{"title":"US state consumer privacy laws","question":"Which US states have comprehensive consumer privacy laws, who do they apply to, and what happens if a business breaks them?","scope":"Enacted US state laws that broadly cover consumer personal data, including laws passed but not yet in effect. Excludes laws limited to one sector or data type, such as health or biometric data, and bills still pending. Florida's Digital Bill of Rights is included even though it reaches only very large companies.","topic":"Law","url":"https://skeletable.com/zackhhi/us-state-consumer-privacy-laws","licence":"CC BY 4.0","attribution":"Skeletable, US state consumer privacy laws, https://skeletable.com/zackhhi/us-state-consumer-privacy-laws","lastRead":"2026-11-01","columns":[{"id":"law","label":"Law","type":"text","rule":"The act's official or short title as the statute or the state's official page gives it, with its code citation if stated."},{"id":"takes_effect","label":"Takes effect","type":"text","rule":"The first date the law's main consumer-privacy duties apply to businesses, as stated by the statute or state. Ignore later phase-ins for specific provisions."},{"id":"who_it_applies_to","label":"Who it applies to","type":"text","rule":"The law's applicability threshold in short form, as the statute states it, such as revenue or number of consumers processed."},{"id":"consumers_threshold","label":"Consumers threshold","type":"number","unit":"consumers","rule":"The lowest number of state consumers whose personal data triggers the law on its own, without a revenue test. Null if the law has no such number."},{"id":"cure_period","label":"Cure period","type":"number","unit":"days","rule":"Days the statute gives a business to fix a violation before enforcement. Null if the law gives no right to cure."},{"id":"cure_period_ends","label":"Cure period ends","type":"text","rule":"The date the right to cure sunsets, as stated in the statute. Null if there is no cure period or it does not expire."},{"id":"enforced_by","label":"Enforced by","type":"text","rule":"The official or agency the statute names as enforcer."},{"id":"maximum_penalty","label":"Maximum penalty","type":"number","unit":"USD per violation","rule":"The highest civil penalty per violation stated in the statute, including higher tiers such as intentional violations. Use the statute's base figure, not inflation-adjusted amounts, unless the statute itself states the adjusted figure."},{"id":"private_right_of_action","label":"Private right of action","type":"boolean","rule":"True if consumers can sue directly under the law for any violation. False if the statute says it creates no private right of action or leaves enforcement solely to the state."},{"id":"opt_out_signal_required","label":"Opt-out signal required","type":"boolean","rule":"True if the statute requires businesses to honor a universal opt-out signal or preference signal, such as Global Privacy Control, now or by a stated date."}],"rows":[{"key":"Alabama","url":"https://skeletable.com/zackhhi/us-state-consumer-privacy-laws/row/alabama","cells":{"consumers_threshold":{"value":25000,"source":"https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf","kind":"first-hand","quote":"25,000 consumers, excluding personal data controlled or","read":"2026-11-01"},"cure_period":{"value":45,"source":"https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf","kind":"first-hand","quote":"within 45 days after receipt of the notice of violation","read":"2026-11-01"},"cure_period_ends":{"missing":true,"checked":["https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf"],"read":"2026-11-01","absent":true},"enforced_by":{"value":"Attorney General","source":"https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf","kind":"first-hand","quote":"The Attorney General may enforce","read":"2026-11-01"},"law":{"value":"Alabama Personal Data Protection Act","source":"https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf","kind":"first-hand","quote":"This act shall be known as the Alabama Personal Data Protection Act.","read":"2026-11-01"},"maximum_penalty":{"value":15000,"source":"https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf","kind":"first-hand","quote":"of not more than fifteen thousand dollars ($15,000) per","read":"2026-11-01"},"opt_out_signal_required":{"value":true,"source":"https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf","kind":"first-hand","quote":"opt-out preference signal sent in accordance with this section","read":"2026-11-01"},"private_right_of_action":{"missing":true,"checked":["https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf"],"read":"2026-11-01","absent":true},"takes_effect":{"value":"May 1, 2027","source":"https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf","kind":"first-hand","quote":"This act shall become effective on May 1, 2027.","read":"2026-11-01"},"who_it_applies_to":{"value":"Control or process the personal data of more than","source":"https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf","kind":"first-hand","quote":"Control or process the personal data of more than","read":"2026-11-01"}}},{"key":"California","url":"https://skeletable.com/zackhhi/us-state-consumer-privacy-laws/row/california","cells":{"consumers_threshold":{"value":100000,"source":"https://oag.ca.gov/privacy/ccpa","kind":"first-hand","quote":"Buy, sell, or share the personal information of 100,000 or more California residents or households","read":"2026-11-01"},"cure_period":{"missing":true,"checked":[],"read":"2026-11-01"},"cure_period_ends":{"missing":true,"checked":[],"read":"2026-11-01"},"enforced_by":{"missing":true,"checked":[],"read":"2026-11-01"},"law":{"value":"California Consumer Privacy Act of 2018","source":"https://oag.ca.gov/privacy/ccpa","kind":"first-hand","quote":"The California Consumer Privacy Act of 2018 (CCPA) gives consumers more control","read":"2026-11-01"},"maximum_penalty":{"missing":true,"checked":[],"read":"2026-11-01"},"opt_out_signal_required":{"value":true,"source":"https://oag.ca.gov/privacy/ccpa","kind":"first-hand","quote":"Under