
- Products
- Solutions
By Regulation
- Resources
Our Latest Blog
- Partner With Us
Send a message.
We’re here to answer any question you may have.
By Regulation
We’re here to answer any question you may have.
Select a U.S. state below to get information on its data protection laws.
While each law is unique, there are common elements
Defines which businesses the law applies to, often based on revenue, data volume, or the percentage of revenue derived from data sales.
Includes rights like accessing, correcting, deleting or opting out of data processing.
Some laws require explicit consent for processing sensitive personal data.
Includes requirements for privacy notices, security measures, and data protection assessments.
Typically handled by the state attorney general, with penalties for violations.
State | Effective Date | Applicability | Consumer Rights | Penalties |
---|---|---|---|---|
California Consumer Privacy Act (CCPA/CPRA) | January 1, 2020/2023 | $25M revenue, 50,000 consumers, or 50%+ revenue from data sales | Access, Delete, Correct, Opt-Out, Portability | $2,500 per violation; $7,500 for intentional violations |
Virginia Consumer Data Privacy Act (VCDPA) | January 1, 2023 | 100,000 consumers or 25,000+ 50%+ revenue from data sales | Access, Delete, Correct, Opt-Out, Portability | Up to $7,500 per violation |
Colorado Privacy Act (CPA) | July 1, 2023 | 100,000 consumers or 25,000+ 25%+ revenue from data sales | Access, Delete, Correct, Opt-Out, Portability | Up to $20,000 per violation with a total maximum penalty of $500,000 |
Connecticut Data Privacy Act (CTDPA) | July 1, 2023 | 100,000 consumers or 25,000+ 25%+ revenue from data sales | Access, Delete, Correct, Opt-Out, Portability | Up to $500,000 per violation |
Utah Consumer Privacy Act (UCPA) | December 31, 2023 | $25M revenue and 100,000 consumer or 25,000+ consumers with 50% revenue from data sales | Access, Delete, Opt-Out, Portability | Up to $7,500 per violation |
Oregon Consumer Privacy Act (OCPA) | July 1, 2024 | 100,000 consumer or 25,000+ consumers with 25% revenue from data sales | Access, Delete, Correct, Opt-Out, Portability | Up to $7,500 per violation |
Texas Data Privacy and Security Act (TDPSA) | July 1, 2024 | 35,000 consumer or 10,000+ consumers with 20% revenue from data sales | Access, Delete, Correct, Opt-Out, Portability | Up to $7,500 per violation |
Florida Digital Bill of Rights (FDBR) | July 1, 2024 | gross annual revenue of at least $1 billion or 50% or more revenue from targeted advertising | Access, Delete, Correct, Opt-Out, Portability | Up to $50,000 per violation |
Montana Consumer Data Privacy Act (MTCDPA) | October 1, 2024 | 50,000 consumer or 25,000+ consumers with 25% revenue from data sales | Access, Delete, Correct, Opt-Out, Portability | Not specified |
Delaware Personal Data Privacy Act (DPDPA) | January 1, 2025 | 35,000 consumer or 10,000+ consumers with 20% revenue from data sales | Access, Delete, Correct, Opt-Out, Portability | up to $10,000 per violation |
Iowa Consumer Data Protection Act (ICDPA) | January 1, 2025 | 100,000 consumer or 25,000+ consumers with 50% revenue from data sales | Access, Delete, Portability Opt-Out, | up to $7,500 per violation |
Nebraska Data Privacy Act (NDPA) | January 1, 2025 | Annual gross Revenue exceeding $10 million or buying/selling/sharing personal information of 50,000 or more consumers or 50%+ revenue from data sales | Access, Delete, Correct, Opt-Out, Portability | up to $7,500 per violation |
New Hampshire Privacy Act | January 1, 2025 | 35,000 consumer or 10,000+ consumers with 25% revenue from data sales | Access, Delete, Correct, Opt-Out, Portability | up to $10,000 per violation |
New Jersey Data Privacy Act (NJDPA) | January 15, 2025 | 100,000 consumer or 25,000+ consumers with data sales revenue | Access, Delete, Correct, Opt-Out, Portability | Up to $10,000 for 1st violation and up to $20,000 for subsequent violations |
Tennessee Information Protection Act (TIPA) | July 1, 2025 | $25M revenue, 25,000 consumers (50%+ revenue from data sales) or 175,000 consumers | Access, Delete, Correct, Opt-Out, Portability | $7,500 per violation; treble damages for intentional violations |
