office has exclusive authority to enforce the NHDPA. Violations can lead to civil penalties of up to $10,000 per violation under the state consumer protection act (RSA 358-A). Businesses were given 60 days to remedy violations after receiving written notice until December 31, 2025; since January 1, 2026, any cure opportunity is at the Attorney General’s discretion.
The Nebraska Attorney General’s Office will have exclusive authority to enforce the NDPA. Non-compliance can result in civil penalties of up to $7,500 per violation, and businesses will have 30 days to remedy violations after receiving written notice.
Enforced by the Attorney General under the Florida Deceptive and Unfair Trade Practices Act; civil penalties of up to $50,000 per violation, tripled for violations involving known children, failure to delete or correct, or continued sale after an opt-out. 45-day cure period at the Attorney General’s discretion (not available for violations involving known children).
Enforced exclusively by the Attorney General; civil penalties of up to $7,500 per violation, which a court may triple for willful or knowing violations; permanent 60-day cure period. Affirmative defense for controllers with a privacy program aligned with the NIST Privacy Framework.
Enforced by the Attorney General; civil penalties of up to $10,000 per violation ($25,000 for repeat violations). Discretionary 60-day cure period until April 1, 2027. No private right of action.
Enforced by the Attorney General; civil penalties of up to $7,500 per violation. The 30-day cure period expired on January 31, 2026. No private right of action.
Enforced by the Attorney General; civil penalties of up to $15,000 per violation; permanent 45-day cure period. The law does not provide a private right of action.
Enforced exclusively by the Attorney General; civil penalties of up to $7,500 per violation; permanent 30-day cure period. No private right of action.
Enforced by the Attorney General under the Unfair Trade Practices and Consumer Protection Law; no private right of action. 30-day cure period until July 31, 2027.
Enforced by the Attorney General under the Consumer Protection Act (civil penalties of up to $10,000 per violation); no private right of action. Mandatory 60-day cure period until June 30, 2029.
Violations are enforced exclusively by the Attorney General. Businesses receive a 30-day cure period. If the violation is not cured or recurs, the Attorney General may seek injunctive relief and civil penalties of up to $7,500 per violation, as well as attorneys’ fees and investigation costs. There is no private right of action.
Violations are enforced exclusively by the Attorney General and are treated as deceptive trade practices under state commercial law. Intentional unlawful disclosures of personal data (especially to evade the law) may result in fines of $100 to $500 per disclosure, in addition to other remedies available under commercial law. There is no private right of action.
Nevada
California
Colorado
Virginia
Connecticut
Utah
Oregon
Texas
Montana
Iowa
Kentucky
New Jersey
Delaware
New Hampshire
Nebraska
Florida
Tennessee
Maryland
Illinois
Minnesota
Alabama
Oklahoma
Louisiana
Vermont
Washington
New York
Massachussetts
Arizona
Maine
Indiana
Rhode Island