law, it must be honored by covered businesses as a valid consumer request to stop the sale or sharing of personal information.","read":"2026-11-01"},"private_right_of_action":{"value":true,"source":"https://oag.ca.gov/privacy/ccpa","kind":"first-hand","quote":"you can sue for the amount of monetary damages you actually suffered from the breach","read":"2026-11-01"},"takes_effect":{"missing":true,"checked":[],"read":"2026-11-01"},"who_it_applies_to":{"value":"Have a gross annual revenue of over $25 million","source":"https://oag.ca.gov/privacy/ccpa","kind":"first-hand","quote":"Have a gross annual revenue of over $25 million","read":"2026-11-01"}}},{"key":"Colorado","url":"https://skeletable.com/zackhhi/us-state-consumer-privacy-laws/row/colorado","cells":{"consumers_threshold":{"value":100000,"source":"https://leg.colorado.gov/sites/default/files/2021a_190_signed.pdf","kind":"first-hand","quote":"PERSONAL DATA OF ONE HUNDRED THOUSAND CONSUMERS OR MORE","read":"2026-11-01"},"cure_period":{"value":60,"source":"https://leg.colorado.gov/sites/default/files/2021a_190_signed.pdf","kind":"first-hand","quote":"FAILS TO CURE THE VIOLATION WITHIN SIXTY DAYS AFTER RECEIPT OF THE NOTICE OF VIOLATION","read":"2026-11-01"},"cure_period_ends":{"value":"JANUARY 1, 2025","source":"https://leg.colorado.gov/sites/default/files/2021a_190_signed.pdf","kind":"first-hand","quote":"THIS SUBSECTION (1)(d) IS REPEALED, EFFECTIVE JANUARY 1, 2025.","read":"2026-11-01"},"enforced_by":{"value":"ATTORNEY GENERAL AND DISTRICT ATTORNEYS","source":"https://leg.colorado.gov/sites/default/files/2021a_190_signed.pdf","kind":"first-hand","quote":"ATTORNEY GENERAL AND DISTRICT ATTORNEYS HAVE EXCLUSIVE","read":"2026-11-01"},"law":{"value":"COLORADO PRIVACY ACT","source":"https://leg.colorado.gov/sites/default/files/2021a_190_signed.pdf","kind":"first-hand","quote":"THE SHORT TITLE OF THIS PART 13 IS THE \"COLORADO PRIVACY ACT\".","read":"2026-11-01"},"maximum_penalty":{"missing":true,"checked":[],"read":"2026-11-01"},"opt_out_signal_required":{"value":true,"source":"https://leg.colorado.gov/sites/default/files/2021a_190_signed.pdf","kind":"first-hand","quote":"THROUGH A USER-SELECTED UNIVERSAL OPT-OUT MECHANISM","read":"2026-11-01"},"private_right_of_action":{"value":false,"source":"https://leg.colorado.gov/sites/default/files/2021a_190_signed.pdf","kind":"first-hand","quote":"DOES NOT AUTHORIZE A PRIVATE RIGHT OF ACTION FOR A VIOLATION OF THIS PART 13","read":"2026-11-01"},"takes_effect":{"value":"July 1, 2023","source":"https://leg.colorado.gov/sites/default/files/2021a_190_signed.pdf","kind":"first-hand","quote":"This act takes effect July 1, 2023","read":"2026-11-01"},"who_it_applies_to":{"value":"PROCESSES THE PERSONAL DATA OF ONE HUNDRED THOUSAND CONSUMERS OR MORE DURING A CALENDAR YEAR","source":"https://leg.colorado.gov/sites/default/files/2021a_190_signed.pdf","kind":"first-hand","quote":"PROCESSES THE PERSONAL DATA OF ONE HUNDRED THOUSAND CONSUMERS OR MORE DURING A CALENDAR YEAR","read":"2026-11-01"}}},{"key":"Connecticut","url":"https://skeletable.com/zackhhi/us-state-consumer-privacy-laws/row/connecticut","cells":{"consumers_threshold":{"value":35000,"source":"https://www.cga.ct.gov/2025/act/pa/pdf/2025PA-00113-R00SB-01295-PA.pdf","kind":"first-hand","quote":"[one hundred thousand] thirty-five thousand consumers","read":"2026-11-01"},"cure_period":{"value":60,"source":"https://www.cga.ct.gov/current/pub/chap_743jj.htm","kind":"first-hand","quote":"fails to cure such violation within sixty days of receipt of the notice of violation","read":"2026-11-01"},"cure_period_ends":{"value":"December 31, 2024","source":"https://www.cga.ct.gov/current/pub/chap_743jj.htm","kind":"first-hand","quote":"During the period beginning on July 1, 2023, and ending on December 31, 2024, the Attorney General shall","read":"2026-11-01"},"enforced_by":{"value":"Attorney General","source":"https://www.cga.ct.gov/current/pub/chap_743jj.htm","kind":"first-hand","quote":"The Attorney General shall have exclusive authority to enforce violations of sections 42-515 to 42-524","read":"2026-11-01"},"law":{"missing":true,"checked":[],"read":"2026-11-01"},"maximum_penalty":{"value":5000,"source":"https://www.cga.ct.gov/current/pub/chap_735a.htm","kind":"first-hand","quote":"a civil penalty of not more than five thousand dollars for each violation","read":"2026-11-01"},"opt_out_signal_required":{"value":true,"source":"https://www.cga.ct.gov/current/pub/chap_743jj.htm","kind":"first-hand","quote":"the controller shall comply with such consumer's opt-out preference signal","read":"2026-11-01"},"private_right_of_action":{"value":false,"source":"https://www.cga.ct.gov/current/pub/chap_743jj.htm","kind":"first-hand","quote":"shall be construed as providing the basis for, or be subject to, a private right of action for violations of said sections or any other law","read":"2026-11-01"},"takes_effect":{"value":"July 1, 2023","source":"https://www.cga.ct.gov/current/pub/chap_743jj.htm","kind":"first-hand","quote":"P.A. 22-15 effective July 1, 2023","read":"2026-11-01"},"who_it_applies_to":{"missing":true,"checked":[],"read":"2026-11-01"}}},{"key":"Delaware","url":"https://skeletable.com/zackhhi/us-state-consumer-privacy-laws/row/delaware","cells":{"consumers_threshold":{"value":35000,"source":"https://delcode.delaware.gov/title6/c012d/index.html","kind":"first-hand","quote":"Controlled or processed the personal data of not less than 35,000 consumers","read":"2026-11-01"},"cure_period":{"value":60,"source":"https://delcode.delaware.gov/title6/c012d/index.html","kind":"first-hand","quote":"If the controller fails to cure such violation within 60 days of receipt of the notice of violation","read":"2026-11-01"},"cure_period_ends":{"value":"December 31, 2025","source":"https://delcode.delaware.gov/title6/c012d/index.html","kind":"first-hand","quote":"During the period beginning on January 1, 2025, and ending on December 31, 2025, the Department of Justice shall","read":"2026-11-01"},"enforced_by":{"value":"Department of