Minnesota Consumer Data Privacy Act (MCDPA) | July 31, 2025 | 100,000 consumers or 25,000+ consumers with data 25%+ revenue from data sales | Access, Delete, Correct, Opt-Out, Portability | up to $7,500 per violation |
Maryland Online Data Privacy Act (MODPA) | Oct 1, 2025 | 35,000 consumers or 10,000+ consumers with 20%+ revenue from data sales | Access, Delete, Correct, Opt-Out, Portability | up to $10,000 per violation, and up to $25,000 for repeated violations |
Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA) | January 1, 2026 | 35,000 consumers or 10,000+ consumers with 20%+ revenue from data sales | Access, Delete, Correct, Opt-Out, Portability | $10,000 per violation and between $100 - $500 for each intentional disclosure of personal data |
Kentucky Consumer Data Protection Act (KCDPA) | January 1, 2026 | 100,000 consumers or 25,000+ consumers with data 50%+ revenue from data sales | Access, Delete, Correct, Opt-Out, Portability | Up to $7,500 per violation |
Indiana Consumer Data Protection Act (INCDPA) | January 1, 2026 | 100,000 consumers or 25,000+ consumers with data 50%+ revenue from data sales | Access, Delete, Correct, Opt-Out, Portability | Up to $7,500 per violation |
Consumers have several important rights under U.S. privacy laws. They typically have the right to know what data is being collected, the right to access their data, and the right to delete their data. In some states, they can also opt out of having their data sold or shared for marketing purposes. Essentially, these laws aim to give individuals more control over their personal information.
In most cases, U.S. privacy laws do not require explicit permission before collecting personal data. However, consumers must be informed about what data is being collected, and businesses must give them the option to opt-out of certain uses of their data, such as for marketing. For more sensitive data or practices like cookies, businesses may need to obtain consent, particularly in states with stricter privacy laws like California and Colorado.
If your business doesn’t follow privacy laws, it could face legal consequences like fines and penalties. For example, under the California Consumer Privacy Act (CCPA), businesses can be fined up to $7,500 for each violation. In addition to financial penalties, businesses may also suffer reputational damage if they mishandle consumer data, which can lead to loss of trust and customers.
A Privacy Policy is a document that explains how a business collects, uses, and protects consumers’ personal data. It's important because most privacy laws require businesses to provide a clear and accessible Privacy Policy to inform customers about their data practices. This not only helps ensure compliance but also builds trust with consumers, as they can see how their data will be handled.
A Data Deletion Request allows consumers to ask a business to delete their personal information from its records. This is a key right under many U.S. privacy laws, including the CCPA. Once a request is submitted, businesses are generally required to remove the consumer's data, unless there’s a valid reason to keep it, such as for legal or business purposes. It’s important for businesses to have a process in place to handle these requests quickly and securely.
Not all businesses are required to comply with every privacy law. However, if your business meets certain criteria, such as having a significant amount of customer data or operating in a state with specific privacy laws (like California or Virginia) you may need to comply. Small businesses may be exempt from some regulations, but it’s still good practice to adopt privacy practices that protect customer information.
In the U.S., cookie laws are primarily focused on providing transparency about the use of cookies for tracking online behavior. Businesses must inform users when cookies are being used and, in some cases, give them the option to opt-out of non-essential cookies. While U.S. laws are less strict than the EU’s GDPR, states like California require businesses to provide clear information about their cookie practices, particularly for those using cookies for advertising purposes.
Our platform makes it easy to collect and manage consent from your customers, making sure you're following the rules of each state.
Our automated DSAR tool ensures that you can quickly respond to consumer requests to access or delete their data.
Ensure your website follows the cookie consent laws required by the states like California and Colorado.
Florida Digital Bill of Rights (FDBR)
Effective Date: July 1, 2024
Applicability | Consumer Rights | Penalties |
---|---|---|
gross annual revenue of at least $1 billion or 50% or more revenue from targeted advertising | Access, Delete, Correct, Opt-Out, Portability |
Up to $50,000 per violation |
Dedicated Data Privacy Laws in Rhode_Island
Rhode_Island does not have a comprehensive consumer data privacy and protection law, nor are any bills making progress at this time. However, it is protected by some privacy-related legislation.
Dedicated Data Privacy Laws in Michigan
Michigan does not have a comprehensive consumer data privacy and protection law, nor are any bills making progress at this time. However, it is protected by some privacy-related legislation.
Dedicated Data Privacy Laws in Indiana
Indiana does not have a comprehensive consumer data privacy and protection law, nor are any bills making progress at this time. However, it is protected by some privacy-related legislation.
Dedicated Data Privacy Laws in Tennessee
Tennessee does not have a comprehensive consumer data privacy and protection law, nor are any bills making progress at this time. However, it is protected by some privacy-related legislation.
Dedicated Data Privacy Laws in Kentucky
Kentucky does not have a comprehensive consumer data privacy and protection law, nor are any bills making progress at this time. However, it is protected by some privacy-related legislation.
Dedicated Data Privacy Laws in Minnesota
Minnesota does not have a comprehensive consumer data privacy and protection law, nor are any bills making progress at this time. However, it is protected by some privacy-related legislation.
Dedicated Data Privacy Laws in West_Virginia
West_Virginia does not have a comprehensive consumer data privacy and protection law, nor are any bills making progress at this time. However, it is protected by some privacy-related legislation.
Dedicated Data Privacy Laws in Washington D.C.
Washington D.C. does not have a comprehensive consumer data privacy and protection law, nor are any bills making progress at this time. However, it is protected by some privacy-related legislation.
Dedicated Data Privacy Laws in Washington
Washington does not have a comprehensive consumer data privacy and protection law, nor are any bills making progress at this time. However, it is protected by some privacy-related legislation.
Dedicated Data Privacy Laws in Wisconsin
Wisconsin does not have a comprehensive consumer data privacy and protection law, nor are any bills making progress at this time. However, it is protected by some privacy-related legislation.
Dedicated Data Privacy Laws in Alaska
Alaska does not have a comprehensive consumer data privacy and protection law, nor are any bills making progress at this time. However, it is protected by some privacy-related legislation.
Dedicated Data Privacy Laws in Louisiana
Louisiana does not have a comprehensive consumer data privacy and protection law, nor are any bills making progress at this time. However, it is protected by some privacy-related legislation.
Dedicated Data Privacy Laws in Kansas
Kansas does not have a comprehensive consumer data privacy and protection law, nor are any bills making progress at this time. However, it is protected by some privacy-related legislation.
Dedicated Data Privacy Laws in Vermont
Vermont does not have a comprehensive consumer data privacy and protection law, nor are any bills making progress at this time. However, it is protected by some privacy-related legislation.
Dedicated Data Privacy Laws in Maine
Maine does not have a comprehensive consumer data privacy and protection law, nor are any bills making progress at this time. However, it is protected by some privacy-related legislation.
Dedicated Data Privacy Laws in Mississippi
Mississippi does not have a comprehensive consumer data privacy and protection law, nor are any bills making progress at this time. However, it is protected by some privacy-related legislation.
Dedicated Data Privacy Laws in Missouri
Missouri does not have a comprehensive consumer data privacy and protection law, nor are any bills making progress at this time. However, it is protected by some privacy-related legislation.
Dedicated Data Privacy Laws in North_Carolina
North_Carolina does not have a comprehensive consumer data privacy and protection law, nor are any bills making progress at this time. However, it is protected by some privacy-related legislation.