Justice","source":"https://delcode.delaware.gov/title6/c012d/index.html","kind":"first-hand","quote":"The Department of Justice has enforcement authority over this chapter","read":"2026-11-01"},"law":{"value":"Delaware Personal Data Privacy Act","source":"https://delcode.delaware.gov/title6/c012d/index.html","kind":"first-hand","quote":"CHAPTER 12D. Delaware Personal Data Privacy Act","read":"2026-11-01"},"maximum_penalty":{"value":10000,"source":"https://delcode.delaware.gov/title6/c025/sc02/index.html","kind":"first-hand","quote":"a civil penalty of not more than $10,000 for each violation","read":"2026-11-01"},"opt_out_signal_required":{"value":true,"source":"https://delcode.delaware.gov/title6/c012d/index.html","kind":"first-hand","quote":"Not later than January 1, 2026, allowing a consumer to opt out of any processing of the consumer’s personal data for the purposes of targeted advert","read":"2026-11-01"},"private_right_of_action":{"value":false,"source":"https://delcode.delaware.gov/title6/c012d/index.html","kind":"first-hand","quote":"Nothing in this chapter shall be construed as providing the basis for, or be subject to, a private right of action for violations of said sections or any other law.","read":"2026-11-01"},"takes_effect":{"missing":true,"checked":[],"read":"2026-11-01"},"who_it_applies_to":{"missing":true,"checked":[],"read":"2026-11-01"}}},{"key":"Florida","url":"https://skeletable.com/zackhhi/us-state-consumer-privacy-laws/row/florida","cells":{"consumers_threshold":{"missing":true,"checked":[],"read":"2026-11-01"},"cure_period":{"value":45,"source":"http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/Sections/0501.72.html","kind":"first-hand","quote":"the department may grant a 45-day period to cure the alleged violation","read":"2026-11-01"},"cure_period_ends":{"missing":true,"checked":[],"read":"2026-11-01"},"enforced_by":{"value":"Department of Legal Affairs","source":"http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/Sections/0501.72.html","kind":"first-hand","quote":"solely by the Department of Legal Affairs","read":"2026-11-01"},"law":{"value":"Florida Digital Bill of Rights","source":"http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/Sections/0501.701.html","kind":"first-hand","quote":"This part may be cited as the “Florida Digital Bill of Rights.”","read":"2026-11-01"},"maximum_penalty":{"value":50000,"source":"http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/Sections/0501.72.html","kind":"first-hand","quote":"a civil penalty of up to $50,000 per violation","read":"2026-11-01"},"opt_out_signal_required":{"missing":true,"checked":[],"read":"2026-11-01"},"private_right_of_action":{"value":false,"source":"http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/Sections/0501.72.html","kind":"first-hand","quote":"This part does not establish a private cause of action.","read":"2026-11-01"},"takes_effect":{"missing":true,"checked":[],"read":"2026-11-01"},"who_it_applies_to":{"value":"Makes in excess of $1 billion in global gross annual revenues","source":"http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/Sections/0501.702.html","kind":"first-hand","quote":"Makes in excess of $1 billion in global gross annual revenues","read":"2026-11-01"}}},{"key":"Indiana","url":"https://skeletable.com/zackhhi/us-state-consumer-privacy-laws/row/indiana","cells":{"consumers_threshold":{"missing":true,"checked":[],"read":"2026-11-01"},"cure_period":{"missing":true,"checked":[],"read":"2026-11-01"},"cure_period_ends":{"missing":true,"checked":[],"read":"2026-11-01"},"enforced_by":{"missing":true,"checked":[],"read":"2026-11-01"},"law":{"missing":true,"checked":[],"read":"2026-11-01"},"maximum_penalty":{"missing":true,"checked":[],"read":"2026-11-01"},"opt_out_signal_required":{"missing":true,"checked":[],"read":"2026-11-01"},"private_right_of_action":{"missing":true,"checked":[],"read":"2026-11-01"},"takes_effect":{"missing":true,"checked":[],"read":"2026-11-01"},"who_it_applies_to":{"missing":true,"checked":[],"read":"2026-11-01"}}},{"key":"Iowa","url":"https://skeletable.com/zackhhi/us-state-consumer-privacy-laws/row/iowa","cells":{"consumers_threshold":{"value":100000,"source":"https://www.legis.iowa.gov/docs/code/715D.pdf","kind":"first-hand","quote":"Controls or processes personal data of at least one hundred thousand consumers.","read":"2026-11-01"},"cure_period":{"value":90,"source":"https://www.legis.iowa.gov/docs/code/715D.pdf","kind":"first-hand","quote":"ninety days' written notice identifying the specific provisions of this chapter","read":"2026-11-01"},"cure_period_ends":{"missing":true,"checked":["https://www.legis.iowa.gov/docs/code/715D.pdf"],"read":"2026-11-01","absent":true},"enforced_by":{"value":"attorney general","source":"https://www.legis.iowa.gov/docs/code/715D.pdf","kind":"first-hand","quote":"The attorney general shall have exclusive authority to enforce the provisions of this chapter.","read":"2026-11-01"},"law":{"missing":true,"checked":[],"read":"2026-11-01"},"maximum_penalty":{"value":7500,"source":"https://www.legis.iowa.gov/docs/code/715D.pdf","kind":"first-hand","quote":"civil penalties of up to seven thousand five hundred dollars for each violation under this chapter","read":"2026-11-01"},"opt_out_signal_required":{"missing":true,"checked":["https://www.legis.iowa.gov/docs/code/715D.pdf"],"read":"2026-11-01","absent":true},"private_right_of_action":{"value":false,"source":"https://www.legis.iowa.gov/docs/code/715D.pdf","kind":"first-hand","quote":"private right of action for violations of this chapter or under any other law","read":"2026-11-01"},"takes_effect":{"value":"January 1, 2025","source":"https://www.legis.iowa.gov/docs/acts/2023/CH0017.pdf","kind":"first-hand","quote":"This Act takes effect January 1, 2025.","read":"2026-11-01"},"who_it_applies_to":{"value":"Controls or processes personal data of at least one hundred thousand consumers.","source":"https://www.legis.iowa.gov/docs/code/715D.pdf","kind":"first-hand","quote":"Controls or processes personal data of at least one hundred thousand consumers.","read":"2026-11-01"}}},{"key":"Kentucky","url":"https://skeletable.com/zackhhi/us-state-consumer-privacy-laws/row/kentucky","cells":{"consumers_threshold":{"value":100000,"source":"https://apps.legislature.ky.gov/law/acts/24RS/documents/0072.pdf","kind":"first-hand","quote":"One hundred thousand (100,000) consumers","read":"2026-11-01"},"cure_period":{"value":30,"source":"https://apps.legislature.ky.gov/law/acts/24RS/documents/0072.pdf","kind":"first-hand","quote":"If within the thirty (30) days the controller or processor cures the noticed violation","read":"2026-11-01"},"cure_period_ends":{"missing":true,"checked":["https://apps.legislature.ky.gov/law/acts/24RS/documents/0072.pdf"],"read":"2026-11-01","absent":true},"enforced_by":{"value":"Attorney General","source":"https://apps.legislature.ky.gov/law/acts/24RS/documents/0072.pdf","kind":"first-hand","quote":"The Attorney General shall have exclusive authority to enforce violations of Sections 1 to 10 of this Act.","read":"2026-11-01"},"law":{"value":"Kentucky Consumer Data Protection Act","source":"https://apps.legislature.ky.gov/law/acts/24RS/documents/0072.pdf","kind":"first-hand","quote":"This Act may be cited as the Kentucky Consumer Data Protection Act.","read":"2026-11-01"},"maximum_penalty":{"value":7500,"source":"https://apps.legislature.ky.gov/law/acts/24RS/documents/0072.pdf","kind":"first-hand","quote":"seek damages for up to seven thousand five hundred dollars ($7,500) for each continued violation","read":"2026-11-01"},"opt_out_signal_required":{"missing":true,"checked":["https://apps.legislature.ky.gov/law/acts/24RS/documents/0072.pdf"],"read":"2026-11-01","absent":true},"private_right_of_action":{"value":false,"source":"https://apps.legislature.ky.gov/law/acts/24RS/documents/0072.pdf","kind":"first-hand","quote":"shall be construed as providing the basis for, or give rise to, a private right of action for violations of Sections 1 to 10 of this Act.","read":"2026-11-01"},"takes_effect":{"value":"January 1, 2026","source":"https://apps.legislature.ky.gov/law/acts/24RS/documents/0072.pdf","kind":"first-hand","quote":"This Act takes effect January 1, 2026.","read":"2026-11-01"},"who_it_applies_to":{"value":"One hundred thousand (100,000) consumers","source":"https://apps.legislature.ky.gov/law/acts/24RS/documents/0072.pdf","kind":"first-hand","quote":"One hundred thousand (100,000) consumers","read":"2026-11-01"}}},{"key":"Louisiana","url":"https://skeletable.com/zackhhi/us-state-consumer-privacy-laws/row/louisiana","cells":{"consumers_threshold":{"missing":true,"checked":[],"read":"2026-11-01"},"cure_period":{"missing":true,"checked":[],"read":"2026-11-01"},"cure_period_ends":{"value":"July 31, 2027","source":"https://legis.la.gov/legis/ViewDocument.aspx?d=1480202","kind":"first-hand","quote":"Beginning January 1, 2027, and ending July 31, 2027","read":"2026-11-01"},"enforced_by":{"value":"attorney general","source":"https://legis.la.gov/legis/ViewDocument.aspx?d=1480202","kind":"first-hand","quote":"The attorney general shall enforce the provisions of this Chapter.","read":"2026-11-01"},"law":{"value":"Louisiana Data Privacy Act","source":"https://legis.la.gov/legis/ViewDocument.aspx?d=1480202","kind":"first-hand","quote":"creates the Louisiana Data Privacy Act","read":"2026-11-01"},"maximum_penalty":{"missing":true,"checked":[],"read":"2026-11-01"},"opt_out_signal_required":{"missing":true,"checked":[],"read":"2026-11-01"},"private_right_of_action":{"missing":true,"checked":[],"read":"2026-11-01"},"takes_effect":{"value":"January 1, 2027","source":"https://legis.la.gov/legis/ViewDocument.aspx?d=1480202","kind":"first-hand","quote":"This Act shall become effective on January 1, 2027.","read":"2026-11-01"},"who_it_applies_to":{"value":"Has annual gross revenues in excess of twenty-five million dollars.","source":"https://legis.la.gov/legis/ViewDocument.aspx?d=1480202","kind":"first-hand","quote":"Has annual gross revenues in excess of twenty-five million dollars.","read":"2026-11-01"}}},{"key":"Maryland","url":"https://skeletable.com/zackhhi/us-state-consumer-privacy-laws/row/maryland","cells":{"consumers_threshold":{"value":35000,"source":"https://mgaleg.maryland.gov/2024RS/Chapters_noln/CH_454_hb0567e.pdf","kind":"first-hand","quote":"PERSONAL DATA OF AT LEAST 35,000 CONSUMERS","read":"2026-11-01"},"cure_period":{"missing":true,"checked":[],"read":"2026-11-01"},"cure_period_ends":{"missing":true,"checked":[],"read":"2026-11-01"},"enforced_by":{"missing":true,"checked":[],"read":"2026-11-01"},"law":{"value":"Maryland Online Data Privacy Act of 2024","source":"https://mgaleg.maryland.gov/2024RS/Chapters_noln/CH_454_hb0567e.pdf","kind":"first-hand","quote":"Maryland Online Data Privacy Act of 2024","read":"2026-11-01"},"maximum_penalty":{"value":25000,"source":"https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl&section=13-410","kind":"first-hand","quote":"is subject to a fine not exceeding $25,000 for each subsequent violation","read":"2026-11-01"},"opt_out_signal_required":{"value":true,"source":"https://mgaleg.maryland.gov/2024RS/Chapters_noln/CH_454_hb0567e.pdf","kind":"first-hand","quote":"ON OR BEFORE OCTOBER 1, 2025, ALLOWING A CONSUMER TO OPT OUT OF ANY PROCESSING","read":"2026-11-01"},"private_right_of_action":{"missing":true,"checked":[],"read":"2026-11-01"},"takes_effect":{"missing":true,"checked":[],"read":"2026-11-01"},"who_it_applies_to":{"missing":true,"checked":[],"read":"2026-11-01"}}},{"key":"Minnesota","url":"https://skeletable.com/zackhhi/us-state-consumer-privacy-laws/row/minnesota","cells":{"consumers_threshold":{"value":100000,"source":"https://www.revisor.mn.gov/statutes/cite/325M.12","kind":"first-hand","quote":"controls or processes personal data of 100,000 consumers or more","read":"2026-11-01"},"cure_period":{"value":30,"source":"https://www.revisor.mn.gov/statutes/cite/325M.20","kind":"first-hand","quote":"fter 30 days of issuance of the warning letter","read":"2026-11-01"},"cure_period_ends":{"value":"January 31, 2026","source":"https://www.revisor.mn.gov/statutes/cite/325M.20","kind":"first-hand","quote":"This paragraph expires January 31, 2026.","read":"2026-11-01"},"enforced_by":{"value":"attorney general","source":"https://www.revisor.mn.gov/statutes/cite/325M.20","kind":"first-hand","quote":"the attorney general may bring an enforcement action","read":"2026-11-01"},"law":{"value":"Minnesota Consumer Data Privacy Act","source":"https://www.revisor.mn.gov/statutes/cite/325M.10","kind":"first-hand","quote":"may be cited as the \"Minnesota Consumer Data Privacy Act.