Dedicated Data Privacy Laws in Georgia
Georgia does not have a comprehensive consumer data privacy and protection law, nor are any bills making progress at this time. However, it is protected by some privacy-related legislation.
Dedicated Data Privacy Laws in Alabama
Alabama does not have a comprehensive consumer data privacy and protection law, nor are any bills making progress at this time. However, it is protected by some privacy-related legislation.
Dedicated Data Privacy Laws in Arkansas
Arkansas does not have a comprehensive consumer data privacy and protection law, nor are any bills making progress at this time. However, it is protected by some privacy-related legislation.
Dedicated Data Privacy Laws in New_Mexico
New_Mexico does not have a comprehensive consumer data privacy and protection law, nor are any bills making progress at this time. However, it is protected by some privacy-related legislation.
Dedicated Data Privacy Laws in Arizona
Arizona does not have a comprehensive consumer data privacy and protection law, nor are any bills making progress at this time. However, it is protected by some privacy-related legislation.
Dedicated Data Privacy Laws in Nevada
Nevada does not have a comprehensive consumer data privacy and protection law, nor are any bills making progress at this time. However, it is protected by some privacy-related legislation.
Dedicated Data Privacy Laws in Idaho
Idaho does not have a comprehensive consumer data privacy and protection law, nor are any bills making progress at this time. However, it is protected by some privacy-related legislation.
Dedicated Data Privacy Laws in Wyoming
Wyoming does not have a comprehensive consumer data privacy and protection law, nor are any bills making progress at this time. However, it is protected by some privacy-related legislation.
Dedicated Data Privacy Laws in South_Dakota
South_Dakota does not have a comprehensive consumer data privacy and protection law, nor are any bills making progress at this time. However, it is protected by some privacy-related legislation.
Dedicated Data Privacy Laws in North_Dakota
North_Dakota does not have a comprehensive consumer data privacy and protection law, nor are any bills making progress at this time. However, it is protected by some privacy-related legislation.
Dedicated Data Privacy Laws in Hawaii
Hawaii does not have an official comprehensive consumer privacy law. However, there are a few privacy-related regulations in force and a few introduced bills moving through the state government.
South_Carolina does not have an official comprehensive consumer privacy law. However, there are a few privacy-related regulations in force and a few introduced bills moving through the state government.
Dedicated Data Privacy Laws in Connecticut
Connecticut does not have an official comprehensive consumer privacy law. However, there are a few privacy-related regulations in force and a few introduced bills moving through the state government.
Dedicated Data Privacy Laws in Massachusetts
Massachusetts does not have an official comprehensive consumer privacy law. However, there are a few privacy-related regulations in force and a few introduced bills moving through the state government.
Dedicated Data Privacy Laws in Ohio
Ohio does not have an official comprehensive consumer privacy law. However, there are a few privacy-related regulations in force and a few introduced bills moving through the state government.
Dedicated Data Privacy Laws in Illinois
Illinois does not have an official comprehensive consumer privacy law. However, there are a few privacy-related regulations in force and a few introduced bills moving through the state government.
Dedicated Data Privacy Laws in Oklahoma
Oklahoma does not have an official comprehensive consumer privacy law. However, there are a few privacy-related regulations in force and a few introduced bills moving through the state government.
Dedicated Data Privacy Laws in Pennsylvania
Pennsylvania does not have a comprehensive consumer data privacy and protection law, nor are any bills making progress at this time. However, it is protected by some privacy-related legislation.
Dedicated Data Privacy Laws in NewYork
New York does not have an official comprehensive consumer privacy law. However, there are a few privacy-related regulations in force and a few introduced bills moving through the state government.