\"","read":"2026-11-01"},"maximum_penalty":{"value":7500,"source":"https://www.revisor.mn.gov/statutes/cite/325M.20","kind":"first-hand","quote":"a civil penalty of not more than $7,500 for each violation","read":"2026-11-01"},"opt_out_signal_required":{"value":true,"source":"https://www.revisor.mn.gov/statutes/cite/325M.14","kind":"first-hand","quote":"through an opt-out preference signal sent, with the consumer's consent","read":"2026-11-01"},"private_right_of_action":{"value":false,"source":"https://www.revisor.mn.gov/statutes/cite/325M.20","kind":"first-hand","quote":"establishes a private right of action","read":"2026-11-01"},"takes_effect":{"missing":true,"checked":[],"read":"2026-11-01"},"who_it_applies_to":{"value":"controls or processes personal data of 100,000 consumers or more, excluding personal data controlled or processed solely for the purpose of completing a payment transaction","source":"https://www.revisor.mn.gov/statutes/cite/325M.12","kind":"first-hand","quote":"controls or processes personal data of 100,000 consumers or more, excluding personal data controlled or processed solely for the purpose of completing a payment transaction","read":"2026-11-01"}}},{"key":"Montana","url":"https://skeletable.com/zackhhi/us-state-consumer-privacy-laws/row/montana","cells":{"consumers_threshold":{"missing":true,"checked":[],"read":"2026-11-01"},"cure_period":{"missing":true,"checked":[],"read":"2026-11-01"},"cure_period_ends":{"missing":true,"checked":[],"read":"2026-11-01"},"enforced_by":{"missing":true,"checked":[],"read":"2026-11-01"},"law":{"missing":true,"checked":[],"read":"2026-11-01"},"maximum_penalty":{"missing":true,"checked":[],"read":"2026-11-01"},"opt_out_signal_required":{"missing":true,"checked":[],"read":"2026-11-01"},"private_right_of_action":{"missing":true,"checked":[],"read":"2026-11-01"},"takes_effect":{"missing":true,"checked":[],"read":"2026-11-01"},"who_it_applies_to":{"missing":true,"checked":[],"read":"2026-11-01"}}},{"key":"Nebraska","url":"https://skeletable.com/zackhhi/us-state-consumer-privacy-laws/row/nebraska","cells":{"consumers_threshold":{"missing":true,"checked":["https://nebraskalegislature.gov/laws/statutes.php?statute=87-1103"],"read":"2026-11-01","absent":true},"cure_period":{"missing":true,"checked":[],"read":"2026-11-01"},"cure_period_ends":{"missing":true,"checked":[],"read":"2026-11-01"},"enforced_by":{"value":"Attorney General","source":"https://nebraskalegislature.gov/laws/statutes.php?statute=87-1124","kind":"first-hand","quote":"The Attorney General may bring an action in the name of the State of Nebraska","read":"2026-11-01"},"law":{"value":"Data Privacy Act","source":"https://nebraskalegislature.gov/laws/statutes.php?statute=87-1101","kind":"first-hand","quote":"shall be known and may be cited as the Data Privacy Act.","read":"2026-11-01"},"maximum_penalty":{"value":7500,"source":"https://nebraskalegislature.gov/laws/statutes.php?statute=87-1124","kind":"first-hand","quote":"a civil penalty in an amount not to exceed seven thousand five hundred dollars for each violation","read":"2026-11-01"},"opt_out_signal_required":{"missing":true,"checked":[],"read":"2026-11-01"},"private_right_of_action":{"value":false,"source":"https://nebraskalegislature.gov/laws/statutes.php?statute=87-1125","kind":"first-hand","quote":"The Data Privacy Act shall not be construed as providing a basis for, or being subject to, a private right of action","read":"2026-11-01"},"takes_effect":{"missing":true,"checked":[],"read":"2026-11-01"},"who_it_applies_to":{"value":"Is not a small business as determined under the federal Small Business Act","source":"https://nebraskalegislature.gov/laws/statutes.php?statute=87-1103","kind":"first-hand","quote":"Is not a small business as determined under the federal Small Business Act","read":"2026-11-01"}}},{"key":"New Hampshire","url":"https://skeletable.com/zackhhi/us-state-consumer-privacy-laws/row/new-hampshire","cells":{"consumers_threshold":{"value":35000,"source":"https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm","kind":"first-hand","quote":"Controlled or processed the personal data of not less than 35,000 unique consumers","read":"2026-11-01"},"cure_period":{"value":60,"source":"https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm","kind":"first-hand","quote":"If the controller fails to cure such violation within 60 days of receipt of the notice of violation","read":"2026-11-01"},"cure_period_ends":{"value":"December 31, 2025","source":"https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm","kind":"first-hand","quote":"During the period beginning January 1, 2025 and ending December 31, 2025, the attorney general shall","read":"2026-11-01"},"enforced_by":{"value":"attorney general","source":"https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm","kind":"first-hand","quote":"The attorney general shall have exclusive authority to enforce violations under this chapter.","read":"2026-11-01"},"law":{"missing":true,"checked":[],"read":"2026-11-01"},"maximum_penalty":{"missing":true,"checked":[],"read":"2026-11-01"},"opt_out_signal_required":{"value":true,"source":"https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm","kind":"first-hand","quote":"the controller shall comply with such consumer's opt-out preference signal","read":"2026-11-01"},"private_right_of_action":{"value":false,"source":"https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm","kind":"first-hand","quote":"Nothing in this chapter shall be construed as providing the basis for, or be subject to, a private right of action for violations under this chapter or any other law.","read":"2026-11-01"},"takes_effect":{"value":"Jan. 1, 2025","source":"https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm","kind":"first-hand","quote":"Source. 2024, 5:1, eff. Jan. 1, 2025","read":"2026-11-01"},"who_it_applies_to":{"value":"Controlled or processed the personal data of not less than 35,000 unique consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction","source":"https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm","kind":"first-hand","quote":"Controlled or processed the personal data of not less than 35,000 unique consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction","read":"2026-11-01"}}},{"key":"New Jersey","url":"https://skeletable.com/zackhhi/us-state-consumer-privacy-laws/row/new-jersey","cells":{"consumers_threshold":{"value":100000,"source":"https://www.njleg.state.nj.us/Bills/2022/PL23/266_.PDF","kind":"first-hand","quote":"control or process the personal data of at least 100,000 consumers","read":"2026-11-01"},"cure_period":{"value":30,"source":"https://www.njleg.state.nj.us/Bills/2022/PL23/266_.PDF","kind":"first-hand","quote":"within 30 days after receiving notice of alleged noncompliance from the division","read":"2026-11-01"},"cure_period_ends":{"missing":true,"checked":[],"read":"2026-11-01"},"enforced_by":{"value":"Office of the Attorney General","source":"https://www.njleg.state.nj.us/Bills/2022/PL23/266_.PDF","kind":"first-hand","quote":"The Office of the Attorney General shall have sole and exclusive authority to enforce","read":"2026-11-01"},"law":{"missing":true,"checked":[],"read":"2026-11-01"},"maximum_penalty":{"missing":true,"checked":[],"read":"2026-11-01"},"opt_out_signal_required":{"value":true,"source":"https://www.njleg.state.nj.us/Bills/2022/PL23/266_.PDF","kind":"first-hand","quote":"through a user-selected universal opt-out mechanism","read":"2026-11-01"},"private_right_of_action":{"missing":true,"checked":[],"read":"2026-11-01"},"takes_effect":{"missing":true,"checked":[],"read":"2026-11-01"},"who_it_applies_to":{"missing":true,"checked":[],"read":"2026-11-01"}}},{"key":"Oklahoma","url":"https://skeletable.com/zackhhi/us-state-consumer-privacy-laws/row/oklahoma","cells":{"consumers_threshold":{"value":100000,"source":"https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.PDF","kind":"first-hand","quote":"controls or processes personal data of at least one hundred thousand (100,000) consumers","read":"2026-11-01"},"cure_period":{"value":30,"source":"https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.PDF","kind":"first-hand","quote":"no later than thirty (30) days before bringing the action","read":"2026-11-01"},"cure_period_ends":{"missing":true,"checked":["https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.PDF"],"read":"2026-11-01","absent":true},"enforced_by":{"value":"Attorney General","source":"https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.PDF","kind":"first-hand","quote":"The Attorney General has exclusive authority to enforce the provisions of this act.","read":"2026-11-01"},"law":{"missing":true,"checked":[],"read":"2026-11-01"},"maximum_penalty":{"value":7500,"source":"https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.PDF","kind":"first-hand","quote":"exceed Seven Thousand Five Hundred Dollars ($7,500.00) for each violation","read":"2026-11-01"},"opt_out_signal_required":{"missing":true,"checked":["https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.PDF"],"read":"2026-11-01","absent":true},"private_right_of_action":{"value":false,"source":"https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.PDF","kind":"first-hand","quote":"a private right of action for a violation of this act or any other provision of law","read":"2026-11-01"},"takes_effect":{"value":"January 1, 2027","source":"https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.PDF","kind":"first-hand","quote":"This act shall become effective January 1, 2027.","read":"2026-11-01"},"who_it_applies_to":{"value":"controls or processes personal data of at least one hundred thousand (100,000) consumers","source":"https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.PDF","kind":"first-hand","quote":"controls or processes personal data of at least one hundred thousand (100,000) consumers","read":"2026-11-01"}}},{"key":"Oregon","url":"https://skeletable.com/zackhhi/us-state-consumer-privacy-laws/row/oregon","cells":{"consumers_threshold":{"value":100000,"source":"https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html","kind":"first-hand","quote":"The personal data of 100,000 or more consumers","read":"2026-11-01"},"cure_period":{"value":30,"source":"https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html","kind":"first-hand","quote":"fails to cure the violation within 30 days after receiving the notice of the violation","read":"2026-11-01"},"cure_period_ends":{"missing":true,"checked":[],"read":"2026-11-01"},"enforced_by":{"value":"Attorney General","source":"https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html","kind":"first-hand","quote":"The Attorney General may bring an action to seek a civil penalty","read":"2026-11-01"},"law":{"missing":true,"checked":[],"read":"2026-11-01"},"maximum_penalty":{"value":7500,"source":"https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html","kind":"first-hand","quote":"a civil penalty of not more than $7,500 for each violation of ORS 646A.570 to 646A.589","read":"2026-11-01"},"opt_out_signal_required":{"value":true,"source":"https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html","kind":"first-hand","quote":"Allow a consumer or authorized agent to send a signal to the controller","read":"2026-11-01"},"private_right_of_action":{"value":false,"source":"https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html","kind":"first-hand","quote":"do not create a private right of action to enforce a violation of ORS 646A.570 to 646A.589","read":"2026-11-01"},"takes_effect":{"missing":true,"checked":[],"read":"2026-11-01"},"who_it_applies_to":{"missing":true,"checked":[],"read":"2026-11-01"}}},{"key":"Rhode