Maryland Online Data Privacy Act (MODPA)
Effective Date: Oct 1, 2025
Applicability | Consumer Rights | Penalties |
---|---|---|
35,000 consumers or 10,000+ consumers with 20%+ revenue from data sales |
Access, Delete, Correct, Opt-Out, Portability |
up to $10,000 per violation, and up to $25,000 for repeated violations |
Delaware Personal Data Privacy Act (DPDPA)
Effective Date: January 1, 2025
Applicability | Consumer Rights | Penalties |
---|---|---|
35,000 consumer or 10,000+ consumers with 20% revenue from data sales |
Access, Delete, Correct, Opt-Out, Portability |
up to $10,000 per violation |
New Jersey Data Privacy Act (NJDPA)
Effective Date: January 15, 2025
Applicability | Consumer Rights | Penalties |
---|---|---|
100,000 consumer or 25,000+ consumers with 50% revenue from data sales |
Access, Delete, Correct, Opt-Out, Portability |
Up to $10,000 for 1st violation and up to $20,000 for subsequent violations |
Effective Date: January 1, 2025
Applicability | Consumer Rights | Penalties |
---|---|---|
35,000 consumer or 10,000+ consumers with 25% revenue from data sales |
Access, Delete, Correct, Opt-Out, Portability |
up to $10,000 per violation |
Virginia Consumer Data Privacy Act (VCDPA)
Effective Date: January 1, 2023
Applicability | Consumer Rights | Penalties |
---|---|---|
100,000 consumer or 25,000+ consumers with 50% revenue from data sales |
Access, Delete, Correct, Opt-Out, Portability |
Up to $7,500 per violation |
Texas Data Privacy and Security Act (TDPSA)
Effective Date: July 1, 2024
Applicability | Consumer Rights | Penalties |
---|---|---|
35,000 consumer or 10,000+ consumers with 20% revenue from data sales |
Access, Delete, Correct, Opt-Out, Portability |
Up to $7,500 per violation |
Oregon Consumer Privacy Act (OCPA)
Effective Date: July 1, 2024
Applicability | Consumer Rights | Penalties |
---|---|---|
100,000 consumer or 25,000+ consumers with 25% revenue from data sales |
Access, Delete, Correct, Opt-Out, Portability |
Up to $7,500 per violation |
Montana Consumer Data Privacy Act (MTCDPA)
Effective Date: October 1, 2024
Applicability | Consumer Rights | Penalties |
---|---|---|
50,000 consumer or 25,000+ consumers with 25% revenue from data sales |
Access, Delete, Correct, Opt-Out, Portability |
Not specified |
Iowa Consumer Data Protection Act (ICDPA)
Effective Date: January 1, 2025
Applicability | Consumer Rights | Penalties |
---|---|---|
100,000 consumer or 25,000+ consumers with 50% revenue from data sales |
Access, Delete, Portability Opt-Out |
Up to $7,500 per violation |
Nebraska Data Privacy Act (NDPA)
Effective Date: January 1, 2025
Applicability | Consumer Rights | Penalties |
---|---|---|
Annual gross Revenue exceeding $10 million or buying/selling/sharing personal information of 50,000 or more consumers or 50%+ revenue from data sales | Access, Delete, Correct, Opt-Out, Portability |
Up to $7,500 per violation |
Effective Date: July 1, 2023
Applicability | Consumer Rights | Penalties |
---|---|---|
100,000 consumers or 25,000+ 25%+ revenue from data sales |
Access, Delete, Correct, Opt-Out, Portability |
Up to $20,000 per violation with a total maximum penalty of $500,000 |
Utah Consumer Privacy Act (UCPA)
Effective Date: December 31, 2023
Applicability | Consumer Rights | Penalties |
---|---|---|
$25M revenue and 100,000 consumer or 25,000+ consumers with 50% revenue from data sales |
Access, Delete, Opt-Out, Portability |
Up to $7,500 per violation |
California Consumer Privacy Act (CCPA)/CPRA
Effective Date : January 1, 2020/2023
Applicability | Consumer Rights | Penalties |
---|---|---|
$25M revenue, 50,000 consumers, or 50%+ revenue from data sales |
Access, Delete, Correct, Opt-Out, Portability |
$2,500 per violation; $7,500 for intentional violations |
Adding {{itemName}} to cart
Added {{itemName}} to cart