Island","url":"https://skeletable.com/zackhhi/us-state-consumer-privacy-laws/row/rhode-island","cells":{"consumers_threshold":{"value":35000,"source":"https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-4.htm","kind":"first-hand","quote":"not less than thirty-five thousand (35,000) customers","read":"2026-11-01"},"cure_period":{"missing":true,"checked":[],"read":"2026-11-01"},"cure_period_ends":{"missing":true,"checked":[],"read":"2026-11-01"},"enforced_by":{"value":"attorney general","source":"https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-8.htm","kind":"first-hand","quote":"The attorney general shall have sole enforcement authority of the provisions of this chapter","read":"2026-11-01"},"law":{"value":"Rhode Island Data Transparency and Privacy Protection Act","source":"https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-1.htm","kind":"first-hand","quote":"This chapter shall be known and may be cited as the “Rhode Island Data Transparency and Privacy Protection Act”.","read":"2026-11-01"},"maximum_penalty":{"value":500,"source":"https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-8.htm","kind":"first-hand","quote":"no more than five hundred dollars ($500) for each such disclosure","read":"2026-11-01"},"opt_out_signal_required":{"missing":true,"checked":[],"read":"2026-11-01"},"private_right_of_action":{"value":false,"source":"https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-8.htm","kind":"first-hand","quote":"Nothing in this section shall be construed to authorize any private right of action to enforce any provision of this chapter","read":"2026-11-01"},"takes_effect":{"value":"January 1, 2026","source":"https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-1.htm","kind":"first-hand","quote":"P.L. 2024, ch. 430, § 2, effective January 1, 2026","read":"2026-11-01"},"who_it_applies_to":{"value":"Controlled or processed the personal data of not less than thirty-five thousand (35,000) customers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction.","source":"https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-4.htm","kind":"first-hand","quote":"Controlled or processed the personal data of not less than thirty-five thousand (35,000) customers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction.","read":"2026-11-01"}}},{"key":"Tennessee","url":"https://skeletable.com/zackhhi/us-state-consumer-privacy-laws/row/tennessee","cells":{"consumers_threshold":{"missing":true,"checked":[],"read":"2026-11-01"},"cure_period":{"missing":true,"checked":[],"read":"2026-11-01"},"cure_period_ends":{"missing":true,"checked":[],"read":"2026-11-01"},"enforced_by":{"missing":true,"checked":[],"read":"2026-11-01"},"law":{"missing":true,"checked":[],"read":"2026-11-01"},"maximum_penalty":{"missing":true,"checked":[],"read":"2026-11-01"},"opt_out_signal_required":{"missing":true,"checked":[],"read":"2026-11-01"},"private_right_of_action":{"missing":true,"checked":[],"read":"2026-11-01"},"takes_effect":{"missing":true,"checked":[],"read":"2026-11-01"},"who_it_applies_to":{"missing":true,"checked":[],"read":"2026-11-01"}}},{"key":"Texas","url":"https://skeletable.com/zackhhi/us-state-consumer-privacy-laws/row/texas","cells":{"consumers_threshold":{"missing":true,"checked":["https://capitol.texas.gov/tlodocs/88R/billtext/pdf/HB00004F.pdf"],"read":"2026-11-01","absent":true},"cure_period":{"value":30,"source":"https://capitol.texas.gov/tlodocs/88R/billtext/pdf/HB00004F.pdf","kind":"first-hand","quote":"within the 30-day period, the person cures the","read":"2026-11-01"},"cure_period_ends":{"missing":true,"checked":["https://capitol.texas.gov/tlodocs/88R/billtext/pdf/HB00004F.pdf"],"read":"2026-11-01","absent":true},"enforced_by":{"value":"attorney general","source":"https://capitol.texas.gov/tlodocs/88R/billtext/pdf/HB00004F.pdf","kind":"first-hand","quote":"attorney general has exclusive authority to enforce this chapter.","read":"2026-11-01"},"law":{"value":"Texas Data Privacy and Security Act","source":"https://capitol.texas.gov/tlodocs/88R/billtext/pdf/HB00004F.pdf","kind":"first-hand","quote":"This Act may be cited as the Texas Data Privacy and Security Act.","read":"2026-11-01"},"maximum_penalty":{"value":7500,"source":"https://capitol.texas.gov/tlodocs/88R/billtext/pdf/HB00004F.pdf","kind":"first-hand","quote":"an amount not to exceed $7,500 for each violation.","read":"2026-11-01"},"opt_out_signal_required":{"value":true,"source":"https://capitol.texas.gov/tlodocs/88R/billtext/pdf/HB00004F.pdf","kind":"first-hand","quote":"global setting on an electronic device, that allows the consumer to","read":"2026-11-01"},"private_right_of_action":{"value":false,"source":"https://capitol.texas.gov/tlodocs/88R/billtext/pdf/HB00004F.pdf","kind":"first-hand","quote":"private right of action for a violation of this chapter","read":"2026-11-01"},"takes_effect":{"value":"July 1, 2024","source":"https://capitol.texas.gov/tlodocs/88R/billtext/pdf/HB00004F.pdf","kind":"first-hand","quote":"this Act takes effect July 1, 2024.","read":"2026-11-01"},"who_it_applies_to":{"value":"is not a small business as defined by the United","source":"https://capitol.texas.gov/tlodocs/88R/billtext/pdf/HB00004F.pdf","kind":"first-hand","quote":"is not a small business as defined by the United","read":"2026-11-01"}}},{"key":"Utah","url":"https://skeletable.com/zackhhi/us-state-consumer-privacy-laws/row/utah","cells":{"consumers_threshold":{"value":100000,"source":"https://le.utah.gov/~2022/bills/sbillenr/SB0227.pdf","kind":"first-hand","quote":"controls or processes personal data of 100,000 or more","read":"2026-11-01"},"cure_period":{"value":30,"source":"https://le.utah.gov/~2022/bills/sbillenr/SB0227.pdf","kind":"first-hand","quote":"cures the noticed violation within 30 days after the day on which the controller or","read":"2026-11-01"},"cure_period_ends":{"missing":true,"checked":["https://le.utah.gov/~2022/bills/sbillenr/SB0227.pdf"],"read":"2026-11-01","absent":true},"enforced_by":{"value":"attorney general","source":"https://le.utah.gov/~2022/bills/sbillenr/SB0227.pdf","kind":"first-hand","quote":"The attorney general has the exclusive authority to enforce this chapter.","read":"2026-11-01"},"law":{"value":"Utah Consumer Privacy Act","source":"https://le.utah.gov/~2022/bills/sbillenr/SB0227.pdf","kind":"first-hand","quote":"This bill enacts the Utah Consumer Privacy Act.","read":"2026-11-01"},"maximum_penalty":{"value":7500,"source":"https://le.utah.gov/~2022/bills/sbillenr/SB0227.pdf","kind":"first-hand","quote":"an amount not to exceed $7,500.","read":"2026-11-01"},"opt_out_signal_required":{"missing":true,"checked":["https://le.utah.gov/~2022/bills/sbillenr/SB0227.pdf"],"read":"2026-11-01","absent":true},"private_right_of_action":{"value":false,"source":"https://le.utah.gov/~2022/bills/sbillenr/SB0227.pdf","kind":"first-hand","quote":"No private cause of action.","read":"2026-11-01"},"takes_effect":{"value":"December 31, 2023","source":"https://le.utah.gov/~2022/bills/sbillenr/SB0227.pdf","kind":"first-hand","quote":"This bill takes effect on December 31, 2023.","read":"2026-11-01"},"who_it_applies_to":{"value":"has annual revenue of $25,000,000 or more","source":"https://le.utah.gov/~2022/bills/sbillenr/SB0227.pdf","kind":"first-hand","quote":"has annual revenue of $25,000,000 or more","read":"2026-11-01"}}},{"key":"Vermont","url":"https://skeletable.com/zackhhi/us-state-consumer-privacy-laws/row/vermont","cells":{"consumers_threshold":{"value":35000,"source":"https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf","kind":"first-hand","quote":"controlled or processed the personal data of not fewer than 35,000","read":"2026-11-01"},"cure_period":{"value":60,"source":"https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf","kind":"first-hand","quote":"fails to cure the violation within 60 days after receipt of","read":"2026-11-01"},"cure_period_ends":{"value":"June 30, 2029","source":"https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf","kind":"first-hand","quote":"During the period beginning January 1, 2028, and ending on June 30, 2029,","read":"2026-11-01"},"enforced_by":{"value":"Attorney General","source":"https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf","kind":"first-hand","quote":"The Attorney General has the same authority to enforce","read":"2026-11-01"},"law":{"value":"Vermont Data Privacy and Online Surveillance Act","source":"https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf","kind":"first-hand","quote":"Vermont Data Privacy and Online Surveillance Act","read":"2026-11-01"},"maximum_penalty":{"value":10000,"source":"https://legislature.vermont.gov/statutes/section/09/063/02458","kind":"first-hand","quote":"a civil penalty of not more than $10,000.00 for each unfair or deceptive act or practice in commerce","read":"2026-11-01"},"opt_out_signal_required":{"value":true,"source":"https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf","kind":"first-hand","quote":"shall comply with the","read":"2026-11-01"},"private_right_of_action":{"value":false,"source":"https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf","kind":"first-hand","quote":"private right of action for violations of this subchapter or any other law.","read":"2026-11-01"},"takes_effect":{"value":"January 1, 2028","source":"https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf","kind":"first-hand","quote":"This act shall take effect on January 1, 2028.","read":"2026-11-01"},"who_it_applies_to":{"missing":true,"checked":[],"read":"2026-11-01"}}},{"key":"Virginia","url":"https://skeletable.com/zackhhi/us-state-consumer-privacy-laws/row/virginia","cells":{"consumers_threshold":{"value":100000,"source":"https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/","kind":"first-hand","quote":"control or process personal data of at least 100,000 consumers","read":"2026-11-01"},"cure_period":{"value":30,"source":"https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/","kind":"first-hand","quote":"If within the 30-day period the controller or processor cures the noticed violation","read":"2026-11-01"},"cure_period_ends":{"missing":true,"checked":["https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/"],"read":"2026-11-01","absent":true},"enforced_by":{"value":"Attorney General","source":"https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/","kind":"first-hand","quote":"The Attorney General shall have exclusive authority to enforce the provisions of this chapter.","read":"2026-11-01"},"law":{"value":"Consumer Data Protection Act","source":"https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/","kind":"first-hand","quote":"Chapter 53. Consumer Data Protection Act","read":"2026-11-01"},"maximum_penalty":{"value":7500,"source":"https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/","kind":"first-hand","quote":"civil penalties of up to $7,500 for each violation under this chapter","read":"2026-11-01"},"opt_out_signal_required":{"missing":true,"checked":["https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/"],"read":"2026-11-01","absent":true},"private_right_of_action":{"value":false,"source":"https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/","kind":"first-hand","quote":"Nothing in this chapter shall be construed as providing the basis for, or be subject to, a private right of action for violations of this chapter or under any other law.","read":"2026-11-01"},"takes_effect":{"missing":true,"checked":[],"read":"2026-11-01"},"who_it_applies_to":{"value":"control or process personal data of at least 100,000 consumers or (ii) control or process personal data of at least 25,000 consumers and derive over 50 percent of gross revenue from the sale of personal data","source":"https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/","kind":"first-hand","quote":"control or process personal data of at least 100,000 consumers or (ii) control or process personal data of at least 25,000 consumers and derive over 50 percent of gross revenue from the sale of personal data","read":"2026-11-01"}}}]}